Find similar analyses in TI Lookup

Analysis date (UTC): 26 December 2024, 14:53Analysis environment: Windows 10 Pro, build 19045, x64

SilverFox.7z

MD5:54ACF97E27719432C0CDD6714D468AB7

SHA1:470A06CC4491311EF43E0D979BBA300AD4DF5F72

SHA256:4D08AF0A23E230672FAE7CAB550F7F7D512CC02D4EE5DF04F7EB8E997F90A5A4

Analysis result

Threat level:Malicious activity

Tags:

autovalleyratsilverfox

Full analysis:Analysis SilverFox.7z (MD5: 54ACF97E27719432C0CDD6714D468AB7) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

VALLEYRAT has been found (auto)

WinRAR.exe (PID: 6056)

Adds path to the Windows Defender exclusion list

安装助手1.0.2.tmp (PID: 2612)

SUSPICIOUS

Executable content was dropped or overwritten

安装助手1.0.2.exe (PID: 4932)
安装助手1.0.2.exe (PID: 3288)
安装助手1.0.2.tmp (PID: 2612)
安装助手1.0.2.exe (PID: 5876)
安装助手1.0.2.tmp (PID: 6268)

Reads the Windows owner or organization settings

安装助手1.0.2.tmp (PID: 2612)

Process drops legitimate windows executable

安装助手1.0.2.tmp (PID: 2612)
安装助手1.0.2.tmp (PID: 6268)

Script adds exclusion path to Windows Defender

安装助手1.0.2.tmp (PID: 2612)

Starts POWERSHELL.EXE for commands execution

安装助手1.0.2.tmp (PID: 2612)

Reads security settings of Internet Explorer

安装助手1.0.2.tmp (PID: 2612)

INFO

Executable content was dropped or overwritten

WinRAR.exe (PID: 6056)

Checks supported languages

安装助手1.0.2.exe (PID: 4932)
安装助手1.0.2.tmp (PID: 5732)
安装助手1.0.2.tmp (PID: 2612)
安装助手1.0.2.tmp (PID: 6268)

The process uses the downloaded file

WinRAR.exe (PID: 6056)
安装助手1.0.2.tmp (PID: 2612)

Create files in a temporary directory

安装助手1.0.2.exe (PID: 3288)
安装助手1.0.2.tmp (PID: 2612)
安装助手1.0.2.exe (PID: 5876)
安装助手1.0.2.tmp (PID: 6268)

Reads the computer name

安装助手1.0.2.tmp (PID: 2612)
安装助手1.0.2.tmp (PID: 6268)

Checks if a key exists in the options dictionary (POWERSHELL)

powershell.exe (PID: 624)

Script raised an exception (POWERSHELL)

powershell.exe (PID: 624)

Creates files in the program directory

安装助手1.0.2.tmp (PID: 6268)

Threats

No threats detected