File name:

rufus-3.18.exe

Full analysis: https://app.any.run/tasks/61c7f126-a4ae-4ae8-90d6-0039040a6add
Verdict: Malicious activity
Analysis date: August 19, 2024, 20:10:01
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5:

B685F77ACE37783D5A8C3568E96C68C8

SHA1:

8422936C6FFCA78B9FB332AD5D09D7ED8FDE1B29

SHA256:

22820692CB7295CD13BF62AB984A8F5B37E3CB09999B6AA2AD27A704E3380C48

SSDEEP:

49152:/UWpqkCP//7q2hoozQ3bTVYImbK1nq9tTKJZcjDlEdlEq32BmjYK3qY1EyCyuoPF:/btCTq2hooKbJYm1stuJClTmjdZ1EyCI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • rufus-3.18.exe (PID: 6884)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • rufus-3.18.exe (PID: 6884)

    • Executes as Windows Service

      • vds.exe (PID: 6960)

  • INFO

    • Checks supported languages

      • rufus-3.18.exe (PID: 6884)

    • Reads the machine GUID from the registry

      • rufus-3.18.exe (PID: 6884)

    • Create files in a temporary directory

      • rufus-3.18.exe (PID: 6884)

    • Reads the computer name

      • rufus-3.18.exe (PID: 6884)

    • Process checks whether UAC notifications are on

      • rufus-3.18.exe (PID: 6884)

    • UPX packer has been detected

      • rufus-3.18.exe (PID: 6884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.38
CodeSize: 1331200
InitializedDataSize: 45056
UninitializedDataSize: 2699264
EntryPoint: 0x3d7970
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.18.1877.0
ProductVersionNumber: 3.18.1877.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: https://rufus.ie
CompanyName: Akeo Consulting
FileDescription: Rufus
FileVersion: 3.18.1877
InternalName: Rufus
LegalCopyright: © 2011-2022 Pete Batard (GPL v3)
LegalTrademarks: https://www.gnu.org/licenses/gpl-3.0.html
OriginalFileName: rufus-3.18.exe
ProductName: Rufus
ProductVersion: 3.18.1877
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT rufus-3.18.exe vdsldr.exe no specs vds.exe no specs rufus-3.18.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6836"C:\Users\admin\Desktop\rufus-3.18.exe" C:\Users\admin\Desktop\rufus-3.18.exe—explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
MEDIUM
Description:
Rufus
Exit code:
3221226540
Version:
3.18.1877
Modules
Images
c:\users\admin\desktop\rufus-3.18.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6884"C:\Users\admin\Desktop\rufus-3.18.exe" C:\Users\admin\Desktop\rufus-3.18.exe
explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
HIGH
Description:
Rufus
Version:
3.18.1877
Modules
Images
c:\users\admin\desktop\rufus-3.18.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6924C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6960C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
258
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
453
Read events
391
Write events
30
Delete events
32

Modification events

(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\AppHVSI
Operation:writeName:AllowAppHVSI_ProviderSet
Value:
0
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\EdgeUpdate
Operation:writeName:UpdateDefault
Value:
0
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\Windows\Network Connections
Operation:writeName:NC_DoNotShowLocalOnlyIcon
Value:
1
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\Windows\Windows Feeds
Operation:writeName:EnableFeeds
Value:
0
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUServer
Value:
http://neverupdatewindows10.com
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUStatusServer
Value:
http://neverupdatewindows10.com
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:UpdateServiceUrlAlternate
Value:
http://neverupdatewindows10.com
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:**del.FillEmptyContentUrls
Value:
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:UseWUServer
Value:
1
(PID) Process:(6884) rufus-3.18.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{B52D4CCD-BD34-457E-8EB6-F3D9BC4AE090}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
0
Executable files
0
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6884rufus-3.18.exeC:\Users\admin\AppData\Local\Temp\RufDE66.tmptext
MD5:59166591A1B7B9D2DFF5751C92923619
SHA256:DB6E6B0FA49CA75437122E9E104D67D19A9BCCAF9C7784570B676FF34BBA5BA7
6884rufus-3.18.exeC:\Windows\SysWOW64\GroupPolicy\gpt.initext
MD5:39DFFC602ED934569F26BE44EC645814
SHA256:B57A88E5B1ACF3A784BE88B87FA3EE1F0991CB7C1C66DA423F3595FFC6E0C5C2
6884rufus-3.18.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:2392F1772EA5EC57F3B38729204010E4
SHA256:182966E809A108282397D80C3F82D0116CB437D1C90630FCB1F93F7CC8F6219D
6884rufus-3.18.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:0C014C71A70DC7758BFDC822E974F1F3
SHA256:8EBD915268E16B55A3ABDE6F612363576FAB5DF656F955D672CCE8889C5FF9CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
29
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2396
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6200
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6720
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3540
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2468
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3540
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2256
svchost.exe
224.0.0.251:5353
—
—
—
unknown
2256
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2396
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2396
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.174
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.68
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.72
  • 40.126.32.138
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted

Threats

No threats detected
Process
Message
rufus-3.18.exe
*** Rufus init ***
rufus-3.18.exe
Binary executable is signed by 'Akeo Consulting'
rufus-3.18.exe
Will use settings from registry
rufus-3.18.exe
loc file not found in current directory - embedded one will be used
rufus-3.18.exe
localization: extracted data to 'C:\Users\admin\AppData\Local\Temp\RufDE66.tmp'
rufus-3.18.exe
localization: found locale 'en-US'
rufus-3.18.exe
localization: found locale 'ar-SA'
rufus-3.18.exe
embedded.loc(409): the version of this translation is older than the base one and may result in some messages not being properly translated. If you are the translator, please update your translation with the changes that intervened between v3.5 and v3.14. See https://github.com/pbatard/rufus/blob/master/res/loc/ChangeLog.txt
rufus-3.18.exe
localization: found locale 'bg-BG'
rufus-3.18.exe
embedded.loc(763): the version of this translation is older than the base one and may result in some messages not being properly translated. If you are the translator, please update your translation with the changes that intervened between v3.5 and v3.14. See https://github.com/pbatard/rufus/blob/master/res/loc/ChangeLog.txt
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rufus-3.18.exe