Malware analysis drw_fr_installer.17213164218168b1301.exe Malicious activity

Add for printing

File name:	drw_fr_installer.17213164218168b1301.exe
Full analysis:	https://app.any.run/tasks/d3e43f0b-dc7d-4e9b-92d7-7e9d2cae809b
Verdict:	Malicious activity
Analysis date:	July 27, 2024, 08:52:53
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:	2EEA36240F8A9E8DF63F8EDF1C74BE83
SHA1:	2524BC5B4DD572F9C6F40FB30057251550F278D7
SHA256:	1415CFF1239E323F7FE80C6E56623EE2A719AE2AF726033AFCD75A8FB9197D0B
SSDEEP:	49152:lR6V0844fc94dQTFq3N6TNtRgnZXTnaSPSbcg823BdPRX7fbipkipECFwgwmjBKV:lR69HfybTFcN8NtqZjn7SbTx3BJRbskT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - drw_fr_installer.17213164218168b1301.exe (PID: 7032)
- Scans artifacts that could help determine the target
  - AliyunWrapExe.exe (PID: 4276)
SUSPICIOUS
- Executable content was dropped or overwritten
  - drw_fr_installer.17213164218168b1301.exe (PID: 7032)
- Reads security settings of Internet Explorer
  - EDownloader.exe (PID: 5240)
  - AliyunWrapExe.exe (PID: 4276)
- Reads Internet Explorer settings
  - EDownloader.exe (PID: 5240)
- Reads Microsoft Outlook installation path
  - EDownloader.exe (PID: 5240)
INFO
- Checks supported languages
  - drw_fr_installer.17213164218168b1301.exe (PID: 7032)
  - EDownloader.exe (PID: 5240)
  - InfoForSetup.exe (PID: 5948)
  - AliyunWrapExe.exe (PID: 4276)
  - InfoForSetup.exe (PID: 4288)
  - InfoForSetup.exe (PID: 1736)
  - InfoForSetup.exe (PID: 4356)
  - InfoForSetup.exe (PID: 4840)
  - InfoForSetup.exe (PID: 5040)
- Create files in a temporary directory
  - drw_fr_installer.17213164218168b1301.exe (PID: 7032)
  - EDownloader.exe (PID: 5240)
  - InfoForSetup.exe (PID: 4288)
  - AliyunWrapExe.exe (PID: 4276)
- Reads the computer name
  - EDownloader.exe (PID: 5240)
  - AliyunWrapExe.exe (PID: 4276)
- Checks proxy server information
  - AliyunWrapExe.exe (PID: 4276)
  - EDownloader.exe (PID: 5240)
- Creates files or folders in the user directory
  - AliyunWrapExe.exe (PID: 4276)
- Manual execution by a user
  - mspaint.exe (PID: 1764)
- Process checks Internet Explorer phishing filters
  - EDownloader.exe (PID: 5240)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (67.4)
.dll	\|	Win32 Dynamic Link Library (generic) (14.2)
.exe	\|	Win32 Executable (generic) (9.7)
.exe	\|	Generic Win/DOS Executable (4.3)
.exe	\|	DOS Executable Generic (4.3)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2018:01:30 03:57:48+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	26624
InitializedDataSize:	186368
UninitializedDataSize:	2048
EntryPoint:	0x338f
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

155

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1736

/SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"United States\",\"Install_Path\":\"C:/Program Files/EaseUS/EaseUS Data Recovery Wizard\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17213164218168b1301\",\"Timezone\":\"GMT-00:00\"}"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

1764

"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\wifemon.png"

C:\Windows\System32\mspaint.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Paint

Exit code:

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

4032

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

4276

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe

InfoForSetup.exe

User:

admin

Integrity Level:

HIGH

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\aliyunwrapexe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll

4288

/SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17213164218168b1301\",\"Timezone\":\"GMT-00:00\"}"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

4356

/SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Downloadfrom\":\"https://d1.easeus.com/drw/free/drw18.0.0.0_free.exe\",\"Pageid\":\"17213164218168b1301\",\"Testid\":\"FR181_2024715AB2-07092\",\"Version\":\"free\",\"Versionnumber\":\"18.1\"}"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

