| File name: | virus.exe |
| Full analysis: | https://app.any.run/tasks/606dcd91-1d85-443d-86a5-20c1bd8ea74f |
| Verdict: | Malicious activity |
| Analysis date: | October 21, 2024, 04:02:54 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 2FC9EA74BEE86D0459B63DAF45884CEA |
| SHA1: | 0501AEDB773BAA5754CF46CB5928C51BC70C8A49 |
| SHA256: | EA52F7B2D69E2ABBF76BE99F92AE936F7115A1AE4AA6821923F5085F5CB17A82 |
| SSDEEP: | 49152:7QY+sybp/GNg0iVDOUy7usuxTdxu+gIvQtslTUSLdNLZCNuy9O8FPPH9SuwQHBM3:7Wbp/GNeOUNsuxRxTxvQtiLdNZyYcPwZ |
MALICIOUS
Connects to the CnC server
- wsmprovhost.exe (PID: 1976)
SUSPICIOUS
Process drops legitimate windows executable
- virus.exe (PID: 3364)
Starts a Microsoft application from unusual location
- virus.exe (PID: 3364)
Executable content was dropped or overwritten
- wsmprovhost.exe (PID: 1976)
INFO
Checks supported languages
- virus.exe (PID: 3364)
- wmpnscfg.exe (PID: 2500)
Reads the computer name
- virus.exe (PID: 3364)
- wmpnscfg.exe (PID: 2500)
Creates files or folders in the user directory
- wsmprovhost.exe (PID: 1976)
Manual execution by a user
- wmpnscfg.exe (PID: 2500)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2013:08:10 00:51:29+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 89600 |
| InitializedDataSize: | 785920 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x9b4a |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 4.5.6001.22159 |
| ProductVersionNumber: | 4.5.6001.22159 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Windows Session Manager |
| FileVersion: | 4, 5, 6001, 22159 |
| LegalCopyright: | Microsoft Corporation. All rights reserved. |
| OriginalFileName: | winssmngr.exe |
| ProductName: | Windows Session Manager |
| ProductVersion: | 4, 5, 6001, 22159 |
Total processes
36
Monitored processes
3
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1976 | wsmprovhost.exe | C:\Windows\System32\wsmprovhost.exe | virus.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host process for WinRM plug-ins Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 2500 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3364 | "C:\Users\admin\AppData\Local\Temp\virus.exe" | C:\Users\admin\AppData\Local\Temp\virus.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Session Manager Exit code: 0 Version: 4, 5, 6001, 22159 Modules
| |||||||||||||||
Total events
310
Read events
309
Write events
1
Delete events
0
Modification events
| (PID) Process: | (1976) wsmprovhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows |
| Operation: | write | Name: | run |
Value: C:\Users\admin\AppData\Roaming\Microsoft\Installer\{C018D68A-4554-4DD3-A844-CD3B8E04CD0A}\_6F7D185CA4F8.exe | |||
Executable files
1
Suspicious files
5
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1976 | wsmprovhost.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2f | abr | |
MD5:D898504A722BFF1524134C6AB6A5EAA5 | SHA256:878F32F76B159494F5A39F9321616C6068CDB82E88DF89BCC739BBC1EA78E1F9 | |||
| 1976 | wsmprovhost.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\AES\S-1-5-48-208389635-9837536653-437876021-227\dfd56e1c79a287f001d5eb1ce0f45a7c_e13ca0e1-3819-2857-6250-be1f20373d29 | binary | |
MD5:392BECBF18E0E15DF0D99E8038C693CC | SHA256:339DF687C9DB74B89D290A9825C3903E7337C873424A7B871CE88C00F2ACFD33 | |||
| 1976 | wsmprovhost.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\AES\S-1-5-48-208389635-9837536653-437876021-227\EAF5343E-DC9B45C5-9F9DBFFB-518010BD\_FFFFFF1021050300 | binary | |
MD5:AD6AEC8091734E2D29B025BD05D4F3AF | SHA256:2456ECFCB1D0D6982D6112E4BDB6A4DB99108D2FD5CB3CF58155AB8C6392E4FD | |||
| 1976 | wsmprovhost.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\AES\S-1-5-48-208389635-9837536653-437876021-227\be1e17081cb14daa94c2ca351ba279c3_e13ca0e1-3819-2857-6250-be1f20373d29 | binary | |
MD5:940CE83DEF81635CED96C658634EBCDF | SHA256:032EA1B544ECD2AA203208E81B799D194DC7EC776EC4FFED6AA1787B026C351D | |||
| 1976 | wsmprovhost.exe | C:\Users\admin\AppData\Roaming\Microsoft\Installer\{C018D68A-4554-4DD3-A844-CD3B8E04CD0A}\_6F7D185CA4F8.exe | executable | |
MD5:2FC9EA74BEE86D0459B63DAF45884CEA | SHA256:EA52F7B2D69E2ABBF76BE99F92AE936F7115A1AE4AA6821923F5085F5CB17A82 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
2
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1976 | wsmprovhost.exe | GET | 404 | 173.248.241.71:80 | http://themoviehometheather.com/content/faq.php?vc1=9c2ea93d85df5612b02baf0d596621a011d52391d0fe85c8bf52d4c56eabd831e18edb7492936fe5d3d6e3d8a0a595610fbb4eda6cb8dc2be59611d6b53e521b85da0c1d95d600e93f486a54dbf07e79bf87ed1c0758f93c05db737a6af14df30f3a49c119d02d1d0a8e5a0c9ffa5e4c0106387b038ac7275814c8345664e0d6 | unknown | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
2564 | svchost.exe | 239.255.255.250:3702 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1976 | wsmprovhost.exe | 173.248.241.71:80 | themoviehometheather.com | EFLY NETWORK LIMITED | HK | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
themoviehometheather.com |
| malicious |
Threats
1 ETPRO signatures available at the full report