| File name: | Ninite Java AdoptOpenJDK 8 Installer.exe |
| Full analysis: | https://app.any.run/tasks/ad0475cd-142c-4219-af8e-1b7b45426792 |
| Verdict: | Malicious activity |
| Analysis date: | December 20, 2024, 11:18:38 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections |
| MD5: | 183A94A0AFBA16038B1B6A3C92496550 |
| SHA1: | 2BBCDB55D3BA9A221B93155FC9B5E8EB5007F7EC |
| SHA256: | 4D4DF42DDA8A7045073C1201B69B38A35BE320B6B102874991CE4321FEC2ABEF |
| SSDEEP: | 12288:jLVP603RQX2pyf+cnci2N9pKKfyeo+pW1KKRyzEw:HVP60BM2pMUN9keo+c+zEw |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- Ninite.exe (PID: 6416)
- Ninite.exe (PID: 6220)
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
Application launched itself
- Ninite.exe (PID: 6220)
Checks Windows Trust Settings
- Ninite.exe (PID: 6416)
- msiexec.exe (PID: 6952)
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
Searches for installed software
- Ninite.exe (PID: 6416)
Checks for Java to be installed
- Ninite.exe (PID: 6416)
Process drops legitimate windows executable
- msiexec.exe (PID: 6952)
The process drops C-runtime libraries
- msiexec.exe (PID: 6952)
Executable content was dropped or overwritten
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
INFO
The sample compiled with english language support
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
- msiexec.exe (PID: 6952)
Process checks computer location settings
- Ninite.exe (PID: 6220)
Reads the computer name
- Ninite.exe (PID: 6220)
- Ninite.exe (PID: 6416)
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
- msiexec.exe (PID: 6952)
- msiexec.exe (PID: 7068)
The process uses the downloaded file
- Ninite.exe (PID: 6220)
Checks supported languages
- Ninite.exe (PID: 6416)
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
- msiexec.exe (PID: 6952)
- msiexec.exe (PID: 7068)
- Ninite.exe (PID: 6220)
Checks proxy server information
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
- Ninite.exe (PID: 6416)
Create files in a temporary directory
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
Reads the machine GUID from the registry
- Ninite.exe (PID: 6416)
- msiexec.exe (PID: 6952)
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
Reads the software policy settings
- Ninite.exe (PID: 6416)
- msiexec.exe (PID: 6952)
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
Creates files or folders in the user directory
- Ninite.exe (PID: 6416)
- msiexec.exe (PID: 6952)
- Ninite Java AdoptOpenJDK 8 Installer.exe (PID: 2100)
Executable content was dropped or overwritten
- msiexec.exe (PID: 6952)
Creates a software uninstall entry
- msiexec.exe (PID: 6952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2017:04:12 00:19:47+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14 |
| CodeSize: | 233472 |
| InitializedDataSize: | 182272 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x1a53a |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.1.1.1183 |
| ProductVersionNumber: | 0.1.1.1183 |
| FileFlagsMask: | 0x0017 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Secure By Design Inc. |
| FileDescription: | Ninite |
| FileVersion: | 0,1,1,1183 |
| InternalName: | Ninite |
| LegalCopyright: | Copyright (C) 2009 Secure By Design Inc |
| OriginalFileName: | - |
| ProductName: | Ninite |
| ProductVersion: | 0,1,1,1183 |
Total processes
135
Monitored processes
6
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2100 | "C:\Users\admin\AppData\Local\Temp\Ninite Java AdoptOpenJDK 8 Installer.exe" | C:\Users\admin\AppData\Local\Temp\Ninite Java AdoptOpenJDK 8 Installer.exe | explorer.exe | ||||||||||||
