Malware analysis Hone - Installer.exe Malicious activity

Add for printing

File name:	Hone - Installer.exe
Full analysis:	https://app.any.run/tasks/7b9a41e8-c207-4b4f-acbe-945724e9b5e8
Verdict:	Malicious activity
Analysis date:	January 02, 2025, 18:04:20
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	arch-exec
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:	5BB17FB2C53D4DC7427D0E526CF1AD8A
SHA1:	C96C9DF5F626FDE444B29AF1929A94DE881E66F6
SHA256:	2FE2FE9E4B01502C23F64C2707D69F0C42B1501115519EC612C833905EC9E397
SSDEEP:	98304:d/d5kO4fJ/A9nGcRa1xXcVsy3RxeLLCIJgap176MVhAuMdehHtW3FRgpXNhW2Gep:BZc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: on
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Executing a file with an untrusted certificate
  - ow-electron-setup.exe (PID: 3812)
  - Hone.exe (PID: 4444)
  - Hone.exe (PID: 1416)
  - Hone.exe (PID: 6604)
  - Hone.exe (PID: 4144)
  - Hone.exe (PID: 244)
  - HoneStartup.exe (PID: 6576)
  - Hone.exe (PID: 2380)
  - gamefinder472.exe (PID: 6204)
  - gamefinder472.exe (PID: 936)
  - Hone.exe (PID: 5988)
- Changes powershell execution policy (Unrestricted)
  - Hone.exe (PID: 4444)
SUSPICIOUS
- Malware-specific behavior (creating "System.dll" in Temp)
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6176)
  - Hone - Installer.exe (PID: 6700)
  - Hone - Installer.exe (PID: 6796)
  - ow-electron-setup.exe (PID: 3812)
- Reads security settings of Internet Explorer
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6176)
  - OWInstaller.exe (PID: 6560)
  - Hone - Installer.exe (PID: 6700)
  - Hone - Installer.exe (PID: 6796)
  - OWInstaller.exe (PID: 6876)
- Drops 7-zip archiver for unpacking
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6176)
  - Hone - Installer.exe (PID: 6700)
  - Hone - Installer.exe (PID: 6796)
- The process creates files with name similar to system file names
  - Hone - Installer.exe (PID: 6176)
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6700)
  - Hone - Installer.exe (PID: 6796)
  - ow-electron-setup.exe (PID: 3812)
- Executable content was dropped or overwritten
  - Hone - Installer.exe (PID: 6176)
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6700)
  - Hone - Installer.exe (PID: 6796)
  - ow-electron-setup.exe (PID: 3812)
- Application launched itself
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6700)
  - Hone.exe (PID: 4444)
- Reads Microsoft Outlook installation path
  - OWInstaller.exe (PID: 6560)
  - OWInstaller.exe (PID: 6876)
- Reads Internet Explorer settings
  - OWInstaller.exe (PID: 6560)
  - OWInstaller.exe (PID: 6876)
- Checks Windows Trust Settings
  - OWInstaller.exe (PID: 6876)
  - OWInstaller.exe (PID: 6560)
- Reads the date of Windows installation
  - OWInstaller.exe (PID: 6560)
- The process drops C-runtime libraries
  - ow-electron-setup.exe (PID: 3812)
- Process drops legitimate windows executable
  - ow-electron-setup.exe (PID: 3812)
- Drops a system driver (possible attempt to evade defenses)
  - ow-electron-setup.exe (PID: 3812)
- Creates a software uninstall entry
  - ow-electron-setup.exe (PID: 3812)
- Starts CMD.EXE for commands execution
  - Hone.exe (PID: 4444)
- Uses REG/REGEDIT.EXE to modify registry
  - cmd.exe (PID: 6480)
  - cmd.exe (PID: 6520)
  - cmd.exe (PID: 4052)
- Starts POWERSHELL.EXE for commands execution
  - Hone.exe (PID: 4444)
  - cmd.exe (PID: 2280)
- The process hides Powershell's copyright startup banner
  - Hone.exe (PID: 4444)
- The process bypasses the loading of PowerShell profile settings
  - Hone.exe (PID: 4444)
- The process executes Powershell scripts
  - cmd.exe (PID: 2280)
INFO
- Reads the computer name
