File name:

ArmouryCrateInstaller.exe

Full analysis: https://app.any.run/tasks/bd616895-c5ee-4cba-8353-33bd006bc9d4
Verdict: Malicious activity
Analysis date: July 25, 2024, 07:31:24
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

350ADD77EC579BBBDE55F5CD84E5104F

SHA1:

7497FD58BF6F80EFDB8D569C1771FFE9BEC21977

SHA256:

4D05106479102D0AC3B774FB5287DEE09A785CB27F9C64884D46631E2F52337F

SSDEEP:

98304:wWBAn6mYHT6Gl2Bn8uSM1ytXp17JKR7jLVW0Whm9T5DfUqbBiKhOFYMLlt1DM8nJ:w36

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ArmouryCrateInstaller.exe (PID: 4880)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • ArmouryCrateInstaller.exe (PID: 4880)
      • conhost.exe (PID: 4044)

    • Executable content was dropped or overwritten

      • ArmouryCrateInstaller.exe (PID: 4880)

    • Reads security settings of Internet Explorer

      • ArmouryCrateInstaller.exe (PID: 4880)
      • Armoury Crate Installer.exe (PID: 4360)
      • Armoury Crate Installer.exe (PID: 6956)
      • Armoury Crate Installer.exe (PID: 4116)
      • Armoury Crate Installer.exe (PID: 6604)

    • Reads the date of Windows installation

      • ArmouryCrateInstaller.exe (PID: 4880)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6544)
      • cmd.exe (PID: 6448)
      • cmd.exe (PID: 1756)

    • Starts CMD.EXE for commands execution

      • ArmouryCrateInstaller.exe (PID: 4880)

    • Executes as Windows Service

      • AsusROGLSLService.exe (PID: 2192)

  • INFO

    • Creates files in the program directory

      • ArmouryCrateInstaller.exe (PID: 4880)
      • AsusROGLSLService.exe (PID: 3968)
      • Armoury Crate Installer.exe (PID: 4360)
      • Armoury Crate Installer.exe (PID: 6956)
      • Armoury Crate Installer.exe (PID: 4116)
      • Armoury Crate Installer.exe (PID: 6604)

    • Checks supported languages

      • ArmouryCrateInstaller.exe (PID: 4880)
      • AsusROGLSLService.exe (PID: 3968)
      • AsusROGLSLService.exe (PID: 7080)
      • AsusROGLSLService.exe (PID: 2192)
      • Armoury Crate Installer.exe (PID: 6956)
      • Armoury Crate Installer.exe (PID: 6604)
      • Armoury Crate Installer.exe (PID: 4360)
      • Armoury Crate Installer.exe (PID: 4116)

    • Reads the computer name

      • ArmouryCrateInstaller.exe (PID: 4880)
      • AsusROGLSLService.exe (PID: 3968)
      • Armoury Crate Installer.exe (PID: 4360)
      • Armoury Crate Installer.exe (PID: 6956)
      • Armoury Crate Installer.exe (PID: 6604)
      • AsusROGLSLService.exe (PID: 2192)
      • Armoury Crate Installer.exe (PID: 4116)
      • AsusROGLSLService.exe (PID: 7080)

    • Process checks computer location settings

      • ArmouryCrateInstaller.exe (PID: 4880)

    • Reads the machine GUID from the registry

      • Armoury Crate Installer.exe (PID: 6604)
      • Armoury Crate Installer.exe (PID: 4360)
      • Armoury Crate Installer.exe (PID: 6956)
      • Armoury Crate Installer.exe (PID: 4116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (83)
.exe | Win32 Executable (generic) (9)
.exe | Generic Win/DOS Executable (3.9)
.exe | DOS Executable Generic (3.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:01:17 13:47:38+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 398848
InitializedDataSize: 3752960
UninitializedDataSize: -
EntryPoint: 0x37c24
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 3.2.11.2
ProductVersionNumber: 3.2.11.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral 2
CharacterSet: Unicode
CompanyName: ASUS
FileDescription: The installer for Armoury Crate and Aura Creator.
FileVersion: 3.2.11.2
LegalCopyright: Copyright (C) 2019
OriginalFileName: ArmouryCrateInstaller.exe
ProductVersion: 3.2.11.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
19
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start armourycrateinstaller.exe conhost.exe no specs asusroglslservice.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs asusroglslservice.exe no specs conhost.exe no specs asusroglslservice.exe armoury crate installer.exe no specs slui.exe no specs armoury crate installer.exe no specs armoury crate installer.exe no specs armoury crate installer.exe no specs armourycrateinstaller.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204"C:\ArmouryCrateInstaller.exe" C:\ArmouryCrateInstaller.exe—explorer.exe
User:
admin
Company:
ASUS
Integrity Level:
MEDIUM
Description:
The installer for Armoury Crate and Aura Creator.
Exit code:
3221226540
Version:
3.2.11.2
Modules
Images
c:\armourycrateinstaller.exe
c:\windows\system32\ntdll.dll
1756C:\WINDOWS\system32\cmd.exe /c Powershell "(get-appxpackage -Name B9ECED6F.ArmouryCrateSE).Version"C:\Windows\System32\cmd.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2192"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -runserviceC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe
services.exe
User:
SYSTEM
Company:
ASUS
Integrity Level:
SYSTEM
Version:
2.3.11.0
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2616C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3968"C:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe" -removeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Exit code:
0
Version:
2.3.11.0
Modules
Images
c:\program files (x86)\asus\asusroglslservice\asusroglslservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4044\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—ArmouryCrateInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4116"C:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe" -roglsloaderstart -win armourycrate -networkerrorC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe—AsusROGLSLService.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Armoury Crate Installer
Version:
2.3.11.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\armoury crate installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4248Powershell "(get-appxpackage -Name B9ECED6F.ArmouryCrateSE).Version"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4360"C:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe" -roglsloaderstart -win armourycrate -acinstallerC:\Program Files (x86)\ASUS\AsusROGLSLService\Armoury Crate Installer.exe—AsusROGLSLService.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Armoury Crate Installer
Exit code:
21858
Version:
2.3.11.2
Modules
Images
c:\program files (x86)\asus\asusroglslservice\armoury crate installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4880"C:\ArmouryCrateInstaller.exe" C:\ArmouryCrateInstaller.exe
explorer.exe
User:
admin
Company:
ASUS
Integrity Level:
HIGH
Description:
The installer for Armoury Crate and Aura Creator.
Exit code:
0
Version:
3.2.11.2
Modules
Images
c:\armourycrateinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
20 486
Read events
20 465
Write events
19
Delete events
2

Modification events

(PID) Process:(4880) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:ACInstallPath
Value:
C:
(PID) Process:(4880) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:InstallFinish
Value:
0
(PID) Process:(4880) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:aaiu
Value:
(PID) Process:(4880) ArmouryCrateInstaller.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:delete valueName:InstallerSilentMode
Value:
(PID) Process:(4880) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4880) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4880) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4880) ArmouryCrateInstaller.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7080) AsusROGLSLService.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\ASUS\ROGLiveServicePackage
Operation:writeName:aaiu
Value:
0
(PID) Process:(4360) Armoury Crate Installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
Operation:writeName:Left
Value:
0
Executable files
9
Suspicious files
1
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
4880ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\QueryUWP.exeexecutable
MD5:040D1F9B8554F4452473F655C0898A12
SHA256:E96FC05448DEE664BD0CC011E983E98ECF7AB2904AAB25BE401B1EE994141EF9
4880ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusROGLSLService.exeexecutable
MD5:12D2B87765FA26B2FCE79C806F4EB2EA
SHA256:43A0C9E2B294656EFF305EC8A247D647BC3B85542F2FE1EC424D7FDC822A5F07
4880ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsusGCGridServiceSetup.exeexecutable
MD5:242C0332DB5EBA361CC3628DFAB5CE56
SHA256:BCC843B036C22AD4A1485E62C2ED5CA88F33688FA919C73276B93D4CDBE83347
4880ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\AsZip.exeexecutable
MD5:9131A40E5770D1170C3093FB0D2F6F63
SHA256:FCF8D154E6B37985434F991B048CEF457DE123DD5A553EF3C6B28A67FB8A3987
4880ArmouryCrateInstaller.exeC:\Program Files (x86)\ASUS\AsusROGLSLService\Newtonsoft.Json.dllexecutable
MD5:081D9558BBB7ADCE142DA153B2D5577A
SHA256:B624949DF8B0E3A6153FDFB730A7C6F4990B6592EE0D922E1788433D276610F3
6056powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zbx2keio.jqe.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6056powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:8FBC791747280AD0113BBDE4A8DF1B1D
SHA256:37878E09E57EA184973E2A953AA9B354E69621A6BDB437B61E574E1CB100CE31
7092powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wr2rqzyl.far.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6056powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5kythodp.is0.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4248powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ljmv23ft.ibf.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
21
DNS requests
6
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6012
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4012
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4512
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.178:443
—
Akamai International B.V.
DE
unknown
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4204
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4512
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6176
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
Process
Message
AsusROGLSLService.exe
Failed to get baseboard manufacturer via WMI, get via registry.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArmouryCrateInstaller.exe