File name: | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe |
Full analysis: | https://app.any.run/tasks/87c77258-aadf-4253-857a-858cbcb808a4 |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 08:23:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | E806D1194873FCFA4E31726710B75405 |
SHA1: | 7D10BF42D901224BCE67249B590C0DFC4F350653 |
SHA256: | ED37BB51AF01647FDE0A5B04A401FD278EBA50CF2D5D0678F86227D27AECBC62 |
SSDEEP: | 3072:655tEdAOKlggqO3G0jPonfYnoFMIkcXo0fSUa:/W26QfweMILXoXU |
.exe | | | UPX compressed Win32 Executable (64.2) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.6) |
.exe | | | Win32 Executable (generic) (10.6) |
.exe | | | Generic Win/DOS Executable (4.7) |
.exe | | | DOS Executable Generic (4.7) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2019:08:02 16:08:23+00:00 |
ImageFileCharacteristics: | No relocs, Executable, 32-bit |
PEType: | PE32 |
LinkerVersion: | 9 |
CodeSize: | 139264 |
InitializedDataSize: | 20480 |
UninitializedDataSize: | 4894720 |
EntryPoint: | 0x4cce90 |
OSVersion: | 5 |
ImageVersion: | - |
SubsystemVersion: | 5 |
Subsystem: | Windows GUI |
FileVersionNumber: | 44.0.0.0 |
ProductVersionNumber: | 44.0.0.0 |
FileFlagsMask: | 0x003f |
FileFlags: | Special build |
FileOS: | Windows NT 32-bit |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | Russian |
CharacterSet: | Windows, Turkish |
FileV: | 1.0.2.37 |
ProductVer: | 2.0.9.29 |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 02-Aug-2019 16:08:23 |
Detected languages: |
|
FileV: | 1.0.2.37 |
ProductVer: | 2.0.9.29 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x000000E0 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 3 |
Time date stamp: | 02-Aug-2019 16:08:23 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 0x00001000 | 0x004AB000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
UPX1 | 0x004AC000 | 0x00022000 | 0x00021200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.78442 |
.rsrc | 0x004CE000 | 0x00005000 | 0x00004600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 5.01714 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.99666 | 9640 | UNKNOWN | English - United States | RT_ICON |
2 | 3.94238 | 308 | UNKNOWN | UNKNOWN | RT_CURSOR |
3 | 2.74199 | 304 | UNKNOWN | UNKNOWN | RT_CURSOR |
4 | 2.33799 | 240 | UNKNOWN | UNKNOWN | RT_CURSOR |
5 | 1.67607 | 4264 | UNKNOWN | UNKNOWN | RT_CURSOR |
25 | 3.27359 | 996 | UNKNOWN | UNKNOWN | RT_STRING |
26 | 3.18584 | 682 | UNKNOWN | UNKNOWN | RT_STRING |
124 | 1.91924 | 20 | UNKNOWN | English - United States | RT_GROUP_ICON |
2371 | 1.91924 | 20 | UNKNOWN | UNKNOWN | RT_GROUP_CURSOR |
2374 | 2.51621 | 48 | UNKNOWN | UNKNOWN | RT_GROUP_CURSOR |
GDI32.dll |
KERNEL32.DLL |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2712 | "C:\Users\admin\Desktop\ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe" | C:\Users\admin\Desktop\ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
3604 | C:\Windows\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2540 | C:\Windows\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937} | C:\Windows\System32\dllhost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2752 | "C:\Users\admin\Desktop\ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe" | C:\Users\admin\Desktop\ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | dllhost.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 1 Modules
| |||||||||||||||
3208 | "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet | C:\Windows\System32\cmd.exe | — | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3268 | vssadmin delete shadows /all /quiet | C:\Windows\System32\vssadmin.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3404 | C:\Windows\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3920 | /c vssadmin Delete Shadows /All /Quiet | C:\Windows\System32\cmd.exe | — | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2332 | vssadmin Delete Shadows /All /Quiet | C:\Windows\System32\vssadmin.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Command Line Interface for Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2372 | /c bcdedit /set {default} recoveryenabled No | C:\Windows\System32\cmd.exe | — | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|
(PID) Process: | (3604) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ICM\Calibration |
Operation: | write | Name: | DisplayCalibrator |
Value: %SystemRoot%\System32\DCCW.exe | |||
(PID) Process: | (2540) dllhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2540) dllhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2540) dllhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2540) dllhost.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2752) ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2752) ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2752) ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2752) ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1856) bcdedit.exe | Key: | HKEY_LOCAL_MACHINE\BCD00000000\Objects\{345b46fd-a9f9-11e7-a83c-e8a4f72b1d33}\Elements\16000009 |
Operation: | write | Name: | Element |
Value: 01 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.lockbit | binary | |
MD5:E74F75D0063561E61761D2636811F49A | SHA256:6615B17882BF857DC35FC28CC1C6C9B0716D392D574C90C15759A17655716A63 | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Accessibility_R_RHP.aapp | binary | |
MD5:64B1132C66F6E787FDBC8A2D8476328A | SHA256:8F53BC8BE6588BC0559222535E793580DB6D73B974D1800FA8C38144C7776EBC | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Actions_R_RHP.aapp.lockbit | binary | |
MD5:BC68329DE541CB222E5CFEAF257BEC09 | SHA256:2AB84D70EB753FEB69A151D9095405123408913C826B74FC978220281CC282C5 | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf | binary | |
MD5:E74F75D0063561E61761D2636811F49A | SHA256:6615B17882BF857DC35FC28CC1C6C9B0716D392D574C90C15759A17655716A63 | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Restore-My-Files.txt | text | |
MD5:706807F46A5B7757057139F673B49AE5 | SHA256:71C9F447052D2DB32BB8817BE541BF7CE766E474624F6FB51E083B676F3920AE | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\Restore-My-Files.txt | text | |
MD5:706807F46A5B7757057139F673B49AE5 | SHA256:71C9F447052D2DB32BB8817BE541BF7CE766E474624F6FB51E083B676F3920AE | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Accessibility_R_RHP.aapp.lockbit | binary | |
MD5:64B1132C66F6E787FDBC8A2D8476328A | SHA256:8F53BC8BE6588BC0559222535E793580DB6D73B974D1800FA8C38144C7776EBC | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp.lockbit | binary | |
MD5:B9181DAED0C76EAD4D219989B7872B37 | SHA256:4B6EF1A3C8023BAA49DBE88C5DA54F5D77A7018A966C8F2DA4F6A04DB173389B | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Actions_R_RHP.aapp | binary | |
MD5:BC68329DE541CB222E5CFEAF257BEC09 | SHA256:2AB84D70EB753FEB69A151D9095405123408913C826B74FC978220281CC282C5 | |||
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp.lockbit | binary | |
MD5:6E6D10B9A92EE81A635378049B2EBAA9 | SHA256:4A5445560713215723C07197A915A6D06F33DF817E42C1893DD67C660475C786 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1632 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | 192.168.100.1:445 | — | — | — | unknown |
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | 192.168.100.1:445 | — | — | — | unknown |
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | 192.168.100.2:135 | — | — | — | whitelisted |
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | 192.168.100.2:445 | — | — | — | whitelisted |
1632 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | 192.168.100.2:135 | — | — | — | whitelisted |
1632 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | 192.168.100.2:445 | — | — | — | whitelisted |
1632 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | 192.168.100.1:135 | — | — | — | unknown |
2752 | ed37bb51af01647fde0a5b04a401fd278eba50cf2d5d0678f86227d27aecbc62.exe | 192.168.100.1:135 | — | — | — | unknown |