File name: | file |
Full analysis: | https://app.any.run/tasks/e4f4bce8-e0dc-4302-842d-1bd0d57f1a7d |
Verdict: | Malicious activity |
Analysis date: | December 05, 2022, 17:15:44 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | BFEB50FC297E738DFA963A5F6DA482B0 |
SHA1: | F5F6FA85B5A11BEEAD6D5E9B1C508934F0AF99CD |
SHA256: | FE8F5C79DD2959E556E3A7A85DD04ABD241C40ADD5DF49313E52145875D39AE6 |
SSDEEP: | 196608:91OP1STRs9nnI1z47TrdIDSet4hAthJPfnDlk7bhOEb1Vx:3OtwWhnoe8t4hAJPP5kNNb1L |
.exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
---|---|---|
.exe | | | Win64 Executable (generic) (37.3) |
.dll | | | Win32 Dynamic Link Library (generic) (8.8) |
.exe | | | Win32 Executable (generic) (6) |
.exe | | | Generic Win/DOS Executable (2.7) |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 2010-Nov-18 16:27:35 |
Detected languages: |
|
CompanyName: | Igor Pavlov |
FileDescription: | 7z Setup SFX |
FileVersion: | 9.20 |
InternalName: | 7zS.sfx |
LegalCopyright: | Copyright (c) 1999-2010 Igor Pavlov |
OriginalFilename: | 7zS.sfx.exe |
ProductName: | 7-Zip |
ProductVersion: | 9.20 |
e_magic: | MZ |
---|---|
e_cblp: | 144 |
e_cp: | 3 |
e_crlc: | - |
e_cparhdr: | 4 |
e_minalloc: | - |
e_maxalloc: | 65535 |
e_ss: | - |
e_sp: | 184 |
e_csum: | - |
e_ip: | - |
e_cs: | - |
e_ovno: | - |
e_oemid: | - |
e_oeminfo: | - |
e_lfanew: | 232 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
NumberofSections: | 5 |
TimeDateStamp: | 2010-Nov-18 16:27:35 |
PointerToSymbolTable: | - |
NumberOfSymbols: | - |
SizeOfOptionalHeader: | 224 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 4096 | 104938 | 104960 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.60849 |
.rdata | 110592 | 17556 | 17920 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.36802 |
.data | 131072 | 23112 | 12800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.37054 |
.sxdata | 155648 | 4 | 512 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 159744 | 2656 | 3072 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 3.30196 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 3.75404 | 744 | UNKNOWN | English - United States | RT_ICON |
2 | 3.18403 | 296 | UNKNOWN | English - United States | RT_ICON |
5 | 1.43775 | 52 | UNKNOWN | English - United States | RT_STRING |
500 | 3.09294 | 184 | UNKNOWN | English - United States | RT_DIALOG |
1 (#2) | 2.78284 | 148 | UNKNOWN | English - United States | RT_STRING |
1 (#3) | 2.37086 | 34 | UNKNOWN | English - United States | RT_GROUP_ICON |
1 (#4) | 3.44049 | 700 | UNKNOWN | English - United States | RT_VERSION |
KERNEL32.dll |
OLEAUT32.dll |
SHELL32.dll |
USER32.dll |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2736 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Igor Pavlov Integrity Level: MEDIUM Description: 7z Setup SFX Exit code: 3221226540 Version: 9.20 Modules
| |||||||||||||||
3264 | "C:\Users\admin\AppData\Local\Temp\file.exe" | C:\Users\admin\AppData\Local\Temp\file.exe | Explorer.EXE | ||||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z Setup SFX Exit code: 0 Version: 9.20 Modules
| |||||||||||||||
868 | .\Install.exe | C:\Users\admin\AppData\Local\Temp\7zSDD1E.tmp\Install.exe | — | file.exe | |||||||||||
User: admin Company: Igor Pavlov Integrity Level: HIGH Description: 7z Setup SFX Exit code: 0 Version: 9.20 Modules
| |||||||||||||||
2576 | .\Install.exe /S /site_id "525403" | C:\Users\admin\AppData\Local\Temp\7zSDFBE.tmp\Install.exe | — | Install.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
1616 | "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0&" | C:\Windows\System32\forfiles.exe | — | Install.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: ForFiles - Executes a command on selected files Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2648 | "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0&" | C:\Windows\System32\forfiles.exe | — | Install.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: ForFiles - Executes a command on selected files Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2892 | /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0& | C:\Windows\System32\cmd.exe | — | forfiles.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
4072 | REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 | c:\windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2168 | /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0& | C:\Windows\System32\cmd.exe | — | forfiles.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3316 | REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 | c:\windows\system32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2576) Install.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2576) Install.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2576) Install.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2576) Install.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (4072) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions |
Operation: | write | Name: | exe |
Value: 0 | |||
(PID) Process: | (3316) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet |
