URL:

https://download2391.mediafire.com/2a9l89uhekfg/1ie9xenfddk1b8t/ATF_v11.70_Full_Installer.rar

Full analysis: https://app.any.run/tasks/f256469b-3d04-490a-8bd9-faf908f02ef1
Verdict: Malicious activity
Analysis date: October 16, 2021, 00:23:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

343932AD55C94F9D06C31536D4A7930F

SHA1:

8DB167291D7817BB6E648A64BCB30EC381FA4B17

SHA256:

3F19D349FEAAC80C4848FFC3B29FC05BC986289AC1E282976F0D741F1282D3E8

SSDEEP:

3:N8SE5bURvQeGuhNrVVc4UHdRYYUmQjQasLWTXLO:2SWbUFQeGc9V0dRAm2QaFXLO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Loads dropped or rewritten executable

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Application was dropped or rewritten from another process

      • ATF_v11.70_Full_Installer.exe (PID: 3528)
      • ATF_v11.70_Full_Installer.exe (PID: 3536)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2736)
      • WinRAR.exe (PID: 3320)
      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Reads the computer name

      • WinRAR.exe (PID: 3320)
      • WinRAR.exe (PID: 2736)
      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 716)

    • Drops a file that was compiled in debug mode

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Executable content was dropped or overwritten

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Drops a file with too old compile date

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Reads Windows owner or organization settings

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Reads the Windows organization settings

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Executed as Windows Service

      • vssvc.exe (PID: 3760)

    • Searches for installed software

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Reads Environment values

      • vssvc.exe (PID: 3760)

    • Creates a directory in Program Files

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

    • Creates files in the program directory

      • ATF_v11.70_Full_Installer.exe (PID: 3536)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2844)

    • Reads the computer name

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 716)
      • vssvc.exe (PID: 3760)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 716)

    • Creates files in the user directory

      • iexplore.exe (PID: 2844)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2844)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2844)

    • Checks supported languages

      • iexplore.exe (PID: 2844)
      • iexplore.exe (PID: 716)
      • vssvc.exe (PID: 3760)

    • Changes internet zones settings

      • iexplore.exe (PID: 2844)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2844)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 716)
      • iexplore.exe (PID: 2844)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2844)

    • Manual execution by user

      • ATF_v11.70_Full_Installer.exe (PID: 3536)
      • ATF_v11.70_Full_Installer.exe (PID: 3528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe no specs winrar.exe no specs atf_v11.70_full_installer.exe no specs atf_v11.70_full_installer.exe vssvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
716"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2844 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2736"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\ATF_v11.70_Full_Installer.rar"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2844"C:\Program Files\Internet Explorer\iexplore.exe" "https://download2391.mediafire.com/2a9l89uhekfg/1ie9xenfddk1b8t/ATF_v11.70_Full_Installer.rar"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3320"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\ATF_v11.70_Full_Installer.rar"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3528"C:\Users\admin\Desktop\ATF_v11.70_Full_Installer.exe" C:\Users\admin\Desktop\ATF_v11.70_Full_Installer.exe—Explorer.EXE
User:
admin
Company:
Acresso Software Inc.
Integrity Level:
MEDIUM
Description:
InstallScript Setup Launcher
Exit code:
3221226540
Version:
16.0.400
Modules
Images
c:\users\admin\desktop\atf_v11.70_full_installer.exe
c:\windows\system32\ntdll.dll
3536"C:\Users\admin\Desktop\ATF_v11.70_Full_Installer.exe" C:\Users\admin\Desktop\ATF_v11.70_Full_Installer.exe
Explorer.EXE
User:
admin
Company:
Acresso Software Inc.
Integrity Level:
HIGH
Description:
InstallScript Setup Launcher
Exit code:
0
Version:
16.0.400
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
3760C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
19 588
Read events
19 290
Write events
295
Delete events
3

Modification events

(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
159809824
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30917156
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
459817246
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30917156
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2844) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
50
Suspicious files
524
Text files
811
Unknown types
33

