File name:

d.exe

Full analysis: https://app.any.run/tasks/8ad0b6ce-3c66-426d-b0a1-4c8bc7c82d42
Verdict: Malicious activity
Analysis date: December 13, 2023, 18:41:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CB5CE11E089CE13DFE214E30CE67D670

SHA1:

9766466955692B45D8FCDC64CE598A07B56847F1

SHA256:

FA9A121A748323BA9EE924337B381634818393C7CA487D90DA884B29A8C0E283

SSDEEP:

98304:0m2dQIkAhnUAXORy4vlDYjCvoE62zGywo84jE62X:0mSVkvQL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • cmd.exe (PID: 280)

    • Drops the executable file immediately after the start

      • d.exe (PID: 2632)
      • StikyNot.exe (PID: 3276)
      • StikyNot.exe (PID: 3252)

    • Changes the autorun value in the registry

      • StikyNot.exe (PID: 3276)
      • StikyNot.exe (PID: 3252)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • d.exe (PID: 3264)
      • StikyNot.exe (PID: 3140)
      • StikyNot.exe (PID: 3632)
      • StikyNot.exe (PID: 1868)

    • Application launched itself

      • d.exe (PID: 3264)
      • d.exe (PID: 2632)
      • StikyNot.exe (PID: 3140)
      • StikyNot.exe (PID: 3276)
      • StikyNot.exe (PID: 1868)
      • StikyNot.exe (PID: 3632)
      • StikyNot.exe (PID: 3252)

    • Drops a system driver (possible attempt to evade defenses)

      • d.exe (PID: 2632)

    • The process creates files with name similar to system file names

      • explorer.exe (PID: 2964)
      • StikyNot.exe (PID: 3276)
      • StikyNot.exe (PID: 3252)

    • Detected use of alternative data streams (AltDS)

      • explorer.exe (PID: 2964)

  • INFO

    • Checks supported languages

      • d.exe (PID: 3264)
      • d.exe (PID: 2632)
      • d.exe (PID: 2084)
      • StikyNot.exe (PID: 3140)
      • StikyNot.exe (PID: 3276)
      • StikyNot.exe (PID: 2988)
      • StikyNot.exe (PID: 3632)
      • StikyNot.exe (PID: 2100)
      • StikyNot.exe (PID: 1868)
      • StikyNot.exe (PID: 4016)
      • StikyNot.exe (PID: 3252)

    • Create files in a temporary directory

      • d.exe (PID: 2632)
      • d.exe (PID: 2084)
      • StikyNot.exe (PID: 3276)
      • StikyNot.exe (PID: 2988)
      • explorer.exe (PID: 2964)
      • StikyNot.exe (PID: 2100)
      • StikyNot.exe (PID: 3252)

    • Creates files or folders in the user directory

      • d.exe (PID: 2632)
      • explorer.exe (PID: 2964)
      • StikyNot.exe (PID: 3276)
      • StikyNot.exe (PID: 3252)

    • Reads the machine GUID from the registry

      • d.exe (PID: 2084)
      • StikyNot.exe (PID: 2988)
      • StikyNot.exe (PID: 2100)

    • Reads the computer name

      • d.exe (PID: 2084)
      • StikyNot.exe (PID: 2988)
      • StikyNot.exe (PID: 2100)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 2964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:05:29 15:49:02+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 45056
InitializedDataSize: 221184
UninitializedDataSize: -
EntryPoint: 0xb10f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (Australian)
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: FlowerPower
FileVersion: 1, 0, 0, 1
InternalName: FlowerPower
LegalCopyright: Copyright (C) 2000
LegalTrademarks: -
OriginalFileName: FlowerPower.EXE
PrivateBuild: -
ProductName: FlowerPower
ProductVersion: 1, 0, 0, 1
SpecialBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
18
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start d.exe no specs cmd.exe d.exe no specs d.exe no specs explorer.exe no specs stikynot.exe no specs cmd.exe no specs stikynot.exe stikynot.exe no specs explorer.exe no specs stikynot.exe no specs cmd.exe no specs stikynot.exe stikynot.exe no specs explorer.exe no specs stikynot.exe no specs cmd.exe no specs stikynot.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280C:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\admin\AppData\Local\Temp\d.exe",1: >"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"C:\Windows\System32\cmd.exe
d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1868C:\Users\admin\AppData\Local\Chrome\StikyNot.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FlowerPower
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\chrome\stikynot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mfc42.dll
2084C:\Users\admin\AppData\Local\Temp\d.exeC:\Users\admin\AppData\Local\Temp\d.exe—d.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FlowerPower
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2100C:\Users\admin\AppData\Local\Chrome\StikyNot.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exe—StikyNot.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FlowerPower
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\chrome\stikynot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2632C:\Users\admin\AppData\Local\Temp\d.exeC:\Users\admin\AppData\Local\Temp\d.exe—d.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FlowerPower
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2964"C:\Windows\explorer.exe"C:\Windows\explorer.exe—d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2988C:\Users\admin\AppData\Local\Chrome\StikyNot.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exe—StikyNot.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FlowerPower
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\chrome\stikynot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3140C:\Users\admin\AppData\Local\Chrome\StikyNot.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FlowerPower
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\chrome\stikynot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mfc42.dll
3252C:\Users\admin\AppData\Local\Chrome\StikyNot.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exe
StikyNot.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FlowerPower
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\chrome\stikynot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3264"C:\Users\admin\AppData\Local\Temp\d.exe" C:\Users\admin\AppData\Local\Temp\d.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
FlowerPower
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mfc42.dll
Total events
611
Read events
604
Write events
7
Delete events
0

