| File name: | KeePass-2.55-Setup.exe |
| Full analysis: | https://app.any.run/tasks/f26e4683-71c7-4884-a0fe-3db69030d21f |
| Verdict: | Malicious activity |
| Analysis date: | October 24, 2023, 00:59:41 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 85A374B5F3FA0402081C39B002619353 |
| SHA1: | 5754A7DE25E791EA26EED342F3839A823279EE98 |
| SHA256: | 37C2488E0D29E2ADE03827DD3D9C4C4563C4506B98BA24BB3EF1981FDD6D765D |
| SSDEEP: | 98304:L+cD4dndUSIh1GJwXuj5RZLud5xT/QFyBo9kp963Oi7mDwS6qybDZpyTnfqF0azo:nSLU1tx+Bk |
MALICIOUS
Drops the executable file immediately after the start
- KeePass-2.55-Setup.exe (PID: 2464)
- KeePass-2.55-Setup.exe (PID: 3504)
- KeePass-2.55-Setup.tmp (PID: 3528)
- mscorsvw.exe (PID: 3600)
Application was dropped or rewritten from another process
- ShInstUtil.exe (PID: 576)
- ShInstUtil.exe (PID: 2328)
- KeePass.exe (PID: 960)
- ShInstUtil.exe (PID: 1556)
Loads dropped or rewritten executable
- mscorsvw.exe (PID: 3600)
- KeePass.exe (PID: 960)
SUSPICIOUS
Reads the Windows owner or organization settings
- KeePass-2.55-Setup.tmp (PID: 3528)
Reads the Internet Settings
- ShInstUtil.exe (PID: 2328)
- KeePass.exe (PID: 960)
Reads settings of System Certificates
- KeePass.exe (PID: 960)
INFO
Create files in a temporary directory
- KeePass-2.55-Setup.exe (PID: 2464)
- KeePass-2.55-Setup.exe (PID: 3504)
Application was dropped or rewritten from another process
- KeePass-2.55-Setup.tmp (PID: 116)
- KeePass-2.55-Setup.tmp (PID: 3528)
Checks supported languages
- KeePass-2.55-Setup.exe (PID: 2464)
- KeePass-2.55-Setup.exe (PID: 3504)
- KeePass-2.55-Setup.tmp (PID: 3528)
- KeePass-2.55-Setup.tmp (PID: 116)
- ShInstUtil.exe (PID: 1556)
- ShInstUtil.exe (PID: 2328)
- ShInstUtil.exe (PID: 576)
- ngen.exe (PID: 3672)
- mscorsvw.exe (PID: 2816)
- ngen.exe (PID: 3032)
- mscorsvw.exe (PID: 3600)
- KeePass.exe (PID: 960)
Reads the computer name
- KeePass-2.55-Setup.tmp (PID: 3528)
- KeePass-2.55-Setup.tmp (PID: 116)
- ShInstUtil.exe (PID: 2328)
- ngen.exe (PID: 3672)
- mscorsvw.exe (PID: 2816)
- mscorsvw.exe (PID: 3600)
- KeePass.exe (PID: 960)
- ngen.exe (PID: 3032)
Creates files in the program directory
- KeePass-2.55-Setup.tmp (PID: 3528)
Reads the machine GUID from the registry
- ngen.exe (PID: 3032)
- mscorsvw.exe (PID: 2816)
- mscorsvw.exe (PID: 3600)
- KeePass.exe (PID: 960)
Reads Environment values
- KeePass.exe (PID: 960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (51.8) |
|---|---|---|
| .exe | | | InstallShield setup (20.3) |
| .exe | | | Win32 EXE PECompact compressed (generic) (19.6) |
| .dll | | | Win32 Dynamic Link Library (generic) (3.1) |
| .exe | | | Win32 Executable (generic) (2.1) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:02:15 15:54:16+01:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 38400 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.55.0.0 |
| ProductVersionNumber: | 2.55.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Dominik Reichl |
| FileDescription: | KeePass Password Safe 2.55 Setup |
| FileVersion: | 2.55.0.0 |
| LegalCopyright: | Copyright © 2003-2023 Dominik Reichl |
| OriginalFileName: | |
| ProductName: | KeePass Password Safe |
| ProductVersion: | 2.55 |
Total processes
55
Monitored processes
12
Malicious processes
10
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | "C:\Users\admin\AppData\Local\Temp\is-4ADSP.tmp\KeePass-2.55-Setup.tmp" /SL5="$5035E,3468729,781312,C:\Users\admin\Desktop\KeePass-2.55-Setup.exe" | C:\Users\admin\AppData\Local\Temp\is-4ADSP.tmp\KeePass-2.55-Setup.tmp | — | KeePass-2.55-Setup.exe | |||||||||||
User: admin Company: Dominik Reichl Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 576 | "C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe" preload_register | C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe | — | KeePass-2.55-Setup.tmp | |||||||||||
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: ShInstUtil - KeePass Helper Utility Exit code: 0 Version: 2.55.0.0 Modules
| |||||||||||||||
| 960 | "C:\Program Files\KeePass Password Safe 2\KeePass.exe" | C:\Program Files\KeePass Password Safe 2\KeePass.exe | KeePass-2.55-Setup.tmp | ||||||||||||
User: admin Company: Dominik Reichl Integrity Level: MEDIUM Description: KeePass Exit code: 0 Version: 2.55.0.0 Modules
| |||||||||||||||
| 1556 | "C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe" net_check | C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe | — | KeePass-2.55-Setup.tmp | |||||||||||
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: ShInstUtil - KeePass Helper Utility Exit code: 0 Version: 2.55.0.0 Modules
| |||||||||||||||
| 2328 | "C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe" ngen_install | C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe | — | KeePass-2.55-Setup.tmp | |||||||||||
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: ShInstUtil - KeePass Helper Utility Exit code: 0 Version: 2.55.0.0 Modules
| |||||||||||||||
| 2464 | "C:\Users\admin\Desktop\KeePass-2.55-Setup.exe" | C:\Users\admin\Desktop\KeePass-2.55-Setup.exe | — | explorer.exe | |||||||||||
User: admin Company: Dominik Reichl Integrity Level: MEDIUM Description: KeePass Password Safe 2.55 Setup Exit code: 0 Version: 2.55.0.0 Modules
| |||||||||||||||
| 2816 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 118 -InterruptEvent 0 -NGENProcess 108 -Pipe 114 -Comment "NGen Worker Process" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe | — | ngen.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: .NET Runtime Optimization Service Exit code: 0 Version: 4.0.30319.34209 built by: FX452RTMGDR Modules
| |||||||||||||||
| 3032 | "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "C:\Program Files\KeePass Password Safe 2\KeePass.exe" | C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe | — | ShInstUtil.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Common Language Runtime native compiler Exit code: 0 Version: 4.0.30319.34209 built by: FX452RTMGDR Modules
| |||||||||||||||
| 3504 | "C:\Users\admin\Desktop\KeePass-2.55-Setup.exe" /SPAWNWND=$60300 /NOTIFYWND=$5035E | C:\Users\admin\Desktop\KeePass-2.55-Setup.exe | KeePass-2.55-Setup.tmp | ||||||||||||
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: KeePass Password Safe 2.55 Setup Exit code: 0 Version: 2.55.0.0 Modules
| |||||||||||||||
| 3528 | "C:\Users\admin\AppData\Local\Temp\is-C8IGQ.tmp\KeePass-2.55-Setup.tmp" /SL5="$F017C,3468729,781312,C:\Users\admin\Desktop\KeePass-2.55-Setup.exe" /SPAWNWND=$60300 /NOTIFYWND=$5035E | C:\Users\admin\AppData\Local\Temp\is-C8IGQ.tmp\KeePass-2.55-Setup.tmp | — | KeePass-2.55-Setup.exe | |||||||||||
User: admin Company: Dominik Reichl Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
Total events
10 984
Read events
10 940
Write events
38
Delete events
6
Modification events
| (PID) Process: | (2328) ShInstUtil.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2328) ShInstUtil.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2328) ShInstUtil.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2328) ShInstUtil.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (3032) ngen.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGENService\Roots |
| Operation: | write | Name: | WorkPending |
Value: 0 | |||
| (PID) Process: | (3032) ngen.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGENService\Roots\C:/Program Files/KeePass Password Safe 2/KeePass.exe\0 |
| Operation: | write | Name: | ImageList |
Value: 0100000000020000006A00000043003A005C00500072006F006700720061006D002000460069006C00650073005C004B006500650050006100730073002000500061007300730077006F007200640020005300610066006500200032005C004B006500650050006100730073002E006500780065000000000000000000000000 | |||
| (PID) Process: | (3032) ngen.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGENService\Roots\C:/Program Files/KeePass Password Safe 2/KeePass.exe\0 |
| Operation: | write | Name: | Status |
Value: 2 | |||
| (PID) Process: | (3032) ngen.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGENService\Roots\C:/Program Files/KeePass Password Safe 2/KeePass.exe\0 |
| Operation: | write | Name: | ImageList |
Value: 0E00000000030000006A00000043003A005C00500072006F006700720061006D002000460069006C00650073005C004B006500650050006100730073002000500061007300730077006F007200640020005300610066006500200032005C004B006500650050006100730073002E00650078006500000001A00000004B006500650050006100730073002C002000560065007200730069006F006E003D0032002E00350035002E0030002E00310038003000340032002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D0066006500640032006500640037003700310036006100650063006600350063000000020000000100000004000000040000000200000006000000030000000800000001D1265D6159EA876F9D63EA4C1361B58705000000980000006D00730063006F0072006C00690062002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D006200370037006100350063003500360031003900330034006500300038003900000000000000000000000001AC38CB30C15EB9E4A54459EE01E9F8E605000000B0000000530079007300740065006D002E00570069006E0064006F00770073002E0046006F0072006D0073002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D0062003700370061003500630035003600310039003300340065003000380039000000000300000001000000030000000400000007000000080000000900000005000000060000000A0000000B0000000D00000001CE11900FA489575613DC777C7FBB0D7D05000000A4000000530079007300740065006D002E00440072006100770069006E0067002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D006200300033006600350066003700660031003100640035003000610033006100000000020000000100000004000000010000000500000001B75BA99F72F116D8951B0F2BBA8C276A0500000094000000530079007300740065006D002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D0062003700370061003500630035003600310039003300340065003000380039000000000100000001000000020000000500000006000000017ECE7799D670CDFC1393B98B0668A04605000000B0000000530079007300740065006D002E0043006F006E00660069006700750072006100740069006F006E002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D00620030003300660035006600370066003100310064003500300061003300610000000002000000010000000400000002000000060000000800000001668BC5E53FD656DC16C9F40EA15E872E050000009C000000530079007300740065006D002E0058006D006C002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D006200370037006100350063003500360031003900330034006500300038003900000000020000000100000004000000020000000500000007000000016488E32A78BC42E7ACD967C0839679A005000000AC000000530079007300740065006D002E0044006100740061002E00530071006C0058006D006C002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D0062003700370061003500630035003600310039003300340065003000380039000000000300000001000000060000000400000000000000014C1BDC03E699AB178DB76A938FCE6BC105000000A6000000530079007300740065006D002E00530065006300750072006900740079002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D006200300033006600350066003700660031003100640035003000610033006100000000020000000100000004000000010000000600000001D9EF873B190C9DF202C3F9F8A5D38C4805000000A20000004100630063006500730073006900620069006C006900740079002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D0062003000330066003500660037006600310031006400350030006100330061000000000100000001000000000000000117AD11AD896ADEC5F9FBBE9C4DC2B80C05000000AA000000530079007300740065006D002E004400650070006C006F0079006D0065006E0074002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D0062003000330066003500660037006600310031006400350030006100330061000000000300000001000000040000000B000000040000000200000006000000080000000300000001E0FEA191B75897EC38735BFC31B89FE0050000009E000000530079007300740065006D002E0043006F00720065002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D0062003700370061003500630035003600310039003300340065003000380039000000000200000001000000040000000300000008000000060000000C00000001DE2A832558F95DB343E443C365BD357505000000A6000000530079007300740065006D002E004E0075006D00650072006900630073002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D006200370037006100350063003500360031003900330034006500300038003900000000010000000100000000000000013CD8049438E5C524AD5518B6043D2AD405000000E0000000530079007300740065006D002E00520075006E00740069006D0065002E00530065007200690061006C0069007A006100740069006F006E002E0046006F0072006D006100740074006500720073002E0053006F00610070002C002000560065007200730069006F006E003D0034002E0030002E0030002E0030002C002000430075006C0074007500720065003D006E00650075007400720061006C002C0020005000750062006C00690063004B006500790054006F006B0065006E003D00620030003300660035006600370066003100310064003500300061003300610000000001000000010000000100000006000000 | |||
| (PID) Process: | (3032) ngen.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGENService\Roots\C:/Program Files/KeePass Password Safe 2/KeePass.exe\0 |
| Operation: | write | Name: | Status |
Value: 3 | |||
| (PID) Process: | (3032) ngen.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727\NGENService\Roots\C:/Program Files/KeePass Password Safe 2/KeePass.exe |
| Operation: | write | Name: | Status |
Value: 3 | |||
Executable files
16
Suspicious files
8
Text files
16
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\unins000.exe | executable | |
MD5:99E2FD5C60D2FFF2582CA32D28BE8B18 | SHA256:9BEFAFF16298EEBF6D08C0E3892EAE93C27F0D2EE607178D69A40940000405AF | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-D0GUJ.tmp | text | |
MD5:883FC3D7E7A4773F3FA777F740175C21 | SHA256:7F43637944C83B6522C96BC6CDFE09B54E65B6DD0BF1B5E7B60BBB9EB736382E | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\KeePass.exe.config | xml | |
MD5:1E94157E4BE96C705ADB7322E889A5E7 | SHA256:A5666AB533FA9E5571F42F7B1718F60506E042B6B91C87D46D2B507CE6D84B54 | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\KeePass.XmlSerializers.dll | executable | |
MD5:915464316DBE796726B387CF9758CDC4 | SHA256:CC0389A94DE3CB21E116173741EA6AFE1D310D58ED28991308E4818A81F26E1E | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\KeePass.config.xml | xml | |
MD5:AC0F1E104F82D295C27646BFFF39FECC | SHA256:C4A3626BBCDFE4B17759E75582AD5F89BEAA28EFC857431F373E104FBE7B8440 | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\KeePass.chm | binary | |
MD5:2CE4E98FC8612894D36F7EF66F40D25B | SHA256:24AE4319F9B682A3F615794512E74EB53A333BF964E322225FF92286621894D1 | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-KNQ9U.tmp | executable | |
MD5:ABE4019FFAA18ADA3AD992624327E8C3 | SHA256:AF2C492AF5BDD9F6BB5FD0973E70C9A6A31A6258F271EA6CB3424E501008124F | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\License.txt | text | |
MD5:883FC3D7E7A4773F3FA777F740175C21 | SHA256:7F43637944C83B6522C96BC6CDFE09B54E65B6DD0BF1B5E7B60BBB9EB736382E | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\ShInstUtil.exe | executable | |
MD5:047B76689E7C18DA2FABB17CD0B240D9 | SHA256:0ABA3B195D9DBF035676004DC938F46FC6D352F0FAC40D35BD8DBA13D2A07687 | |||
| 3528 | KeePass-2.55-Setup.tmp | C:\Program Files\KeePass Password Safe 2\is-IQPF5.tmp | executable | |
MD5:047B76689E7C18DA2FABB17CD0B240D9 | SHA256:0ABA3B195D9DBF035676004DC938F46FC6D352F0FAC40D35BD8DBA13D2A07687 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2656 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
960 | KeePass.exe | 92.205.64.102:443 | www.dominik-reichl.de | Host Europe GmbH | FR | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.dominik-reichl.de |
| unknown |