| File name: | kis21.3.10.391abcdefghijklru_26486.exe |
| Full analysis: | https://app.any.run/tasks/2c8562b0-dfc7-411c-93b4-57e0f3164ced |
| Verdict: | Malicious activity |
| Analysis date: | August 01, 2024, 15:44:15 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 8FCB378E0431A5FA683EDABC389469DA |
| SHA1: | 7066E5969BC74D669567F78479AE9A25BD3544EF |
| SHA256: | 2AD8F141ADBC514D9C864BF6A4BE66CCEA3ADDF6DB0839B31A9E890228596934 |
| SSDEEP: | 98304:EKBwrBQbYrniSos+Ej3+PNy+4jKEwb7Cnzmk207EXNe89jsTyOYok225h8z2z7tB:fjCk |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Application launched itself
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
Checks Windows Trust Settings
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Executable content was dropped or overwritten
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Reads Microsoft Outlook installation path
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Reads the date of Windows installation
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
INFO
Checks supported languages
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
- TEST_WPF.EXE (PID: 2584)
Create files in a temporary directory
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Creates files in the program directory
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Process checks whether UAC notifications are on
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Process checks Internet Explorer phishing filters
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Reads the computer name
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- TEST_WPF.EXE (PID: 2584)
Process checks computer location settings
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
Checks proxy server information
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Reads the machine GUID from the registry
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- TEST_WPF.EXE (PID: 2584)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Checks for the presence of KasperskyLab
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Reads the software policy settings
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 6424)
- kis21.3.10.391abcdefghijklru_26486.exe (PID: 1432)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1972:01:30 11:30:30+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.16 |
| CodeSize: | 302080 |
| InitializedDataSize: | 2393088 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x24c0 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 21.3.10.391 |
| ProductVersionNumber: | 21.3.10.391 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Лаборатория Касперского |
| FileDescription: | Kaspersky Internet Security [21.3.10.391.0.2520.0 (a.b.c.d.e.f.g.h.i.j.k.l)] |
| FileVersion: | 21.3.10.391 |
| LegalCopyright: | © 2021 АО "Лаборатория Касперского" |
| LegalTrademarks: | Зарегистрированные товарные знаки и знаки обслуживания являются собственностью их правообладателей |
| ProductName: | Kaspersky Internet Security |
| ProductVersion: | 21.3.10.391 |
| InternalName: | Setup |
| OriginalFileName: | Setup.exe |
Total processes
125
Monitored processes
3
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1432 | "C:\Users\admin\Desktop\kis21.3.10.391abcdefghijklru_26486.exe" /-elevated= | C:\Users\admin\Desktop\kis21.3.10.391abcdefghijklru_26486.exe | kis21.3.10.391abcdefghijklru_26486.exe | ||||||||||||
User: admin Company: Лаборатория Касперского Integrity Level: HIGH Description: Kaspersky Internet Security [21.3.10.391.0.2520.0 (a.b.c.d.e.f.g.h.i.j.k.l)] Version: 21.3.10.391 Modules
| |||||||||||||||
| 2584 | "C:\Users\admin\AppData\Local\Temp\1FB80EAB-501D-11EF-B4E3-18F7786F96EE\TEST_WPF.EXE" "C:\Users\admin\AppData\Local\Temp\9AE08BF1D105FE114B3E817F87F669EE\setup.dll" | C:\Users\admin\AppData\Local\Temp\1FB80EAB-501D-11EF-B4E3-18F7786F96EE\TEST_WPF.EXE | — | kis21.3.10.391abcdefghijklru_26486.exe | |||||||||||
User: admin Integrity Level: HIGH Description: test_wpf Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 6424 | "C:\Users\admin\Desktop\kis21.3.10.391abcdefghijklru_26486.exe" | C:\Users\admin\Desktop\kis21.3.10.391abcdefghijklru_26486.exe | explorer.exe | ||||||||||||
User: admin Company: Лаборатория Касперского Integrity Level: MEDIUM Description: Kaspersky Internet Security [21.3.10.391.0.2520.0 (a.b.c.d.e.f.g.h.i.j.k.l)] Version: 21.3.10.391 Modules
| |||||||||||||||
Total events
11 134
Read events
11 006
Write events
123
Delete events
5
Modification events
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2520.0 |
| Operation: | write | Name: | TrashFiles |
Value: C:\ProgramData\Kaspersky Lab Setup Files\KIS21.3.10.391.0.2520.0
| |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2520.0 |
| Operation: | write | Name: | TrashFiles |
Value: C:\ProgramData\Kaspersky Lab Setup Files\KIS21.3.10.391.0.2520.0
