Analyzing...

File Name: mcrmainsite.exe

SHA1: 47f7cc6926f691d9545a700d0a8ef458f0c58f14

MD5: 0d391ce055fd84c2c29ef5d6129d1981

First Seen Date: 2017-06-19 00:10:16.447649 ( 2017-06-19 00:10:16.447649 )

Number of Clients Seen: 6

Last Analysis Date: 2017-06-19 00:10:16.447649 ( 2017-06-19 00:10:16.447649 )

Human Expert Analysis Result: No human expert analysis verdict given to this sample yet.

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2018-11-05 20:27:26.895105	Malware
Static Analysis Overall Verdict	2017-06-19 00:10:16.447649	No Threat Found
Dynamic Analysis Overall Verdict	2017-06-19 00:10:16.447649	No Threat Found
Precise Detectors Overall Verdict	2017-06-19 00:10:16.447649	No Match

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Clean
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Suspicious
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Dynamic Analysis

Dynamic Analysis Overall Verdict	Result
No Threat Found

Suspicious Behaviors
Creates a child process
Writes to address space of another process
Uses a function clandestinely
Reads memory of another process
Opens a file in a system directory

Behavioral Information

SetFilePointer

{"lDistanceToMove": "fffffc00", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "0", "hFile": "28c"}

{"lDistanceToMove": "fffffc00", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "0", "hFile": "178"}

{"lDistanceToMove": "fffffc00", "dwMoveMethod": "2", "lpDistanceToMoveHigh": "0", "hFile": "288"}

QueryFilePath

C:\Users\win7\AppData\Local\Temp\is-962D4.tmp\mcrmainsite.tmp

C:\Windows\SysWOW64\taskkill.exe

C:\Windows\SysWOW64\ieframe.dll

C:\Windows\system32\PROPSYS.dll

C:\Windows\syswow64\MSCTF.dll

ReadRegisteryKey

ProcessID

EnablePrivateObjectHeap

Plane4

Plane5

Plane6

Plane7

Plane1

Plane2

Plane3

Plane8

ObjectLimit

WaitToKillServiceTimeout

RegisteredOrganization

Plane9

Disable

IdentifierLimit

FrameTabWindow

DataFilePath

SystemSetupInProgress

ContextLimit

EnablePunycode

DisableSecuritySettingsCheck

Plane16

Plane14

Plane15

Plane12

Plane13

Plane10

Plane11

RegisteredOwner

TabProcGrowth

FrameMerging

CreateUriCacheSize

SpecialFoldersCacheSize

SessionMerging

AdminTabProcs

RegSetValue

{"Reserved": "0", "hKey": "160", "lpData": "3367d8", "dwType": "3", "lpValueName": "SessionHash", "cbData": "20"}

{"Reserved": "0", "hKey": "160", "lpData": "336f90", "dwType": "3", "lpValueName": "Owner", "cbData": "c"}

{"Reserved": "0", "hKey": "15c", "lpData": "18fdcc", "dwType": "4", "lpValueName": "Sequence", "cbData": "4"}

{"h_key": "80000001", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "18fd70", "dwOptions": "1", "lpClass": "<NULL>", "phkResult": "18fd84", "lpSubKey": "Software\\Microsoft\\RestartManager\\Session0000"}

{"h_key": "80000001", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "18fda0", "dwOptions": "1", "lpClass": "<NULL>", "phkResult": "18fda4", "lpSubKey": "Software\\Microsoft\\RestartManager\\Session0000"}

{"h_key": "80000001", "samDesired": "2001f", "Reserved": "0", "lpSecurityAttributes": "0", "lpdwDisposition": "18fd90", "dwOptions": "1", "lpClass": "<NULL>", "phkResult": "18fd94", "lpSubKey": "Software\\Microsoft\\RestartManager\\Session0000"}

CreateFile

{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\is-1JE06.tmp\\_isetup\\_iscrypt.dll", "dwDesiredAccess": "c0000000", "dwShareMode": "0"}

{"dwCreationDisposition": "3", "path": "\\??\\C:\\Windows\\SysWOW64\\ieframe.dll", "dwDesiredAccess": "80", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\System32\\taskkill.exe", "dwDesiredAccess": "20000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\system32\\rsaenh.dll", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000008.db", "dwDesiredAccess": "80000000", "dwShareMode": "1"}

{"dwCreationDisposition": "3", "path": "C:\\Users\\win7\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db", "dwDesiredAccess": "80000000", "dwShareMode": "3"}

{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\is-1JE06.tmp\\_isetup\\_shfoldr.dll", "dwDesiredAccess": "c0000000", "dwShareMode": "0"}

{"dwCreationDisposition": "3", "path": "C:\\Windows", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\System32\\schtasks.exe", "dwDesiredAccess": "20000", "dwShareMode": "3"}

{"dwCreationDisposition": "3", "path": "C:\\", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "2", "path": "C:\\Users\\win7\\AppData\\Local\\Temp\\is-1JE06.tmp\\_isetup\\_setup64.tmp", "dwDesiredAccess": "c0000000", "dwShareMode": "0"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\System32", "dwDesiredAccess": "100081", "dwShareMode": "7"}

{"dwCreationDisposition": "3", "path": "C:\\Windows\\Fonts\\staticcache.dat", "dwDesiredAccess": "80000000", "dwShareMode": "5"}

OpenRegisteryKey

{"hKey": "284", "phkResult": "0", "lpSubKey": "MS Sans Serif"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\RestartManager"}