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6176)
  - OWInstaller.exe (PID: 6560)
  - Hone - Installer.exe (PID: 6700)
  - Hone - Installer.exe (PID: 6796)
  - OWInstaller.exe (PID: 6876)
  - ow-electron-setup.exe (PID: 3812)
  - Hone.exe (PID: 4444)
  - Hone.exe (PID: 1416)
  - Hone.exe (PID: 6604)
- Checks supported languages
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6176)
  - Hone - Installer.exe (PID: 6700)
  - OWInstaller.exe (PID: 6560)
  - Hone - Installer.exe (PID: 6796)
  - OWInstaller.exe (PID: 6876)
  - ow-electron-setup.exe (PID: 3812)
  - Hone.exe (PID: 6604)
  - Hone.exe (PID: 5988)
  - Hone.exe (PID: 1416)
  - Hone.exe (PID: 4144)
  - Hone.exe (PID: 244)
  - Hone.exe (PID: 2380)
  - Hone.exe (PID: 4444)
  - HoneStartup.exe (PID: 1460)
- The sample compiled with english language support
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6176)
  - Hone - Installer.exe (PID: 6700)
  - Hone - Installer.exe (PID: 6796)
  - ow-electron-setup.exe (PID: 3812)
- Process checks computer location settings
  - Hone - Installer.exe (PID: 5920)
  - Hone - Installer.exe (PID: 6700)
  - OWInstaller.exe (PID: 6560)
  - Hone.exe (PID: 4444)
  - Hone.exe (PID: 5988)
  - Hone.exe (PID: 244)
  - Hone.exe (PID: 4144)
  - Hone.exe (PID: 2380)
- Create files in a temporary directory
  - Hone - Installer.exe (PID: 6176)
  - Hone - Installer.exe (PID: 5920)
  - OWInstaller.exe (PID: 6560)
  - Hone - Installer.exe (PID: 6700)
  - Hone - Installer.exe (PID: 6796)
  - OWInstaller.exe (PID: 6876)
  - ow-electron-setup.exe (PID: 3812)
  - Hone.exe (PID: 4444)
- Checks proxy server information
  - Hone - Installer.exe (PID: 6176)
  - OWInstaller.exe (PID: 6560)
  - Hone - Installer.exe (PID: 6796)
  - OWInstaller.exe (PID: 6876)
  - Hone.exe (PID: 4444)
- Disables trace logs
  - OWInstaller.exe (PID: 6560)
  - OWInstaller.exe (PID: 6876)
- Creates files or folders in the user directory
  - OWInstaller.exe (PID: 6560)
  - Hone - Installer.exe (PID: 6176)
  - OWInstaller.exe (PID: 6876)
  - Hone - Installer.exe (PID: 6796)
  - ow-electron-setup.exe (PID: 3812)
  - Hone.exe (PID: 4444)
  - Hone.exe (PID: 1416)
- Reads Environment values
  - OWInstaller.exe (PID: 6560)
  - OWInstaller.exe (PID: 6876)
  - Hone.exe (PID: 4444)
- Manual execution by a user
  - Hone - Installer.exe (PID: 6700)
- Reads the software policy settings
  - OWInstaller.exe (PID: 6560)
  - OWInstaller.exe (PID: 6876)
  - Hone.exe (PID: 6604)
- The process uses the downloaded file
  - OWInstaller.exe (PID: 6560)
  - OWInstaller.exe (PID: 6876)
- Reads the machine GUID from the registry
  - OWInstaller.exe (PID: 6876)
  - OWInstaller.exe (PID: 6560)
  - Hone.exe (PID: 4444)
- Reads product name
  - Hone.exe (PID: 4444)
- Creates files in the program directory
  - ow-electron-setup.exe (PID: 3812)
  - Hone.exe (PID: 4444)
- Reads CPU info
  - Hone.exe (PID: 4444)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (67.4)
.dll	\|	Win32 Dynamic Link Library (generic) (14.2)
.exe	\|	Win32 Executable (generic) (9.7)
.exe	\|	Generic Win/DOS Executable (4.3)
.exe	\|	DOS Executable Generic (4.3)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2021:09:25 21:57:46+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	27136
InitializedDataSize:	186880
UninitializedDataSize:	2048
EntryPoint:	0x352d
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	2.265.0.3
ProductVersionNumber:	2.265.0.3
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
Comments:	-
CompanyName:	Overwolf Ltd.
FileDescription:	Hone
FileVersion:	2.265.0.3
LegalCopyright:	Copyright (C) 2021 Overwolf Ltd. All Rights Reserved.
LegalTrademarks:	-
ProductName:	Hone
ProductVersion:	2.265.0.3

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

166

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

244

"C:\Users\admin\AppData\Local\Programs\Hone\Hone.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\Hone" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=Hone --app-path="C:\Users\admin\AppData\Local\Programs\Hone\resources\app.asar" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3812,i,9893929753588565144,1367316892662291030,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1

C:\Users\admin\AppData\Local\Programs\Hone\Hone.exe

—

Hone.exe

User:

admin

Company:

AuraSide Inc

Integrity Level:

HIGH

Description:

Hone

Version:

1.1.41

Modules

Images
c:\users\admin\appdata\local\programs\hone\hone.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

936

C:\Users\admin\AppData\Local\Programs\Hone\resources\assets\hone-resources\gamefinder472.exe --installed-only

C:\Users\admin\AppData\Local\Programs\Hone\resources\assets\hone-resources\gamefinder472.exe

—

Hone.exe

User:

admin

Company:

AuraSide, Inc

Integrity Level:

HIGH

Description:

gamedetector

Version:

1.0.2.4

1416

"C:\Users\admin\AppData\Local\Programs\Hone\Hone.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\admin\AppData\Roaming\Hone" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --field-trial-handle=2036,i,9893929753588565144,1367316892662291030,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3

C:\Users\admin\AppData\Local\Programs\Hone\Hone.exe

Hone.exe

User:

admin

Company:

AuraSide Inc

Integrity Level:

HIGH

Description:

Hone

Version:

1.1.41

Modules

Images
c:\users\admin\appdata\local\programs\hone\hone.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1460

C:\Users\admin\AppData\Local\Programs\Hone\resources\assets\hone-resources\HoneStartup.exe

—

Hone.exe

User:

admin

Integrity Level:

HIGH

Modules

Images
c:\users\admin\appdata\local\programs\hone\resources\assets\hone-resources\honestartup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\gdi32.dll

1480

"C:\WINDOWS\System32\WindowsPowershell\v1.0\powershell.exe" -Command "Unblock-File -Path 'c:\ProgramData\Microsoft\bbba12b9-7672-4b4a-bd7c-20c6dac5c9fa.ps1'"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows PowerShell

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

2008

reg add "hklm\Software\Classes\hone" /ve /t REG_SZ /d "URL:hone" /f

C:\Windows\System32\reg.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Registry Console Tool

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

2280

C:\WINDOWS\system32\cmd.exe /d /s /c ""C:\WINDOWS\System32\WindowsPowershell\v1.0\powershell.exe" -Command "Unblock-File -Path 'c:\ProgramData\Microsoft\bbba12b9-7672-4b4a-bd7c-20c6dac5c9fa.ps1'""

C:\Windows\System32\cmd.exe

—

Hone.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows Command Processor

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll

2380

"C:\Users\admin\AppData\Local\Programs\Hone\Hone.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\Hone" --standard-schemes=owepm --secure-schemes=owepm --bypasscsp-schemes=owepm --fetch-schemes=owepm --streaming-schemes=owepm --app-user-model-id=Hone --app-path="C:\Users\admin\AppData\Local\Programs\Hone\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3856,i,9893929753588565144,1367316892662291030,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3852 --uid=mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc --package-folder="C:\Users\admin\AppData\Roaming\ow-electron" --app-root="C:\Users\admin\AppData\Local\Programs\Hone\resources\app.asar" --muid=bb926e54-e3ca-40fd-ae90-2764341e7792 --phase=43 --owepm-config="{\"phasing\":100}" --js-flags=--expose-gc /prefetch:1

C:\Users\admin\AppData\Local\Programs\Hone\Hone.exe

—

Hone.exe

User:

admin

Company:

AuraSide Inc

Integrity Level:

HIGH

Description:

Hone

Version:

1.1.41

Modules

Images
c:\users\admin\appdata\local\programs\hone\hone.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

3288

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

gamefinder472.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

3812

"C:\Users\admin\AppData\Local\Temp\ow-electron-setup-mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc\ow-electron-setup.exe" /S --force-run /d="C:\Users\admin\AppData\Local\Programs\Hone"

C:\Users\admin\AppData\Local\Temp\ow-electron-setup-mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc\ow-electron-setup.exe

OWInstaller.exe

User:

admin

Company:

AuraSide Inc

Integrity Level:

HIGH

Description:

Hone installer for Windows

Exit code:

