Malware analysis http://download3.portableapps.com/portableapps/PortableApps.comPlatform/PortableApps.com_Platform_Setup_15.0.2.paf.exe?201806 Malicious activity

Add for printing

URL:	http://download3.portableapps.com/portableapps/PortableApps.comPlatform/PortableApps.com_Platform_Setup_15.0.2.paf.exe?201806
Full analysis:	https://app.any.run/tasks/f7566a32-800e-470a-9158-4f9092f91dcc
Verdict:	Malicious activity
Threats:	A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. Malware Trends Tracker >>>
Analysis date:	November 08, 2018, 09:58:23
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	trojan loader adware mindspark
Indicators:
MD5:	017795B3D9D8F00DFF9E81D5A340A1D9
SHA1:	152720E32308812556BF3EA771CDB4A4230DC6A9
SHA256:	4D45E5C75A8E6E17EFC2D0F18E26D76130DCD67FF7D2A447C4E313211006C753
SSDEEP:	3:N1KaKE4LgyKZlKUq4pB/Wy+M3CGB/WySJOMWA2VYYDJaFEVT:CaNbQUdppeM3CGptMWVhDUmT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: off
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (68.0.3440.106)
Google Update Helper (1.3.33.17)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Application was dropped or rewritten from another process
  - GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe (PID: 4020)
- Loads dropped or rewritten executable
  - GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe (PID: 4020)
- Downloads executable files from the Internet
  - iexplore.exe (PID: 3280)
- MINDSPARK was detected
  - GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe (PID: 4020)
SUSPICIOUS
- Executable content was dropped or overwritten
  - iexplore.exe (PID: 3900)
  - iexplore.exe (PID: 920)
  - iexplore.exe (PID: 3280)
  - GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe (PID: 4020)
- Uses RUNDLL32.EXE to load library
  - iexplore.exe (PID: 920)
- Creates files in the user directory
  - GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe (PID: 4020)
- Changes the started page of IE
  - GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe (PID: 4020)
- Creates a software uninstall entry
  - GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe (PID: 4020)
INFO
- Changes internet zones settings
  - iexplore.exe (PID: 920)
- Reads internet explorer settings
  - iexplore.exe (PID: 3900)
  - iexplore.exe (PID: 3280)
  - iexplore.exe (PID: 2620)
  - iexplore.exe (PID: 1016)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 3900)
  - iexplore.exe (PID: 920)
  - iexplore.exe (PID: 3280)
  - iexplore.exe (PID: 2620)
  - iexplore.exe (PID: 1016)
- Creates files in the user directory
  - iexplore.exe (PID: 3900)
  - FlashUtil32_26_0_0_131_ActiveX.exe (PID: 1180)
  - iexplore.exe (PID: 920)
  - iexplore.exe (PID: 3280)
  - iexplore.exe (PID: 2620)
  - iexplore.exe (PID: 1016)
- Application launched itself
  - iexplore.exe (PID: 920)
- Reads settings of System Certificates
  - iexplore.exe (PID: 920)
  - iexplore.exe (PID: 3280)
  - iexplore.exe (PID: 1016)
- Changes settings of System certificates
  - iexplore.exe (PID: 920)
- Adds / modifies Windows certificates
  - iexplore.exe (PID: 920)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
920	"C:\Program Files\Internet Explorer\iexplore.exe" -nohome	C:\Program Files\Internet Explorer\iexplore.exe		explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3900	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:920 CREDAT:71937	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
3868	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\PortableApps.com_Platform_Setup_15.0.2.paf[1]	C:\Windows\system32\rundll32.exe	—	iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3280	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:920 CREDAT:71941	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
1180	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding	C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe	—	svchost.exe
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131
4020	"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe"	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe		iexplore.exe
User: admin Company: Mindspark Interactive Network, Inc. Integrity Level: MEDIUM Description: GetFormsOnline Setup Exit code: 0 Version: 2.7.1.3000
2620	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:920 CREDAT:203009	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)
1016	"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:920 CREDAT:334081	C:\Program Files\Internet Explorer\iexplore.exe		iexplore.exe
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 8.00.7600.16385 (win7_rtm.090713-1255)

Add for printing

Total events

2 175

Read events

1 764

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

255

Unknown types

Dropped files

PID	Process	Filename		Type
920	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico		—
		MD5:—	SHA256:—
920	iexplore.exe	C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico		—
		MD5:—	SHA256:—
920	iexplore.exe	C:\Users\admin\AppData\Local\Temp\~DFE6B3031E644A131D.TMP		—
		MD5:—	SHA256:—
920	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\favicon[1].ico		—
		MD5:—	SHA256:—
3900	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[2].txt		—
		MD5:—	SHA256:—
3900	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\search[1].txt		—
		MD5:—	SHA256:—
920	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018110820181109\index.dat		dat
		MD5:6A8A397FBA7A7DB1B0F3232E025E8634	SHA256:0A366383D61B70922E9D044D0FB019937C4F7B418C2B24F75E557E126AE333B8
3900	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\Passport[1].aspx		—
		MD5:—	SHA256:—
3900	iexplore.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\search[1].htm		html
		MD5:C7126F6A9EB660D98C8BE5FB01F4F4B2	SHA256:87C1D838AC711711239A33A096D7334214F3DB0C066F87808DA23AB17F944E56
3900	iexplore.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[1].txt		text
		MD5:8DD2594AD827ABF1824FD86A9D6DDF72	SHA256:95E431D862A8FEDB617ABC5CB5A575AC2863F6A8231686086F59E6EF522D8E45

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

117

TCP/UDP connections

182

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3280	iexplore.exe	GET	302	162.243.236.235:80	http://download3.portableapps.com/portableapps/	US	—	—	suspicious
3280	iexplore.exe	GET	301	2.16.186.27:80	http://shell.windows.com/fileassoc/fileassoc.asp?Ext=paf%5b1%5d	unknown	—	—	whitelisted
3280	iexplore.exe	GET	302	104.94.183.45:80	http://go.microsoft.com/fwlink/?LinkId=57426&Ext=paf[1]	NL	—	—	whitelisted
3900	iexplore.exe	GET	301	2.16.186.24:80	http://shell.windows.com/fileassoc/fileassoc.asp?Ext=paf%5b1%5d	unknown	—	—	whitelisted
3900	iexplore.exe	GET	—	162.243.236.235:80	http://download3.portableapps.com/portableapps/PortableApps.comPlatform/PortableApps.com_Platform_Setup_15.0.2.paf.exe?201806	US	—	—	suspicious
3900	iexplore.exe	GET	302	104.94.183.45:80	http://go.microsoft.com/fwlink/?LinkId=57426&Ext=paf[1]	NL	—	—	whitelisted
3900	iexplore.exe	GET	206	162.243.236.235:80	http://download3.portableapps.com/portableapps/PortableApps.comPlatform/PortableApps.com_Platform_Setup_15.0.2.paf.exe?201806	US	mp3	4.77 Mb	suspicious
3280	iexplore.exe	GET	404	162.243.236.235:80	http://download3.portableapps.com/portableapps/PortableApps.comPlatform/PortableApps.com_Platform_Setup_15.0.2.exe	US	html	370 b	suspicious
920	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted
3280	iexplore.exe	GET	403	162.243.236.235:80	http://download3.portableapps.com/portableapps/PortableApps.comPlatform/	US	html	332 b	suspicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
920	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
3900	iexplore.exe	2.16.186.24:80	shell.windows.com	Akamai International B.V.	—	whitelisted
3900	iexplore.exe	204.79.197.200:443	www.bing.com	Microsoft Corporation	US	whitelisted
3900	iexplore.exe	157.55.134.136:443	login.live.com	Microsoft Corporation	US	whitelisted
920	iexplore.exe	204.79.197.200:443	www.bing.com	Microsoft Corporation	US	whitelisted
3900	iexplore.exe	104.94.183.45:80	go.microsoft.com	Akamai Technologies, Inc.	NL	whitelisted
3900	iexplore.exe	162.243.236.235:80	download3.portableapps.com	Digital Ocean, Inc.	US	suspicious
3280	iexplore.exe	204.79.197.200:443	www.bing.com	Microsoft Corporation	US	whitelisted
3280	iexplore.exe	2.16.186.27:80	shell.windows.com	Akamai International B.V.	—	whitelisted
3280	iexplore.exe	104.239.166.87:80	portableapps.com	Rackspace Ltd.	US	suspicious

DNS requests

Domain	IP	Reputation
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
download3.portableapps.com	162.243.236.235	unknown
go.microsoft.com	104.94.183.45	whitelisted
shell.windows.com	2.16.186.24 2.16.186.27	whitelisted
login.live.com	157.55.134.136 157.55.135.128 157.55.134.142	whitelisted
portableapps.com	104.239.166.87	suspicious
fonts.googleapis.com	216.58.215.234	whitelisted
fonts.gstatic.com	216.58.215.227	whitelisted
cdn.portableapps.com	94.31.29.131	unknown
pagead2.googlesyndication.com	172.217.168.2	whitelisted

Threats

PID	Process	Class	Message
3900	iexplore.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
3280	iexplore.exe	A Network Trojan was detected	SC TROJAN_DOWNLOADER Suspicious downloader - 404 Not Found for .exe
3280	iexplore.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
4020	GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe	Misc activity	ADWARE [PTsecurity] Mindspark CAPDownloadProcess
4020	GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe	Misc activity	ADWARE [PTsecurity] Mindspark User-Agent
4020	GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe	Misc activity	ADWARE [PTsecurity] Mindspark CAPDownloadProcess
4020	GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe	Misc activity	ADWARE [PTsecurity] Mindspark User-Agent
4020	GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe	Misc activity	ADWARE [PTsecurity] Mindspark CAPDownloadProcess
4020	GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe	Misc activity	ADWARE [PTsecurity] Mindspark User-Agent
4020	GetFormsOnline.78c1eb647b1341b2ac98b4df70fafc75[1].exe	Misc activity	ADWARE [PTsecurity] Mindspark CAPDownloadProcess

5 ETPRO signatures available at the full report

Add for printing

No debug info

General Info

http://download3.portableapps.com/portableapps/PortableApps.comPlatform/PortableApps.com_Platform_Setup_15.0.2.paf.exe?201806

017795B3D9D8F00DFF9E81D5A340A1D9

152720E32308812556BF3EA771CDB4A4230DC6A9

4D45E5C75A8E6E17EFC2D0F18E26D76130DCD67FF7D2A447C4E313211006C753

3:N1KaKE4LgyKZlKUq4pB/Wy+M3CGB/WySJOMWA2VYYDJaFEVT:CaNbQUdppeM3CGptMWVhDUmT

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

Loads dropped or rewritten executable

Downloads executable files from the Internet

MINDSPARK was detected

SUSPICIOUS

Executable content was dropped or overwritten

Uses RUNDLL32.EXE to load library

Creates files in the user directory

Changes the started page of IE

Creates a software uninstall entry

INFO

Changes internet zones settings

Reads internet explorer settings

Reads Internet Cache Settings

Creates files in the user directory

Application launched itself

Reads settings of System Certificates

Changes settings of System certificates

Adds / modifies Windows certificates

Malware configuration

Static information

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings