File name:

kts21.3.10.391abcdefghijklru_26487.exe

Full analysis: https://app.any.run/tasks/93178839-fffc-42e8-bb37-38dedb1c1b2a
Verdict: Malicious activity
Analysis date: August 01, 2024, 15:37:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A05B0CFE267655DE881AC2E7B06D7848

SHA1:

2B03CE061A49A7D7065D343C9AB7079F283F8814

SHA256:

49C7CF3C52C28B5C472639E3C06F349E84DD5E0F2F856F2240C4815BBEA4E70D

SSDEEP:

98304:zKBwrBJbYrniSos+gIsIspUW/YqXOyR7GoLm4yOFrUx87d83DwIaxdMx+x49xrRe:vsdZoHK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads security settings of Internet Explorer

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads Microsoft Outlook installation path

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Checks Windows Trust Settings

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

  • INFO

    • Checks supported languages

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Process checks whether UAC notifications are on

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Creates files in the program directory

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Create files in a temporary directory

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads the computer name

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Process checks Internet Explorer phishing filters

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Checks proxy server information

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads the software policy settings

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads the machine GUID from the registry

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Checks for the presence of KasperskyLab

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1972:01:30 11:30:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 302080
InitializedDataSize: 2392064
UninitializedDataSize: -
EntryPoint: 0x24c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 21.3.10.391
ProductVersionNumber: 21.3.10.391
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Лаборатория Касперского
FileDescription: Kaspersky Total Security [21.3.10.391.0.2520.0 (a.b.c.d.e.f.g.h.i.j.k.l)]
FileVersion: 21.3.10.391
LegalCopyright: © 2021 АО "Лаборатория Касперского"
LegalTrademarks: Зарегистрированные товарные знаки и знаки обслуживания являются собственностью их правообладателей
ProductName: Kaspersky Total Security
ProductVersion: 21.3.10.391
InternalName: Setup
OriginalFileName: Setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start kts21.3.10.391abcdefghijklru_26487.exe

Process information

PID
CMD
Path
Indicators
Parent process
6672"C:\Users\admin\Desktop\kts21.3.10.391abcdefghijklru_26487.exe" C:\Users\admin\Desktop\kts21.3.10.391abcdefghijklru_26487.exe
explorer.exe
User:
admin
Company:
Лаборатория Касперского
Integrity Level:
MEDIUM
Description:
Kaspersky Total Security [21.3.10.391.0.2520.0 (a.b.c.d.e.f.g.h.i.j.k.l)]
Version:
21.3.10.391
Modules
Images
c:\users\admin\desktop\kts21.3.10.391abcdefghijklru_26487.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\dbghelp.dll
Total events
4 508
Read events
4 482
Write events
26
Delete events
0

Modification events

(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2520.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\PURE21.3.10.391.0.2520.0
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2520.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\PURE21.3.10.391.0.2520.0 C:\ProgramData\Kaspersky Lab Setup Files
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLab\IEOverride\Main
Operation:writeName:Enable Browser Extensions
Value:
no
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLab\IEOverride\Main
Operation:writeName:UseSWRender
Value:
1
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
1
Suspicious files
4
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\760657FFB105FE114B3E817F87F669EE\setup.dllexecutable
MD5:8A786A74B605E8E2551C0CE6EA857501
SHA256:—
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\jquery.custom_select.min.jsbinary
MD5:D2C620C462B75696EEA1FB22FB23602A
SHA256:DD678D32073078552E0E2C35EED78F16CC8D6E8662D4734518561A1B183F775C
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-script.jsbinary
MD5:026425CCBF4417EEFA444285707132EF
SHA256:97E5F342227EA23C27C1B660F111847FCDD9D7B23C1D248C733A36F983FD7F04
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\check_new_version.htmlhtml
MD5:CE4F2BAE0B1F6B51EEA2157E7ACA8D4C
SHA256:—
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-logo.pngimage
MD5:18F81892DAA926FEC1D30324B4CD9367
SHA256:681A96B96B5E0425FC74BE929D29164528BF0BC0A84AC97952C011E407E23D9B
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-script-lte-ie8.jstxt
MD5:5134186180074C51639D7A514919ED23
SHA256:33E84B33FF911257E3A6A303C08A2CC178827DADB7DFD7C951E096866E02AD5E
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\welcome_page_kavkis.htmlhtml
MD5:A1298580FED0F124E151D6F91DA271A3
SHA256:—
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\jquery-1.12.4.min.jss
MD5:4F252523D4AF0B478C810C2547A63E19
SHA256:668B046D12DB350CCBA6728890476B3EFEE53B2F42DBB84743E5E9F1AE0CC404
6672kts21.3.10.391abcdefghijklru_26487.exeC:\ProgramData\Kaspersky Lab Setup Files\PURE21.3.10.391.0.2520.0\kdscrl.rdbbinary
MD5:79A78149E4EF2E6E09CC061338C7B151
SHA256:E6C0DA20FC5D9EDA24E4128FAA5641F8B2D39951E0A0236C013E1F1EFCBF83FD
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-print.csstext
MD5:1304724DD5001B2600FC5BD80C098F1E
SHA256:2481B34B48FD96B194405DA621E8E5F19142DCB55744F9C9A93591705CB697FD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
16
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
109.248.196.5:443
https://dm.s.kaspersky-labs.com/bases/kavkis2021mr3/PURE/kdscrl.rdb.z
unknown
compressed
4.86 Kb
unknown
—
—
GET
200
195.122.169.10:443
https://dm.s.kaspersky-labs.com/bases/kavkis2021mr3/pure/index-bases-x64-2.txt
unknown
text
4.38 Kb
unknown
—
—
GET
200
195.122.169.10:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/x64/index2.txt
unknown
text
5.52 Kb
unknown
—
—
GET
200
195.122.169.10:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/x64/index2.txt
unknown
text
5.52 Kb
unknown
—
—
GET
200
109.248.196.5:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/ksn_antispam_ru-ru.txt
unknown
text
9.52 Kb
unknown
—
—
GET
200
81.19.104.170:443
https://dm.s.kaspersky-labs.com/kleaner/interactive2021.2/global/index-kleaner-2.txt
unknown
text
4.03 Kb
unknown
—
—
GET
200
81.19.104.170:443
https://dm.s.kaspersky-labs.com/bases/kavkis2021mr3/pure/index-bases-x64-2.txt
unknown
text
4.38 Kb
unknown
—
—
GET
200
109.248.196.5:443
https://dm.s.kaspersky-labs.com/kleaner/interactive2021.2/global/index-kleaner-2.txt
unknown
text
4.03 Kb
unknown
—
—
GET
200
195.122.169.10:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/eula_gdpr_ru-ru.txt
unknown
text
98.3 Kb
unknown
—
—
GET
200
81.19.104.170:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/eula_ru-ru.txt
unknown
text
56.0 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
6672
kts21.3.10.391abcdefghijklru_26487.exe
81.19.104.170:443
dm.s.kaspersky-labs.com
NTT-LTD-2914
GB
unknown
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
unknown
google.com
  • 142.250.184.238
unknown
dm.s.kaspersky-labs.com
  • 81.19.104.170
  • 195.122.169.10
  • 109.248.196.5
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kts21.3.10.391abcdefghijklru_26487.exe