File name:

4ukey-for-android.exe

Full analysis: https://app.any.run/tasks/c7874b5c-a551-4a4a-b139-8558fe3d8b9a
Verdict: Malicious activity
Analysis date: November 20, 2023, 00:03:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

B6C90C8BBC6AA77835B06F8489EE9EDE

SHA1:

6584BBC2EC709B3DC76367C7FC4EBFEDDFB985C5

SHA256:

08FCACBD30E1CB292B263FD4DBCE2237E6B4850EE37CA4FC85825F1BE183FCE0

SSDEEP:

98304:OXuHPx1C6PGczmSLf1zrBKzYMjZtNWBrgNFd1Lr6lsWX942ggqufVz+OZ1n59t2c:2y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • 4ukey-for-android.exe (PID: 3472)

    • Drops the executable file immediately after the start

      • 4ukeyforandroid_ts_2.10.0.exe (PID: 1360)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 4ukey-for-android.exe (PID: 3472)

    • Reads security settings of Internet Explorer

      • 4ukey-for-android.exe (PID: 3472)

    • Reads settings of System Certificates

      • 4ukey-for-android.exe (PID: 3472)

    • Checks Windows Trust Settings

      • 4ukey-for-android.exe (PID: 3472)

    • Checks for external IP

      • 4ukey-for-android.exe (PID: 3472)

    • Drops 7-zip archiver for unpacking

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Drops a system driver (possible attempt to evade defenses)

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Reads the Windows owner or organization settings

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Process drops legitimate windows executable

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • The process drops C-runtime libraries

      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

  • INFO

    • Checks supported languages

      • 4ukey-for-android.exe (PID: 3472)
      • wmpnscfg.exe (PID: 3876)
      • 4ukeyforandroid_ts_2.10.0.exe (PID: 1360)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Reads the computer name

      • 4ukey-for-android.exe (PID: 3472)
      • wmpnscfg.exe (PID: 3876)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Checks proxy server information

      • 4ukey-for-android.exe (PID: 3472)

    • Reads Environment values

      • 4ukey-for-android.exe (PID: 3472)

    • Reads the machine GUID from the registry

      • 4ukey-for-android.exe (PID: 3472)
      • wmpnscfg.exe (PID: 3876)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3876)

    • Creates files or folders in the user directory

      • 4ukey-for-android.exe (PID: 3472)

    • Create files in a temporary directory

      • 4ukey-for-android.exe (PID: 3472)
      • 4ukeyforandroid_ts_2.10.0.exe (PID: 1360)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)

    • Creates files in the program directory

      • 4ukey-for-android.exe (PID: 3472)
      • 4ukeyforandroid_ts_2.10.0.tmp (PID: 1356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:11 08:34:05+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 1736704
InitializedDataSize: 208896
UninitializedDataSize: 2158592
EntryPoint: 0x3b7c20
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.7.11.0
ProductVersionNumber: 2.7.11.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Tenorshare Co., Ltd.
FileDescription: 4uKey for Android
FileVersion: 2.7.11.0
LegalCopyright: Copyright © 2007-2023 Tenorshare
ProductName: 20230711143339
ProductVersion: 2.7.11.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 4ukey-for-android.exe wmpnscfg.exe no specs 4ukeyforandroid_ts_2.10.0.exe no specs 4ukeyforandroid_ts_2.10.0.tmp no specs 4ukey-for-android.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1356"C:\Users\admin\AppData\Local\Temp\is-QCDM1.tmp\4ukeyforandroid_ts_2.10.0.tmp" /SL5="$70180,102589273,318464,C:\Users\admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe" /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files\Tenorshare\4uKey for Android\" /LANG=en /LOG="C:\Users\admin\AppData\Local\Temp\4uKey for Android_Setup_20231120000434.log" /sptrack nullC:\Users\admin\AppData\Local\Temp\is-QCDM1.tmp\4ukeyforandroid_ts_2.10.0.tmp—4ukeyforandroid_ts_2.10.0.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qcdm1.tmp\4ukeyforandroid_ts_2.10.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1360 /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files\Tenorshare\4uKey for Android\" /LANG=en /LOG="C:\Users\admin\AppData\Local\Temp\4uKey for Android_Setup_20231120000434.log" /sptrack nullC:\Users\admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe—4ukey-for-android.exe
User:
admin
Company:
Tenorshare
Integrity Level:
HIGH
Description:
4uKey for Android Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3416"C:\Users\admin\Desktop\4ukey-for-android.exe" C:\Users\admin\Desktop\4ukey-for-android.exe—explorer.exe
User:
admin
Company:
Tenorshare Co., Ltd.
Integrity Level:
MEDIUM
Description:
4uKey for Android
Exit code:
3221226540
Version:
2.7.11.0
Modules
Images
c:\users\admin\desktop\4ukey-for-android.exe
c:\windows\system32\ntdll.dll
3472"C:\Users\admin\Desktop\4ukey-for-android.exe" C:\Users\admin\Desktop\4ukey-for-android.exe
explorer.exe
User:
admin
Company:
Tenorshare Co., Ltd.
Integrity Level:
HIGH
Description:
4uKey for Android
Exit code:
0
Version:
2.7.11.0
Modules
Images
c:\users\admin\desktop\4ukey-for-android.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3876"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
5 750
Read events
5 723
Write events
24
Delete events
3

Modification events

(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3472) 4ukey-for-android.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3876) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{ED122579-7792-447F-AC0E-0D6ECEC161EB}\{2F6663E4-F6A7-42E2-A9CB-E0870C8E0DA3}
Operation:delete keyName:(default)
Value:
Executable files
591
Suspicious files
1 232
Text files
84
Unknown types
0

Dropped files

PID
Process
Filename
Type
34724ukey-for-android.exeC:\Users\admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe —
MD5:—
SHA256:—
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_EB10CBE5F5A4C34C11B6616190391C99binary
MD5:4D1C665BBCF54E9C6F300BCC98B9EE9D
SHA256:792098648F6292D0851AFF0993A166F16CA867FB446FD3FF9CE3F7C358BB426C
34724ukey-for-android.exeC:\Users\admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.10.0.exe.xmltext
MD5:15EA3F7928B8A36D5482537E222BF9D1
SHA256:E6D41499B1BF839C5A61833170B2868CD9F93E6FA4EABE75C59E31FA8B183B25
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:6DD9AE59AA138101383801F58D4ED0BB
SHA256:346EEB53E17C990267C6D0759F01B13C261C9D7C99E1AA514B1256DA34946F2E
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:8BDF688D086625784302F809CE52150D
SHA256:328EA38F5CBF00CC4F13E6421068011079538A41FC48B454E41BE7D2DDD92FF4
34724ukey-for-android.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\CRQQ2MTW.txttext
MD5:FCA6E8E9A5C07ACC2B672DE40E817892
SHA256:35CF3C3BFF49EC6D9C9794520F3C9BBDA7B91D79C622611B191E7FAC8D47BEEA
34724ukey-for-android.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\WC90BF9H.txttext
MD5:E7A23E280DEC33410A7C661BD9ABA575
SHA256:F39C71005131BCCDAB4B41BDB19F5EF138D3BE3C4ADAED0B49B1340D4D8D34BC
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95binary
MD5:5BBB674CB0D8565B838E45958264A28B
SHA256:A3CFD01B827A24306222C4D1B0A6BAF24321B7E3E170ED74438A6822A290D923
34724ukey-for-android.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:35703A8F5C39F9B5E032812BCC867F38
SHA256:B690E654D5BD6496AADEFFCC46F43ABADC487405BB4122A1A7714AA90DD20740
13604ukeyforandroid_ts_2.10.0.exeC:\Users\admin\AppData\Local\Temp\is-QCDM1.tmp\4ukeyforandroid_ts_2.10.0.tmpexecutable
MD5:053537FF877BB8441A19F26AA96A4830
SHA256:2CB4E84A399B141CDCC3EF818399CD9EEFBD5C9DA620016386670CBE70C985DF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
112
DNS requests
7
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3472
4ukey-for-android.exe
GET
301
104.18.24.249:80
http://www.tenorshare.com/downloads/service/softwarelog.txt
unknown
html
245 b
unknown
3472
4ukey-for-android.exe
GET
200
95.101.54.105:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d19af1718ae57980
unknown
compressed
4.66 Kb
unknown
3472
4ukey-for-android.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
text
152 b
unknown
3472
4ukey-for-android.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
binary
471 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3472
4ukey-for-android.exe
POST
200
142.250.186.142:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3472
4ukey-for-android.exe
104.18.24.249:80
www.tenorshare.com
CLOUDFLARENET
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3472
4ukey-for-android.exe
104.18.24.249:443
www.tenorshare.com
CLOUDFLARENET
—
unknown
3472
4ukey-for-android.exe
95.101.54.105:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3472
4ukey-for-android.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3472
4ukey-for-android.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
3472
4ukey-for-android.exe
142.250.186.142:443
www.google-analytics.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
whitelisted
ctldl.windowsupdate.com
  • 95.101.54.105
  • 95.101.54.113
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
update.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
unknown
ip-api.com
  • 208.95.112.1
shared
www.google-analytics.com
  • 142.250.186.142
whitelisted
download.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
unknown

Threats

PID
Process
Class
Message
3472
4ukey-for-android.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3472
4ukey-for-android.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3472
4ukey-for-android.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
3472
4ukey-for-android.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3472
4ukey-for-android.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Tensorshare Google Analytics Checkin
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4ukey-for-android.exe