Malware analysis 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77 Malicious activity

Add for printing

File name:	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77
Full analysis:	https://app.any.run/tasks/468cfd46-feb5-4b6a-b70e-e058d10ce172
Verdict:	Malicious activity
Threats:	Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	August 04, 2024, 16:40:07
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	stealer qrcode ransomware
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	EACD115C2082467FCF66353D9EF8F832
SHA1:	E58399297A1B990FB7BCB367C57E0D5B542B8F3B
SHA256:	102D78CD19A298EE98DD4FCE7112C526A8BF943C0A69452FA85B6A95A7BE8F77
SSDEEP:	24576:ldWHxJl12sm0WV4i5z9XWzb17mGre8mScvQHvkwJG9K0GXKZHAv4Yx4lcJASrPtv:ldWHxJl12T0WVL5z9XWzb17breXScvQr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Actions looks like stealing of personal data
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
SUSPICIOUS
- Executable content was dropped or overwritten
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Reads security settings of Internet Explorer
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Reads Microsoft Outlook installation path
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Reads Internet Explorer settings
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
INFO
- Creates files in the program directory
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Create files in a temporary directory
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Reads the computer name
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Checks supported languages
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Process checks computer location settings
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Dropped object may contain TOR URL's
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Reads the machine GUID from the registry
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- The dropped object may contain a URL to Tor Browser
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Process checks Internet Explorer phishing filters
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)
- Checks proxy server information
  - 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe (PID: 6308)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.dll	\|	Win32 Dynamic Link Library (generic) (43.5)
.exe	\|	Win32 Executable (generic) (29.8)
.exe	\|	Generic Win/DOS Executable (13.2)
.exe	\|	DOS Executable Generic (13.2)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	0000:00:00 00:00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	678912
InitializedDataSize:	-
UninitializedDataSize:	-
EntryPoint:	0x16ed1
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

137

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

6308

"C:\Users\admin\Desktop\102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe"

C:\Users\admin\Desktop\102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\desktop\102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

Add for printing

Total events

3 930

Read events

3 917

Write events

Delete events

Modification events


(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:	write	Name:	DisableFirstRunCustomize
Value: 1
(PID) Process:	(6308) 102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch
Operation:	write	Name:	Version
Value: WS not running

Add for printing

Executable files

Suspicious files

707

Text files

286

Unknown types

Dropped files

PID	Process	Filename		Type
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt.ctbl		binary
		MD5:769BC99628C1166A96ABB8AED1B08982	SHA256:ABD4403CA54B267B3A8485D131523EC46528636D78FAA75B06570B151975E0FD
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txtiehqgbj		text
		MD5:D9D4F495E875A2E075A1A4A6E1B9770F	SHA256:25FC0E7096FC653718202DC30B0C580B8AB87EAC11A700CBA03A7C021BC35B0C
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\ProgramData\Adobe\mfuacph		binary
		MD5:9D3C57A191B9783A22B3BB47CE66ED7A	SHA256:40844B5EEE10C349E78DD6D6A78A9F0D81561F733FCB5AE28C8712D7C3CC3577
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\ConnectedDevicesPlatform\ActivitiesCache.dbiehqgbj		binary
		MD5:A0D7DB5C67086D6C44A07C167299BAA9	SHA256:B574FD10A2427A8CADD00C0465ED50ECFDAD005F53F3EE391C1DE1E1FF548522
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\Temp\gewekpa.exe		executable
		MD5:EACD115C2082467FCF66353D9EF8F832	SHA256:102D78CD19A298EE98DD4FCE7112C526A8BF943C0A69452FA85B6A95A7BE8F77
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.dbiehqgbj		sqlite
		MD5:82C2B5A5C27EB596D0A2D84D57EBB11E	SHA256:B0AFC0CE9C0AB77D1F6C89516ACAA2F0630AEEAAD62EF0CA6D01FAD58EB3DB96
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.dbiehqgbj		binary
		MD5:1FFA65AC7EF156D81175695CA8EC1F22	SHA256:8D5EDC6CEAB998E8F8352A255455F1C8D1106D99A91C51882AC0B765F8E3F81E
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\ConnectedDevicesPlatform\ActivitiesCache.db.ctbl		binary
		MD5:ACC5CD69696649C2851138B682F3A6DE	SHA256:2100AA22399198AAE2B9C4337BC21AA28CB83EC1D0C68F38EB3010192286BE10
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.dbiehqgbj		binary
		MD5:315332044706528A5FE8A6DDE075F0B3	SHA256:05CF19B9848E82CA48587087B680AD6E5BF0C898E9505125E3B6EF46F7371D75
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db.ctbl		binary
		MD5:5713B6F22B39652BADF6DB0233582BC4	SHA256:4AE1684AB96E7D98D8860C42A1488F21E38947CBF8C34B6C435A82A173A6DF77

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
6700	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
2876	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6736	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
876	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1784	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5336	SearchApp.exe	184.86.251.22:443	www.bing.com	Akamai International B.V.	DE	unknown
5336	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
2876	svchost.exe	20.190.160.14:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	unknown
2876	svchost.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 4.231.128.59	whitelisted
google.com	216.58.212.174	whitelisted
www.bing.com	184.86.251.22 184.86.251.24 184.86.251.27 184.86.251.26 184.86.251.4 184.86.251.28 184.86.251.25 184.86.251.29 184.86.251.6	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	20.190.160.14 40.126.32.133 20.190.160.20 40.126.32.74 40.126.32.136 40.126.32.68 40.126.32.76 40.126.32.140	whitelisted
client.wns.windows.com	40.115.3.253 40.113.103.199	whitelisted
th.bing.com	184.86.251.25 184.86.251.29 184.86.251.24 184.86.251.4 184.86.251.19 184.86.251.22 184.86.251.18 184.86.251.26 184.86.251.6	whitelisted
fd.api.iris.microsoft.com	20.103.156.88	whitelisted
arc.msn.com	20.223.35.26	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted

Threats

PID	Process	Class	Message
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 239
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Misc activity	ET POLICY TLS possible TOR SSL traffic
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Unknown Traffic	ET JA3 Hash - [Abuse.ch] Possible Ransomware
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 239
6308	102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77.exe	Misc Attack	ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 239

Add for printing

No debug info

General Info

102d78cd19a298ee98dd4fce7112c526a8bf943c0a69452fa85b6a95a7be8f77

EACD115C2082467FCF66353D9EF8F832

E58399297A1B990FB7BCB367C57E0D5B542B8F3B

102D78CD19A298EE98DD4FCE7112C526A8BF943C0A69452FA85B6A95A7BE8F77

24576:ldWHxJl12sm0WV4i5z9XWzb17mGre8mScvQHvkwJG9K0GXKZHAv4Yx4lcJASrPtv:ldWHxJl12T0WVL5z9XWzb17breXScvQr

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Actions looks like stealing of personal data

SUSPICIOUS

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Reads Microsoft Outlook installation path

Reads Internet Explorer settings

INFO

Creates files in the program directory

Create files in a temporary directory

Reads the computer name

Checks supported languages

Process checks computer location settings

Dropped object may contain TOR URL's

Reads the machine GUID from the registry

The dropped object may contain a URL to Tor Browser

Process checks Internet Explorer phishing filters

Checks proxy server information

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings