analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

md5.exe

Full analysis: https://app.any.run/tasks/efc37acc-365e-4ff5-9d9f-c9a565cc2e8e
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Analysis date: October 05, 2022, 07:36:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
apt
chches
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

37C89F291DBE880B1F3AC036E6B9C558

SHA1:

16A046D2557CC6377D713E21F14F1EBEA7128419

SHA256:

E90064884190B14A6621C18D1F9719A37B9E5F98506E28FF0636438E3282098B

SSDEEP:

3072:3DQcggG8+EfcByY7oNPgaKxUuPiSCbEggvQ4+8DhqKPmCtI0mfBSXBKBlNuPiu7I:3Eyi76PgadK3+8DwKPJm0mZ0BiJVx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • CHCHES was detected

      • md5.exe (PID: 3184)
    • Connects to the CnC server

      • md5.exe (PID: 3184)
    • Steals credentials from Web Browsers

      • md5.exe (PID: 3184)
  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • md5.exe (PID: 3184)
    • Reads Internet Settings

      • md5.exe (PID: 3184)
  • INFO

    • Process checks LSA protection

      • md5.exe (PID: 3184)
    • Reads the computer name

      • md5.exe (PID: 3184)
    • Checks supported languages

      • md5.exe (PID: 3184)
    • Creates files in the user directory

      • md5.exe (PID: 3184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2011-Nov-22 00:25:16
Detected languages:
  • English - United States
  • Japanese - Japan

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 256

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 6
TimeDateStamp: 2011-Nov-22 00:25:16
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
104810
104960
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.68383
.rdata
110592
33592
33792
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.1052
.data
147456
70904
61440
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93972
.gfids
221184
248
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.92243
.rsrc
225280
54264
54272
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.00244
.reloc
282624
7068
7168
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.69125

Resources

Title
Entropy
Size
Codepage
Language
Type
1
2.57202
748
UNKNOWN
Japanese - Japan
RT_CURSOR
2
2.34914
748
UNKNOWN
Japanese - Japan
RT_CURSOR
3
2.01591
748
UNKNOWN
Japanese - Japan
RT_CURSOR
4
3.0244
744
UNKNOWN
English - United States
RT_ICON
5
2.89186
296
UNKNOWN
English - United States
RT_ICON
6
5.25454
3752
UNKNOWN
English - United States
RT_ICON
7
5.58238
2216
UNKNOWN
English - United States
RT_ICON
8
3.88741
1384
UNKNOWN
English - United States
RT_ICON
9
4.89113
9640
UNKNOWN
English - United States
RT_ICON
10
5.26307
4264
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
USER32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #CHCHES md5.exe

Process information

PID
CMD
Path
Indicators
Parent process
3184"C:\Users\admin\AppData\Local\Temp\md5.exe" C:\Users\admin\AppData\Local\Temp\md5.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Total events
4 978
Read events
4 958
Write events
20
Delete events
0

Modification events

(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecisionTime
Value:
EC9702488DD8D801
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadDecision
Value:
0
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{362E934C-743B-4588-8259-D2482DB771A8}
Operation:writeName:WpadNetworkName
Value:
Network 4
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecisionTime
Value:
EC9702488DD8D801
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-36-3e-ff
Operation:writeName:WpadDecision
Value:
0
(PID) Process:(3184) md5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
0
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3184md5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\RA[1].htmhtml
MD5:3198BCA99B94CFFB4FBF7C50BACF8A4C
SHA256:59566FF370221C4F3CAFEDFBDEA482D85E54ADA124C12E2BE160102B805514C3
3184md5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\mA[1].htmhtml
MD5:7A0E9A0DEDE9FB21C0933E0CD3646537
SHA256:F4B91D47160E4A10630B94C4F6DE582FD123470C2DEADED3E044B1FE2D0AAD8C
3184md5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\wT[1].htmhtml
MD5:3C2DFF59321020AA18038F9FBBC7FCD5
SHA256:F52F21C7872BFFC0453747EB8575EB6F6B8222EBC00593CD2DE1A572E769D35C
3184md5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\LFpW5zg[1].htmhtml
MD5:24AEA817E6B2D8B5D3A379E7232D3808
SHA256:F0C76B966EDD31857E999585470E633A742C45D8712DDACF57E229194635FC78
3184md5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\xw[1].htmhtml
MD5:BA6B50A27D41160746B3C8E313F60AA1
SHA256:DB2C66C016206629252E23CEC35D98CCE0CDCBCB5DD5B9F40A671AA22C6966CB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
11
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3184
md5.exe
GET
200
199.115.115.102:80
http://zebra.wthelpdesk.com/isk/mA.htm
US
html
486 b
malicious
3184
md5.exe
GET
200
199.115.115.102:80
http://zebra.wthelpdesk.com/q7v/xw.htm
US
html
486 b
malicious
3184
md5.exe
GET
200
199.115.115.102:80
http://zebra.wthelpdesk.com/O/wT.htm
US
html
484 b
malicious
3184
md5.exe
GET
200
199.115.115.102:80
http://zebra.wthelpdesk.com/J5qB/z/LFpW5zg.htm
US
html
494 b
malicious
3184
md5.exe
GET
200
199.115.115.102:80
http://zebra.wthelpdesk.com/Zpv/RA.htm
US
html
486 b
malicious
3184
md5.exe
ST
302
199.115.115.102:80
http://zebra.wthelpdesk.com/08rfY/-Pugwh/Q.htm
US
text
11 b
malicious
3184
md5.exe
ST
302
199.115.115.102:80
http://zebra.wthelpdesk.com/c0z/3w.htm
US
text
11 b
malicious
3184
md5.exe
ST
302
199.115.115.102:80
http://zebra.wthelpdesk.com/XrIcCsH0gq/8/g.htm
US
text
11 b
malicious
3184
md5.exe
GET
429
199.115.115.102:80
http://zebra.wthelpdesk.com/A-s/QiVE3/09.htm
US
text
17 b
malicious
3184
md5.exe
ST
429
199.115.115.102:80
http://zebra.wthelpdesk.com/qSHs9/lizT/EmA.htm
US
text
17 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3184
md5.exe
199.115.115.102:80
zebra.wthelpdesk.com
LEASEWEB-USA-WDC
US
malicious

DNS requests

Domain
IP
Reputation
zebra.wthelpdesk.com
  • 199.115.115.102
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
3184
md5.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3184
md5.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3184
md5.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3184
md5.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
7 ETPRO signatures available at the full report
No debug info