User: admin Company: Secure By Design Inc. Integrity Level: MEDIUM Description: Ninite Version: 0,1,1,1183 Modules
| |||||||||||||||
| 6220 | Ninite.exe "178c3b9540144df96e081f5e21880bb7e5598a51" /fullpath "C:\Users\admin\AppData\Local\Temp\Ninite Java AdoptOpenJDK 8 Installer.exe" | C:\Users\admin\AppData\Local\Temp\2aeb1f3c-bec4-11ef-b4ea-18f7786f96ee\Ninite.exe | — | Ninite Java AdoptOpenJDK 8 Installer.exe | |||||||||||
User: admin Company: Secure By Design Inc. Integrity Level: MEDIUM Description: Ninite Version: 0,1,1,1481 Modules
| |||||||||||||||
| 6416 | "C:\Users\admin\AppData\Local\Temp\2aeb1f3c-bec4-11ef-b4ea-18f7786f96ee\Ninite.exe" "178c3b9540144df96e081f5e21880bb7e5598a51" /fullpath "C:\Users\admin\AppData\Local\Temp\Ninite Java AdoptOpenJDK 8 Installer.exe" /relaunch | C:\Users\admin\AppData\Local\Temp\2aeb1f3c-bec4-11ef-b4ea-18f7786f96ee\Ninite.exe | Ninite.exe | ||||||||||||
User: admin Company: Secure By Design Inc. Integrity Level: HIGH Description: Ninite Version: 0,1,1,1481 Modules
| |||||||||||||||
| 6912 | msiexec.exe /i "C:\Users\admin\AppData\Local\Temp\2C667D~1\target.msi" /qn /norestart REBOOT=ReallySuppress ALLUSERS=1 INSTALLLEVEL=3 | C:\Windows\SysWOW64\msiexec.exe | — | Ninite.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6952 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7068 | C:\Windows\syswow64\MsiExec.exe -Embedding 4424EF39B7E0211105E9FE245CEBF8B4 | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
10 610
Read events
10 297
Write events
305
Delete events
8
Modification events
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: 281B00004FEA57F4D052DB01 | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 43B17D27CCAD30908B2554FEB8C065FA41D1E6ADBDA2F9867A163A5DB3A529C3 | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9C023A4FD63E3335A85D21E7A84509F6 |
| Operation: | write | Name: | 3D607E694CDA16B4183104887D24EA6A |
Value: | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8251A334D67240E519898902580546B7 |
| Operation: | write | Name: | 3D607E694CDA16B4183104887D24EA6A |
Value: 02:\SOFTWARE\Eclipse Adoptium\JRE\8.0.432.6\hotspot\MSI\JavaHome | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFC51D07C16011D57A866D85C51BFC78 |
| Operation: | write | Name: | 3D607E694CDA16B4183104887D24EA6A |
Value: 02:\SOFTWARE\Eclipse Adoptium\JRE\8.0.432.6\hotspot\MSI\JavaHomeSetForSystem | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\25A93C16A6B250858943B37BEF59343F |
| Operation: | write | Name: | 3D607E694CDA16B4183104887D24EA6A |
Value: | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A81274A57E68FA5284E4340471825F1 |
| Operation: | write | Name: | 3D607E694CDA16B4183104887D24EA6A |
Value: 02:\SOFTWARE\Classes\.jar\ | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C1C702F56F8B1515BAC385F392B3442B |
| Operation: | write | Name: | 3D607E694CDA16B4183104887D24EA6A |
Value: 02:\SOFTWARE\JavaSoft\Java Runtime Environment\CurrentVersion | |||
| (PID) Process: | (6952) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\96DF28AA85465055AB45E9F953114ECA |
| Operation: | write | Name: | 3D607E694CDA16B4183104887D24EA6A |
Value: 02:\SOFTWARE\JavaSoft\Java Runtime Environment\1.8\JavaHome | |||
Executable files
131
Suspicious files
24
Text files
43
Unknown types
22
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6416 | Ninite.exe | C:\Users\admin\AppData\Local\Temp\2c667dd6-bec4-11ef-b4ea-18f7786f96ee\target.msi_2c667dd7-bec4-11ef-b4ea-18f7786f96ee | — | |
MD5:— | SHA256:— | |||
| 6416 | Ninite.exe | C:\Users\admin\AppData\Local\Temp\2c667dd6-bec4-11ef-b4ea-18f7786f96ee\target.msi | — | |
