URL:

https://github.com/th3ken-dev/TH3KEN-EDITON-GOLD/archive/master.zip

Full analysis: https://app.any.run/tasks/073a7cad-1575-4808-9a9d-07a386c45875
Verdict: Malicious activity
Analysis date: September 20, 2020, 12:05:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

1C4820B73432631A7E47419A871C3644

SHA1:

548CE5BCFC91951593B33EA083AE5CB55D0EFA82

SHA256:

27C4D5634B0789B864DB7235FD53E5542301710BE52FE8E689EB6E1ADC3F2155

SSDEEP:

3:N8tEdhNOw7sTqpc+zJo:2uwQzc2Jo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • TH3KEN EDİTON.exe (PID: 1892)
      • TH3KEN EDİTON.exe (PID: 1652)
      • FPS Unlocker.exe (PID: 1556)
      • Gold Updater.exe (PID: 1844)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3072)
      • TH3KEN EDİTON.exe (PID: 1892)

    • Changes settings of System certificates

      • TH3KEN EDİTON.exe (PID: 1892)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3836)
      • TH3KEN EDİTON.exe (PID: 1892)

    • Adds / modifies Windows certificates

      • TH3KEN EDİTON.exe (PID: 1892)

    • Reads Internet Cache Settings

      • TH3KEN EDİTON.exe (PID: 1892)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2292)
      • iexplore.exe (PID: 3292)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2292)

    • Application launched itself

      • iexplore.exe (PID: 3292)

    • Changes internet zones settings

      • iexplore.exe (PID: 3292)

    • Manual execution by user

      • TH3KEN EDİTON.exe (PID: 1652)
      • Gold Updater.exe (PID: 1844)
      • FPS Unlocker.exe (PID: 1556)
      • TH3KEN EDİTON.exe (PID: 1892)
      • rundll32.exe (PID: 3956)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe no specs iexplore.exe winrar.exe searchprotocolhost.exe no specs th3ken edi̇ton.exe no specs th3ken edi̇ton.exe fps unlocker.exe no specs gold updater.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1556"C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\FPS Unlocker.exe" C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\FPS Unlocker.exe—explorer.exe
User:
admin
Company:
TH3KEN A.S
Integrity Level:
MEDIUM
Description:
By TH3KEN Developer
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\th3ken-editon-gold-master\fps unlocker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1652"C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\TH3KEN EDİTON.exe" C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\TH3KEN EDİTON.exe—explorer.exe
User:
admin
Company:
TH3KEN A.S
Integrity Level:
MEDIUM
Description:
TH3KEN EDİTON
Exit code:
3221226540
Version:
10.9.0.0
Modules
Images
c:\users\admin\desktop\th3ken-editon-gold-master\th3ken edi̇ton.exe
c:\systemroot\system32\ntdll.dll
1844"C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\Gold Updater.exe" C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\Gold Updater.exe
explorer.exe
User:
admin
Company:
TH3KEN A.S
Integrity Level:
MEDIUM
Description:
TH3KEN Güncelleyici
Exit code:
4294967295
Version:
10.9.0.0
Modules
Images
c:\users\admin\desktop\th3ken-editon-gold-master\gold updater.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1892"C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\TH3KEN EDİTON.exe" C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\TH3KEN EDİTON.exe
explorer.exe
User:
admin
Company:
TH3KEN A.S
Integrity Level:
HIGH
Description:
TH3KEN EDİTON
Exit code:
0
Version:
10.9.0.0
Modules
Images
c:\users\admin\desktop\th3ken-editon-gold-master\th3ken edi̇ton.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2292"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3292 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3072"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3292"C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/th3ken-dev/TH3KEN-EDITON-GOLD/archive/master.zipC:\Program Files\Internet Explorer\iexplore.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3836"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\TH3KEN-EDITON-GOLD-master.zip"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3956"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\TH3KEN-EDITON-GOLD-master\v8.binC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
Total events
1 769
Read events
1 657
Write events
108
Delete events
4

Modification events

(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
1917930242
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30838598
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
16
Suspicious files
14
Text files
8
Unknown types
6

Dropped files

PID
Process
Filename
Type
2292iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab7896.tmp —
MD5:—
SHA256:—
2292iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar7897.tmp —
MD5:—
SHA256:—
2292iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\TH3KEN-EDITON-GOLD-master[1].zip —
MD5:—
SHA256:—
2292iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\TH3KEN-EDITON-GOLD-master.zip.yg3vynn.partial —
MD5:—
SHA256:—
3292iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF39B5C7574B9D0EFD.TMP —
MD5:—
SHA256:—
3292iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\TH3KEN-EDITON-GOLD-master.zip.yg3vynn.partial:Zone.Identifier —
MD5:—
SHA256:—
3292iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFDA04E6B2FCC4381F.TMP —
MD5:—
SHA256:—
3292iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{9E0DE5C1-FB39-11EA-8C46-12A9866C77DE}.dat —
MD5:—
SHA256:—
2292iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_B00CE8D5D4CF0E959CFDB61F636A135Dbinary
MD5:—
SHA256:—
2292iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABder
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
9
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2292
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2292
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2292
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAVXyAsoJoOhewoRRJMpa3k%3D
US
der
471 b
whitelisted
2292
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAVXyAsoJoOhewoRRJMpa3k%3D
US
der
471 b
whitelisted
2292
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwHO2dvZ0V4%2BZmBSFKERlE%3D
US
der
471 b
whitelisted
2292
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAwHO2dvZ0V4%2BZmBSFKERlE%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2292
iexplore.exe
140.82.121.4:443
github.com
—
US
malicious
2292
iexplore.exe
140.82.121.9:443
codeload.github.com
—
US
suspicious
1892
TH3KEN EDİTON.exe
104.28.30.205:443
th3kennetwork.xyz
Cloudflare Inc
US
unknown
1844
Gold Updater.exe
140.82.121.4:443
github.com
—
US
malicious
1844
Gold Updater.exe
151.101.0.133:443
raw.githubusercontent.com
Fastly
US
malicious
2292
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.4
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
codeload.github.com
  • 140.82.121.9
whitelisted
th3kennetwork.xyz
  • 104.28.30.205
  • 172.67.170.227
  • 104.28.31.205
suspicious
raw.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/th3ken-dev/TH3KEN-EDITON-GOLD/archive/master.zip