File name:

kts21.3.10.391abcdefghijklru_26487.exe

Full analysis: https://app.any.run/tasks/93178839-fffc-42e8-bb37-38dedb1c1b2a
Verdict: Malicious activity
Analysis date: August 01, 2024, 15:37:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A05B0CFE267655DE881AC2E7B06D7848

SHA1:

2B03CE061A49A7D7065D343C9AB7079F283F8814

SHA256:

49C7CF3C52C28B5C472639E3C06F349E84DD5E0F2F856F2240C4815BBEA4E70D

SSDEEP:

98304:zKBwrBJbYrniSos+gIsIspUW/YqXOyR7GoLm4yOFrUx87d83DwIaxdMx+x49xrRe:vsdZoHK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads security settings of Internet Explorer

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Checks Windows Trust Settings

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads Microsoft Outlook installation path

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

  • INFO

    • Checks supported languages

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Process checks whether UAC notifications are on

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Process checks Internet Explorer phishing filters

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Checks proxy server information

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Create files in a temporary directory

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads the computer name

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Creates files in the program directory

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads the software policy settings

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Reads the machine GUID from the registry

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)

    • Checks for the presence of KasperskyLab

      • kts21.3.10.391abcdefghijklru_26487.exe (PID: 6672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1972:01:30 11:30:30+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 302080
InitializedDataSize: 2392064
UninitializedDataSize: -
EntryPoint: 0x24c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 21.3.10.391
ProductVersionNumber: 21.3.10.391
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Лаборатория Касперского
FileDescription: Kaspersky Total Security [21.3.10.391.0.2520.0 (a.b.c.d.e.f.g.h.i.j.k.l)]
FileVersion: 21.3.10.391
LegalCopyright: © 2021 АО "Лаборатория Касперского"
LegalTrademarks: Зарегистрированные товарные знаки и знаки обслуживания являются собственностью их правообладателей
ProductName: Kaspersky Total Security
ProductVersion: 21.3.10.391
InternalName: Setup
OriginalFileName: Setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start kts21.3.10.391abcdefghijklru_26487.exe

Process information

PID
CMD
Path
Indicators
Parent process
6672"C:\Users\admin\Desktop\kts21.3.10.391abcdefghijklru_26487.exe" C:\Users\admin\Desktop\kts21.3.10.391abcdefghijklru_26487.exe
explorer.exe
User:
admin
Company:
Лаборатория Касперского
Integrity Level:
MEDIUM
Description:
Kaspersky Total Security [21.3.10.391.0.2520.0 (a.b.c.d.e.f.g.h.i.j.k.l)]
Version:
21.3.10.391
Modules
Images
c:\users\admin\desktop\kts21.3.10.391abcdefghijklru_26487.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\dbghelp.dll
Total events
4 508
Read events
4 482
Write events
26
Delete events
0

Modification events

(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2520.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\PURE21.3.10.391.0.2520.0
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLabSetup\Setup21.3.10.391.0.2520.0
Operation:writeName:TrashFiles
Value:
C:\ProgramData\Kaspersky Lab Setup Files\PURE21.3.10.391.0.2520.0 C:\ProgramData\Kaspersky Lab Setup Files
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLab\IEOverride\Main
Operation:writeName:Enable Browser Extensions
Value:
no
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\KasperskyLab\IEOverride\Main
Operation:writeName:UseSWRender
Value:
1
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6672) kts21.3.10.391abcdefghijklru_26487.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
1
Suspicious files
4
Text files
7
Unknown types
2

