download: | test.exe |
Full analysis: | https://app.any.run/tasks/4d9d7739-7469-439b-9dc6-36b1bdb9a76b |
Verdict: | Malicious activity |
Analysis date: | January 15, 2022, 01:01:53 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 64 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 71CA06D7DFE21E83EA5D8D0E983FC1A1 |
SHA1: | DD4289EF7833356330D1570BB232E9D3121AEDF3 |
SHA256: | E6DF557815C5B2166DE06728ABE0C4FBA66BDBC2470E7CCB8725ED7D1A1B6275 |
SSDEEP: | 6144:xDqZJaSeEyfWyELiU3hSCr2SqCsvxAt4uer5W1+8Hbc6AKA7zzSbQ5BI28PwP43A:xGZAjEyOylOhSCrXsvxAKTc3cLhUUP4w |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2022:01:14 14:24:16+01:00 |
PEType: | PE32 |
LinkerVersion: | 14.29 |
CodeSize: | 326144 |
InitializedDataSize: | 51200 |
UninitializedDataSize: | - |
EntryPoint: | 0x4d9c1 |
OSVersion: | 6 |
ImageVersion: | - |
SubsystemVersion: | 6 |
Subsystem: | Windows GUI |
FileVersionNumber: | 52159.0.0.0 |
ProductVersionNumber: | 0.0.0.0 |
FileFlagsMask: | 0x0000 |
FileFlags: | (none) |
FileOS: | Unknown (0) |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
filedescription: | The New |
CompanyName: | dnsfsjdfoisdf |
LegalCopyright: | sfsffi34fo34f |
ProductName: | sdfsdf34434 |
FileVersion: | 323423423423r,lsf |
ProductVersion: | 2.746 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2184 | "C:\Users\admin\AppData\Local\Temp\test.exe" | C:\Users\admin\AppData\Local\Temp\test.exe | Explorer.EXE | |
User: admin Company: dnsfsjdfoisdf Integrity Level: MEDIUM Description: The New Version: 323423423423r,lsf | ||||
2500 | C:\Windows\System32\powercfg.exe -energy -auto | C:\Windows\System32\powercfg.exe | — | services.exe |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Power Settings Command-Line Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
864 | C:\Windows\system32\svchost.exe -k DcomLaunch | C:\Windows\system32\svchost.exe | services.exe | |
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
(PID) Process: | (2500) powercfg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
(PID) Process: | (2500) powercfg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 1 | |||
(PID) Process: | (2500) powercfg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2500) powercfg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2500) powercfg.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: |
PID | Process | Filename | Type | |
---|---|---|---|---|
2500 | powercfg.exe | C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-ntkl.etl | — | |
MD5:— | SHA256:— | |||
2500 | powercfg.exe | C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report-latest.xml | xml | |
MD5:F0C9FF0F1B15B3EAD4DDCD0FC2F1A97A | SHA256:01D1116118C7A659C0B95077C1BC5DF67CC6C8B19D5E040B1AA83C9A0B1DD584 | |||
2184 | test.exe | C:\Users\admin\AppData\Local\Intel Graphic Card\RuntimeBroker.exe | executable | |
MD5:71CA06D7DFE21E83EA5D8D0E983FC1A1 | SHA256:E6DF557815C5B2166DE06728ABE0C4FBA66BDBC2470E7CCB8725ED7D1A1B6275 | |||
2500 | powercfg.exe | C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report-2022-01-15.xml | xml | |
MD5:F0C9FF0F1B15B3EAD4DDCD0FC2F1A97A | SHA256:01D1116118C7A659C0B95077C1BC5DF67CC6C8B19D5E040B1AA83C9A0B1DD584 | |||
2500 | powercfg.exe | C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-report.html | html | |
MD5:25A51A08AF774D6F6CB9A4CFF7E5B511 | SHA256:A726DDF86090800CC52BA874603E7EF0349FCE7FA1B9B1B2EE34821A8CB7D8CD | |||
2500 | powercfg.exe | C:\ProgramData\Microsoft\Windows\Power Efficiency Diagnostics\energy-trace.etl | etl | |
MD5:7423867355A25C4A4114A53BDC66A50D | SHA256:0BCDB54ECDF84F3959217BC90A762F5CA2EC4A47F65B2DA71D39489B61330329 | |||
2500 | powercfg.exe | C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IDR_XML_DEFAULT_TRANSFORM[1] | xml | |
MD5:7B9A05D16BE2420D5588E8E7E589D467 | SHA256:000657B88AF66C4C62026AF12D97EBE3BFC8BA57B6262EA9B96BCE21AAE3F6BF |