flash

d4e475d7d17a16be8b9eeac6e10b25af.exe

Status: finished
Submission Time: 20.11.2020 07:23:08
Malicious
Trojan
Evader
Nanocore

Comments

Tags

  • NanoCore

Details

  • Analysis ID:
    320928
  • API (Web) ID:
    543662
  • Analysis Started:
    20.11.2020 07:23:08
  • Analysis Finished:
    20.11.2020 07:32:52
  • MD5:
    5162337b6fd4c8806ef62f6ebf4a5df8
  • SHA1:
    126642db1117de853d7e0ae601e0ff45358d7413
  • SHA256:
    9c2e4a4a0e7bb4c3c47ca33ec0d0c377fa38e0ae498721062432648ebf060a10
  • Technologies:
Full Report Management Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
100/100

malicious
48/72

malicious
15/37

malicious
34/48

malicious

IPs

IP Country Detection
192.190.19.55
Canada

Domains

Name IP Detection
windowslivesoffice.ddns.net
192.190.19.55

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat
data
#
C:\Users\user\hdwwiz\DiagnosticsHub.StandardCollector.Service.exe.bat
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
#
Click to see the 4 hidden entries
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegAsm.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\dhcpmon.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinSAT.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Nov 20 14:23:58 2020, mtime=Fri Nov 20 14:23:58 2020, atime=Fri Nov 20 14:23:58 2020, length=1124928, window=hide
#
\Device\ConDrv
ASCII text, with CRLF line terminators
#