File name:

afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe

Full analysis: https://app.any.run/tasks/fe38ff05-d6c4-4fd6-a895-7d4952f6ae02
Verdict: Malicious activity
Analysis date: April 12, 2024, 17:34:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

0BAFBD90A6657EBC1D40339949A65D0B

SHA1:

E072E153F9CD9279632D82D5C6A618A7C7F0E290

SHA256:

4245B59EB49F9EA2596ED1791EA2C81173ACBFDFA2CEAF8E17AB418ACE71D847

SSDEEP:

196608:pv4QjAo6ihTG8JvQpB12nfhQu8axinqYl:eQjv64HC8fhQSxiqYl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

    • Drops 7-zip archiver for unpacking

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

    • Creates a software uninstall entry

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

    • The process creates files with name similar to system file names

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

  • INFO

    • Reads the computer name

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

    • Checks supported languages

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

    • Create files in a temporary directory

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

    • Creates files in the program directory

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)

    • Reads the machine GUID from the registry

      • afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe (PID: 2892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:07:25 00:55:51+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x33b6
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.1.0.0
ProductVersionNumber: 1.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Shanghai Lilith Network Technology Co., Ltd.
FileDescription: AFK Journey
FileVersion: 1.1.0.0
LegalCopyright: Copyright (C) 2024
ProductName: AFK Journey
ProductVersion: 1.1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\Users\admin\AppData\Local\Temp\afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe" C:\Users\admin\AppData\Local\Temp\afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe—explorer.exe
User:
admin
Company:
Shanghai Lilith Network Technology Co., Ltd.
Integrity Level:
MEDIUM
Description:
AFK Journey
Exit code:
3221226540
Version:
1.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe
c:\windows\system32\ntdll.dll
2892"C:\Users\admin\AppData\Local\Temp\afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe" C:\Users\admin\AppData\Local\Temp\afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe
explorer.exe
User:
admin
Company:
Shanghai Lilith Network Technology Co., Ltd.
Integrity Level:
HIGH
Description:
AFK Journey
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
2 676
Read events
2 660
Write events
16
Delete events
0

Modification events

(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\lilith\10013832
Operation:writeName:InstallGuid
Value:
v291981aaf-b969-43b4-b231-bedf0f9d6576
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:LinkName
Value:
AFK Journey
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:DisplayName
Value:
AFK Journey
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\AFK Journey\AFKJourneyLauncher.exe
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:Publisher
Value:
Shanghai Lilith Network Technology Co., Ltd.
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:InstallTimestamp
Value:
1712943273
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files\AFK Journey\AFKJourneyUninst.exe"
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\AFK Journey
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:LauncherName
Value:
AFKJourneyLauncher.exe
(PID) Process:(2892) afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{prod8bef2ba4a37b2d80540cd3f97000}_is1
Operation:writeName:DisplayVersion
Value:
1.1.0.0
Executable files
9
Suspicious files
15
Text files
78
Unknown types
9

Dropped files

PID
Process
Filename
Type
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Users\admin\AppData\Local\Temp\nsn2DE3.tmp\NsLauncher.dllexecutable
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Users\admin\AppData\Local\Temp\nsn2DE3.tmp\BgWorker.dllexecutable
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Program Files\AFK Journey\launcher.7z —
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Users\admin\AppData\Local\Temp\nsn2DE3.tmp\nsis7z.dllexecutable
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Users\admin\AppData\Local\Temp\nsn2DE3.tmp\System.dllexecutable
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Program Files\AFK Journey\CSLog\customLog.txttext
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Program Files\AFK Journey\GameBabyConfig.dattext
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Program Files\AFK Journey\resource\cer\cacert.pemtext
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Program Files\AFK Journey\resource\data\init.datbinary
MD5:—
SHA256:—
2892afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exeC:\Program Files\AFK Journey\resource\data\ver.datbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
9
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
2892
afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe
163.181.157.110:443
imv2-gl.farlightgames.com
—
US
unknown
2892
afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe
23.50.131.72:443
app.farlightgames.com
Akamai International B.V.
DE
unknown
2892
afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe
49.13.77.253:443
fake.fake
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
imv2-gl.farlightgames.com
  • 163.181.157.110
unknown
app.farlightgames.com
  • 23.50.131.72
  • 23.50.131.93
unknown
fake.fake
  • 49.13.77.253
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
afkjourneysetup_a344eb529a973ae3ebb7144f518e4efb.exe