File name:

ArmouryCrateInstaller.exe

Full analysis: https://app.any.run/tasks/e33a0e57-292b-42bf-828f-924984e9df0d
Verdict: Malicious activity
Analysis date: July 23, 2024, 20:07:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

363769A37B55839971D893CDC9E1B881

SHA1:

BEEA1942853E03A52954E599E0C57A6E2E39A264

SHA256:

04C94126555FC301587D09E83990E43092136E2EA372D33B65A1F31824CCAF75

SSDEEP:

98304:kyNUmqSyGl2BnAuSM1ytX7X7JKR7jLVW0Whm9T5etUqbBiKhOFYMLlt1DMbADJEF:O/+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ArmouryCrateInstaller.exe (PID: 5632)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ArmouryCrateInstaller.exe (PID: 5632)
      • Armoury Crate Installer.exe (PID: 5532)
      • Armoury Crate Installer.exe (PID: 4552)
      • ShellExperienceHost.exe (PID: 6888)

    • Executable content was dropped or overwritten

      • ArmouryCrateInstaller.exe (PID: 5632)

    • Reads the date of Windows installation

      • ArmouryCrateInstaller.exe (PID: 5632)

    • Executes as Windows Service

      • AsusROGLSLService.exe (PID: 1504)

  • INFO

    • Checks supported languages

      • ArmouryCrateInstaller.exe (PID: 5632)
      • AsusROGLSLService.exe (PID: 5276)
      • AsusROGLSLService.exe (PID: 4880)
      • Armoury Crate Installer.exe (PID: 5532)
      • Armoury Crate Installer.exe (PID: 4552)
      • ShellExperienceHost.exe (PID: 6888)
      • AsusROGLSLService.exe (PID: 1504)

    • Creates files in the program directory

      • ArmouryCrateInstaller.exe (PID: 5632)
      • AsusROGLSLService.exe (PID: 5276)
      • AsusROGLSLService.exe (PID: 1504)
      • Armoury Crate Installer.exe (PID: 5532)
      • Armoury Crate Installer.exe (PID: 4552)

    • Reads the computer name

      • ArmouryCrateInstaller.exe (PID: 5632)
      • AsusROGLSLService.exe (PID: 4880)
      • AsusROGLSLService.exe (PID: 1504)
      • AsusROGLSLService.exe (PID: 5276)
      • Armoury Crate Installer.exe (PID: 4552)
      • ShellExperienceHost.exe (PID: 6888)
      • Armoury Crate Installer.exe (PID: 5532)

    • Process checks computer location settings

      • ArmouryCrateInstaller.exe (PID: 5632)

    • Reads the machine GUID from the registry

      • Armoury Crate Installer.exe (PID: 4552)
      • Armoury Crate Installer.exe (PID: 5532)

    • Reads the software policy settings

      • slui.exe (PID: 1148)

    • Checks proxy server information

      • slui.exe (PID: 1148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (49.3)
.exe | Win64 Executable (generic) (32.7)
.dll | Win32 Dynamic Link Library (generic) (7.8)
.exe | Win32 Executable (generic) (5.3)
.exe | Generic Win/DOS Executable (2.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:09:12 10:55:20+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 212992
InitializedDataSize: 3700736
UninitializedDataSize: -
EntryPoint: 0x14174
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 3.2.9.1
ProductVersionNumber: 3.2.9.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral 2
CharacterSet: Unicode
CompanyName: ASUS
FileDescription: The installer for Armoury Crate and Aura Creator.
FileVersion: 3.2.9.1
LegalCopyright: Copyright (C) 2019
OriginalFileName: ArmouryCrateInstaller.exe
ProductVersion: 3.2.9.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
13
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start armourycrateinstaller.exe conhost.exe no specs asusroglslservice.exe no specs conhost.exe no specs asusroglslservice.exe no specs conhost.exe no specs asusroglslservice.exe armoury crate installer.exe no specs slui.exe no specs slui.exe armoury crate installer.exe no specs shellexperiencehost.exe no specs armourycrateinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1148C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1504"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -runserviceC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe
services.exe
User:
SYSTEM
Company:
ASUS
Integrity Level:
SYSTEM
Exit code:
0
Version:
2.3.7.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3140"C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe" C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe—explorer.exe
User:
admin
Company:
ASUS
Integrity Level:
MEDIUM
Description:
The installer for Armoury Crate and Aura Creator.
Exit code:
3221226540
Version:
3.2.9.1
Modules
Images
c:\users\admin\appdata\local\temp\armourycrateinstaller.exe
c:\windows\system32\ntdll.dll
4180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AsusROGLSLService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4552"C:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe" -roglsloaderstart -win armourycrate -networkerrorC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe—AsusROGLSLService.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Armoury Crate Installer
Exit code:
21865
Version:
2.3.9.1
Modules
Images
c:\program files (x86)\asus\asusroglslservice\armoury crate installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4880"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -installC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Exit code:
0
Version:
2.3.7.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5276"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -removeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Exit code:
0
Version:
2.3.7.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5532"C:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe" -roglsloaderstart -win armourycrate -acinstallerC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe—AsusROGLSLService.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Armoury Crate Installer
Exit code:
21859
Version:
2.3.9.1
Modules
Images
c:\program files (x86)\asus\asusroglslservice\armoury crate installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5632"C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe" C:\Users\admin\AppData\Local\Temp\ArmouryCrateInstaller.exe
explorer.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Description:
The installer for Armoury Crate and Aura Creator.
Exit code:
0
Version:
3.2.9.1
Modules
Images
c:\users\admin\appdata\local\temp\armourycrateinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
6 248
Read events
6 228
Write events
18
Delete events
2

