File name:

DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe

Full analysis: https://app.any.run/tasks/e5a50939-c756-4623-9d9b-22a5a1c504d0
Verdict: Malicious activity
Analysis date: March 25, 2024, 21:00:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E784871B03036596699BD694D137E685

SHA1:

31785A76AC15BCF2EF1E701A8619421531C34EF2

SHA256:

2B50B78F45AEB5D3F395719518E62E68A4F64FE4B94F62837FFBF22D11879023

SSDEEP:

12288:VtIAlouyt8wNKgLnXYGaO113YWCvCYmRPy/+vgnFWvAWQ9ypHnwOf:VtIAlouyt8wNKgLnXTaI13YWCvCYoPyA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
  • SUSPICIOUS

    • Reads the date of Windows installation

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
    • Reads the Internet Settings

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
      • Usermode Font Driver Host.exe (PID: 2292)
    • The process creates files with name similar to system file names

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
    • Executable content was dropped or overwritten

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
    • Reads security settings of Internet Explorer

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
    • Application launched itself

      • Usermode Font Driver Host.exe (PID: 3940)
  • INFO

    • Reads the machine GUID from the registry

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
      • DDDL_Activator.exe (PID: 3964)
    • Create files in a temporary directory

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
    • Reads the computer name

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
      • DDDL_Activator.exe (PID: 3964)
      • Usermode Font Driver Host.exe (PID: 2292)
    • Checks supported languages

      • DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe (PID: 1692)
      • Usermode Font Driver Host.exe (PID: 2292)
      • DDDL_Activator.exe (PID: 3964)
    • Application launched itself

      • msedge.exe (PID: 3488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.3)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:12:29 12:41:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 1.73
CodeSize: 160768
InitializedDataSize: 135168
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
FileDescription: KeygenApp
ProductName: KeygenApp
FileVersion: 1.0.0.0
ProductVersion: 1.0.0.0
LegalCopyright: Copyright © 2022
OriginalFileName: KeygenApp.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
15
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dddl 8.15, 8.16 keygen level 10 pc unlocked.exe dddl_activator.exe no specs usermode font driver host.exe no specs usermode font driver host.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1336"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2148 --field-trial-handle=1344,i,15591661348829253052,8274364626255128301,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1404"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1324 --field-trial-handle=1344,i,15591661348829253052,8274364626255128301,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1544"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1472 --field-trial-handle=1344,i,15591661348829253052,8274364626255128301,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1636"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=3176 --field-trial-handle=1344,i,15591661348829253052,8274364626255128301,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1644"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1344,i,15591661348829253052,8274364626255128301,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1692"C:\Users\admin\AppData\Local\Temp\DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe" C:\Users\admin\AppData\Local\Temp\DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dddl 8.15, 8.16 keygen level 10 pc unlocked.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1844"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2160 --field-trial-handle=1344,i,15591661348829253052,8274364626255128301,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1936"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2160 --field-trial-handle=1344,i,15591661348829253052,8274364626255128301,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2064"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6a22f598,0x6a22f5a8,0x6a22f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2292"C:\Users\admin\AppData\Local\Temp\Usermode Font Driver Host.exe"C:\Users\admin\AppData\Local\Temp\Usermode Font Driver Host.exeUsermode Font Driver Host.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2148734720
Modules
Images
c:\users\admin\appdata\local\temp\usermode font driver host.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
8 639
Read events
8 499
Write events
138
Delete events
2

Modification events

(PID) Process:(1692) DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1692) DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1692) DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1692) DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1692) DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3488) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3488) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3488) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3488) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3488) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
Executable files
2
Suspicious files
13
Text files
24
Unknown types
12

Dropped files

PID
Process
Filename
Type
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF1834b7.TMP
MD5:
SHA256:
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old
MD5:
SHA256:
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1834c7.TMP
MD5:
SHA256:
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old
MD5:
SHA256:
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF1834f5.TMP
MD5:
SHA256:
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old
MD5:
SHA256:
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State~RF183469.TMPbinary
MD5:2E4F5B4F652DAFFD9C80C58770313C9C
SHA256:21BC9F7B1F0EC2B6DF8435AC271D31602B57FBE030AFAB94761F399CF3D9076E
3488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:DF0BCCD68449F07F531D76F53C718178
SHA256:12025F4DA9E53A8B91892D4F6E6A9B89513F3488BFE9F1EEEC3C05F7EF96BDD8
1692DDDL 8.15, 8.16 KEYGEN LEVEL 10 PC UNLOCKED.exeC:\Users\admin\AppData\Local\Temp\Usermode Font Driver Host.exeexecutable
MD5:810570D755E60DF665D900B150491484
SHA256:771517244569A6C9FB07C5D7647AC81ACE7E0471ED4EBD6BCA30777DC6F71E4F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
15
DNS requests
24
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
1080
svchost.exe
224.0.0.252:5355
unknown
3488
msedge.exe
239.255.255.250:1900
unknown
1644
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1644
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1644
msedge.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
1644
msedge.exe
23.35.230.168:443
learn.microsoft.com
AKAMAI-AS
DE
unknown
1644
msedge.exe
13.107.246.60:443
wcpstatic.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1644
msedge.exe
52.17.32.208:443
mscom.demdex.net
AMAZON-02
IE
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
learn.microsoft.com
  • 23.35.230.168
whitelisted
wcpstatic.microsoft.com
  • 13.107.246.60
  • 13.107.213.60
whitelisted
js.monitor.azure.com
  • 13.107.246.60
  • 13.107.213.60
whitelisted
mscom.demdex.net
  • 52.17.32.208
  • 3.248.85.196
  • 54.76.68.76
  • 52.208.77.120
  • 34.247.203.10
  • 52.49.147.36
  • 52.215.99.44
  • 54.229.250.195
whitelisted
microsoftmscompoc.tt.omtrdc.net
  • 66.235.152.156
  • 66.235.152.225
  • 66.235.152.221
whitelisted
target.microsoft.com
  • 66.235.152.156
  • 66.235.152.225
  • 66.235.152.221
whitelisted
mdec.nelreports.net
  • 2.21.20.138
  • 2.21.20.143
whitelisted

Threats

No threats detected
No debug info