C:\ProgramData\Kaspersky Lab Setup Files
| |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\KasperskyLab\IEOverride\Main |
| Operation: | write | Name: | Enable Browser Extensions |
Value: no | |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\KasperskyLab\IEOverride\Main |
| Operation: | write | Name: | UseSWRender |
Value: 1 | |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (6424) kis21.3.10.391abcdefghijklru_26486.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
Executable files
3
Suspicious files
6
Text files
26
Unknown types
22
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F9E6092FC105FE114B3E817F87F669EE\setup.dll | executable | |
MD5:0F0081847656E278B7EFECA615BC973B | SHA256:— | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F2906EA0-501C-11EF-B4E3-18F7786F96EE\kis-print.css | text | |
MD5:1304724DD5001B2600FC5BD80C098F1E | SHA256:2481B34B48FD96B194405DA621E8E5F19142DCB55744F9C9A93591705CB697FD | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F2906EA0-501C-11EF-B4E3-18F7786F96EE\check_new_version.html | html | |
MD5:62DCA9A7607DC6F8BF9E43C1722446E4 | SHA256:801943D39ACB74BBE5CB3C42B9F95A26CAA36D0F1AD75743EA187B98CFB77BBA | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F2906EA0-501C-11EF-B4E3-18F7786F96EE\jquery.custom_select.min.js | binary | |
MD5:D2C620C462B75696EEA1FB22FB23602A | SHA256:DD678D32073078552E0E2C35EED78F16CC8D6E8662D4734518561A1B183F775C | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F2906EA0-501C-11EF-B4E3-18F7786F96EE\jquery-1.12.4.min.js | s | |
MD5:4F252523D4AF0B478C810C2547A63E19 | SHA256:668B046D12DB350CCBA6728890476B3EFEE53B2F42DBB84743E5E9F1AE0CC404 | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F2906EA0-501C-11EF-B4E3-18F7786F96EE\kis-script-lte-ie8.js | txt | |
MD5:5134186180074C51639D7A514919ED23 | SHA256:33E84B33FF911257E3A6A303C08A2CC178827DADB7DFD7C951E096866E02AD5E | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F2906EA0-501C-11EF-B4E3-18F7786F96EE\kis-script.js | binary | |
MD5:026425CCBF4417EEFA444285707132EF | SHA256:97E5F342227EA23C27C1B660F111847FCDD9D7B23C1D248C733A36F983FD7F04 | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F2906EA0-501C-11EF-B4E3-18F7786F96EE\kis-style.css | text | |
MD5:2B4BD0AFD0E9DD5C90FB8C3BB4A5D619 | SHA256:F9963B403E053F6BFA7C87CAD3C10DD55CF1F94FEFE00C6380921440E28B48D2 | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\Users\admin\AppData\Local\Temp\F2906EA0-501C-11EF-B4E3-18F7786F96EE\kis-logo.png | image | |
MD5:18F81892DAA926FEC1D30324B4CD9367 | SHA256:681A96B96B5E0425FC74BE929D29164528BF0BC0A84AC97952C011E407E23D9B | |||
| 6424 | kis21.3.10.391abcdefghijklru_26486.exe | C:\ProgramData\Kaspersky Lab Setup Files\KIS21.3.10.391.0.2520.0\kdscrl.rdb.z | compressed | |
MD5:8D5AF5785C43C875C885726409BD1ED1 | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
24
DNS requests
9
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | — | null:443 | https://www.not.existing.kaspersky.com/ | unknown | — | — | unknown |
— | — | GET | — | null:443 | https://www.not.existing.kaspersky.com/ | unknown | — | — | unknown |
1432 | kis21.3.10.391abcdefghijklru_26486.exe | GET | 301 | 81.19.104.200:80 | http://redirect.kaspersky.com/slideshow_default | GB | — | 246 b | whitelisted |
1432 | kis21.3.10.391abcdefghijklru_26486.exe | GET | 301 | 81.19.104.200:80 | http://redirect.kaspersky.com/slideshow_default | GB | — | 246 b | whitelisted |
1432 | kis21.3.10.391abcdefghijklru_26486.exe | GET | 301 | 81.19.104.200:80 | http://redirect.kaspersky.com/slideshow_default | GB | — | 246 b | whitelisted |
— | — | GET | — | null:443 | https://www.not.existing.kaspersky.com/ | unknown | — | — | unknown |
— | — | GET | 200 | 80.239.169.147:443 | https://dm.s.kaspersky-labs.com/ru-RU/KIS/21.3.10.391/ksn_ru-ru.txt | unknown | text | 87.2 Kb | unknown |
— | — | GET | 200 | 212.73.221.196:443 | https://dm.s.kaspersky-labs.com/ru-RU/KIS/21.3.10.391/product.msi.z | FR | compressed | 5.21 Mb | unknown |
— | — | GET | 200 | 212.73.221.196:443 | https://dm.s.kaspersky-labs.com/bases/kavkis2021mr3/kis/index-bases-x64-2.txt | FR | text | 4.38 Kb | unknown |
— | — | GET | 200 | 80.231.123.135:443 | https://dm.s.kaspersky-labs.com/kleaner/interactive2021.2/global/index-kleaner-2.txt | FR | text | 4.03 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4056 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | unknown |
2120 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | unknown |
2120 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
6424 | kis21.3.10.391abcdefghijklru_26486.exe | 212.73.221.196:443 | dm.s.kaspersky-labs.com | LEVEL3 | FR | unknown |
4056 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| unknown |
google.com |
| unknown |
dm.s.kaspersky-labs.com |
| unknown |
redirect.kaspersky.com |
| unknown |
www.not.existing.kaspersky.com |
| unknown |