Dropped files

PID
Process
Filename
Type
716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:3D0D6856F9DEE0004E6178A9E5E28209
SHA256:EC7BF7E0B4090B81E0543329C05255E6ABBD194A378213FACEE500FE1043953C
716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:9B071D45EECA53C9E56419D54779840F
SHA256:3F66103A8923387F9BBDCE093B5E8795401505C1A1BCC8AFA0EB89EEC592845C
716iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ATF_v11.70_Full_Installer[1].rarcompressed
MD5:C01594CA331E4E24493F3FFF4A04C442
SHA256:F9943F466455BDB7D4D4427FC39E1231712B989BD1A1B35F7E5A05D180A59D1C
716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FDFAEE642D1E48FB4F5431C0654EDD42der
MD5:C36C7015D7DFCECE3D28755E645C4D6A
SHA256:C426D22C0C5CA7F316D1E00A2178FFF1EA70B54758700C884E797EDC797E8D75
716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:BBEBBEE673EC51AE2F175C19E6E6B8DE
SHA256:83EEDF8A2F746FCBB9AC471E886DDF2DF8F192E8B6FD0C3FAA82427C6C324B44
716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FDFAEE642D1E48FB4F5431C0654EDD42binary
MD5:18CAC0048AEE1F135A3851179E87ED0B
SHA256:64D03A7258134D3882FCF565A14108A237EAD4628BD3D283D0D5926EA10FB05A
716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:9B38C2E18F9A10B03651295F7E41B819
SHA256:39ACE75CE8E870EED28890E924A29C165E2904CBE47B60BF47269AFCEBC6B927
716iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:EA20B2E770604C13DABAE47156BB778F
SHA256:ABE0B08A3F6B0395D53FC69E2F21ACFCEEEC1163E4A3A9C2372493564D0BEF5C
2844iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:6927B5144C379A208496780732968C2F
SHA256:2CA0D657285F2BF0E233D37F427235DFB95A436F2BDB282BB8BC95096E920975
2844iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:E77DF4336E43FF8A70847CBCC5F939A7
SHA256:AA76D3D0CB3F7AC2C8F59984AE0C0251494BE87C2D785D880A470C6223C3E706
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
24
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
716
iexplore.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
716
iexplore.exe
GET
200
104.18.30.182:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECECUTgfQsc%2BcBwNBMQNWQl0M%3D
US
der
471 b
whitelisted
2844
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2844
iexplore.exe
GET
304
8.253.190.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a005ca243809d24d
US
—
—
whitelisted
2844
iexplore.exe
GET
304
8.253.190.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?286d3dfd2ce6de08
US
—
—
whitelisted
2844
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2844
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2844
iexplore.exe
GET
304
8.253.190.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bf711ff5778faadd
US
—
—
whitelisted
2844
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
716
iexplore.exe
GET
200
8.253.190.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a34c29e24764bbe9
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
716
iexplore.exe
199.91.155.132:443
download2391.mediafire.com
MediaFire, LLC
US
suspicious
716
iexplore.exe
8.253.190.120:80
ctldl.windowsupdate.com
Global Crossing
US
unknown
716
iexplore.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
716
iexplore.exe
104.18.30.182:80
ocsp.sectigo.com
Cloudflare Inc
US
suspicious
716
iexplore.exe
67.26.115.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
2844
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2844
iexplore.exe
8.253.190.120:80
ctldl.windowsupdate.com
Global Crossing
US
unknown
2844
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
716
iexplore.exe
8.241.79.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
unknown
2844
iexplore.exe
104.111.242.51:443
go.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
download2391.mediafire.com
  • 199.91.155.132
suspicious
ctldl.windowsupdate.com
  • 8.253.190.120
  • 67.26.115.254
  • 8.241.79.254
  • 67.27.157.254
  • 67.27.158.126
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 104.18.30.182
  • 104.18.31.182
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 104.111.242.51
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download2391.mediafire.com/2a9l89uhekfg/1ie9xenfddk1b8t/ATF_v11.70_Full_Installer.rar