Cuckoo Sandbox

Category	Started On	Completed On	Duration	Cuckoo Version
FILE	2022-11-14 20:00:37.665697	2022-11-14 20:01:41.701970	64 seconds	2.0-dev

Machine	Label	Manager	Started On	Shutdown On
win7cuckoo	win7 Clone 1	VirtualBox	2022-11-14 20:00:38	2022-11-14 20:01:40

File Details

File name	30fe96ed612b0afd3016a22938da79a88636cd36.dll
File size	231994 bytes
File type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
CRC32	86936F7E
MD5	97a48f9d72a963c1867e08200c7015f0
SHA1	30fe96ed612b0afd3016a22938da79a88636cd36
SHA256	9608a3d760d5bf6cbe591fad5b34160e3b20477450f3c61427802532db983602
SHA512	2a9d96cf3e37b5987ba41e733a1a5b4bbe8411f04c64b6ba6fbfe0b6199e331118ce83c2a695117aacd66b7849b3ef0923ef30b9e8c7b9f21694d33d2ebae10a
Ssdeep	None
PEiD	None matched
Yara	contains_base64 (This rule finds for base64 strings) screenshot (Take screenshot) win_registry (Affect system registries) CRC32_poly_Constant (Look for CRC32 [poly]) suspicious_packer_section (The packer/protector section names/keywords) IsPE32 () IsWindowsGUI () IsPacked (Entropy Check) HasOverlay (Overlay Check) HasDigitalSignature (DigitalSignature Check) HasRichSignature (Rich Signature Check) UPXv20MarkusLaszloReiser () UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser () PackerUPX_CompresorGratuito_wwwupxsourceforgenet () UPX_wwwupxsourceforgenet_additional () yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h () UPX_wwwupxsourceforgenet () UPX ()
VirusTotal	File not found on VirusTotal

MetaFlows Scores

Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1668474113]=0): Snort Events=0, AV Events=0
Total Score=50

Dropped File/Buffer Yara Signatures:
3c33bc6ec009c2ef_install-prodinfo.exe: contains_base64

Signatures

nolookup_communication details

packer_entropy details

packer_upx details

Screenshots

No screenshots available.

Static Analysis

Version Infos

Sections

Name	Virtual Address	Virtual Size	Size of Raw Data	Entropy
UPX0	0x00001000	0x0001a000	0x00000000	0.0
UPX1	0x0001b000	0x00010000	0x0000fc00	7.97222274518
.rsrc	0x0002b000	0x00001000	0x00000e00	4.28164669368

Resources

Name	Offset	Size	Language	Sub-language	File type
RT_ICON	0x0002b498	0x00000128	LANG_ENGLISH	SUBLANG_ENGLISH_US	GLS_BINARY_LSB_FIRST
RT_ICON	0x0002b498	0x00000128	LANG_ENGLISH	SUBLANG_ENGLISH_US	GLS_BINARY_LSB_FIRST
RT_STRING	0x0002b5c4	0x0000006c	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_GROUP_ICON	0x0002b634	0x00000022	LANG_ENGLISH	SUBLANG_ENGLISH_US	MS Windows icon resource - 2 icons, 32x32, 16-colors
RT_VERSION	0x0002b65c	0x0000024c	LANG_ENGLISH	SUBLANG_ENGLISH_US	data
RT_MANIFEST	0x0002b8ac	0x0000027e	LANG_ENGLISH	SUBLANG_ENGLISH_US	XML document text

Imports

Strings

Dropped Files

57fce2e63e9bea0a_bg_400.gif

File name	57fce2e63e9bea0a_bg_400.gif
File size	598 bytes
File type	GIF image data, version 89a, 1 x 400
MD5	e6bd167bfd6656fd0a0053d95d7c27c4
SHA1	5d70445c9c175aef79cf37c82435315c44d0c867
SHA256	57fce2e63e9bea0aead2811c3bc79d545b0026fc5d11359f6592fd584c38a162
SHA512	3315fcdbf8844270dfcb33a7ef83805ef9960289eb238f49f22eb5fa2e571491d0a02ac9fa85319fac9623274e8f026a483e9f4383479e988cc8e7d74009d387
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

3c33bc6ec009c2ef_install-prodinfo.exe

File name	3c33bc6ec009c2ef_install-prodinfo.exe
File size	144328 bytes
File type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, Nullsoft Installer self-extracting archive
MD5	4e981b18adca73f8672bc8e47d1ec990
SHA1	29d69e3e43d037632b022d6e44a6fadb15eb2213
SHA256	3c33bc6ec009c2ef67d42250c761aabc10991099bab04d25d72dace5fbe883fb
SHA512	96fe1f1585d6e8282cbb75143195d66a8782eaffe1c5b73cfb15058bc87404b5596632c272b79bb87feb90c57b6f3a54e5d445cb51b524c8ddd56cbaa0e7fcc5
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings) screenshot (Take screenshot) CRC32_poly_Constant (Look for CRC32 [poly]) suspicious_packer_section (The packer/protector section names/keywords) IsPE32 () IsWindowsGUI () IsPacked (Entropy Check) HasOverlay (Overlay Check) HasDigitalSignature (DigitalSignature Check) HasRichSignature (Rich Signature Check) UPXv20MarkusLaszloReiser () UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser () PackerUPX_CompresorGratuito_wwwupxsourceforgenet () UPX_wwwupxsourceforgenet_additional () yodas_Protector_v1033_dllocx_Ashkbiz_Danehkar_h () UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay () UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay_additional () UPX_wwwupxsourceforgenet () UPX ()
VirusTotal	Search for Analysis

c248c06c5f6162f0_wtatom.html

File name	c248c06c5f6162f0_wtatom.html
File size	9832 bytes
File type	HTML document, Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
MD5	a79b0caa65d9c15c8aee600d601c3460
SHA1	69ce755870acef08c01b1e5b61478b24d3d285fa
SHA256	c248c06c5f6162f0135765c0af348ae336a048148bbc712a9f0924cefbdf3b20
SHA512	0eecf959d0ff56f3b1f9176fcf5d9cd61e3807c250daf8f895bb9fe55c10e9351bfce62405e5ed2ed448c3757c776a0bd4ef7e18d87c81ac4177f4b28ab1d093
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

80d8ac443868d7b3_wtatom.xml

File name	80d8ac443868d7b3_wtatom.xml
File size	1183 bytes
File type	XML document text
MD5	91a695c374edfdf593f2097eef314109
SHA1	9265325835a9b0799dc0bf3b7a85781879af1f31
SHA256	80d8ac443868d7b323f534de35014c18d17d1fa10f28e9f2501f56558ab298fc
SHA512	a20a83b07feec3df0db286654619c6389d77983fef5f89f36a0172143c9d7491ef0dbed0e16616a0f6060eb2763a1136623cd9efb496e75f25acde54a35c2114
Ssdeep	None
Yara	contains_base64 (This rule finds for base64 strings)
VirusTotal	Search for Analysis

fdd17447c564bd55_atomui.css

File name	fdd17447c564bd55_atomui.css
File size	248 bytes
File type	ASCII text, with CRLF line terminators
MD5	00915a276f15a803339c2551b69e84c9
SHA1	aba6455139b32e8e3e4460d25954dfad911fae17
SHA256	fdd17447c564bd5561136450054687af859ca33cb0eb2ebcb2f73665980dac46
SHA512	6beef0a662399ea989d86680af73625e1620290ab71b39a01be071bc31e41478e98880bc272f588cbf3291fab2a4ece82be76e14731ca7ef6d83ad8b7ca6cb4a
Ssdeep	None
Yara	None matched
VirusTotal	Search for Analysis

Network Analysis

Hosts Involved

IP Address
20.126.106.131
23.101.14.229
23.204.249.81
23.99.109.44
70.186.27.9
8.250.163.254
8.8.8.8

DNS Requests

Domain	IP Address
ipv6.msftncsi.com
dns.msftncsi.com	131.107.255.255
nexusrules.officeapps.live.com	52.109.8.45
teredo.ipv6.microsoft.com	54.241.176.34
ctldl.windowsupdate.com	209.197.3.8
nexus.officeapps.live.com	20.234.90.154
armmf.adobe.com	23.204.249.81
watson.microsoft.com	104.208.16.94

HTTP Requests

URL	Data
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f	GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015	GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?99597122bcf08015 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com

Behavior Summary

File-Read

C:\Users\Harry Dresden\AppData\Local\Temp\30fe96ed612b0afd3016a22938da79a88636cd36.dll

File-Written

C:\Users\Harry Dresden\AppData\Local\Temp\prodinfo_supergranny6_1.0.1.1171\bg_400.gif
C:\Users\Harry Dresden\AppData\Local\Temp\prodinfo_supergranny6_1.0.1.1171\install-prodinfo.exe
C:\Users\Harry Dresden\AppData\Local\Temp\prodinfo_supergranny6_1.0.1.1171\wtatom.html
C:\Users\Harry Dresden\AppData\Local\Temp\prodinfo_supergranny6_1.0.1.1171\wtatom.xml
C:\Users\Harry Dresden\AppData\Local\Temp\prodinfo_supergranny6_1.0.1.1171\atomui.css

File-Opened

C:\Users\Harry Dresden\AppData\Local\Temp\30fe96ed612b0afd3016a22938da79a88636cd36.dll

Directory-Created

C:\Users\Harry Dresden\AppData\Local\Temp\prodinfo_supergranny6_1.0.1.1171

Registry Key-Read

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles

Mutex-Accessed

{EEF4DCB9-E47E-4ee9-A191-C303C366F66C}_Mutex

Processes

registry filesystem process services network synchronization

C:\Windows\system32\lsass.exe PID: 480, Parent PID: 384

"C:\Users\Harry Dresden\AppData\Local\Temp\30fe96ed612b0afd3016a22938da79a88636cd36.dll" PID: 948, Parent PID: 3384

Volatility

Nothing to display.

LegalCopyright:	WildTangent, Inc. All rights reserved.
ProductVersion:	1.0.1.6
FileDescription:	WTDownloader SFXStub
FileVersion:	1.0.1.6
CompanyName:	WildTangent, Inc.
Translation:	0x0409 0x04e4