analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | batyw3.harz |
| Full analysis: | https://app.any.run/tasks/529d8e97-a878-4491-8cd8-fcb02e4763d8 |
| Verdict: | Malicious activity |
| Analysis date: | February 19, 2019, 09:27:48 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 20D8A0A83FAA4019855FA95824814F7C |
| SHA1: | 20F6A32A5D6D0100551B928E0EEB3D31F86B797B |
| SHA256: | E0613370DACBAEEA955B026782A88F850C7F9EFB554DF3C1D986F633966F8A0B |
| SSDEEP: | 3072:hkyrSmefi8xQRv00gDg4JgUrQrY17hJHe0KuVuPi6d+YShwaqz+UQc/uGkn3dK:hkal2i8WjgDuY9hhFxTyUOaMkN |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Changes internet zones settings
- iexplore.exe (PID: 416)
- iexplore.exe (PID: 3532)
- iexplore.exe (PID: 1012)
- iexplore.exe (PID: 3960)
Application launched itself
- iexplore.exe (PID: 416)
- iexplore.exe (PID: 1012)
- iexplore.exe (PID: 3960)
Reads internet explorer settings
- iexplore.exe (PID: 3852)
- iexplore.exe (PID: 1004)
- iexplore.exe (PID: 2904)
Reads Internet Cache Settings
- iexplore.exe (PID: 3852)
- iexplore.exe (PID: 2904)
- iexplore.exe (PID: 1004)
- iexplore.exe (PID: 3840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| ProductVersion: | 13.0.84.85 |
|---|---|
| ProductName: | Element Payment Services |
| OriginalFileName: | sonnight.exe |
| LegalTrademarks: | Know excite Nowwhose wrong field |
| LegalCopyright: | Lift |
| InternalName: | Element Payment Services |
| FileVersion: | 13.0.84.85 |
| CompanyName: | Call_glass |
| CharacterSet: | Unknown (04E0) |
| LanguageCode: | English (U.S.) |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Win32 |
| FileFlags: | (none) |
| FileFlagsMask: | 0x0000 |
| ProductVersionNumber: | 13.0.84.85 |
| FileVersionNumber: | 13.0.84.85 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 4 |
| ImageVersion: | - |
| OSVersion: | 4 |
| EntryPoint: | 0x1110f |
| UninitializedDataSize: | - |
| InitializedDataSize: | 348160 |
| CodeSize: | 102400 |
| LinkerVersion: | 8 |
| PEType: | PE32 |
| TimeStamp: | 2007:02:15 12:17:41+01:00 |
| MachineType: | Intel 386 or later, and compatibles |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 15-Feb-2007 11:17:41 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | Call_glass |
| FileVersion: | 13.0.84.85 |
| InternalName: | Element Payment Services |
| LegalCopyright: | Lift |
| LegalTrademarks: | Know excite Nowwhose wrong field |
| OriginalFilename: | sonnight.exe |
| ProductName: | Element Payment Services |
| ProductVersion: | 13.0.84.85 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000E8 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 15-Feb-2007 11:17:41 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00018F18 | 0x00019000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.46401 |
.rdata | 0x0001A000 | 0x0001546E | 0x00016000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.48019 |
.data | 0x00030000 | 0x00012860 | 0x00002000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.24394 |
.rsrc | 0x00043000 | 0x00028C48 | 0x00029000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.67976 |
.reloc | 0x0006C000 | 0x000022A6 | 0x00003000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 3.78835 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.79597 | 346 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 3.62767 | 38056 | UNKNOWN | English - United States | RT_ICON |
3 | 3.69399 | 21640 | UNKNOWN | English - United States | RT_ICON |
4 | 3.63784 | 16936 | UNKNOWN | English - United States | RT_ICON |
5 | 3.84705 | 9640 | UNKNOWN | English - United States | RT_ICON |
6 | 4.02657 | 4264 | UNKNOWN | English - United States | RT_ICON |
7 | 4.19729 | 2440 | UNKNOWN | English - United States | RT_ICON |
8 | 4.37908 | 1128 | UNKNOWN | English - United States | RT_ICON |
112 | 2.8207 | 202 | UNKNOWN | English - United States | RT_DIALOG |
116 | 2.92189 | 198 | UNKNOWN | English - United States | RT_DIALOG |
Imports
COMCTL32.dll |
COMDLG32.dll |
KERNEL32.dll |
SHLWAPI.dll |
USER32.dll |
WINSPOOL.DRV |
dbghelp.dll |
ole32.dll |
Total processes
39
Monitored processes
9
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 3116 | "C:\Users\admin\AppData\Local\Temp\batyw3.harz.exe" | C:\Users\admin\AppData\Local\Temp\batyw3.harz.exe | — | explorer.exe |
User: admin Integrity Level: MEDIUM | ||||
| 3532 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3852 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3532 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 416 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 1004 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:416 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 1012 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 1 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 2904 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1012 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3960 | "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding | C:\Program Files\Internet Explorer\iexplore.exe | svchost.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
| 3840 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3960 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | |
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
1 336
Read events
1 166
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
34
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3532 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3532 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3532 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFB9A41D06FF51DA78.TMP | — | |
MD5:— | SHA256:— | |||
| 3532 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{C23F0740-3428-11E9-AA93-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
| 3532 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF6FA598F234652598.TMP | — | |
MD5:— | SHA256:— | |||
| 3532 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{C23F073F-3428-11E9-AA93-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
| 416 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 416 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3852 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\JavaDeployReg.log | text | |
MD5:0B0122858083BD7B8DD5BA521EFD12F0 | SHA256:66A6B253A89258EB0D34DC3C1CD6180F3021E84E2A87CDD01ABD7A3935BEC151 | |||
| 3852 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\ErrorPageTemplate[1] | text | |
MD5:F4FE1CB77E758E1BA56B8A8EC20417C5 | SHA256:8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
6
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3852 | iexplore.exe | GET | — | 46.29.167.72:80 | http://nsyblefgg.city/images/jbIp9jgvl4_2Btlsyp/6TIyuzpjH/p9QxipHYLigdrcJvio_2/FCYNmHGE0T3I7hK3m_2/Bqx8GmLJ6wfJtx9ntIapm4/GrQWIZrOlq4Yy/iSfkVjU5/dxHZYKw5ASgxhUMTWYauTc8/0AeqaeHu7J/6RiO5ohQGMWUm/8.avi | RU | — | — | malicious |
3840 | iexplore.exe | GET | — | 46.29.167.72:80 | http://nsyblefgg.city/images/WyllDfAbmut89RPy2MQY4mn/S1ocSEgGMM/ZobwoWbFl_2F0kERc/mssPHdGLUjum/2a30kV0HkyC/c5Q0wUwye3X7CI/P_2FXNYWz2peaG9tMX8xR/Iul_2BtEF0Yw7MoV/4Rcoejw6Uvn5JuQ/hezKjVcaS562unh5/e.avi | RU | — | — | malicious |
3960 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3532 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
1012 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
416 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3960 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
416 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3532 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
1012 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3852 | iexplore.exe | 46.29.167.72:80 | nsyblefgg.city | LLC Baxet | RU | malicious |
3840 | iexplore.exe | 46.29.167.72:80 | nsyblefgg.city | LLC Baxet | RU | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
nsyblefgg.city |
| malicious |
m25lni11528.com |
| unknown |
dgrover.band |
| unknown |