analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://120.192.64.13/cdn/pcfile/20181106/17/24/IQIYIUpSetup_4_11.exe

Full analysis: https://app.any.run/tasks/9566e1da-df15-4840-ad43-c5b677446828
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 19, 2019, 09:34:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

62356762FE56B04481F17F76737CF003

SHA1:

777F8ECB41724519E69F1ED8A754BB99E2CFCA42

SHA256:

039263BCDFFFF2E10EC9DFA09AAE5FB6DF0EA79E8642CB30F4C1E5F732878DBD

SSDEEP:

3:N1KvhXyWLKV8K5M3kAQMn:CdimzJ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • IQIYIUpSetup_4_11.exe (PID: 1244)
      • IQIYIUpSetup_4_11.exe (PID: 2124)
      • QiyiUpdate.exe (PID: 3856)
      • QYUploader.exe (PID: 1204)
      • QYUploader.exe (PID: 284)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 2140)

    • Downloads executable files from IP

      • chrome.exe (PID: 2140)

    • Adds new firewall rule via NETSH.EXE

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Loads the Task Scheduler COM API

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Loads dropped or rewritten executable

      • QYUploader.exe (PID: 1204)
      • QYUploader.exe (PID: 284)
      • QiyiUpdate.exe (PID: 3856)

    • Changes settings of System certificates

      • dxdiag.exe (PID: 2820)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2140)
      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Creates files in the user directory

      • IQIYIUpSetup_4_11.exe (PID: 2124)
      • QYUploader.exe (PID: 284)
      • QYUploader.exe (PID: 1204)

    • Creates a software uninstall entry

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Uses NETSH.EXE for network configuration

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Creates files in the program directory

      • QYUploader.exe (PID: 284)
      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Creates COM task schedule object

      • dxdiag.exe (PID: 2820)

    • Changes IE settings (feature browser emulation)

      • IQIYIUpSetup_4_11.exe (PID: 2124)

    • Executed via Task Scheduler

      • QYUploader.exe (PID: 284)

    • Adds / modifies Windows certificates

      • dxdiag.exe (PID: 2820)

    • Creates files in the Windows directory

      • dxdiag.exe (PID: 2820)

    • Reads Internet Cache Settings

      • QYUploader.exe (PID: 1204)

  • INFO

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2140)

    • Application launched itself

      • chrome.exe (PID: 2140)

    • Application was crashed

      • QiyiUpdate.exe (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
16
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs iqiyiupsetup_4_11.exe no specs iqiyiupsetup_4_11.exe netsh.exe no specs dxdiag.exe qyuploader.exe qiyiupdate.exe qyuploader.exe chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2140"C:\Program Files\Google\Chrome\Application\chrome.exe" http://120.192.64.13/cdn/pcfile/20181106/17/24/IQIYIUpSetup_4_11.exeC:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
3548"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6f5e0f18,0x6f5e0f28,0x6f5e0f34C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
3660"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3116 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
1132"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15920027177994419801 --mojo-platform-channel-handle=972 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
73.0.3683.75
2052"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --service-pipe-token=9769889835570430814 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=9769889835570430814 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1900 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
73.0.3683.75
2188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --service-pipe-token=15224294843315945074 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=15224294843315945074 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2024 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
73.0.3683.75
392"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --service-pipe-token=18005679549821982615 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18005679549821982615 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
2384"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=940,10475201787745855185,11569598025373852412,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=2948966507321790421 --mojo-platform-channel-handle=3720 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
1244"C:\Users\admin\Downloads\IQIYIUpSetup_4_11.exe" C:\Users\admin\Downloads\IQIYIUpSetup_4_11.exe—chrome.exe
User:
admin
Company:
爱奇艺
Integrity Level:
MEDIUM
Description:
爱奇艺视频助手
Exit code:
3221226540
Version:
7.6.0.12
2124"C:\Users\admin\Downloads\IQIYIUpSetup_4_11.exe" C:\Users\admin\Downloads\IQIYIUpSetup_4_11.exe
chrome.exe
User:
admin
Company:
爱奇艺
Integrity Level:
HIGH
Description:
爱奇艺视频助手
Exit code:
0
Version:
7.6.0.12
Total events
1 921
Read events
1 536
Write events
0
Delete events
0