{"hKey": "1a0", "phkResult": "0", "lpSubKey": "FEATURE_PROTOCOL_LOCKDOWN"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\FA2268FD-F787-4DD3-B6F1-CA4F706F481E_is1"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\CurrentControlSet\\Control"}

{"hKey": "1a0", "phkResult": "0", "lpSubKey": "FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"}

{"hKey": "1a0", "phkResult": "0", "lpSubKey": "FEATURE_ALLOW_REVERSE_SOLIDUS_IN_USERINFO_KB932562"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\FA2268FD-F787-4DD3-B6F1-CA4F706F481E_is1"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"}

{"hKey": "1a0", "phkResult": "0", "lpSubKey": "FEATURE_INITIALIZE_URLACTION_SHELLEXECUTE_TO_ALLOW_KB936610"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"}

{"hKey": "244", "phkResult": "0", "lpSubKey": "Microsoft\\Internet Explorer\\Security"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "284", "phkResult": "0", "lpSubKey": "Verdana"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "System\\Setup"}

{"hKey": "1a0", "phkResult": "0", "lpSubKey": "FEATURE_ZONES_CHECK_ZONEMAP_POLICY_KB941001"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\WBEM\\CIMOM"}

{"hKey": "284", "phkResult": "0", "lpSubKey": "Tahoma"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Policies"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\KindMap"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Internet Explorer\\Main\\FeatureControl"}

{"hKey": "240", "phkResult": "0", "lpSubKey": "Microsoft\\Internet Explorer\\Security"}

{"hKey": "1a0", "phkResult": "0", "lpSubKey": "FEATURE_LOCALMACHINE_LOCKDOWN"}

{"hKey": "80000002", "phkResult": "0", "lpSubKey": "Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings"}

{"hKey": "80000001", "phkResult": "0", "lpSubKey": "Software\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap"}

{"hKey": "1a0", "phkResult": "0", "lpSubKey": "FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000"}

{"hKey": "2a0", "phkResult": "0", "lpSubKey": "Arial"}

CreateMutex

<NULL>

Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511

Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000

Local\ZonesCacheCounterMutex

Local\ZonesLockedCacheCounterMutex

OpenMutex

DefaultTabtip-MainUI

WriteFile

{"nNumberOfBytesToWrite": "5b10", "lpOverlapped": "0", "lpBuffer": "54bf10", "lpNumberOfBytesWritten": "18fd6c", "hFile": "12c"}

{"nNumberOfBytesToWrite": "1800", "lpOverlapped": "0", "lpBuffer": "54a060", "lpNumberOfBytesWritten": "18fd5c", "hFile": "12c"}

{"nNumberOfBytesToWrite": "a00", "lpOverlapped": "0", "lpBuffer": "674df80", "lpNumberOfBytesWritten": "18fd98", "hFile": "12c"}

CreateProcess

"C:\Windows\System32\schtasks.exe" /delete /tn "Malware Crusher_launcher" /f

"C:\Windows\System32\taskkill.exe" /f /im "MalwareCrusher.exe"

LoadLibrary

API-MS-Win-Security-LSALookup-L1-1-0.dll

API-MS-Win-Core-LocalRegistry-L1-1-0.dll

C:\Windows\system32\Winsta.dll

C:\Windows\SysWOW64\taskkill.exe

ADVAPI32.dll

CRYPTBASE.dll

OLEAUT32.dll

ole32.dll

comctl32.dll

C:\Users\win7\AppData\Local\Temp\is-1JE06.tmp\_isetup\_shfoldr.dll

shfolder.dll

shell32.dll

C:\Users\win7\AppData\Local\Temp\is-1JE06.tmp\_isetup\_iscrypt.dll

Rstrtmgr.dll

C:\Windows\SysWOW64\bcryptprimitives.dll

kernel32.dll

propsys.dll

C:\Windows\SysWOW64\ieframe.dll

SHELL32.dll

ntmarta.dll

Secur32.dll

API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL

OLEAUT32.DLL

uxtheme.dll

UxTheme.dll

IMM32.dll

C:\Windows\system32\imageres.dll

C:\Windows\system32\shell32.dll

C:\Windows\system32\shlwapi.dll

DeleteFile

C:\Windows\Fonts\IconCrusher.ttf

C:\Windows\Fonts\MCPro.ttf

Precise Detectors Analysis Results

Detector Name	Date	Verdict	Reason
Uninstaller FP Detector	2017-06-19 00:09:51.779581	No Match	No match.
Yara Rule Static Malware Detector	2017-06-19 00:09:51.883076	No Match	No match.
Static Precise PUA Detector 1	2017-06-19 00:09:51.782439	No Match	NotDetected
Static Precise Virus Detector	2017-06-19 00:09:51.783175	No Match	NotDetected
Static Precise Trojan Detector	2017-06-19 00:09:51.814258	No Match	NotDetected
Static Precise PUA Detector 2	2017-06-19 00:09:51.816624	No Match	No match.
Static Precise PUA Detector 3	2017-06-19 00:09:51.812087	No Match	No match.
Static Precise Virus Detector 2	2017-06-19 00:09:51.816714	No Match	No match.
Static Precise Trojan Detector 2	2017-06-19 00:09:51.815325	No Match	No match.
Static Precise Trojan Detector 3	2017-06-19 00:09:51.815031	No Match	No match.
Malicious Url Detector	2017-06-19 00:10:16.374325	No Match	No match.

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Property	Value

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5