Modification events

(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:ACInstallPath
Value:
C:\Users\admin\AppData\Local\Temp
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallFinish
Value:
0
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:aaiu
Value:
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:InstallerSilentMode
Value:
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5632) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4880) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:aaiu
Value:
0
(PID) Process:(5532) Armoury Crate Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Left
Value:
0
Executable files
9
Suspicious files
0
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exeexecutable
MD5:797E279A74176D8A373BAE3A0829D76A
SHA256:23D5B8380A3B8F2A2740E5E8415DEFD90BC6D94CACB0E1B8B5FCC5DD0467E9A2
5276AsusROGLSLService.exeC:\ProgramData\ASUS\ALL\ACLoader\ArmouryCrateInstaller.logtext
MD5:23E856BCCCDF8CB4EC4085DDAA1B93E3
SHA256:C8B929D7845F8957818B99814ECD0F262BBB8EE09883399CA25C895BFE37699C
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exeexecutable
MD5:9131A40E5770D1170C3093FB0D2F6F63
SHA256:FCF8D154E6B37985434F991B048CEF457DE123DD5A553EF3C6B28A67FB8A3987
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.dllexecutable
MD5:964068210EDCB3631F02E45856EB291E
SHA256:4CF079D4D7A154CD93F65934B5D115F07AF8F25EE24930E6CC606DFB0AEA2A4E
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\QueryUWP.exeexecutable
MD5:040D1F9B8554F4452473F655C0898A12
SHA256:E96FC05448DEE664BD0CC011E983E98ECF7AB2904AAB25BE401B1EE994141EF9
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusGCGridServiceSetup.exeexecutable
MD5:242C0332DB5EBA361CC3628DFAB5CE56
SHA256:BCC843B036C22AD4A1485E62C2ED5CA88F33688FA919C73276B93D4CDBE83347
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exeexecutable
MD5:86E566859931EB59E740ACD08F9747C8
SHA256:D3F85929507CB5B8D38B90BE7A49DCE0266071DCECAD11619674152B0AEDE293
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\Newtonsoft.Json.dllexecutable
MD5:081D9558BBB7ADCE142DA153B2D5577A
SHA256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
5276AsusROGLSLService.exeC:\ProgramData\ASUS\ALL\ACLoader\AsusROGLSLService.logtext
MD5:DC7A87483870EB6EFB7DBE6CE61C9BBF
SHA256:C918FE217F8B637E9E6F25F1FB20B45141E977F513F30D7032A8B6F12EF7D94A
5632ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\CheckTool.exeexecutable
MD5:4DE8BCB0A697A225D0DA5A4FD2983FA0
SHA256:E90BE681ECFA7E0B2E546C973B73805A1DCE909DC66B47C822EAE5FE52BB75DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
39
DNS requests
16
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1256
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6012
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3204
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4204
svchost.exe
4.209.32.198:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4424
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1148
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5368
SearchApp.exe
92.123.104.47:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.142
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
www.bing.com
  • 92.123.104.47
  • 92.123.104.30
  • 92.123.104.18
  • 92.123.104.65
  • 92.123.104.52
  • 92.123.104.61
  • 92.123.104.21
  • 92.123.104.59
  • 92.123.104.43
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.0
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.75
  • 20.190.159.71
  • 40.126.31.71
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted

Threats

No threats detected
Process
Message
AsusROGLSLService.exe
Failed to get baseboard manufacturer via WMI, get via registry.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArmouryCrateInstaller.exe