MD5:— | SHA256:— | |||
| 6952 | msiexec.exe | C:\Windows\Installer\13803f.msi | — | |
MD5:— | SHA256:— | |||
| 2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517 | der | |
MD5:7E164878DD7587A223B05A5F9FEA2CE7 | SHA256:C04840B67C8264899F7F46475936A7FA3B8DD8C4AF80DFC27EB6BDD94AF1DF31 | |||
| 2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | C:\Users\admin\AppData\Local\Temp\2aeb1f3c-bec4-11ef-b4ea-18f7786f96ee\Ninite.exe | executable | |
MD5:AECEA03AB75EA848DC8BB0511A3DFD83 | SHA256:168C0280421EC2CEA8ADCF34A22056839F32DF0AC3575B08F98001A10AD587C9 | |||
| 2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50385F8EB1F713E33924A830D7A2A41C | binary | |
MD5:C845F61EA8FCF5BFFB68E6E459B4EEC9 | SHA256:5D4A475218BEE5C7B6BBC397A3D72A3F6C91C280A630795833A2E9FAD958591F | |||
| 2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_A784AE3E993E9BBF7162E8F9F9758D3D | binary | |
MD5:AA4EAF73BF21785FCD0C70F1D6E6D2C8 | SHA256:8221BB3F9BACAE7DFD4AAA79F6CDC11E2B22744A6BFFC0A03810BCC07AEFD01D | |||
| 2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_A784AE3E993E9BBF7162E8F9F9758D3D | der | |
MD5:1AA34BAEE4529BFBCB3024FF23904F29 | SHA256:D3346A43B0D0DD718998D4159E9568B3E302C905B9ED295EBB13FF312039BCF0 | |||
| 2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517 | binary | |
MD5:5FA19A7D250211FF0A82F3F145013C14 | SHA256:BE6322BE6EC2981B865057367378A1705E21334AC52FF9FDA7C444E9E6825B6E | |||
| 6952 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB | binary | |
MD5:0EDEDA636DDA84C6BEA84F1A9467AC63 | SHA256:E2C769ABF6DAD1F6C1C9E97766764321683EF4D57CE5A82AF34B7400A0938374 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
43
DNS requests
24
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | GET | 200 | 18.245.38.41:80 | http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D | unknown | — | — | unknown |
2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | GET | 200 | 151.101.2.133:80 | http://ocsp.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGEJFcIpBz28BuO60qVQ%3D | unknown | — | — | whitelisted |
2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | GET | 200 | 151.101.2.133:80 | http://ocsp.globalsign.com/codesigningrootr45/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEQCBTkIXoSl%2F7VrM1Bf4ka11 | unknown | — | — | whitelisted |
2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | GET | 200 | 151.101.2.133:80 | http://ocsp.globalsign.com/gsgccr45codesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBTLuA3ygnKW%2F7xuSx%2F09F%2BhHVuEUQQU2rONwCSQo2t30wygWd0hZ2R2C3gCDGPUxoqhhiZifL455A%3D%3D | unknown | — | — | whitelisted |
6416 | Ninite.exe | GET | 200 | 104.18.38.233:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D | unknown | — | — | whitelisted |
1176 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6416 | Ninite.exe | GET | 200 | 172.64.149.23:80 | http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd | unknown | — | — | whitelisted |
6416 | Ninite.exe | GET | 200 | 104.18.38.233:80 | http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
6068 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | 65.9.66.14:443 | ninite.com | AMAZON-02 | US | whitelisted |
2100 | Ninite Java AdoptOpenJDK 8 Installer.exe | 18.245.38.41:80 | ocsp.rootca1.amazontrust.com | — | US | shared |
5064 | SearchApp.exe | 104.126.37.144:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
ninite.com |
| whitelisted |
ocsp.rootca1.amazontrust.com |
| shared |
www.bing.com |
| whitelisted |
ocsp.globalsign.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
github.com |
| shared |