Version:

1.1.41.0

Modules

Images
c:\users\admin\appdata\local\temp\ow-electron-setup-mgkabooemhaamambocobpeoeelpadcjhjgbcfhlc\ow-electron-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll

Add for printing

Total events

19 592

Read events

19 510

Write events

Delete events

Modification events


(PID) Process:	(6176) Hone - Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(6560) OWInstaller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\OverwolfPersist
Operation:	write	Name:	MUIDV2
Value: c55b4507-9f0a-40c5-b1e2-734956efb083
(PID) Process:	(6560) OWInstaller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\OverwolfPersist
Operation:	write	Name:	MUIDV2
Value: c55b4507-9f0a-40c5-b1e2-734956efb083
(PID) Process:	(6560) OWInstaller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(6560) OWInstaller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(6560) OWInstaller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(6176) Hone - Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(6176) Hone - Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(6560) OWInstaller.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Overwolf
Operation:	write	Name:	MUID
Value: bb926e54-e3ca-40fd-ae90-2764341e7792
(PID) Process:	(6560) OWInstaller.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\OverwolfElectron
Operation:	write	Name:	MUID
Value: bb926e54-e3ca-40fd-ae90-2764341e7792

Add for printing

Executable files

Suspicious files

210

Text files

248

Unknown types

Dropped files

PID	Process	Filename		Type
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\nsProcess.dll		executable
		MD5:10E47E822B85D2A12FA4727001612182	SHA256:D530589A90918334B8E08D7355630892DD62F41333D948A860735D5BECFCB391
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\OWInstaller.exe		executable
		MD5:1B49AA2792BAE165B1A8EDB20CB5D675	SHA256:522A50B813B24EACA425DBF17CF4ABFAD8ACF75AC3071D4D0569EFDC8F5F4F92
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\System.dll		executable
		MD5:51BD16A2EA23AE1E7A92CEDC6785C82E	SHA256:4DBC79D2B1C7987CC64BB5D014DB81BB5108BDD6D8BF3A5F820FAC1DED62BE33
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\UserInfo.dll		executable
		MD5:1DD4CA0F4A94155F8D46EC95A20ADA4A	SHA256:A27DC3069793535CB64123C27DCA8748983D133C8FA5AADDEE8CDBC83F16986D
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\Newtonsoft.Json.dll		executable
		MD5:98CBB64F074DC600B23A2EE1A0F46448	SHA256:7B44639CBFBC8DDAC8C7A3DE8FFA97A7460BEBB0D54E9FF2E1CCDC3A742C2B13
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\OWInstaller.exe.config		xml
		MD5:82D22E4E19E27E306317513B9BFA70FF	SHA256:272E4C5364193E73633CAA3793E07509A349B79314EA01808B24FDB12C51B827
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\websocket-sharp.dll		executable
		MD5:BD907F40168A3BC1590EE1F22BE99014	SHA256:0C55480EF4020FDDB567CF4487C5A44077A966EC6079B19FAECD3E69DD991AD4
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\uac.dll		executable
		MD5:861F7E800BB28F68927E65719869409C	SHA256:10A0E8CF46038AB3B2C3CF5DCE407B9A043A631CBDE9A5C8BCF0A54B2566C010
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\CommandLine.dll		executable
		MD5:6D11C677CAE02CAA249A4F7F35FFF112	SHA256:DDE08C1DB1FF43B08C7DE59AE14045CB6FEC13BEC7AC65E142142453B8AB1AD4
5920	Hone - Installer.exe	C:\Users\admin\AppData\Local\Temp\nsh5D66.tmp\partner-custom-asset.png		image
		MD5:BAE604C0326ED9356CFD21E41C7840E2	SHA256:F242F6BFD1181F07F91756350B4433D8E6D8D04A3F5F71915692E657CFDB7A84

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

167

DNS requests

219

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4712	MoUsoCoreWorker.exe	GET	200	23.55.110.193:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2736	svchost.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2736	svchost.exe	GET	200	23.55.110.193:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6176	Hone - Installer.exe	GET	200	13.227.219.31:80	http://analyticsnew.overwolf.com/analytics/Counter?Name=installer_uac_action&Value=1&&Extra=%5b%7b%22Name%22%3a%22installer_version%22%2c%22Value%22%3a%222.265.0.3%22%7d%5d	unknown	—	—	whitelisted
—	—	GET	200	23.55.110.193:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6876	OWInstaller.exe	GET	200	74.125.143.102:80	http://www.google-analytics.com/__utm.gif?utmwv=4.7.2&utmn=90236961&utmhn=&utmcs=UTF-8&utmsr=-&utmsc=-&utmul=-&utmje=0&utmfl=-&utmdt=&utmhid=243801603&utmr=/&utmp=/&utmac=UA-80584726-1&utmcc=__utma%3D0.1427583282.1735841073.1735841073.1735841073.2%3B%2B__utmz%3D0.1735841073.1.1.utmcsr%3D%28direct%29%7Cutmccn%3D%7Cutmcmd%3D%3B&utme=5%28Funnel2%2AInstaller%20Launched%2A%29%28%29&gaq=1&utmt=event	unknown	—	—	whitelisted
6560	OWInstaller.exe	GET	200	18.65.32.231:80	http://ocsp.rootca3.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRkNawYMzz%2BjKSfYbTyFR0AXuhs6QQUq7bb1waeN6wwhgeRcMecxBmxeMACEwdzEm3iwvr9LEetiLFWbgGCBG0%3D	unknown	—	—	unknown
6796	Hone - Installer.exe	GET	200	13.227.219.31:80	http://analyticsnew.overwolf.com/analytics/Counter?Name=installer_uac_action&Value=1&&Extra=%5b%7b%22Name%22%3a%22installer_version%22%2c%22Value%22%3a%222.265.0.3%22%7d%5d	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4712	MoUsoCoreWorker.exe	23.55.110.193:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2736	svchost.exe	23.55.110.193:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
—	—	23.55.110.193:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2736	svchost.exe	88.221.169.152:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4712	MoUsoCoreWorker.exe	88.221.169.152:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
—	—	88.221.169.152:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
4712	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6176	Hone - Installer.exe	13.227.219.31:80	analyticsnew.overwolf.com	AMAZON-02	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158	whitelisted
google.com	108.177.127.101	whitelisted
crl.microsoft.com	23.55.110.193	unknown
www.microsoft.com	88.221.169.152 104.76.201.160	whitelisted
analyticsnew.overwolf.com	13.227.219.31	whitelisted
www.google-analytics.com	74.125.143.102	whitelisted
content.overwolf.com	18.239.83.76	whitelisted
ocsp.rootca3.amazontrust.com	18.65.32.231	unknown
storeapi.overwolf.com	65.9.86.37	shared
fonts.googleapis.com	108.177.119.95	whitelisted

Threats

PID	Process	Class	Message
6176	Hone - Installer.exe	Potentially Bad Traffic	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
6796	Hone - Installer.exe	Potentially Bad Traffic	ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge

10 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

Hone - Installer.exe

5BB17FB2C53D4DC7427D0E526CF1AD8A

C96C9DF5F626FDE444B29AF1929A94DE881E66F6

2FE2FE9E4B01502C23F64C2707D69F0C42B1501115519EC612C833905EC9E397

98304:d/d5kO4fJ/A9nGcRa1xXcVsy3RxeLLCIJgap176MVhAuMdehHtW3FRgpXNhW2Gep:BZc

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Executing a file with an untrusted certificate

Changes powershell execution policy (Unrestricted)

SUSPICIOUS

Malware-specific behavior (creating "System.dll" in Temp)

Reads security settings of Internet Explorer

Drops 7-zip archiver for unpacking

The process creates files with name similar to system file names

Executable content was dropped or overwritten

Application launched itself

Reads Microsoft Outlook installation path

Reads Internet Explorer settings

Checks Windows Trust Settings

Reads the date of Windows installation

The process drops C-runtime libraries

Process drops legitimate windows executable

Drops a system driver (possible attempt to evade defenses)

Creates a software uninstall entry

Starts CMD.EXE for commands execution

Uses REG/REGEDIT.EXE to modify registry

Starts POWERSHELL.EXE for commands execution

The process hides Powershell's copyright startup banner

The process bypasses the loading of PowerShell profile settings

The process executes Powershell scripts

INFO

Reads the computer name

Checks supported languages

The sample compiled with english language support

Process checks computer location settings

Create files in a temporary directory

Checks proxy server information

Disables trace logs

Creates files or folders in the user directory

Reads Environment values

Manual execution by a user

Reads the software policy settings

The process uses the downloaded file

Reads the machine GUID from the registry

Reads product name

Creates files in the program directory

Reads CPU info

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules