Malware analysis drw_fr_installer.17213164218168b1301.exe Malicious activity

Add for printing

File name:	drw_fr_installer.17213164218168b1301.exe
Full analysis:	https://app.any.run/tasks/d3e43f0b-dc7d-4e9b-92d7-7e9d2cae809b
Verdict:	Malicious activity
Analysis date:	July 27, 2024, 08:52:53
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:	2EEA36240F8A9E8DF63F8EDF1C74BE83
SHA1:	2524BC5B4DD572F9C6F40FB30057251550F278D7
SHA256:	1415CFF1239E323F7FE80C6E56623EE2A719AE2AF726033AFCD75A8FB9197D0B
SSDEEP:	49152:lR6V0844fc94dQTFq3N6TNtRgnZXTnaSPSbcg823BdPRX7fbipkipECFwgwmjBKV:lR69HfybTFcN8NtqZjn7SbTx3BJRbskT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - drw_fr_installer.17213164218168b1301.exe (PID: 7032)
- Scans artifacts that could help determine the target
  - AliyunWrapExe.exe (PID: 4276)
SUSPICIOUS
- Executable content was dropped or overwritten
  - drw_fr_installer.17213164218168b1301.exe (PID: 7032)
- Reads security settings of Internet Explorer
  - EDownloader.exe (PID: 5240)
  - AliyunWrapExe.exe (PID: 4276)
- Reads Microsoft Outlook installation path
  - EDownloader.exe (PID: 5240)
- Reads Internet Explorer settings
  - EDownloader.exe (PID: 5240)
INFO
- Create files in a temporary directory
  - drw_fr_installer.17213164218168b1301.exe (PID: 7032)
  - InfoForSetup.exe (PID: 4288)
  - EDownloader.exe (PID: 5240)
  - AliyunWrapExe.exe (PID: 4276)
- Checks supported languages
  - drw_fr_installer.17213164218168b1301.exe (PID: 7032)
  - AliyunWrapExe.exe (PID: 4276)
  - InfoForSetup.exe (PID: 4288)
  - InfoForSetup.exe (PID: 5948)
  - EDownloader.exe (PID: 5240)
  - InfoForSetup.exe (PID: 5040)
  - InfoForSetup.exe (PID: 4840)
  - InfoForSetup.exe (PID: 4356)
  - InfoForSetup.exe (PID: 1736)
- Reads the computer name
  - EDownloader.exe (PID: 5240)
  - AliyunWrapExe.exe (PID: 4276)
- Checks proxy server information
  - AliyunWrapExe.exe (PID: 4276)
  - EDownloader.exe (PID: 5240)
- Creates files or folders in the user directory
  - AliyunWrapExe.exe (PID: 4276)
- Process checks Internet Explorer phishing filters
  - EDownloader.exe (PID: 5240)
- Manual execution by a user
  - mspaint.exe (PID: 1764)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (67.4)
.dll	\|	Win32 Dynamic Link Library (generic) (14.2)
.exe	\|	Win32 Executable (generic) (9.7)
.exe	\|	Generic Win/DOS Executable (4.3)
.exe	\|	DOS Executable Generic (4.3)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2018:01:30 03:57:48+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	26624
InitializedDataSize:	186368
UninitializedDataSize:	2048
EntryPoint:	0x338f
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

155

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1736

/SendInfo Window "Home_Installer" Activity "Click_Install" Attribute "{\"Country\":\"United States\",\"Install_Path\":\"C:/Program Files/EaseUS/EaseUS Data Recovery Wizard\",\"Language\":\"English\",\"Os\":\"Microsoft Windows 10\",\"Pageid\":\"17213164218168b1301\",\"Timezone\":\"GMT-00:00\"}"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

1764

"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\wifemon.png"

C:\Windows\System32\mspaint.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Paint

Exit code:

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

4032

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

4276

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe

InfoForSetup.exe

User:

admin

Integrity Level:

HIGH

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\aliyunwrapexe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\rpcrt4.dll

4288

/SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"United States\",\"Pageid\":\"17213164218168b1301\",\"Timezone\":\"GMT-00:00\"}"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

4356

/SendInfo Window "Downloading" Activity "Info_Start_Download_Program" Attribute "{\"Downloadfrom\":\"https://d1.easeus.com/drw/free/drw18.0.0.0_free.exe\",\"Pageid\":\"17213164218168b1301\",\"Testid\":\"FR181_2024715AB2-07092\",\"Version\":\"free\",\"Versionnumber\":\"18.1\"}"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

4772

"C:\Users\admin\AppData\Local\Temp\drw_fr_installer.17213164218168b1301.exe"

C:\Users\admin\AppData\Local\Temp\drw_fr_installer.17213164218168b1301.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221226540

Modules

Images
c:\users\admin\appdata\local\temp\drw_fr_installer.17213164218168b1301.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

4840

/SendInfo Window "Home_Installer" Activity "Result_Download_Configurefile" Attribute "{\"CDN\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/\",\"Elapsed\":\"3\",\"Errorinfo\":\"0\",\"PostURL\":\"http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17213164218168b1301&lang=English&pcVersion=home&pid=2&tid=1&version=free\",\"ResponseJson\":\"{\\"check\\":1,\\"msg\\":\\"\\u6210\\u529f\\",\\"data\\":{\\"pid\\":\\"2\\",\\"version\\":\\"free\\",\\"tj_download\\":\\"test\\",\\"referNumber\\":\\"1000000\\",\\"killSwitch\\":\\"true\\",\\"WriteLogSwitch\\":\\"false\\",\\"curNum\\":\\"18.1\\",\\"testid\\":\\"FR181_2024715AB2-07092\\",\\"configid\\":\\"\\",\\"md5\\":\\"6e8067b6eb0edce0919fd068e9655673\\",\\"download\\":\\"https:\\/\\/d1.easeus.com\\/drw\\/free\\/drw18.0.0.0_free.exe\\",\\"download2\\":\\"https:\\/\\/d2.easeus.com\\/drw\\/free\\/drw18.0.0.0_free.exe\\",\\"download3\\":\\"https:\\/\\/d3.easeus.com\\/drw\\/free\\/drw18.0.0.0_free.exe\\",\\"url\\":[]},\\"time\\":1722070415}\",\"Result\":\"Success\"}"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

5040

/SendInfo Window "Home_Installer" Activity "Click_Fold_Custom"

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

—

EDownloader.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\aliyun\infoforsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

5240

"C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\admin\AppData\Local\Temp ||| EXENAME=drw_fr_installer.17213164218168b1301.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0

C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

drw_fr_installer.17213164218168b1301.exe

User:

admin

Integrity Level:

HIGH

Modules

Images
c:\users\admin\appdata\local\temp\downloader_easeus\2.0.0\2free\edownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

Add for printing

Total events

7 130

Read events

7 079

Write events

Delete events

Modification events


(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(4276) AliyunWrapExe.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(1764) mspaint.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:	write	Name:	WindowPlacement
Value: 2C00000000000000010000000000000000000000FFFFFFFFFFFFFFFF7F000000470000007F04000087020000
(PID) Process:	(1764) mspaint.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:	write	Name:	ShowThumbnail
Value: 0
(PID) Process:	(1764) mspaint.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:	write	Name:	BMPWidth
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Danish.ini		text
		MD5:EB6CB6A1EA028CAC7AE61DADC568C2F9	SHA256:4524116093969EE206FA4F04D84346349ED551B4D7B87D4206E9A12D32AF5D61
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Dutch.ini		text
		MD5:E4E098A3E165FC5ECB4CB806B7E6E9D8	SHA256:3FE882930B7C5299290AE6C0C20AE065BD915984B381436B1C3D1D1CBFC67127
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Indonesian.ini		text
		MD5:38629FAB2999407FE8FA2DBABB097B57	SHA256:13F413DBFCBC4537D83F77E34EF0C9FA868BFA07792E990F4E94526CCEB79848
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\skin.zip		compressed
		MD5:6FA30F652398A902A1464888399E4A33	SHA256:EF835AADD1FD02F8769E56E796FB280F9B46AA39E254FABAE6629A81508A87BB
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Arabic.ini		text
		MD5:B334764EB0A1069F6BA04C8E1F088CD0	SHA256:D9A87257F203A80489756B8B31628FFF8D10AAB229D20A637A083059233DC54C
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\InitConfigure.ini		text
		MD5:FEC03E63245A8E784C6E81F86F56A4A3	SHA256:E20FFB7DC15D0D949C834880C6F804A18CC2309AA98480525C86D63936036E49
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\French.ini		text
		MD5:1737B0DE1DA74E1D45285479CE66E556	SHA256:201229433F78F5CB87A9357921F34CAA2820B2917FF572E82A57D31DB5774E46
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Italian.ini		text
		MD5:AF930A64DA61B99CB120C8A3222456EB	SHA256:1287CD9E6626EC2081379694A309578C1D83BCA25B2C621D1A5D4608CD7AF9BF
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Korean.ini		text
		MD5:81C343D7615A71FFA127E317C98B357E	SHA256:7E8E799B95A5E6F5AA8A18ACB78E6454E634AE52A4615F7A0B0740A51766A26F
7032	drw_fr_installer.17213164218168b1301.exe	C:\Users\admin\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Chinese.ini		text
		MD5:FD6CA501ED9A613A5094EB4C92C1A847	SHA256:4637C9C3FF511C3F15CB482C5A3EE42A3237D26AD002B2FCC3FF467E7A10B99F

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4276	AliyunWrapExe.exe	GET	200	163.171.128.150:80	http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2	unknown	—	—	malicious
5368	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
4424	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
3676	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
4276	AliyunWrapExe.exe	POST	200	47.252.97.13:80	http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	unknown	—	—	unknown
5368	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	whitelisted
2908	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
4276	AliyunWrapExe.exe	POST	200	47.252.97.13:80	http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	unknown	—	—	unknown
5240	EDownloader.exe	POST	200	18.172.112.107:80	http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/	unknown	—	—	unknown
4276	AliyunWrapExe.exe	POST	200	47.252.97.13:80	http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4128	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3952	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	131.253.33.254:443	a-ring-fallback.msedge.net	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
—	—	2.16.110.123:443	www.bing.com	Akamai International B.V.	DE	unknown
4028	slui.exe	52.161.91.37:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
6012	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
996	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1044	slui.exe	52.161.91.37:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
4276	AliyunWrapExe.exe	163.171.128.150:80	track.easeus.com	QUANTILNETWORKS	DE	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 40.127.240.158 4.231.128.59	whitelisted
t-ring-fdv2.msedge.net	13.107.237.254	unknown
a-ring-fallback.msedge.net	131.253.33.254	unknown
www.bing.com	2.16.110.123 2.16.110.171	whitelisted
google.com	216.58.206.46	whitelisted
track.easeus.com	163.171.128.150 163.171.156.15	unknown
login.live.com	40.126.32.138 40.126.32.74 20.190.160.22 20.190.160.14 20.190.160.20 40.126.32.134 40.126.32.136 40.126.32.140	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted
easeusinfo.us-east-1.log.aliyuncs.com	47.252.97.13 47.252.97.10 47.252.97.12 47.252.97.9 47.252.97.11 47.252.97.15 47.252.97.8 47.252.97.212 47.252.97.14	unknown

Threats

PID	Process	Class	Message
2284	svchost.exe	Misc activity	ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method
4276	AliyunWrapExe.exe	Generic Protocol Command Decode	SURICATA HTTP Request unrecognized authorization method

Add for printing

Process	Message
EDownloader.exe	[528]-08:53:00:598 ParseCmdLine param=EXEDIR=C:\Users\admin\AppData\Local\Temp \|\|\| EXENAME=drw_fr_installer.17213164218168b1301.exe \|\|\| DOWNLOAD_VERSION=free \|\|\| PRODUCT_VERSION=2.0.0 \|\|\| INSTALL_TYPE=0
EDownloader.exe	[528]-08:53:00:645 Install recomand return=259
EDownloader.exe	[528]-08:53:01:426 Install recomand return=259
EDownloader.exe	[528]-08:53:31:700 Install recomand return=259
EDownloader.exe	[528]-08:53:31:700 Install recomand return=259
EDownloader.exe	[6432]-08:53:33:387 PostData Start download url=http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/?exeNumber=17213164218168b1301&lang=English&pcVersion=home&pid=2&tid=1&version=free
EDownloader.exe	[6432]-08:53:36:747 PostData end
EDownloader.exe	[6432]-08:53:36:747 Json parse Data Start
EDownloader.exe	[6432]-08:53:36:747 Json parse Data end
EDownloader.exe	[528]-08:53:36:747 CHttpHelper::GetDownloadInfo 45 download info code:0

General Info

drw_fr_installer.17213164218168b1301.exe

2EEA36240F8A9E8DF63F8EDF1C74BE83

2524BC5B4DD572F9C6F40FB30057251550F278D7

1415CFF1239E323F7FE80C6E56623EE2A719AE2AF726033AFCD75A8FB9197D0B

49152:lR6V0844fc94dQTFq3N6TNtRgnZXTnaSPSbcg823BdPRX7fbipkipECFwgwmjBKV:lR69HfybTFcN8NtqZjn7SbTx3BJRbskT

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Scans artifacts that could help determine the target

SUSPICIOUS

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Reads Microsoft Outlook installation path

Reads Internet Explorer settings

INFO

Create files in a temporary directory

Checks supported languages

Reads the computer name

Checks proxy server information

Creates files or folders in the user directory

Process checks Internet Explorer phishing filters

Manual execution by a user

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings