| File name: | Fake ID Cards Creator.exe |
| Full analysis: | https://app.any.run/tasks/d1827ef4-4bd4-410f-be35-b12804031e8c |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | October 31, 2024, 06:04:46 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, 6 sections |
| MD5: | 87CC437408E8FE1FE14684AEC045E8C4 |
| SHA1: | 7CCB69AC9ABAE511FB70DD524D145BF5F90939FB |
| SHA256: | 3DEC5D971808DA5586D0D1747EEE0B55E712349210826E7E9C09C712F3CD6494 |
| SSDEEP: | 98304:enMNSpBSowdPZ4NxaTuxi0HS67w6xeDibrb4x0nHN5d274eGjltv1bDE16XETqh3:gNOOUe/bhBlg |
MALICIOUS
Changes the autorun value in the registry
- sysapp.exe (PID: 4816)
Create files in the Startup directory
- sysapp.exe (PID: 4816)
Application was injected by another process
- explorer.exe (PID: 4616)
SNIFFTHEM has been detected (SURICATA)
- svchost.exe (PID: 6320)
Runs injected code in another process
- svchost.exe (PID: 6320)
SUSPICIOUS
Process drops legitimate windows executable
- Fake ID Cards Creator.exe (PID: 5168)
- sysapp.exe (PID: 4816)
Executable content was dropped or overwritten
- sysapp.exe (PID: 4816)
- Fake ID Cards Creator.exe (PID: 5168)
Reads Internet Explorer settings
- FakeIdGen.exe (PID: 3764)
Potential Corporate Privacy Violation
- svchost.exe (PID: 6320)
- explorer.exe (PID: 4616)
INFO
Create files in a temporary directory
- Fake ID Cards Creator.exe (PID: 5168)
Checks supported languages
- Fake ID Cards Creator.exe (PID: 5168)
- sysapp.exe (PID: 4816)
- FakeIdGen.exe (PID: 3764)
Creates files or folders in the user directory
- Fake ID Cards Creator.exe (PID: 5168)
- sysapp.exe (PID: 4816)
- explorer.exe (PID: 4616)
Reads the computer name
- sysapp.exe (PID: 4816)
- FakeIdGen.exe (PID: 3764)
Checks proxy server information
- svchost.exe (PID: 6320)
- explorer.exe (PID: 4616)
Reads security settings of Internet Explorer
- svchost.exe (PID: 6320)
- explorer.exe (PID: 4616)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 EXE PECompact compressed (generic) (53.4) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (35.5) |
| .exe | | | Win32 Executable (generic) (5.8) |
| .exe | | | Generic Win/DOS Executable (2.5) |
| .exe | | | DOS Executable Generic (2.5) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2024:10:11 08:19:56+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.4 |
| CodeSize: | 122368 |
| InitializedDataSize: | 5953536 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x5b2c |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 5.0.0.0 |
| ProductVersionNumber: | 5.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Unknown (0484) |
| CharacterSet: | Unicode |
| CompanyName: | Program |
| FileDescription: | Program |
| FileVersion: | 5.0.0.0 |
| InternalName: | Program.exe |
| LegalCopyright: | Copyright (C) 2012 |
| OriginalFileName: | Program.exe |
| ProductName: | Program |
| ProductVersion: | 5.0.0.0 |
Total processes
126
Monitored processes
5
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3764 | "FakeIdGen.exe" | C:\Users\admin\AppData\Local\Temp\FakeIdGen.exe | — | Fake ID Cards Creator.exe | |||||||||||
User: admin Company: http://fast-likers.com Integrity Level: MEDIUM Description: Forged identity cards BY MrZaghar Version: 1.0.0.0 Modules
| |||||||||||||||
| 4616 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4816 | "C:\Users\admin\AppData\Roaming\sysapp.exe" | C:\Users\admin\AppData\Roaming\sysapp.exe | Fake ID Cards Creator.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Services.exe Exit code: 0 Version: 1.2.0.1 Modules
| |||||||||||||||
| 5168 | "C:\Users\admin\AppData\Local\Temp\Fake ID Cards Creator.exe" | C:\Users\admin\AppData\Local\Temp\Fake ID Cards Creator.exe | explorer.exe | ||||||||||||
User: admin Company: Program Integrity Level: MEDIUM Description: Program Exit code: 0 Version: 5.0.0.0 Modules
| |||||||||||||||
| 6320 | C:\WINDOWS\system32\svchost.exe -k DcomLaunch | C:\Windows\System32\svchost.exe | sysapp.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
2 618
Read events
2 610
Write events
6
Delete events
2
Modification events
| (PID) Process: | (4816) sysapp.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| Operation: | write | Name: | Services |
Value: C:\Users\admin\AppData\Roaming\{2F33566DA0B91573532102}\{2F33566DA0B91573532102}.exe | |||
| (PID) Process: | (6320) svchost.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (6320) svchost.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4616) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000004028C |
| Operation: | write | Name: | VirtualDesktop |
Value: 100000003030445671D90A7D3588864C9F3CEA9EBAB7B4A7 | |||
| (PID) Process: | (4616) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search |
| Operation: | write | Name: | InstalledWin32AppsRevision |
Value: {0468243E-382E-4B3E-B37D-7465AB5B694B} | |||
| (PID) Process: | (4616) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A0298 |
| Operation: | write | Name: | VirtualDesktop |
Value: 100000003030445671D90A7D3588864C9F3CEA9EBAB7B4A7 | |||
| (PID) Process: | (4616) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search |
| Operation: | write | Name: | TraySearchBoxVisible |
Value: 1 | |||
| (PID) Process: | (4616) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search |
| Operation: | write | Name: | TraySearchBoxVisibleOnAnyMonitor |
Value: 1 | |||
Executable files
3
Suspicious files
3
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4816 | sysapp.exe | C:\Users\admin\AppData\Roaming\{2F33566DA0B91573532102}\{2F33566DA0B91573532102}.exe | executable | |
MD5:CFC83E7145C70E71874460C78A0E9CF4 | SHA256:AB97099D14BFAF3FCB3862628D710D5B6B2FA9AFA30011DDCF686EB11D6FF92F | |||
| 4816 | sysapp.exe | C:\Users\admin\AppData\Local\Temp\THC220.tmp | binary | |
MD5:E8F0F1E11A0530473602CAB10059D054 | SHA256:0612FFC1A7FDF533B69A6CF88763AD6F85399AC5AE3FEE2F162E1A27D4453447 | |||
| 6320 | svchost.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.js | text | |
MD5:96CAACF3123D91520BFE4D6B58EAF1C8 | SHA256:1230EBF7AAE880A2455D660A1AB168EBF60D11616DEE2E4CD8FE74D95B6C6123 | |||
| 4816 | sysapp.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MicrosoftEdgeUpdate.lnk | binary | |
MD5:F66B78E334FE3EBEDC26112F6D2D5A1B | SHA256:40EA4DF60AC724504061E98EE559D3811337710CDFF6CEF06A6338FFC739B8B4 | |||
| 5168 | Fake ID Cards Creator.exe | C:\Users\admin\AppData\Local\Temp\FakeIdGen.exe | executable | |
MD5:CE4EB791CF974D1EA2ACF13E684763D7 | SHA256:7D34406A17FC9D9B1126301C131C3F1BE9FBAF040059E1FF4215C7B3A45B042F | |||
| 4616 | explorer.exe | C:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat | binary | |
MD5:E49C56350AEDF784BFE00E444B879672 | SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E | |||
| 5168 | Fake ID Cards Creator.exe | C:\Users\admin\AppData\Roaming\sysapp.exe | executable | |
MD5:CFC83E7145C70E71874460C78A0E9CF4 | SHA256:AB97099D14BFAF3FCB3862628D710D5B6B2FA9AFA30011DDCF686EB11D6FF92F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
41
DNS requests
18
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6320 | svchost.exe | GET | 200 | 176.111.174.140:80 | http://176.111.174.140/api/loader.bin | unknown | — | — | malicious |
4616 | explorer.exe | POST | 200 | 176.111.174.140:80 | http://176.111.174.140/GrXRYWt.php?2F33566DA0B91573532102 | unknown | — | — | unknown |
4616 | explorer.exe | POST | 200 | 176.111.174.140:80 | http://176.111.174.140/GrXRYWt.php?2F33566DA0B91573532102 | unknown | — | — | unknown |
4616 | explorer.exe | POST | 200 | 176.111.174.140:80 | http://176.111.174.140/GrXRYWt.php?2F33566DA0B91573532102 | unknown | — | — | unknown |
6868 | SIHClient.exe | GET | 200 | 23.32.185.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1552 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6944 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.216.77.28:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5488 | MoUsoCoreWorker.exe | 23.216.77.28:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5488 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4020 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6320 | svchost.exe | 176.111.174.140:80 | — | Chang Way Technologies Co. Limited | RU | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6320 | svchost.exe | Potentially Bad Traffic | ET HUNTING Generic .bin download from Dotted Quad |
6320 | svchost.exe | A Network Trojan was detected | LOADER [ANY.RUN] Sniffthem/Tnaket downloads via HTTP GET request (UA) |
6320 | svchost.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
6320 | svchost.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
6320 | svchost.exe | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
4616 | explorer.exe | Potentially Bad Traffic | ET HUNTING Generic .bin download from Dotted Quad |
4616 | explorer.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
4616 | explorer.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
1 ETPRO signatures available at the full report