download: | 12345.exe |
Full analysis: | https://app.any.run/tasks/f616304c-a24f-44d4-8d9f-f305a9adbc62 |
Verdict: | Malicious activity |
Analysis date: | January 25, 2022, 01:13:37 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows |
MD5: | 02A3C2D3F197ED23FC0A5EF370BB28CA |
SHA1: | 2BE53D774B008E125B456BC40BEB92E9019A49A5 |
SHA256: | E2F4F19D9B41B76AEEF1345D8F78B32E190C682BAFB8B9EBEA7D72681CF00DB6 |
SSDEEP: | 196608:Fy+OxIYjoCaMM82kOsO/hx9/jDXj0uEQTUe1ii9MzyF:xyIytOXsyn9jD4GUepBF |
.exe | | | Win64 Executable (generic) (61.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (14.6) |
.exe | | | Win32 Executable (generic) (10) |
.exe | | | Win16/32 Executable Delphi generic (4.6) |
.exe | | | Generic Win/DOS Executable (4.4) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x14e5 |
UninitializedDataSize: | - |
InitializedDataSize: | 6889472 |
CodeSize: | 2048 |
LinkerVersion: | 6 |
PEType: | PE32 |
TimeStamp: | 0000:00:00 00:00:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 01-Jan-1970 00:00:00 |
Detected languages: |
|
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000080 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 4 |
Time date stamp: | 01-Jan-1970 00:00:00 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00000680 | 0x00000800 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 4.54686 |
.rdata | 0x00002000 | 0x00691D52 | 0x00691E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.39964 |
.bss | 0x00694000 | 0x00000004 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x00695000 | 0x000001F0 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.80743 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 4.85064 | 408 | UNKNOWN | English - United States | RT_MANIFEST |
kernel32.dll |
msvcrt.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2276 | "C:\Users\admin\AppData\Local\Temp\12345.exe" | C:\Users\admin\AppData\Local\Temp\12345.exe | — | Explorer.EXE | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
2932 | "C:\Users\admin\AppData\Local\Temp\12345.exe" | C:\Users\admin\AppData\Local\Temp\12345.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
2612 | cmd /c powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit | C:\Windows\SysWOW64\cmd.exe | — | 12345.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2820 | cmd /c start "" "C:\Users\admin\AppData\Local\Temp\vjdrgrgr.exe" | C:\Windows\SysWOW64\cmd.exe | — | 12345.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3036 | powershell -Command "Add-MpPreference -ExclusionPath @($env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
3056 | "C:\Users\admin\AppData\Local\Temp\vjdrgrgr.exe" | C:\Users\admin\AppData\Local\Temp\vjdrgrgr.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 3221225477 Modules
| |||||||||||||||
2408 | cmd /c start "" "C:\Users\admin\AppData\Local\Temp\sadido.exe" | C:\Windows\SysWOW64\cmd.exe | — | 12345.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2548 | "C:\Users\admin\AppData\Local\Temp\sadido.exe" | C:\Users\admin\AppData\Local\Temp\sadido.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
1384 | powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
2312 | "cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit | C:\Windows\system32\cmd.exe | — | sadido.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
2932 | 12345.exe | C:\Users\admin\AppData\Local\Temp\vjdrgrgr.exe | executable | |
MD5:06C33B534FBA708316DD38F923A83480 | SHA256:C8089EE81A2DC40B068A49AD9B30F1D75EDEEE6E8C62DF1F70BA4DD5394B4777 | |||
3056 | vjdrgrgr.exe | C:\Users\admin\AppData\Roaming\Microsoft\RegHost.exe | executable | |
MD5:06C33B534FBA708316DD38F923A83480 | SHA256:C8089EE81A2DC40B068A49AD9B30F1D75EDEEE6E8C62DF1F70BA4DD5394B4777 | |||
2692 | addttc.exe | C:\Users\admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe | executable | |
MD5:9C4A43965CF91E31D4430B5F164B4CB4 | SHA256:8FE263C13A5BA718631B170835E1F14B758F50B780B742875DEC0660DD3ACB85 | |||
2548 | sadido.exe | C:\Users\admin\AppData\Roaming\addttc.exe | executable | |
MD5:11C77DD72C33FB35A05F4822543D685E | SHA256:867BB0C22B82237157584018BB4D071F3A56246B1EBB8B48BB0DE7E04FA5BF14 | |||
2932 | 12345.exe | C:\Users\admin\AppData\Local\Temp\sadido.exe | executable | |
MD5:11C77DD72C33FB35A05F4822543D685E | SHA256:867BB0C22B82237157584018BB4D071F3A56246B1EBB8B48BB0DE7E04FA5BF14 | |||
3036 | powershell.exe | C:\Users\admin\AppData\Local\Temp\l14qqlwb.21n.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
1384 | powershell.exe | C:\Users\admin\AppData\Local\Temp\4enxqh0i.xom.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
2648 | powershell.exe | C:\Users\admin\AppData\Local\Temp\rwjs3tug.rrb.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
2400 | powershell.exe | C:\Users\admin\AppData\Local\Temp\wrfvhdhl.li1.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
2648 | powershell.exe | C:\Users\admin\AppData\Local\Temp\eo5dexzw.qt2.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3056 | vjdrgrgr.exe | GET | 502 | 193.163.203.41:80 | http://srv2-tunnel.ttl.ovh/lm | DK | html | 166 b | suspicious |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3056 | vjdrgrgr.exe | 193.163.203.41:80 | srv2-tunnel.ttl.ovh | — | DK | suspicious |
1700 | explorer.exe | 91.121.140.167:5555 | pool.supportxmr.com | OVH SAS | FR | malicious |
— | — | 192.168.100.2:53 | — | — | — | whitelisted |
Domain | IP | Reputation |
---|---|---|
www.microsoft.com |
| whitelisted |
srv2-tunnel.ttl.ovh |
| suspicious |
pool.supportxmr.com |
| suspicious |
PID | Process | Class | Message |
---|---|---|---|
1700 | explorer.exe | Potential Corporate Privacy Violation | ET POLICY Cryptocurrency Miner Checkin |