File name: | ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe |
Full analysis: | https://app.any.run/tasks/4d202a3a-955f-4191-8acd-1cbb2e5514d7 |
Verdict: | Malicious activity |
Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
Analysis date: | April 24, 2024, 08:06:15 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | F33C75710D0E0463A2528E619C2EE382 |
SHA1: | 4D2DD071FE274E6A8696448C21EEEECC0CF07E6D |
SHA256: | EC7DD08D03D5D4142C82FC04CEA7E948D05641B0A3008A0D8A00B0421B5B04F9 |
SSDEEP: | 96:6eFssTNOFRRIVSrgSZvUHZcscVzAZi15iKE4FVrBqiJkC7tCEbwTYYYYE:msIQSdvUGD15i/OVrgiJFb4YYYY |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 5 |
ImageVersion: | - |
OSVersion: | 5 |
EntryPoint: | 0x177f |
UninitializedDataSize: | - |
InitializedDataSize: | 5632 |
CodeSize: | 3584 |
LinkerVersion: | 9 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, 32-bit |
TimeStamp: | 2024:04:23 13:39:44+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3028 | "C:\Users\admin\AppData\Local\Temp\ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe" | C:\Users\admin\AppData\Local\Temp\ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
4944 | C:\Users\admin\AppData\Local\Temp\891726313.exe | C:\Users\admin\AppData\Local\Temp\891726313.exe | ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
6440 | C:\Users\admin\AppData\Local\Temp\2822430436.exe | C:\Users\admin\AppData\Local\Temp\2822430436.exe | — | 891726313.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
6996 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
7084 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
4284 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
|
(PID) Process: | (3028) ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (3028) ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (3028) ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (3028) ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3028) ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3028) ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3028) ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (4944) 891726313.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | Windows Settings |
Value: C:\Users\admin\sysvratrel.exe | |||
(PID) Process: | (4944) 891726313.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU |
Operation: | write | Name: | NoAutoUpdate |
Value: 1 | |||
(PID) Process: | (4944) 891726313.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL |
Operation: | write | Name: | CheckedValue |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
4944 | 891726313.exe | C:\Users\admin\AppData\Local\Temp\2822430436.exe | binary | |
MD5:89C0C137E9EEE59DC9291038EEE50B4F | SHA256:3C692532B72C68C1CD92374FC28B54AFD0B27DB1EABD7785C6A0E5B1E92B59C9 | |||
4944 | 891726313.exe | C:\Users\admin\tbtnds.dat | binary | |
MD5:7EF5C34D6FDFDA9C8BEFA4FF0364C195 | SHA256:20D0193D5C583F31891C31909ED1CB634597F586B45991486DA50303638D8962 | |||
3028 | ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\newtpp[1].exe | executable | |
MD5:36010B83BCCFCD1032971DF9FC5082A1 | SHA256:99C140F3DBD18B65457BC398730516F3A8C1D0E5BA68AA46C194505BF0F12A98 | |||
4944 | 891726313.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\1[1] | binary | |
MD5:89C0C137E9EEE59DC9291038EEE50B4F | SHA256:3C692532B72C68C1CD92374FC28B54AFD0B27DB1EABD7785C6A0E5B1E92B59C9 | |||
3028 | ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | C:\Users\admin\AppData\Local\Temp\891726313.exe | executable | |
MD5:36010B83BCCFCD1032971DF9FC5082A1 | SHA256:99C140F3DBD18B65457BC398730516F3A8C1D0E5BA68AA46C194505BF0F12A98 | |||
4944 | 891726313.exe | C:\Users\admin\sysvratrel.exe | executable | |
MD5:36010B83BCCFCD1032971DF9FC5082A1 | SHA256:99C140F3DBD18B65457BC398730516F3A8C1D0E5BA68AA46C194505BF0F12A98 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4944 | 891726313.exe | GET | — | 185.215.113.66:80 | http://185.215.113.66/1 | unknown | — | — | unknown |
3028 | ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | GET | 200 | 185.215.113.66:80 | http://twizt.net/newtpp.exe | unknown | — | — | unknown |
4484 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
4944 | 891726313.exe | GET | 200 | 185.215.113.66:80 | http://185.215.113.66/1 | unknown | — | — | unknown |
3028 | ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | GET | 200 | 185.215.113.66:80 | http://twizt.net/peinstall.php | unknown | — | — | unknown |
2528 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | unknown |
4944 | 891726313.exe | GET | 404 | 185.215.113.66:80 | http://185.215.113.66/2 | unknown | — | — | unknown |
4944 | 891726313.exe | GET | 404 | 185.215.113.66:80 | http://185.215.113.66/3 | unknown | — | — | unknown |
4944 | 891726313.exe | GET | 404 | 185.215.113.66:80 | http://185.215.113.66/5 | unknown | — | — | unknown |
4944 | 891726313.exe | GET | 404 | 185.215.113.66:80 | http://185.215.113.66/6 | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
4008 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
5152 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4484 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6976 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3028 | ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | 185.215.113.66:80 | twizt.net | 1337team Limited | SC | unknown |
4484 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | unknown |
3196 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4944 | 891726313.exe | 185.215.113.66:80 | twizt.net | 1337team Limited | SC | unknown |
5152 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
---|---|---|
twizt.net |
| unknown |
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
www.update.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
3028 | ec7dd08d03d5d4142c82fc04cea7e948d05641b0a3008a0d8a00b0421b5b04f9.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
4944 | 891726313.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 13 |
4944 | 891726313.exe | A Network Trojan was detected | ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |
4944 | 891726313.exe | A Network Trojan was detected | ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |
4944 | 891726313.exe | A Network Trojan was detected | ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |
4944 | 891726313.exe | A Network Trojan was detected | ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |
4944 | 891726313.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 37 |
4944 | 891726313.exe | A Network Trojan was detected | ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |
4944 | 891726313.exe | A Network Trojan was detected | ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |
4944 | 891726313.exe | A Network Trojan was detected | ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC |