PDF

Print

ThreatScope Analysis Report

For file 35f6c01cfbf7eb5680707d0c8f39bfea80961d62.pif uploaded 2014-07-04 at 11:16:25 AM

Threat level: Malicious

Recommendation: Do not allow this file to be run in your network. Perform remediation on machines on which the file may have run.

Threat Assessment

Drops and runs executable file(s) in a directory of the user profile often used by malware

Drops executable file(s)

Writes to the filesystem in a directory of the user profile often used by malware

Writes to the filesystem in a directory of the user profile

Executes the Windows command shell program

Screenshots: None

File details:

Hash MD5

8ed5555a736919e1fd195f3be3d815b8

File size

224.50 KB

Hash SHA-1

35f6c01cfbf7eb5680707d0c8f39bfea80961d62

File uploaded

2014-07-04 11:16:25 AM

Hash SHA-256

e0b8d24becb65d040b9e617c31acf6926d44343807bbac2423b28beab855ba75

Report created

2014-07-04 11:17:57 AM

Technical Details

Requested HTTP URLs

The analyzed file requests the following URLs.

URL

IP Address

Category

Details

May include user agent string, HTTP server, or encryption information.

Details

Method

Status

The first item is the response type (e.g. 200, meaning OK). The second item is the size of the response.

Status

MIME

The first item is the server-declared content type. The second item is the true content type.

MIME

http://yandex.ru/

213.180.204.11

Russian Federation

Search Engines and Portals

User agent:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)

HTTP Server:

GET

302
205 B

text/html; charset=iso-8859-1

http://www.download.windowsupd
ate.com/msdownload/update/v3/s
tatic/trustedr/en/authrootseq.
txt

Information Technology

User agent:

Microsoft-CryptoAPI/5.131.2600.2180

HTTP Server:

Microsoft-IIS/7.5

GET

200
18 B

text/plain

http://www.yandex.ru/

213.180.193.3

Russian Federation

Search Engines and Portals

User agent:

Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)

HTTP Server:

nginx

GET

200
56.69 KB

text/html; charset=UTF-8

Resolved hostnames

The analyzed file used DNS to resolve the following hostnames.

Hostname

Category

IP address

yandex.ru

Search Engines and Portals

213.180.204.11

www.yandex.ru

Search Engines and Portals

213.180.193.3

www.download.windowsupdate.com

Information Technology

IP addresses

The analyzed file requests the following IP addresses.

IP Address

ASN

213.180.204.11

AS13238 Yandex LLC

Russian Federation

213.180.193.3

AS13238 Yandex LLC

Russian Federation

File system modifications

The analyzed file changes the following items in the file system. This type of change can be performed by both malicious and benign files.

Event

File path

Writes file

C:\Documents and Settings\victimo\Application Data\Miozk\alomh.exe

Writes file

C:\Documents and Settings\victimo\Application Data\Miozk\alomh.exe

Writes file

C:\Documents and Settings\victimo\Local Settings\Temp\tmp4309cd6a.bat

Process modifications

The analyzed file affected the following system processes.

Event

File path

Creates process

C:\WINDOWS\explorer.exe

Creates process

C:\WINDOWS\Temp\35f6c01cfbf7eb5680707d0c8f39bfea80961d62.exe

Creates process

C:\WINDOWS\Temp\35f6c01cfbf7eb5680707d0c8f39bfea80961d62.exe

Creates process

C:\Documents and Settings\victimo\Application Data\Miozk\alomh.exe

Creates process

C:\Documents and Settings\victimo\Application Data\Miozk\alomh.exe

Creates process

C:\WINDOWS\system32\cmd.exe

Creates process

C:\WINDOWS\system32\wbem\wmiadap.exe

Creates process

C:\WINDOWS\system32\wbem\wmiprvse.exe

Registry

The analyzed file made the following changes to the Windows Registry. Malicious files often alter the registry to ensure that the malicious software runs at system startup.

Event

Key

Value

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Data:

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Data:

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Data:

Adds/Sets value

\REGISTRY\USER\S-1-5-21-1220945662-152049171-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData

Data:

C:\Documents and Settings\victimo\Application Data

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Data:

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Data:

Adds/Sets value

\REGISTRY\USER\S-1-5-21-1220945662-152049171-1343024091-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData

Data:

C:\Documents and Settings\victimo\Application Data

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Data:

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Data:

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\RNG\Seed

Data:

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\C:\WINDOWS\system32\advapi32.dll[MofResourceName]

Data:

LowDateTime:1236297984,HighDateTime:29653446***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\C:\WINDOWS\system32\DRIVERS\ACPI.sys[ACPIMOFResource]

Data:

LowDateTime:220807424,HighDateTime:29653431***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\C:\WINDOWS\system32\DRIVERS\mssmbios.sys[MofResource]

Data:

LowDateTime:-1933636608,HighDateTime:29653447***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\C:\WINDOWS\system32\DRIVERS\pcntpci5.sys[NdisMofResource]

Data:

LowDateTime:237222144,HighDateTime:29435611***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\C:\WINDOWS\system32\DRIVERS\ipnat.sys[IPNATMofResource]

Data:

LowDateTime:-1439192576,HighDateTime:29653430***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\C:\WINDOWS\System32\Drivers\HTTP.sys[UlMofResource]

Data:

LowDateTime:75774720,HighDateTime:29653430***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Updating

Data:

WmiApRpl

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last Counter

Data:

3360

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib\Last Help

Data:

3361

Adds/Sets value

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Counter

Data:

3366

Adds/Sets value

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Last Help

Data:

3367

Adds/Sets value

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Counter

Data:

3362

Adds/Sets value

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\First Help

Data:

3363

Adds/Sets value

\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WmiApRpl\Performance\Object List

Data:

3362

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\C:\WINDOWS\system32\advapi32.dll[MofResourceName]

Data:

LowDateTime:1236297984,HighDateTime:29653446***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\C:\WINDOWS\system32\DRIVERS\ACPI.sys[ACPIMOFResource]

Data:

LowDateTime:220807424,HighDateTime:29653431***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\C:\WINDOWS\system32\DRIVERS\mssmbios.sys[MofResource]

Data:

LowDateTime:-1933636608,HighDateTime:29653447***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\C:\WINDOWS\system32\DRIVERS\ipnat.sys[IPNATMofResource]

Data:

LowDateTime:-1439192576,HighDateTime:29653430***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\C:\WINDOWS\System32\Drivers\HTTP.sys[UlMofResource]

Data:

LowDateTime:75774720,HighDateTime:29653430***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\WDM\DREDGE\C:\WINDOWS\system32\DRIVERS\pcntpci5.sys[NdisMofResource]

Data:

LowDateTime:237222144,HighDateTime:29435611***Binary mof compiled successfully

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance\Performance Refresh

Data:

0

Adds/Sets value

\REGISTRY\MACHINE\SOFTWARE\Microsoft\WBEM\PROVIDERS\Performance\Performance Refreshed

Data:

1

Global system events


No global system events were detected.

Forcepoint has made an effort to determine if your submission is malicious however, Forcepoint cannot guarantee the accuracy of the result

Copyright © 2021 Forcepoint, Inc. All rights reserved