analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.sf-cdn.net/downloads/sfdesktop/ShareFileDesktop-v1.19.1027.0.exe

Full analysis: https://app.any.run/tasks/18678c0d-0810-4f90-9247-e216f41fe453
Verdict: Malicious activity
Analysis date: March 22, 2019, 05:47:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

BB2DC3B44E6FFB702DAF1E4AFEBC8750

SHA1:

215A5799B1B9CFA8CD1F2E1089964489647B722D

SHA256:

241B9ACE194F2653F84D7CAB2B9595FAAB262B6418E6637B7777B6008FFC7FC7

SSDEEP:

3:N8DSLQBD0BXKErVK/XtEAWOsimSVCLaA:2OLUD0BaEBMdEAOSwLL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ShareFileDesktop-v1.19.1027.0.exe (PID: 2788)
      • ShareFileDesktop-v1.19.1027.0.exe (PID: 2924)
      • ShareFile.Client.WindowsDesktop.exe (PID: 1284)
    • Loads dropped or rewritten executable

      • ShareFileDesktop-v1.19.1027.0.exe (PID: 2924)
      • ShareFile.Client.WindowsDesktop.exe (PID: 1284)
    • Changes the autorun value in the registry

      • ShareFileDesktop-v1.19.1027.0.exe (PID: 2924)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 716)
      • ShareFileDesktop-v1.19.1027.0.exe (PID: 2788)
      • chrome.exe (PID: 3572)
      • ShareFileDesktop-v1.19.1027.0.exe (PID: 2924)
      • msiexec.exe (PID: 3244)
    • Creates a software uninstall entry

      • ShareFileDesktop-v1.19.1027.0.exe (PID: 2924)
    • Creates files in the user directory

      • msiexec.exe (PID: 3244)
      • ShareFile.Client.WindowsDesktop.exe (PID: 1284)
    • Changes IE settings (feature browser emulation)

      • msiexec.exe (PID: 3244)
    • Reads Environment values

      • ShareFile.Client.WindowsDesktop.exe (PID: 1284)
    • Reads internet explorer settings

      • ShareFile.Client.WindowsDesktop.exe (PID: 1284)
  • INFO

    • Application launched itself

      • chrome.exe (PID: 716)
      • msiexec.exe (PID: 3244)
    • Reads settings of System Certificates

      • chrome.exe (PID: 3572)
    • Creates a software uninstall entry

      • msiexec.exe (PID: 3244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
16
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sharefiledesktop-v1.19.1027.0.exe sharefiledesktop-v1.19.1027.0.exe msiexec.exe msiexec.exe no specs sharefile.client.windowsdesktop.exe chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
716"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.sf-cdn.net/downloads/sfdesktop/ShareFileDesktop-v1.19.1027.0.exeC:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
2244"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=73.0.3683.75 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6f660f18,0x6f660f28,0x6f660f34C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
1960"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=332 --on-initialized-event-handle=308 --parent-handle=312 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
2996"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1000,10472020817386206667,17024858077240079286,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=9767620293730585136 --mojo-platform-channel-handle=996 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
73.0.3683.75
3572"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,10472020817386206667,17024858077240079286,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=819762846999301004 --mojo-platform-channel-handle=1520 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
73.0.3683.75
728"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,10472020817386206667,17024858077240079286,131072 --enable-features=PasswordImport --service-pipe-token=6802940444899208819 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6802940444899208819 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
73.0.3683.75
1880"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,10472020817386206667,17024858077240079286,131072 --enable-features=PasswordImport --service-pipe-token=1319514406212120930 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1319514406212120930 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Version:
73.0.3683.75
968"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,10472020817386206667,17024858077240079286,131072 --enable-features=PasswordImport --service-pipe-token=8557134004426551463 --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=8557134004426551463 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
1964"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1000,10472020817386206667,17024858077240079286,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAACAAwAAAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=2727708879223389277 --mojo-platform-channel-handle=3428 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exechrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
73.0.3683.75
2788"C:\Users\admin\Downloads\ShareFileDesktop-v1.19.1027.0.exe" C:\Users\admin\Downloads\ShareFileDesktop-v1.19.1027.0.exe
chrome.exe
User:
admin
Company:
Citrix
Integrity Level:
MEDIUM
Description:
ShareFile Desktop
Version:
1.19.1027.0
Total events
2 521
Read events
1 919
Write events
0
Delete events
0

Modification events

No data
Executable files
79
Suspicious files
23
Text files
87
Unknown types
13

Dropped files

PID
Process
Filename
Type
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\index
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_0
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_2
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_3
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\48f430b9-197f-4809-b8c5-b3747cdb460e.tmp
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000018.dbtmp
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\index
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_0
MD5:
SHA256:
716chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
MD5:
SHA256:
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
25
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3572
chrome.exe
GET
200
13.107.4.50:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
3572
chrome.exe
GET
200
52.85.188.184:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3572
chrome.exe
172.217.16.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
3572
chrome.exe
172.217.22.99:443
ssl.gstatic.com
Google Inc.
US
whitelisted
3572
chrome.exe
52.85.188.184:80
x.ss2.us
Amazon.com, Inc.
US
whitelisted
3572
chrome.exe
216.58.205.238:443
sb-ssl.google.com
Google Inc.
US
whitelisted
3572
chrome.exe
13.107.4.50:80
www.download.windowsupdate.com
Microsoft Corporation
US
whitelisted
3572
chrome.exe
52.85.189.169:443
www.sf-cdn.net
Amazon.com, Inc.
US
unknown
3572
chrome.exe
172.217.16.141:443
accounts.google.com
Google Inc.
US
suspicious
1284
ShareFile.Client.WindowsDesktop.exe
52.87.3.154:443
g.sf-api.com
Amazon.com, Inc.
US
unknown
1284
ShareFile.Client.WindowsDesktop.exe
172.217.16.168:443
ssl.google-analytics.com
Google Inc.
US
whitelisted
1284
ShareFile.Client.WindowsDesktop.exe
172.217.18.168:443
ssl.google-analytics.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 172.217.16.195
whitelisted
www.sf-cdn.net
  • 52.85.189.169
suspicious
accounts.google.com
  • 172.217.16.141
shared
x.ss2.us
  • 52.85.188.184
  • 52.85.188.243
  • 52.85.188.34
  • 52.85.188.60
whitelisted
www.download.windowsupdate.com
  • 13.107.4.50
whitelisted
sb-ssl.google.com
  • 216.58.205.238
whitelisted
ssl.gstatic.com
  • 172.217.22.99
whitelisted
g.sf-api.com
  • 52.87.3.154
  • 52.1.177.90
unknown
ssl.google-analytics.com
  • 172.217.16.168
  • 172.217.18.168
whitelisted
secure.sharefile.com
  • 52.3.211.188
  • 52.22.72.157
whitelisted

Threats

No threats detected
Process
Message
ShareFile.Client.WindowsDesktop.exe
Sparkle:Void .ctor(ShareFile.Client.Windows.NetSparkleÄ
ShareFile.Client.WindowsDesktop.exe
Sparkle:Void .ctor(ShareFile.Client.Windows.NetSparkle.NetSparkleConfiguration) Entry
ShareFile.Client.WindowsDesktop.exe
ShareFile.Client.WindowsDesktop.exe Information: 0 :
ShareFile.Client.WindowsDesktop.exe
Sparkle:Void .ctor(ShareFile.Client.Windows.NetSparkle.NetSparkleConfiguration) Checking the current entry assembly: file:///C:/Users/admin/AppData/Local/Citrix/ShareFile/Desktop/ShareFile.Client.WindowsDesktop.exe
ShareFile.Client.WindowsDesktop.exe
ShareFile.Client.WindowsDesktop.exe Information: 0 :
ShareFile.Client.WindowsDesktop.exe
Sparkle:Void .ctor(ShareFile.Client.Windows.NetSparkle.NetSparkleConfiguration) Using the following url: https://www.sf-cdn.net/downloads/sfdesktop/updates2.xml
ShareFile.Client.WindowsDesktop.exe
ShareFile.Client.WindowsDesktop.exe Information: 0 :
ShareFile.Client.WindowsDesktop.exe
Sparkle:Void .ctor(ShareFile.Client.Windows.NetSparkle.NetSparkleConfiguration) Reading config...
ShareFile.Client.WindowsDesktop.exe
Sparkle:Void .ctor(ShareFile.Client.Windows.NetSparkle.NetSparkleConfiguration) Exit
ShareFile.Client.WindowsDesktop.exe
Sparkle:Void .ctor(ShareFile.Client.Windows.NetSparkle.NetSparkleConfiguration) Exit