4772

"C:\Users\admin\AppData\Local\Temp\drw_fr_installer.17213164218168b1301.exe"

C:\Users\admin\AppData\Local\Temp\drw_fr_installer.17213164218168b1301.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221226540

Modules

Images
c:\users\admin\appdata\local\temp\drw_fr_installer.17213164218168b1301.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

4840

/SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"3\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17213164218168b1301&lang=English&pcVersion=home&pid=2&tid=1&version=free\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"2\\",\\"version\\":\\"free\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"curNum\\":\\"18.1\\",\\"testid\\":\\"FR181_2024715AB2-07092\\",\\"configid\\":\\"\\",\\"md5\\":\\"6e8067b6eb0edce0919fd068e9655673\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/drw\\/free\\/drw18.0.0.0_free.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/drw\\/free\\/drw18.0.0.0_free.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/drw\\/free\\/drw18.0.0.0_free.exe\\",\\"url\\":[]},\\"time\\":1722070415}\",\"Result\":\"Success\"}"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

5040

/SendInfo Window "Home_Installer" Activity "Click_Fold_Custom"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

5240

"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\admin\AppData\Local\Temp ||| EXENAME=drw_fr_installer.17213164218168b1301.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

drw_fr_installer.17213164218168b1301.exe

User:

admin

Integrity Level:

HIGH

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\edownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

Add for printing

Total events

7 130

Read events

7 079

Write events

Delete events

Modification events


(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(1764) mspaint.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:	write	Name:	WindowPlacement
Value: 2C00000000000000010000000000000000000000FFFFFFFFFFFFFFFF7F000000470000007F04000087020000
(PID) Process:	(1764) mspaint.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:	write	Name:	ShowThumbnail
Value: 0
(PID) Process:	(1764) mspaint.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:	write	Name:	BMPWidth
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\German.ini		text
		MD5:DECAA2CBBACCAE2A64C588243FBD6435	SHA256:4FFD51F20C76EE5D6CBAF16EA2AB9D0A0B0491E710C42D548724D5B5AAF3D55F
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Danish.ini		text
		MD5:EB6CB6A1EA028CAC7AE61DADC568C2F9	SHA256:4524116093969EE206FA4F04D84346349ED551B4D7B87D4206E9A12D32AF5D61
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\InitConfigure.ini		text
		MD5:FEC03E63245A8E784C6E81F86F56A4A3	SHA256:E20FFB7DC15D0D949C834880C6F804A18CC2309AA98480525C86D63936036E49
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\skin.zip		compressed
		MD5:6FA30F652398A902A1464888399E4A33	SHA256:EF835AADD1FD02F8769E56E796FB280F9B46AA39E254FABAE6629A81508A87BB
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\LanguageTransfor.ini		text
		MD5:FFE692A67871185785EC705B1CC12C81	SHA256:373BEC6E7976324FF879C2988BAB772C69336D7BCB9A32386A6021568350A824
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Indonesian.ini		text
		MD5:38629FAB2999407FE8FA2DBABB097B57	SHA256:13F413DBFCBC4537D83F77E34EF0C9FA868BFA07792E990F4E94526CCEB79848
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Norwegian.ini		text
		MD5:74F6E38B2B7AC3893B1AB6C092B854D1	SHA256:9692FECB48E8745F26C235C8925F106E56E862CD1B7B8CA8C84B8CB751B7A748
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Mungarian.ini		text
		MD5:35331ED66C059568C54865EF7D41087C	SHA256:F55A35E6D3CCC944D4C264E34244A127BCE54079621CAB25D9E8E53CC1F9AC07
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Polish.ini		text
		MD5:DEF85351F7FDA76B962D6DE5F86F5FE5	SHA256:E833E96EA0E4568FDDF90386AFDFF3F9BED6EA643FAF9EE6BC0938BE71344294
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Portuguese.ini		text
		MD5:7DA92400736262F4E3032DC4B977AB39	SHA256:E22707B2E0E21C3DF87F7F85EDA9A3E76F98BDB76EDD3ED07CD19DBFA2CDC967

