Analysis date (UTC): 23 March 2022, 09:03Analysis environment: Windows 7 Pro, build 7601, x86

https://tinyzonetv.to

MD5:EFA16AD66698920886916A1D56F99224

SHA1:5E12FC2E86C77E8C49A7C14B78BE91E385547597

SHA256:11D11787413F89AE5F869F81DA840B194D0A3AF6BD071BB7BD6F046B0CE968B0

Analysis result

Threat level:Malicious activity

Full analysis:Analysis https://tinyzonetv.to Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Loads dropped or rewritten executable

NoteIt.17.2110.1wl.exe (PID: 2488)
NoteIt.17.2110.1wl.exe (PID: 3040)
NoteIt.17.2110.1wl.exe (PID: 3620)

Drops executable file immediately after starts

NoteIt.17.2110.1wl.exe (PID: 3620)
NoteIt.17.2110.1wl.exe (PID: 3040)

SUSPICIOUS

Drops a file with a compile date too recent

chrome.exe (PID: 3448)

Executable content was dropped or overwritten

chrome.exe (PID: 3448)
NoteIt.17.2110.1wl.exe (PID: 2488)
NoteIt.17.2110.1wl.exe (PID: 3620)
NoteIt.17.2110.1wl.exe (PID: 3040)

Reads the computer name

NoteIt.17.2110.1wl.exe (PID: 2488)
NoteIt.17.2110.1wl.exe (PID: 3620)
NoteIt.17.2110.1wl.exe (PID: 3040)

Checks supported languages

NoteIt.17.2110.1wl.exe (PID: 2488)
NoteIt.17.2110.1wl.exe (PID: 3620)
NoteIt.17.2110.1wl.exe (PID: 3040)

Creates files in the user directory

NoteIt.17.2110.1wl.exe (PID: 3040)

Drops a file with too old compile date

NoteIt.17.2110.1wl.exe (PID: 3040)

Drops a file that was compiled in debug mode

NoteIt.17.2110.1wl.exe (PID: 3040)

INFO

Application launched itself

chrome.exe (PID: 3448)

Checks supported languages

chrome.exe (PID: 3932)
chrome.exe (PID: 3448)
chrome.exe (PID: 1588)
chrome.exe (PID: 3636)
chrome.exe (PID: 2884)
chrome.exe (PID: 2624)
chrome.exe (PID: 3880)
chrome.exe (PID: 3892)
chrome.exe (PID: 3696)
chrome.exe (PID: 1784)
chrome.exe (PID: 2608)
chrome.exe (PID: 492)
chrome.exe (PID: 3208)
chrome.exe (PID: 2924)
chrome.exe (PID: 2168)
chrome.exe (PID: 3168)
chrome.exe (PID: 2072)
chrome.exe (PID: 2640)
chrome.exe (PID: 2548)
chrome.exe (PID: 3028)
chrome.exe (PID: 2552)
chrome.exe (PID: 2148)
chrome.exe (PID: 1996)
chrome.exe (PID: 2756)
chrome.exe (PID: 1040)
chrome.exe (PID: 2480)
chrome.exe (PID: 2244)
chrome.exe (PID: 3664)
chrome.exe (PID: 2960)
chrome.exe (PID: 928)
chrome.exe (PID: 3972)
chrome.exe (PID: 2796)
chrome.exe (PID: 2236)
chrome.exe (PID: 2872)
SndVol.exe (PID: 1740)
chrome.exe (PID: 2280)
chrome.exe (PID: 2792)
chrome.exe (PID: 2788)
chrome.exe (PID: 2364)
chrome.exe (PID: 2080)
chrome.exe (PID: 1232)
chrome.exe (PID: 3880)
chrome.exe (PID: 2656)
chrome.exe (PID: 3008)
chrome.exe (PID: 3968)
chrome.exe (PID: 1176)
chrome.exe (PID: 3304)
chrome.exe (PID: 2856)
chrome.exe (PID: 1588)
chrome.exe (PID: 2884)
chrome.exe (PID: 3328)
chrome.exe (PID: 3572)
chrome.exe (PID: 1596)
chrome.exe (PID: 2008)
chrome.exe (PID: 3324)
chrome.exe (PID: 2812)
chrome.exe (PID: 2068)
chrome.exe (PID: 492)
chrome.exe (PID: 2924)
chrome.exe (PID: 2056)
chrome.exe (PID: 2496)
chrome.exe (PID: 2184)
chrome.exe (PID: 3500)
chrome.exe (PID: 2756)

Reads the computer name

chrome.exe (PID: 3448)
chrome.exe (PID: 2624)
chrome.exe (PID: 3636)
chrome.exe (PID: 1784)
chrome.exe (PID: 3932)
chrome.exe (PID: 492)
chrome.exe (PID: 2148)
chrome.exe (PID: 3324)
SndVol.exe (PID: 1740)
chrome.exe (PID: 1588)
chrome.exe (PID: 1596)
chrome.exe (PID: 2008)
chrome.exe (PID: 2812)
chrome.exe (PID: 2068)
chrome.exe (PID: 2496)
chrome.exe (PID: 492)
chrome.exe (PID: 2056)
chrome.exe (PID: 2184)

Reads the hosts file

chrome.exe (PID: 3448)
chrome.exe (PID: 1784)

Reads settings of System Certificates

chrome.exe (PID: 1784)
chrome.exe (PID: 3448)

Reads the date of Windows installation

chrome.exe (PID: 3636)

Manual execution by user

SndVol.exe (PID: 1740)

Creates files in the user directory

chrome.exe (PID: 3448)

Checks Windows Trust Settings

chrome.exe (PID: 3448)

Threats

PID	Process	Class	Message
—	—	Potentially Bad Traffic	ET DNS Query for .to TLD
—	—	Potentially Bad Traffic	ET DNS Query for .to TLD
—	—	Potentially Bad Traffic	ET DNS Query for .to TLD