Modification events

No data
Executable files
102
Suspicious files
94
Text files
496
Unknown types
4

Dropped files

PID
Process
Filename
Type
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\be0bf042-d975-4941-bb34-ccf25ace48be.tmp —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0 —
MD5:—
SHA256:—
2140chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
18
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1204
QYUploader.exe
GET
200
36.110.220.15:80
http://msg.qy.net/v5/pcclient/cid_recal?&p1=201_11_114&os=6.1&rn=1560936957&mv=&reason=4&cid=kjkaasqev4hcunfcsmvbdwkglhnzyk4m&cid_old=&mac=5254004a04af&lhdd=C4BA-3647&hdd=
CN
—
—
suspicious
1204
QYUploader.exe
GET
200
36.110.220.15:80
http://msg.qy.net/b?aduid=14f4c950464c4da58518356731b67012&c1=0&channelid=411&ctm=1214562&e=1214562&macid=kjkaasqev4hcunfcsmvbdwkglhnzyk4m&nu=&p=11&p1=116&pf=1&pu=&r=1&result=ok&rn=00000001560936960&s1=1&se=1211875&starttype=0&t=3&td=437&u=471b19fe0d764980803c162a70fd6219&v=7.6.0.12
CN
—
—
suspicious
1204
QYUploader.exe
GET
200
36.110.220.15:80
http://msg.qy.net/v5/pcclient/cid_recal?&p1=201_11_114&os=6.1&rn=1560936958&mv=&reason=4&cid=kjkaasqev4hcunfcsmvbdwkglhnzyk4m&cid_old=&mac=5254004a04af&lhdd=C4BA-3647&hdd=
CN
—
—
suspicious
2124
IQIYIUpSetup_4_11.exe
GET
200
36.110.220.15:80
http://msg.qy.net/b?t=6&pf=1&p=11&p1=116&c1=0&result=ok&s1=1&channelid=411&u=471b19fe0d764980803c162a70fd6219&v=7.6.0.12&rn=00000001560936971&e=471b19fe0d764980803c162a70fd6219&r=0&installtype=1&se=&pProcess=chrome.exe&attach=&value=
CN
—
—
suspicious
1204
QYUploader.exe
GET
200
36.110.209.200:80
http://dl.static.iqiyi.com/product/QYUploader/upload_config.json
CN
text
61 b
suspicious
2140
chrome.exe
GET
200
120.192.64.13:80
http://120.192.64.13/cdn/pcfile/20181106/17/24/IQIYIUpSetup_4_11.exe
CN
executable
22.8 Mb
suspicious
3856
QiyiUpdate.exe
GET
200
36.110.209.200:80
http://dl.static.iqiyi.com/product/QYUploader/update.ini
CN
text
244 b
suspicious
1204
QYUploader.exe
GET
—
104.108.67.239:80
http://static.iqiyi.com/ext/common/qisu2/Browser.xml
NL
—
—
suspicious
2820
dxdiag.exe
GET
200
205.185.216.42:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
56.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2140
chrome.exe
216.58.205.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2140
chrome.exe
172.217.22.35:443
ssl.gstatic.com
Google Inc.
US
whitelisted
1204
QYUploader.exe
36.110.220.15:80
msg.qy.net
IDC, China Telecommunications Corporation
CN
malicious
2140
chrome.exe
172.217.22.77:443
accounts.google.com
Google Inc.
US
whitelisted
2140
chrome.exe
172.217.18.110:443
sb-ssl.google.com
Google Inc.
US
whitelisted
2140
chrome.exe
120.192.64.13:80
—
Shandong Mobile Communication Company Limited
CN
suspicious
2140
chrome.exe
172.217.16.164:443
www.google.com
Google Inc.
US
whitelisted
1204
QYUploader.exe
36.110.209.200:80
dl.static.iqiyi.com
IDC, China Telecommunications Corporation
CN
suspicious
2124
IQIYIUpSetup_4_11.exe
36.110.220.15:80
msg.qy.net
IDC, China Telecommunications Corporation
CN
malicious
3856
QiyiUpdate.exe
36.110.209.200:80
dl.static.iqiyi.com
IDC, China Telecommunications Corporation
CN
suspicious

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 216.58.205.227
whitelisted
accounts.google.com
  • 172.217.22.77
shared
www.google.com
  • 172.217.16.164
whitelisted
ssl.gstatic.com
  • 172.217.22.35
whitelisted
sb-ssl.google.com
  • 172.217.18.110
whitelisted
msg.qy.net
  • 36.110.220.15
  • 106.38.219.49
suspicious
dl.static.iqiyi.com
  • 36.110.209.200
  • 36.110.209.201
unknown
iplocation.geo.qiyi.com
  • —
suspicious
openapi.iqiyi.com
  • 123.125.111.69
unknown
cook.iqiyi.com
  • 118.26.32.10
unknown

Threats

PID
Process
Class
Message
2140
chrome.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2140
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2140
chrome.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
1204
QYUploader.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HttpDownload)
1204
QYUploader.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HttpDownload)
Process
Message
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Installer.cpp(110)] =begin extract config files...
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:utils.cpp(38)] extracting resource[CONFIG:801] to string
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:utils.cpp(60)] extracting resource[ZIPRES:802] to file: C:\Users\admin\AppData\Roaming\IQIYI Video\QYInstaller\skin.zip
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Command.cpp(606)] ReadReg(Software\Microsoft\Windows\CurrentVersion\App Paths\QYUploader.exe, Path), returns:
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootDesktopCurUser) returns: C:\Users\admin\Desktop
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootDesktopCommon) returns: C:\Users\Public\Desktop
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootProgramsCurUser) returns: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootProgramsCommon) returns: C:\ProgramData\Microsoft\Windows\Start Menu\Programs
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(rootAppData) returns: C:\Users\admin\AppData\Roaming
IQIYIUpSetup_4_11.exe
[0619/103547:INFO:Extension.cpp(61)] GetVar(appName) returns: QYUploader
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://120.192.64.13/cdn/pcfile/20181106/17/24/IQIYIUpSetup_4_11.exe