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2908	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
4276	AliyunWrapExe.exe	POST	200	47.252.97.13:80	http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	unknown	—	—	unknown
5240	EDownloader.exe	POST	200	18.172.112.107:80	http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/	unknown	—	—	unknown
4276	AliyunWrapExe.exe	POST	200	47.252.97.13:80	http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	unknown	—	—	unknown
4276	AliyunWrapExe.exe	POST	200	47.252.97.13:80	http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	unknown	—	—	unknown
4276	AliyunWrapExe.exe	POST	200	47.252.97.13:80	http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	unknown	—	—	unknown
4276	AliyunWrapExe.exe	GET	200	163.171.128.150:80	http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2	unknown	—	—	malicious
4424	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
3676	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
4276	AliyunWrapExe.exe	POST	200	47.252.97.13:80	http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4128	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3952	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	131.253.33.254:443	a-ring-fallback.msedge.net	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
—	—	2.16.110.123:443	www.bing.com	Akamai International B.V.	DE	unknown
4028	slui.exe	52.161.91.37:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
6012	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
996	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1044	slui.exe	52.161.91.37:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
4276	AliyunWrapExe.exe	163.171.128.150:80	track.easeus.com	QUANTILNETWORKS	DE	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 40.127.240.158 4.231.128.59	whitelisted
t-ring-fdv2.msedge.net	13.107.237.254	unknown
a-ring-fallback.msedge.net	131.253.33.254	unknown
www.bing.com	2.16.110.123 2.16.110.171	whitelisted
google.com	216.58.206.46	whitelisted
track.easeus.com	163.171.128.150 163.171.156.15	unknown
login.live.com	40.126.32.138 40.126.32.74 20.190.160.22 20.190.160.14 20.190.160.20 40.126.32.134 40.126.32.136 40.126.32.140	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted
easeusinfo.us-east-1.log.aliyuncs.com	47.252.97.13 47.252.97.10 47.252.97.12 47.252.97.9 47.252.97.11 47.252.97.15 47.252.97.8 47.252.97.212 47.252.97.14	unknown

Threats

PID	Process	Class	Message
2284	svchost.exe	Misc activity	ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method

Add for printing

Process	Message
EDownloader.exe	[528]-08:53:00:598 ParseCmdLine param=EXEDIR=C:\Users\admin\AppData\Local\Temp \|\|\| EXENAME=drw_fr_installer.17213164218168b1301.exe \|\|\| DOWNLOAD_VERSION=free \|\|\| PRODUCT_VERSION=2.0.0 \|\|\| INSTALL_TYPE=0
EDownloader.exe	[528]-08:53:00:645 Install recomand return=259
EDownloader.exe	[528]-08:53:01:426 Install recomand return=259
EDownloader.exe	[528]-08:53:31:700 Install recomand return=259
EDownloader.exe	[528]-08:53:31:700 Install recomand return=259
EDownloader.exe	[6432]-08:53:33:387 PostData Start download url=http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17213164218168b1301&lang=English&pcVersion=home&pid=2&tid=1&version=free
EDownloader.exe	[6432]-08:53:36:747 PostData end
EDownloader.exe	[6432]-08:53:36:747 Json parse Data Start
EDownloader.exe	[6432]-08:53:36:747 Json parse Data end
EDownloader.exe	[528]-08:53:36:747 CHttpHelper::GetDownloadInfo 45 download info code:0

General Info

drw_fr_installer.17213164218168b1301.exe

2EEA36240F8A9E8DF63F8EDF1C74BE83

2524BC5B4DD572F9C6F40FB30057251550F278D7

1415CFF1239E323F7FE80C6E56623EE2A719AE2AF726033AFCD75A8FB9197D0B

49152:lR6V0844fc94dQTFq3N6TNtRgnZXTnaSPSbcg823BdPRX7fbipkipECFwgwmjBKV:lR69HfybTFcN8NtqZjn7SbTx3BJRbskT

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Scans artifacts that could help determine the target

SUSPICIOUS

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Reads Internet Explorer settings

Reads Microsoft Outlook installation path

INFO

Checks supported languages

Create files in a temporary directory

Reads the computer name

Checks proxy server information

Creates files or folders in the user directory

Manual execution by a user

Process checks Internet Explorer phishing filters

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings