analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.zebra.com/us/en/support-downloads/eula/unrestricted-eula.-227178c9720c025483893483886ea540bd07dd0f9873752cf891686eb495040ba85f97bf163f9fdbc62ce8bbe325bdf8d7c463f51a4ad0a6a906cd075f933a451ef3005a5bc81cd05c75f414a9073d4b71395853b10f27e.html#

Full analysis: https://app.any.run/tasks/96204593-d8b7-4535-b74d-08eedbb167d6
Verdict: Malicious activity
Analysis date: June 30, 2020, 15:54:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5EE1C884B43211D87B355C4EEE375E39

SHA1:

E94B5C9383617C6E19277B05F6DBD6A4F3DECDF9

SHA256:

259F95C3D5B439E1709FE7FF90EA749EB03B77227CAF97C904F624DA9F34735A

SSDEEP:

6:2OLoyoY2VKnRuEEgoZSWog6g+DANPuEWSHSLtDn:2RQRuEEgosyoAduEI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • zsu-1191286.exe (PID: 2584)
      • zsu-1191286.exe (PID: 2784)
      • zsu-1-1-9-1286.exe (PID: 3764)
      • PrnUtils.exe (PID: 2376)
      • PrnInst.exe (PID: 1340)
      • PrnInst.exe (PID: 1000)

    • Loads dropped or rewritten executable

      • zsu-1-1-9-1286.exe (PID: 3764)
      • PrnUtils.exe (PID: 2376)
      • PrnInst.exe (PID: 1340)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1464)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3968)
      • chrome.exe (PID: 1464)
      • zsu-1191286.exe (PID: 2584)
      • zsu-1-1-9-1286.exe (PID: 3764)
      • msiexec.exe (PID: 2684)
      • PrnInst.exe (PID: 1340)
      • DrvInst.exe (PID: 2836)

    • Reads the Windows organization settings

      • zsu-1-1-9-1286.exe (PID: 3764)

    • Reads Windows owner or organization settings

      • zsu-1-1-9-1286.exe (PID: 3764)

    • Creates files in the program directory

      • zsu-1-1-9-1286.exe (PID: 3764)
      • zsu-1191286.exe (PID: 2584)

    • Creates a software uninstall entry

      • zsu-1-1-9-1286.exe (PID: 3764)

    • Executed via COM

      • DrvInst.exe (PID: 2836)

    • Uses RUNDLL32.EXE to load library

      • DrvInst.exe (PID: 2836)

    • Executed as Windows Service

      • vssvc.exe (PID: 3988)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2836)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2836)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 2836)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 588)
      • iexplore.exe (PID: 444)
      • chrome.exe (PID: 1464)

    • Application launched itself

      • iexplore.exe (PID: 444)
      • chrome.exe (PID: 1464)
      • msiexec.exe (PID: 2684)

    • Changes internet zones settings

      • iexplore.exe (PID: 444)

    • Creates files in the user directory

      • iexplore.exe (PID: 444)
      • iexplore.exe (PID: 588)

    • Reads internet explorer settings

      • iexplore.exe (PID: 588)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 444)
      • chrome.exe (PID: 1464)
      • iexplore.exe (PID: 588)
      • chrome.exe (PID: 3968)
      • DrvInst.exe (PID: 2836)

    • Manual execution by user

      • chrome.exe (PID: 1464)
      • explorer.exe (PID: 2784)

    • Reads the hosts file

      • chrome.exe (PID: 1464)
      • chrome.exe (PID: 3968)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2684)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3988)

    • Searches for installed software

      • DrvInst.exe (PID: 2836)

    • Creates files in the program directory

      • msiexec.exe (PID: 2684)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 2836)
      • iexplore.exe (PID: 444)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 2836)
      • iexplore.exe (PID: 444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
99
Monitored processes
51
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs zsu-1191286.exe no specs zsu-1191286.exe zsu-1-1-9-1286.exe chrome.exe no specs chrome.exe no specs msiexec.exe msiexec.exe no specs prnutils.exe no specs prninst.exe explorer.exe no specs drvinst.exe rundll32.exe no specs vssvc.exe no specs prninst.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Program Files\Internet Explorer\iexplore.exe" https://www.zebra.com/us/en/support-downloads/eula/unrestricted-eula.-227178c9720c025483893483886ea540bd07dd0f9873752cf891686eb495040ba85f97bf163f9fdbc62ce8bbe325bdf8d7c463f51a4ad0a6a906cd075f933a451ef3005a5bc81cd05c75f414a9073d4b71395853b10f27e.html#C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
588"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:444 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
1464"C:\Program Files\Google\Chrome\Application\chrome.exe" C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3744"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=75.0.3770.100 --initial-client-data=0x7c,0x80,0x84,0x78,0x88,0x6bc0a9d0,0x6bc0a9e0,0x6bc0a9ecC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
1980"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=3840 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
3132"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1012,8709472624927315624,16173186310965599544,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=17968295626726786301 --mojo-platform-channel-handle=960 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
3968"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1012,8709472624927315624,16173186310965599544,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=2748191821864517450 --mojo-platform-channel-handle=1668 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
75.0.3770.100
272"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1012,8709472624927315624,16173186310965599544,131072 --enable-features=PasswordImport --lang=en-US --instant-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=14202709947731925827 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
3596"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1012,8709472624927315624,16173186310965599544,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=11176150169481151916 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2492 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
75.0.3770.100
2756"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1012,8709472624927315624,16173186310965599544,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2922970784233900411 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2512 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Total events
10 058
Read events
2 491
Write events
0
Delete events
0

Modification events

No data
Executable files
263
Suspicious files
412
Text files
2 981
Unknown types
143

Dropped files

PID
Process
Filename
Type
588iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\CabA068.tmp —
MD5:—
SHA256:—
588iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\TarA069.tmp —
MD5:—
SHA256:—
588iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6der
MD5:1C6771A076A3A2A892B000CBF0D1E2CB
SHA256:5BD433677A3F046883667A52BF66EB784DD63B629C0DD002A5130AA65F4D783C
588iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\2Z9G8EJS.txttext
MD5:95E12DD0C11A135C7330796693959BB2
SHA256:6E9693230A80C215F6C72AB2AEA2CC49E2BD986865D3A3F4FA4C7D955CC269EE
588iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\salesforcechat.min[1].csstext
MD5:ECC9F5A2084E19B4AA4141D3397FA168
SHA256:B182690972AF6C2961CF27D7CE07FE22020CDD7697320D5C72FB5263362FAB99
588iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\contexthub.kernel[1].jstext
MD5:1F77CC856EEB796D60CFC786E66113A0
SHA256:66790E5C8D216C32E1FAE13B7F752CAF00EC75347B5B9E302168296484823B48
588iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\clientlibrarymanager.min[1].jshtml
MD5:322D93F8A0AC069727E51151EF8552C5
SHA256:725DA7F6AE81A5795D07D864AE471566A921DB4CD597672935C97331A8D5EE01
588iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\unrestricted-eula.-227178c9720c025483893483886ea540bd07dd0f9873752cf891686eb495040ba85f97bf163f9fdbc62ce8bbe325bdf8d7c463f51a4ad0a6a906cd075f933a451ef3005[1].htmhtml
MD5:AA85374D58DD017B3592FF6FD6CB07C0
SHA256:AC91DADFE5297B76F7D61E40965C5278F90EEE12342B4DBB862879764C4C769A
588iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:6FA320CE49532C7074AAA1F5046FF1E4
SHA256:046F22794BF5CC110A930B34D9D98992838AF90A2CE61EC11FC08917FDF45A59
588iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\csrf.min[1].jstext
MD5:F10484A622EC7880697EA8ECB9388E73
SHA256:E59222ED7E09AE7A2B5C2498B583915037239028F8849CC224A9D679F8DAEC64
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
87
TCP/UDP connections
358
DNS requests
167
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
588
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQQX6Z6gAidtSefNc6DC0OInqPHDQQUD4BhHIIxYdUvKOeNRji0LOHG2eICEAlRVEBguB2Evrq4EswHgKk%3D
US
der
471 b
whitelisted
588
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
588
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
588
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
588
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D
US
der
471 b
whitelisted
588
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
588
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
588
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
588
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
588
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAza5nSVYZrPeIlAtSf0Rcs%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
588
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
588
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
588
iexplore.exe
161.71.1.37:443
service.force.com
—
GB
unknown
588
iexplore.exe
151.101.192.114:443
cdn.evgnet.com
Fastly
US
unknown
588
iexplore.exe
2.16.186.59:443
use.typekit.net
Akamai International B.V.
—
whitelisted
588
iexplore.exe
104.108.57.39:443
www.zebra.com
Akamai Technologies, Inc.
NL
unknown
588
iexplore.exe
184.51.9.85:443
assets.adobedtm.com
Akamai Technologies, Inc.
US
whitelisted
444
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
588
iexplore.exe
192.124.249.22:80
ocsp.godaddy.com
Sucuri
US
suspicious
588
iexplore.exe
52.30.78.155:443
dpm.demdex.net
Amazon.com, Inc.
IE
unknown

DNS requests

Domain
IP
Reputation
www.zebra.com
  • 104.108.57.39
unknown
ocsp.digicert.com
  • 93.184.220.29
whitelisted
use.typekit.net
  • 2.16.186.59
  • 2.16.186.49
whitelisted
cdn.evgnet.com
  • 151.101.192.114
  • 151.101.0.114
  • 151.101.64.114
  • 151.101.128.114
whitelisted
assets.adobedtm.com
  • 184.51.9.85
whitelisted
service.force.com
  • 161.71.1.37
  • 161.71.0.165
  • 161.71.0.37
  • 161.71.1.38
  • 161.71.0.166
  • 161.71.0.38
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.zebra.com/us/en/support-downloads/eula/unrestricted-eula.-227178c9720c025483893483886ea540bd07dd0f9873752cf891686eb495040ba85f97bf163f9fdbc62ce8bbe325bdf8d7c463f51a4ad0a6a906cd075f933a451ef3005a5bc81cd05c75f414a9073d4b71395853b10f27e.html#