Operation: | write | Name: | SpyNetReporting |
Value: 0 | |||
(PID) Process: | (3052) powershell.EXE | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US | |||
(PID) Process: | (3052) powershell.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (3052) powershell.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (3052) powershell.EXE | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3264 | file.exe | C:\Users\admin\AppData\Local\Temp\7zSDD1E.tmp\__data__\config.txt | binary | |
MD5:1C6ECF68529996320C18C5AEA7FC623F | SHA256:E838D819E2E97FB7613BA81C960A8CAF661642DC1D679FA44451A6E9C78BAD4A | |||
3952 | LFfauDN.exe | C:\Windows\Temp\WtMYTPIbSwjziXOH\PhqCyaWzMTzrPYd\YTusyFT.exe | executable | |
MD5:A642CAB9B19C6F58CFBC6A22C2CD6C11 | SHA256:38E5CA7D40BD3598246E945F2CAA0E9D37B5929AB132F2CD67DF29B4C4D05D6B | |||
3264 | file.exe | C:\Users\admin\AppData\Local\Temp\7zSDD1E.tmp\Install.exe | executable | |
MD5:DD042BF074F9EC8443473686D38D202E | SHA256:F006E4711AE85701DC55F525157B7C67A840E94087E3B776B532479C5971F073 | |||
3248 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9QIMY2UKY4AWQZ11BVRA.temp | binary | |
MD5:784363B06121148330D8FE56BB3E970D | SHA256:CB801021AFDA3E0E3C14DCE299607B9EF8D7CEA4A3E42A0068D33566D7635B07 | |||
3052 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF11f133.TMP | binary | |
MD5:CCFCF369F751CE8DA0370D84E52A7EED | SHA256:53922490C3F5A04667EC3605A01AF2A4F4F265782D1BCA519F63ACAD413F2ED9 | |||
2656 | schtasks.exe | C:\Windows\Tasks\bWqkINIqDdNMaChISJ.job | binary | |
MD5:A0D44BE19AC22DB1CABE29C4EF088728 | SHA256:4C690B076707EDE3D42C6D810BCE3CEC633F2DB8CEA1A89D07B8EAD8344E3AFE | |||
3052 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BVQSMYA4V5PEFE8U1C6S.temp | binary | |
MD5:D8483A077F149CF0E48DB97619E2A3E8 | SHA256:673F53DC0F7DAECA7076027444EEC7009E951EA0EEF8FA0FBC94DC507349ECBC | |||
868 | Install.exe | C:\Users\admin\AppData\Local\Temp\7zSDFBE.tmp\Install.exe | executable | |
MD5:A642CAB9B19C6F58CFBC6A22C2CD6C11 | SHA256:38E5CA7D40BD3598246E945F2CAA0E9D37B5929AB132F2CD67DF29B4C4D05D6B | |||
3248 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:784363B06121148330D8FE56BB3E970D | SHA256:CB801021AFDA3E0E3C14DCE299607B9EF8D7CEA4A3E42A0068D33566D7635B07 | |||
3052 | powershell.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:D8483A077F149CF0E48DB97619E2A3E8 | SHA256:673F53DC0F7DAECA7076027444EEC7009E951EA0EEF8FA0FBC94DC507349ECBC |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3832 | YTusyFT.exe | GET | 200 | 142.250.185.195:80 | http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D | US | der | 1.41 Kb | whitelisted |
3832 | YTusyFT.exe | GET | 200 | 23.32.238.35:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgO3KnkYkYvzjMTY%2BDHZyvRw3Q%3D%3D | US | der | 503 b | shared |
3832 | YTusyFT.exe | GET | 200 | 23.45.105.185:80 | http://x1.c.lencr.org/ | NL | der | 717 b | whitelisted |
3832 | YTusyFT.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?95ff6a381d07c45f | US | compressed | 4.70 Kb | whitelisted |
3832 | YTusyFT.exe | GET | 200 | 142.250.185.195:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDreCS75DAIaRKqvCi%2FvL9c | US | der | 472 b | whitelisted |
3832 | YTusyFT.exe | GET | 200 | 142.250.185.195:80 | http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDuZCz4OZecyRJCVianxG0K | US | der | 472 b | whitelisted |
3832 | YTusyFT.exe | GET | 200 | 142.250.185.195:80 | http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D | US | der | 724 b | whitelisted |
2184 | rundll32.EXE | POST | 200 | 44.233.23.32:80 | http://api4.check-data.xyz/api2/google_api_ifi | US | — | — | malicious |
3832 | YTusyFT.exe | GET | 200 | 209.197.3.8:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?d6c9cdcbcbcd3a3a | US | compressed | 61.4 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3832 | YTusyFT.exe | 142.250.186.138:443 | www.googleapis.com | GOOGLE | US | whitelisted |
3832 | YTusyFT.exe | 142.250.185.195:80 | ocsp.pki.goog | GOOGLE | US | whitelisted |
3832 | YTusyFT.exe | 23.32.238.35:80 | r3.o.lencr.org | Akamai International B.V. | DE | malicious |
3832 | YTusyFT.exe | 3.80.150.121:443 | service-domain.xyz | AMAZON-AES | US | suspicious |
3832 | YTusyFT.exe | 172.217.18.14:443 | clients2.google.com | GOOGLE | US | whitelisted |
3832 | YTusyFT.exe | 209.197.3.8:80 | ctldl.windowsupdate.com | STACKPATH-CDN | US | whitelisted |
3832 | YTusyFT.exe | 23.45.105.185:80 | x1.c.lencr.org | AKAMAI-AS | DE | unknown |
2184 | rundll32.EXE | 44.233.23.32:80 | api4.check-data.xyz | AMAZON-02 | US | suspicious |
Domain | IP | Reputation |
---|---|---|
service-domain.xyz |
| suspicious |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
www.googleapis.com |
| whitelisted |
ocsp.pki.goog |
| whitelisted |
clients2.google.com |
| whitelisted |
api4.check-data.xyz |
| malicious |
PID | Process | Class | Message |
---|---|---|---|
3832 | YTusyFT.exe | Potentially Bad Traffic | ET INFO Observed Let's Encrypt Certificate for Suspicious TLD (.xyz) |
2184 | rundll32.EXE | Potentially Bad Traffic | AV INFO HTTP Request to a *.xyz domain |