File name:

SecuriteInfo.com.Trojan.SuspectCRC.31010.10355

Full analysis: https://app.any.run/tasks/9bfc8bb7-41ae-471b-aebc-6181f08a64aa
Verdict: Malicious activity
Analysis date: October 19, 2023, 23:55:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F8ED06E0F70ED197F3AB59D1FB68BCE8

SHA1:

1D1CD38DD17D8C6A8B0EC0E894AE86AE9E1491A8

SHA256:

EB2BFFE346F259BD17B14911350F6BCAE81AF37C190B3741AD816602863AF78F

SSDEEP:

3072:yNzJHjL21IvjPm9IwDfPmCakonXgnnx7aJ:EzJJvy91qAx7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Reads settings of System Certificates

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Reads Microsoft Outlook installation path

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Checks Windows Trust Settings

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Reads Internet Explorer settings

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

  • INFO

    • Checks proxy server information

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Checks supported languages

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Reads the computer name

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)

    • Creates files or folders in the user directory

      • SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe (PID: 1492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductVersion: 1, 0, 0, 1
ProductName: 4010web 应用程序
OriginalFileName: 4010web.EXE
LegalTrademarks: -
LegalCopyright: 版权所有 (C) 2012
InternalName: 4010web
FileVersion: 1, 0, 0, 1
FileDescription: 4010web Microsoft 基础类应用程序
CompanyName: -
CharacterSet: Unicode
LanguageCode: Chinese (Simplified)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.1
FileVersionNumber: 1.0.0.1
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1b20
UninitializedDataSize: -
InitializedDataSize: 12288
CodeSize: 4096
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2012:10:27 13:35:36+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
29
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.trojan.suspectcrc.31010.10355.exe

Process information

PID
CMD
Path
Indicators
Parent process
1492"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
4010web Microsoft 基础类应用程序
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\users\admin\appdata\local\temp\securiteinfo.com.trojan.suspectcrc.31010.10355.exe
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 315
Read events
2 289
Write events
23
Delete events
3

Modification events

(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000C1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1492) SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E81D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E090000000100000016000000301406082B0601050507030206082B060105050703010B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
Executable files
3
Suspicious files
15
Text files
136
Unknown types
0

Dropped files

PID
Process
Filename
Type
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\5JOHH25Q.htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\index-762c0b1b[1].csstext
MD5:B1C6769DC2493BA4DC97625E813805C4
SHA256:88915B40AE5E41F3CD1A16AFEA2427AD53709AE94F89236860A4D617536E7824
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\3PVRUJJR.htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\DH1CRW20.htmhtml
MD5:2349703FC22A4B78350137D2A8D4A0DB
SHA256:24836EB9D118ACE82ACCBFF1E898EA3439EC96C536A2D4DFDAAA430D5CD77A59
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\PY72EF9A.htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\1894HYAF.htmhtml
MD5:CD2E0E43980A00FB6A2742D3AFD803B8
SHA256:BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2U1WPAC\index-dc1114c2[1].csstext
MD5:F4E3A03A3799E95FBA268E0D5463142B
SHA256:6513E54A9AF844C40AEB1BD005D86302AEA4B78A0F4421A3BBB5D639BE4C7DD8
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BDW1XBVN\sideTool-fd4d44bd[1].csstext
MD5:B2B2C34FBD807EB9E3F35D99E8454EBB
SHA256:3D30674AC51EDF82717AE0C511AE28960AB9748F4C58FBFC90329E4C4CE61A03
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D2U1WPAC\sideTool-fd4d44bd[1].csstext
MD5:B2B2C34FBD807EB9E3F35D99E8454EBB
SHA256:3D30674AC51EDF82717AE0C511AE28960AB9748F4C58FBFC90329E4C4CE61A03
1492SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K78MRVB5\index-5de4219c[1].csstext
MD5:EE4DDB0248A08E61D9A7A0B612ABC3DB
SHA256:DC87BDD8F6C8D73AAB092CE4553A3008DA006151D590620EE412E77CFD47CEC8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
10
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
GET
301
14.17.109.72:80
http://yy.com/
unknown
html
178 b
unknown
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
GET
301
14.17.109.72:80
http://yy.com/
unknown
html
178 b
unknown
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
GET
301
14.17.109.72:80
http://yy.com/
unknown
html
178 b
unknown
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
GET
301
14.17.109.72:80
http://yy.com/
unknown
html
178 b
unknown
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
GET
301
14.17.109.72:80
http://yy.com/
unknown
html
178 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
14.17.109.72:80
yy.com
Chinanet
CN
unknown
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
106.38.197.51:443
www.yy.com
IDC, China Telecommunications Corporation
CN
unknown
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
163.181.92.232:443
web.yystatic.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
157.148.65.35:443
mobilelivephoto.bs2dl.yy.com
China Unicom Guangdong IP network
CN
unknown
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
58.254.180.65:443
emyfs.bs2cdn.yy.com
China Unicom Guangdong IP network
CN
unknown
1492
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355.exe
101.226.28.186:443
cdn.bigda.com
China Telecom Group
CN
unknown

DNS requests

Domain
IP
Reputation
yy.com
  • 14.17.109.72
  • 120.195.158.53
  • 221.228.79.225
  • 183.240.168.210
  • 163.177.156.228
  • 103.227.121.120
whitelisted
www.yy.com
  • 106.38.197.51
  • 103.227.121.120
unknown
emyfs.bs2cdn.yy.com
  • 58.254.180.65
unknown
web.yystatic.com
  • 163.181.92.232
  • 163.181.92.238
  • 163.181.92.235
  • 163.181.92.237
  • 163.181.92.231
  • 163.181.92.236
  • 163.181.92.234
  • 163.181.92.233
unknown
mobilelivephoto.bs2dl.yy.com
  • 157.148.65.35
malicious
zonemin.bs2dl.yy.com
  • 58.254.180.65
unknown
cdn.bigda.com
  • 101.226.28.186
  • 101.226.28.185
  • 101.226.28.184
  • 101.226.28.188
  • 101.226.28.183
  • 101.226.28.187
  • 101.226.28.182
  • 101.226.28.148
unknown
hdjs.bigda.com
  • 222.73.33.215
  • 222.73.33.214
  • 222.73.33.209
  • 222.73.33.212
  • 222.73.33.211
  • 222.73.33.208
  • 222.73.33.210
  • 222.73.33.213
unknown
ai-oss.yystatic.com
  • 58.254.180.65
unknown
mlog.bigda.com
  • 163.177.159.188
  • 120.232.148.122
  • 121.11.217.167
unknown

Threats

Found threats are available for the paid subscriptions
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Trojan.SuspectCRC.31010.10355