File name: | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe |
Full analysis: | https://app.any.run/tasks/d4a5a75f-8dd3-4fbf-a6ae-7f2bde3b3ca8 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2025, 21:03:33 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MIME: | application/vnd.microsoft.portable-executable |
File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections |
MD5: | B7338FFFCE9038B39CD154E431FB134E |
SHA1: | C176E0B63BE81C28808AD223B3882EC11549F06C |
SHA256: | EFB5F7C4CD7ECD8EDB586C145253B63352500A16AD2E19F5F228FF4F5599BC09 |
SSDEEP: | 49152:zfuj56FRSfWJ9kUe9fuj56FRSfWJ9kUer:zf5FAeJUf5FAeJu |
.exe | | | Win32 Executable MS Visual C++ (generic) (30.9) |
---|---|---|
.exe | | | Win64 Executable (generic) (27.3) |
.exe | | | UPX compressed Win32 Executable (26.8) |
.dll | | | Win32 Dynamic Link Library (generic) (6.5) |
.exe | | | Win32 Executable (generic) (4.4) |
Subsystem: | Windows GUI |
---|---|
SubsystemVersion: | 4 |
ImageVersion: | - |
OSVersion: | 4 |
EntryPoint: | 0x2130 |
UninitializedDataSize: | 24576 |
InitializedDataSize: | 4096 |
CodeSize: | 8192 |
LinkerVersion: | 6 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug |
TimeStamp: | 2011:03:15 04:06:07+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
4136 | "C:\Users\admin\Desktop\efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe" | C:\Users\admin\Desktop\efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | — | ||
MD5:— | SHA256:— | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.tmp | executable | |
MD5:0EBA20BB43806F3DB9266404BF228586 | SHA256:47A5815822920993E91B4461EE2F95E5C8C5FC5E6E9D21C03CFE67516F969089 | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmp | executable | |
MD5:12DA12B91D5D22437E9775E0AC543D6F | SHA256:76D265C46DD5C726E9FC7591D112B14D22D691F7CCD8B7CF2F1A37A5C2C8A7EA | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmp | executable | |
MD5:A1CA37A1CCD73B791C3FA216FFC2A612 | SHA256:FE4D9B64B9FF97FDDEC31B327015EACE0D7079359C9BA7BA3F3315EE0FF33B80 | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmp | executable | |
MD5:C63BBC61E8A108A7325F4CE80C95249D | SHA256:3E2B666D569441E5202173A9480C5140EECC38EC29C0C65831778268F793EEC8 | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmp | executable | |
MD5:98AB11BA1CCE2A97068CAC240C5F66FD | SHA256:3DAF7518FC859CBBD5B5917D6F4000802D5894DDD448792E8BC9F271D32DA43D | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmp | executable | |
MD5:7DAB854126839BFB54110889000CD370 | SHA256:57798297E6D56B67358AFBE8452FC32C1DCC03B7E2554F002998E52051190801 | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exe | executable | |
MD5:0EBA20BB43806F3DB9266404BF228586 | SHA256:47A5815822920993E91B4461EE2F95E5C8C5FC5E6E9D21C03CFE67516F969089 | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmp | executable | |
MD5:EF8B492DE29E3A4F39947A86AA473551 | SHA256:F63810A0A413B5888A9535E2581527727A228B0BF92952D45710D88413EC825B | |||
4136 | efb5f7c4cd7ecd8edb586c145253b63352500a16ad2e19f5f228ff4f5599bc09.exe | C:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.tmp | executable | |
MD5:62132C602614F74F45364455E743CE7B | SHA256:840B9DD5A323C9075BC397DBE9473D2974C7A3F793C9F24C49C711C82BDEE8B0 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6072 | svchost.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6072 | svchost.exe | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6072 | svchost.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 2.23.227.208:443 | — | Ooredoo Q.S.C. | QA | unknown |
6072 | svchost.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
6072 | svchost.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
4712 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6072 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |