File name: | f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a |
Full analysis: | https://app.any.run/tasks/b4ceb635-1234-40fa-86b1-8f33fb732864 |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 22:45:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed |
MD5: | 3553F31B0FC2377321C3532697676270 |
SHA1: | 2028DEE9DDBA6616F4B48539CAA17E515524E122 |
SHA256: | F8FB4FB205E65D957E0AB4BF568C394AE3AF6186EEE90751161D6DF85F0D840A |
SSDEEP: | 6144:fZM93Txzh+w+m/AKm9E9RCtRwZfrz4rZD4V:fq9jFhlIS9QzMY4V |
.exe | | | UPX compressed Win32 Executable (39.3) |
---|---|---|
.exe | | | Win32 EXE Yoda's Crypter (38.6) |
.dll | | | Win32 Dynamic Link Library (generic) (9.5) |
.exe | | | Win32 Executable (generic) (6.5) |
.exe | | | Generic Win/DOS Executable (2.9) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2007-Aug-19 08:31:03 |
Detected languages: |
|
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 128 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 3 |
TimeDateStamp: | 2007-Aug-19 08:31:03 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
UPX0 | 4096 | 94208 | 0 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | |
UPX1 | 98304 | 45056 | 41984 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 7.88506 |
.rsrc | 143360 | 4096 | 4096 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.5121 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.85097 | 2216 | UNKNOWN | English - United States | RT_ICON |
2 | 7.61532 | 2216 | UNKNOWN | English - United States | RT_ICON |
8001 | 1.81924 | 20 | UNKNOWN | English - United States | RT_GROUP_ICON |
8002 | 4.32193 | 20 | UNKNOWN | English - United States | RT_GROUP_ICON |
1 (#2) | 5.00605 | 695 | UNKNOWN | English - United States | RT_MANIFEST |
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.DLL |
SHELL32.dll |
USER32.dll |
ole32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1756 | "C:\Users\admin\AppData\Local\Temp\f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe" | C:\Users\admin\AppData\Local\Temp\f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | Explorer.EXE | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
3136 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\install.bat" " | C:\Windows\system32\cmd.exe | — | f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
1284 | devcon remove root\vusbbus | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\devcon.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Setup API Exit code: 3221226540 Version: 5.1.2600.1106 (xpsp1.020828-1920) Modules
| |||||||||||||||
3036 | "C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\devcon.exe" remove root\vusbbus | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\devcon.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Setup API Exit code: 3221226540 Version: 5.1.2600.1106 (xpsp1.020828-1920) Modules
| |||||||||||||||
2008 | "C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\devcon.exe" remove root\vusbbus | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\devcon.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Setup API Exit code: 0 Version: 5.1.2600.1106 (xpsp1.020828-1920) Modules
| |||||||||||||||
4024 | regedit /s 0000EA30.reg | C:\Windows\regedit.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Editor Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1060 | "C:\Windows\regedit.exe" /s 0000EA30.reg | C:\Windows\regedit.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Editor Exit code: 3221226540 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2400 | "C:\Windows\regedit.exe" /s 0000EA30.reg | C:\Windows\regedit.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Editor Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2800 | devcon install vusbbus.inf root\vusbbus | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\devcon.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Setup API Exit code: 3221226540 Version: 5.1.2600.1106 (xpsp1.020828-1920) Modules
| |||||||||||||||
2276 | "C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\devcon.exe" install vusbbus.inf root\vusbbus | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\devcon.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Setup API Exit code: 3221226540 Version: 5.1.2600.1106 (xpsp1.020828-1920) Modules
|
(PID) Process: | (1756) f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (1756) f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (1756) f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (1756) f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (3136) cmd.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3136) cmd.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3136) cmd.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (3136) cmd.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (1936) devcon.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus |
Operation: | write | Name: | setupapi.app.log |
Value: 4096 | |||
(PID) Process: | (1936) devcon.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus |
Operation: | write | Name: | setupapi.dev.log |
Value: 4096 |
PID | Process | Filename | Type | |
---|---|---|---|---|
1756 | f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\install.bat | text | |
MD5:5A4C6D362943939B3214D06B88AF609B | SHA256:1FB2B3F7B605DD67A11C4799DCB9BF02B1AB7EB96F3299DDC2CD1B131478ED18 | |||
1280 | DrvInst.exe | C:\Windows\System32\DriverStore\Temp\{1e5c6049-d661-0ad7-4f1c-c01e8224873b}\SETDDC.tmp | binary | |
MD5:E2A4446F42933143BF8BA7107A454CD3 | SHA256:DE8DA89F6E326D7BAAF6ACA81C9ACA7DA07EED8CDB581733E64FFA6D09678E13 | |||
1756 | f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | C:\Users\admin\AppData\Local\Temp\FP34C.tmp | text | |
MD5:A9AD1E70FE02086D64BCBB8619FAB59C | SHA256:817E78B6D88BC7A1C982F2521196574C6A3BC9CEF52BB92589D2C0205D39658F | |||
1756 | f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\VUsbBus.sys | executable | |
MD5:CFBA49C448DD697D75E9D8DF495F549D | SHA256:EB7AEB285D4DD7DA8AC9FC791D350760E0FB6D10BA1DD07AF479EB557A706746 | |||
1936 | devcon.exe | C:\Windows\INF\setupapi.app.log | ini | |
MD5:C9800A4EC6019E3308416CAF530C7C98 | SHA256:21C4A6409AE8F84DB88B33FEB1876387162C8DCB27B60AD2D7D595187B6F634F | |||
1936 | devcon.exe | C:\Users\admin\AppData\Local\Temp\{2496fcec-86e9-4706-c488-7e79283a6b56}\SETD60.tmp | executable | |
MD5:CFBA49C448DD697D75E9D8DF495F549D | SHA256:EB7AEB285D4DD7DA8AC9FC791D350760E0FB6D10BA1DD07AF479EB557A706746 | |||
1756 | f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\0000EA30.REG | text | |
MD5:09FE24EABFEF6757848A9C71575CDED3 | SHA256:735F6A4EBA1115FCD153AF5CBD38A1D4F9F21D1A626C6AEABBB5DD76FD6F020C | |||
1936 | devcon.exe | C:\Users\admin\AppData\Local\Temp\{2496fcec-86e9-4706-c488-7e79283a6b56}\SETD50.tmp | binary | |
MD5:E2A4446F42933143BF8BA7107A454CD3 | SHA256:DE8DA89F6E326D7BAAF6ACA81C9ACA7DA07EED8CDB581733E64FFA6D09678E13 | |||
1756 | f8fb4fb205e65d957e0ab4bf568c394ae3af6186eee90751161d6df85f0d840a.exe | C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\remove.bat | text | |
MD5:729489770F389ED044FF478BC187F68B | SHA256:AB23F547F250191A9CF3FEDBD94790F23706E2FAE1CA073F5423EDE6175F0321 | |||
1936 | devcon.exe | C:\Users\admin\AppData\Local\Temp\{2496fcec-86e9-4706-c488-7e79283a6b56}\vusbbus.inf | binary | |
MD5:E2A4446F42933143BF8BA7107A454CD3 | SHA256:DE8DA89F6E326D7BAAF6ACA81C9ACA7DA07EED8CDB581733E64FFA6D09678E13 |
Process | Message |
---|---|
regedit.exe | REGEDIT: CreateFile failed, GetLastError() = 2
|