Modification events

(PID) Process:(2084) d.exeKey:HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
(PID) Process:(2988) StikyNot.exeKey:HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
(PID) Process:(3276) StikyNot.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft OneDrive
Value:
C:\Users\admin\AppData\Local\Chrome\StikyNot.exe
(PID) Process:(3252) StikyNot.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Microsoft OneDrive
Value:
C:\Users\admin\AppData\Local\Chrome\SyncHost.exe
(PID) Process:(2100) StikyNot.exeKey:HKEY_CURRENT_USER\Software\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
Executable files
5
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2632d.exeC:\Users\admin\AppData\Local\Chrome\StikyNot.exeexecutable
MD5:CB5CE11E089CE13DFE214E30CE67D670
SHA256:FA9A121A748323BA9EE924337B381634818393C7CA487D90DA884B29A8C0E283
2632d.exeC:\Users\admin\AppData\Local\Temp\Disk.sysexecutable
MD5:CB5CE11E089CE13DFE214E30CE67D670
SHA256:FA9A121A748323BA9EE924337B381634818393C7CA487D90DA884B29A8C0E283
280cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbstext
MD5:83C9C8F127B8F6E4E72BA089F4814D34
SHA256:62C10CAE977768C479CBB4BF354BDD00F2FAF2BB36A6C048AB26DE1CAB766078
2964explorer.exeC:\Users\admin\AppData\Local\Chrome\SyncHost.exeexecutable
MD5:CB5CE11E089CE13DFE214E30CE67D670
SHA256:FA9A121A748323BA9EE924337B381634818393C7CA487D90DA884B29A8C0E283
3276StikyNot.exeC:\Users\admin\AppData\Local\Chrome\SyncHost.exeexecutable
MD5:CB5CE11E089CE13DFE214E30CE67D670
SHA256:FA9A121A748323BA9EE924337B381634818393C7CA487D90DA884B29A8C0E283
3252StikyNot.exeC:\Users\admin\AppData\Local\Chrome\SyncHost.exeexecutable
MD5:CB5CE11E089CE13DFE214E30CE67D670
SHA256:FA9A121A748323BA9EE924337B381634818393C7CA487D90DA884B29A8C0E283
2100StikyNot.exeC:\Users\admin\AppData\Local\Temp\~DFA2DBF92BCDCAF7A2.TMPbinary
MD5:3C24A331D3CDD941337533F2D423A6DB
SHA256:C9D90D949A125139132BB08090ED9590681B2F3237FD6677555842E0FDADBF96
2084d.exeC:\Users\admin\AppData\Local\Temp\~DFA892705E1F6BA180.TMPbinary
MD5:E17B1A8EB10F93E498FF29B365AFA5B6
SHA256:12D051E0349D2D50CA9A2046E8050502E6A6355D2292EB114D71A3D4BC020E2C
2988StikyNot.exeC:\Users\admin\AppData\Local\Temp\~DF68BE3470A282623C.TMPbinary
MD5:70BB2BBD79F80E43A0E39AB18C750419
SHA256:D4D657B41B046875518B9E1BFF5AE771EE3933DE2E538C434D3EEB92AC29D4B5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info