File name:

4ukey-for-android.exe

Full analysis: https://app.any.run/tasks/c7874b5c-a551-4a4a-b139-8558fe3d8b9a
Verdict: Malicious activity
Analysis date: November 20, 2023, 00:03:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

B6C90C8BBC6AA77835B06F8489EE9EDE

SHA1:

6584BBC2EC709B3DC76367C7FC4EBFEDDFB985C5

SHA256:

08FCACBD30E1CB292B263FD4DBCE2237E6B4850EE37CA4FC85825F1BE183FCE0

SSDEEP:

98304:OXuHPx1C6PGczmSLf1zrBKzYMjZtNWBrgNFd1Lr6lsWX942ggqufVz+OZ1n59t2c:2y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 4ukeyforandroid_ts_2.10.0.exe (PID: 1360)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Connects to the CnC server

      • 4ukey-for-android.exe (PID: 3472)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • 4ukey-for-android.exe (PID: 3472)

    • Reads security settings of Internet Explorer

      • 4ukey-for-android.exe (PID: 3472)

    • Reads the Internet Settings

      • 4ukey-for-android.exe (PID: 3472)

    • Checks Windows Trust Settings

      • 4ukey-for-android.exe (PID: 3472)

    • Reads the Windows owner or organization settings

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Process drops legitimate windows executable

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Drops a system driver (possible attempt to evade defenses)

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Drops 7-zip archiver for unpacking

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • The process drops C-runtime libraries

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Checks for external IP

      • 4ukey-for-android.exe (PID: 3472)

  • INFO

    • Reads Environment values

      • 4ukey-for-android.exe (PID: 3472)

    • Checks proxy server information

      • 4ukey-for-android.exe (PID: 3472)

    • Reads the computer name

      • 4ukey-for-android.exe (PID: 3472)
      • wmpnscfg.exe (PID: 3876)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Checks supported languages

      • 4ukey-for-android.exe (PID: 3472)
      • wmpnscfg.exe (PID: 3876)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)
      • 4ukeyforandroid_ts_2.10.0.exe (PID: 1360)

    • Reads the machine GUID from the registry

      • 4ukey-for-android.exe (PID: 3472)
      • wmpnscfg.exe (PID: 3876)

    • Creates files or folders in the user directory

      • 4ukey-for-android.exe (PID: 3472)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3876)

    • Create files in a temporary directory

      • 4ukey-for-android.exe (PID: 3472)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)
      • 4ukeyforandroid_ts_2.10.0.exe (PID: 1360)

    • Creates files in the program directory

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)
      • 4ukey-for-android.exe (PID: 3472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:11 08:34:05+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 1736704
InitializedDataSize: 208896
UninitializedDataSize: 2158592
EntryPoint: 0x3b7c20
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.7.11.0
ProductVersionNumber: 2.7.11.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Tenorshare Co., Ltd.
FileDescription: 4uKey for Android
FileVersion: 2.7.11.0
LegalCopyright: Copyright © 2007-2023 Tenorshare
ProductName: 20230711143339
ProductVersion: 2.7.11.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 4ukey-for-android.exe wmpnscfg.exe no specs 4ukeyforandroid_ts_2.10.0.exe no specs 4ukeyforandroid_ts_2.10.0.tmp no specs 4ukey-for-android.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1356"C:\Users\admin\AppData\Local\Temp\is-QCDM1.tmp\4ukeyforandroid_ts_2.10.0.tmp" /SL5="$70180,102589273,318464,C:\Users\admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe" /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files\Tenorshare\4uKey for Android\" /LANG=en /LOG="C:\Users\admin\AppData\Local\Temp\4uKey for Android_Setup_20231120000434.log" /sptrack nullC:\Users\admin\AppData\Local\Temp\is-QCDM1.tmp\4ukeyforandroid_ts_2.10.0.tmp—4ukeyforandroid_ts_2.10.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qcdm1.tmp\4ukeyforandroid_ts_2.10.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1360 /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files\Tenorshare\4uKey for Android\" /LANG=en /LOG="C:\Users\admin\AppData\Local\Temp\4uKey for Android_Setup_20231120000434.log" /sptrack nullC:\Users\admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe—4ukey-for-android.exe
User:
admin
Company:
Tenorshare
Integrity Level:
HIGH
Description:
4uKey for Android Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3416"C:\Users\admin\Desktop\4ukey-for-android.exe" C:\Users\admin\Desktop\4ukey-for-android.exe—explorer.exe
User:
admin
Company:
Tenorshare Co., Ltd.
Integrity Level:
MEDIUM
Description:
4uKey for Android
Exit code:
3221226540
Version:
2.7.11.0
Modules
Images
c:\users\admin\desktop\4ukey-for-android.exe
c:\windows\system32\ntdll.dll
3472"C:\Users\admin\Desktop\4ukey-for-android.exe" C:\Users\admin\Desktop\4ukey-for-android.exe
explorer.exe
User:
admin
Company:
Tenorshare Co., Ltd.
Integrity Level:
HIGH
Description:
4uKey for Android
Exit code:
0
Version:
2.7.11.0
Modules
Images
c:\users\admin\desktop\4ukey-for-android.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3876"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
5 750
Read events
5 723
Write events
24
Delete events
3

Modification events

(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3876) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{ED122579-7792-447F-AC0E-0D6ECEC161EB}\{2F6663E4-F6A7-42E2-A9CB-E0870C8E0DA3}
Operation:delete keyName:(default)
Value:
Executable files
591
Suspicious files
1 232
Text files
84
Unknown types
0

Dropped files

PID
Process
Filename
Type
34724ukey-for-android.exeC:\Users\admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe —
MD5:—
SHA256:—
13564ukeyforandroid_ts_2.10.0.tmpC:\Program Files\Tenorshare\4uKey for Android\is-7SQPC.tmpexecutable
MD5:753916B01891B0DD3C98E6BFB4335576
SHA256:5F3A603A4AE1CD947BFC98793FE7D4B1A7ECBB37F80833AB819546D389143FF1
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95binary
MD5:F0500309D1330D905326EFD1B6131A87
SHA256:90D9C0ADE839ADC09E54B79E752392D384B189B1E08A106936A862F5C6B8E759
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:6DD9AE59AA138101383801F58D4ED0BB
SHA256:346EEB53E17C990267C6D0759F01B13C261C9D7C99E1AA514B1256DA34946F2E
13604ukeyforandroid_ts_2.10.0.exeC:\Users\admin\AppData\Local\Temp\is-QCDM1.tmp\4ukeyforandroid_ts_2.10.0.tmpexecutable
MD5:053537FF877BB8441A19F26AA96A4830
SHA256:2CB4E84A399B141CDCC3EF818399CD9EEFBD5C9DA620016386670CBE70C985DF
13564ukeyforandroid_ts_2.10.0.tmpC:\Program Files\Tenorshare\4uKey for Android\is-V9TIJ.tmpexecutable
MD5:053537FF877BB8441A19F26AA96A4830
SHA256:2CB4E84A399B141CDCC3EF818399CD9EEFBD5C9DA620016386670CBE70C985DF
13564ukeyforandroid_ts_2.10.0.tmpC:\Program Files\Tenorshare\4uKey for Android\is-CKSLK.tmpxml
MD5:4A73ACE0EB8089AC390DFD9F15244CE7
SHA256:60C84C835694CA792BD94115998EFFA536AB044CCF0EBE3240EBFAFF8F648593
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:8BDF688D086625784302F809CE52150D
SHA256:328EA38F5CBF00CC4F13E6421068011079538A41FC48B454E41BE7D2DDD92FF4
13564ukeyforandroid_ts_2.10.0.tmpC:\Program Files\Tenorshare\4uKey for Android\4uKeyForAndroid.exe.configxml
MD5:4A73ACE0EB8089AC390DFD9F15244CE7
SHA256:60C84C835694CA792BD94115998EFFA536AB044CCF0EBE3240EBFAFF8F648593
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95binary
MD5:5BBB674CB0D8565B838E45958264A28B
SHA256:A3CFD01B827A24306222C4D1B0A6BAF24321B7E3E170ED74438A6822A290D923
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
112
DNS requests
7
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3472
4ukey-for-android.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
binary
471 b
unknown
3472
4ukey-for-android.exe
GET
301
104.18.24.249:80
http://www.tenorshare.com/downloads/service/softwarelog.txt
unknown
html
245 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
text
152 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3472
4ukey-for-android.exe
104.18.24.249:80
www.tenorshare.com
CLOUDFLARENET
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3472
4ukey-for-android.exe
104.18.24.249:443
www.tenorshare.com
CLOUDFLARENET
—
unknown
3472
4ukey-for-android.exe
95.101.54.105:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3472
4ukey-for-android.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3472
4ukey-for-android.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
3472
4ukey-for-android.exe
142.250.186.142:443
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
whitelisted
ctldl.windowsupdate.com
  • 95.101.54.105
  • 95.101.54.113
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
update.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
unknown
ip-api.com
  • 208.95.112.1
shared
www.google-analytics.com
  • 142.250.186.142
whitelisted
download.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
unknown

Threats

PID
Process
Class
Message
3472
4ukey-for-android.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3472
4ukey-for-android.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3472
4ukey-for-android.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
3472
4ukey-for-android.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3472
4ukey-for-android.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Tensorshare Google Analytics Checkin
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4ukey-for-android.exe