Dropped files

PID
Process
Filename
Type
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\check_new_version.htmlhtml
MD5:CE4F2BAE0B1F6B51EEA2157E7ACA8D4C
SHA256:—
6672kts21.3.10.391abcdefghijklru_26487.exeC:\ProgramData\Kaspersky Lab Setup Files\PURE21.3.10.391.0.2520.0\kdscrl.rdb.zcompressed
MD5:F08B87E5EA3EF8E68DDF3428C7CFDF9C
SHA256:—
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-script.jsbinary
MD5:026425CCBF4417EEFA444285707132EF
SHA256:97E5F342227EA23C27C1B660F111847FCDD9D7B23C1D248C733A36F983FD7F04
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\jquery-1.12.4.min.jss
MD5:4F252523D4AF0B478C810C2547A63E19
SHA256:668B046D12DB350CCBA6728890476B3EFEE53B2F42DBB84743E5E9F1AE0CC404
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-logo.pngimage
MD5:18F81892DAA926FEC1D30324B4CD9367
SHA256:681A96B96B5E0425FC74BE929D29164528BF0BC0A84AC97952C011E407E23D9B
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-print.csstext
MD5:1304724DD5001B2600FC5BD80C098F1E
SHA256:2481B34B48FD96B194405DA621E8E5F19142DCB55744F9C9A93591705CB697FD
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-script-lte-ie8.jstxt
MD5:5134186180074C51639D7A514919ED23
SHA256:33E84B33FF911257E3A6A303C08A2CC178827DADB7DFD7C951E096866E02AD5E
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\jquery.custom_select.min.jsbinary
MD5:D2C620C462B75696EEA1FB22FB23602A
SHA256:DD678D32073078552E0E2C35EED78F16CC8D6E8662D4734518561A1B183F775C
6672kts21.3.10.391abcdefghijklru_26487.exeC:\ProgramData\Kaspersky Lab Setup Files\PURE21.3.10.391.0.2520.0\kdscrl.rdbbinary
MD5:79A78149E4EF2E6E09CC061338C7B151
SHA256:E6C0DA20FC5D9EDA24E4128FAA5641F8B2D39951E0A0236C013E1F1EFCBF83FD
6672kts21.3.10.391abcdefghijklru_26487.exeC:\Users\admin\AppData\Local\Temp\FF756068-501B-11EF-B4E3-18F7786F96EE\kis-style.csstext
MD5:2B4BD0AFD0E9DD5C90FB8C3BB4A5D619
SHA256:F9963B403E053F6BFA7C87CAD3C10DD55CF1F94FEFE00C6380921440E28B48D2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
16
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
195.122.169.10:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/x64/index2.txt
unknown
text
5.52 Kb
—
—
—
GET
200
195.122.169.10:443
https://dm.s.kaspersky-labs.com/bases/kavkis2021mr3/pure/index-bases-x64-2.txt
unknown
text
4.38 Kb
—
—
—
GET
200
81.19.104.170:443
https://dm.s.kaspersky-labs.com/kleaner/interactive2021.2/global/index-kleaner-2.txt
unknown
text
4.03 Kb
—
—
—
GET
200
195.122.169.10:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/x64/index2.txt
unknown
text
5.52 Kb
—
—
—
GET
200
109.248.196.5:443
https://dm.s.kaspersky-labs.com/bases/kavkis2021mr3/PURE/kdscrl.rdb.z
unknown
compressed
4.86 Kb
—
—
—
GET
200
109.248.196.5:443
https://dm.s.kaspersky-labs.com/kleaner/interactive2021.2/global/index-kleaner-2.txt
unknown
text
4.03 Kb
—
—
—
GET
200
81.19.104.170:443
https://dm.s.kaspersky-labs.com/bases/kavkis2021mr3/pure/index-bases-x64-2.txt
unknown
text
4.38 Kb
—
—
—
GET
200
109.248.196.5:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/ksn_antispam_ru-ru.txt
unknown
text
9.52 Kb
—
—
—
GET
200
109.248.196.5:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/ksn_ru-ru.txt
unknown
text
87.2 Kb
—
—
—
GET
200
195.122.169.10:443
https://dm.s.kaspersky-labs.com/ru-RU/PURE/21.3.10.391/eula_gdpr_ru-ru.txt
unknown
text
98.3 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
unknown
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:137
—
—
—
unknown
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
6672
kts21.3.10.391abcdefghijklru_26487.exe
81.19.104.170:443
dm.s.kaspersky-labs.com
NTT-LTD-2914
GB
unknown
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
unknown
google.com
  • 142.250.184.238
unknown
dm.s.kaspersky-labs.com
  • 81.19.104.170
  • 195.122.169.10
  • 109.248.196.5
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
kts21.3.10.391abcdefghijklru_26487.exe