analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

mcafee_trial_setup_433.0207.3919_key.exe

Full analysis: https://app.any.run/tasks/c49aaf01-cc6c-49f9-871c-335f408d6d78
Verdict: Malicious activity
Analysis date: January 17, 2020, 18:10:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

974BB99753DE5481EDF071207FEE474E

SHA1:

F3BED4963ED9493DA8E65DC1269F1598D35764AC

SHA256:

500E11FA9E469D3C3F85BA38D34443B880D9CF1F750061039C14072F99AD40B3

SSDEEP:

98304:JjHD8LYjcVNRVbuYd3TQ8DGCvcZYdyIDD+M5ZgArRlGgMK6DoHkdqDnzkMIOF3lS:JjHoLYjcVD1d3M5CvRdyIDD+wi+lQKY+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Loads dropped or rewritten executable

      • mcafee_trial_setup_433.0207.3919_key.exe (PID: 1800)
      • mcuicnt.exe (PID: 4040)
    • Application was dropped or rewritten from another process

      • mcuicnt.exe (PID: 4040)
      • McDiReg.exe (PID: 996)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2748)
    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1744)
  • SUSPICIOUS

    • Creates files in the program directory

      • mcafee_trial_setup_433.0207.3919_key.exe (PID: 1800)
      • McDiReg.exe (PID: 996)
      • mcuicnt.exe (PID: 4040)
    • Reads internet explorer settings

      • mcuicnt.exe (PID: 4040)
    • Starts CMD.EXE for commands execution

      • McDiReg.exe (PID: 996)
    • Reads Internet Cache Settings

      • mcuicnt.exe (PID: 4040)
    • Creates files in the user directory

      • McDiReg.exe (PID: 996)
      • mcuicnt.exe (PID: 4040)
    • Executable content was dropped or overwritten

      • mcafee_trial_setup_433.0207.3919_key.exe (PID: 1800)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

ProductVersion: 4.0.127.1
ProductName: McAfee Package
OriginalFileName: mcinsint_mis.exe
LegalCopyRight: Copyright© 2019 McAfee, LLC
FileVersion: 1.0.0.0
FileDescription: McAfee Package
CompanyName: McAfee, LLC.
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 4.0.127.1
FileVersionNumber: 4.0.127.1
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x31d6
UninitializedDataSize: 1024
InitializedDataSize: 118784
CodeSize: 24576
LinkerVersion: 6
PEType: PE32
TimeStamp: 2018:12:15 23:24:22+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-Dec-2018 22:24:22
Detected languages:
  • English - United States
CompanyName: McAfee, LLC.
FileDescription: McAfee Package
FileVersion: 1.0.0.0
LegalCopyRight: Copyright© 2019 McAfee, LLC
OriginalFilename: mcinsint_mis.exe
ProductName: McAfee Package
ProductVersion: 4.0.127.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 15-Dec-2018 22:24:22
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005F0D
0x00006000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45039
.rdata
0x00007000
0x00001250
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.00109
.data
0x00009000
0x0001A818
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.12959
.ndata
0x00024000
0x00009000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0002D000
0x00006320
0x00006400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.75859

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28733
841
UNKNOWN
English - United States
RT_MANIFEST
2
3.33921
4264
UNKNOWN
English - United States
RT_ICON
3
4.53307
3752
UNKNOWN
English - United States
RT_ICON
4
4.30121
2216
UNKNOWN
English - United States
RT_ICON
5
4.70655
1384
UNKNOWN
English - United States
RT_ICON
6
5.12697
1128
UNKNOWN
English - United States
RT_ICON
103
2.69913
90
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start mcafee_trial_setup_433.0207.3919_key.exe no specs mcafee_trial_setup_433.0207.3919_key.exe mcuicnt.exe mcdireg.exe no specs cmd.exe no specs schtasks.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
996"C:\Users\admin\AppData\Local\Temp\mcafee_trial_setup_433.0207.3919_key.exe" C:\Users\admin\AppData\Local\Temp\mcafee_trial_setup_433.0207.3919_key.exeexplorer.exe
User:
admin
Company:
McAfee, LLC.
Integrity Level:
MEDIUM
Description:
McAfee Package
Exit code:
3221226540
Version:
1.0.0.0
1800"C:\Users\admin\AppData\Local\Temp\mcafee_trial_setup_433.0207.3919_key.exe" C:\Users\admin\AppData\Local\Temp\mcafee_trial_setup_433.0207.3919_key.exe
explorer.exe
User:
admin
Company:
McAfee, LLC.
Integrity Level:
HIGH
Description:
McAfee Package
Exit code:
10
Version:
1.0.0.0
4040"C:\Users\admin\AppData\Local\Temp\nsbA488.tmp\mcuicnt.exe" vi2.dll C:\Users\admin\AppData\Local\Temp\nsbA488.tmp\mcuicnt.exe
mcafee_trial_setup_433.0207.3919_key.exe
User:
admin
Company:
McAfee, LLC.
Integrity Level:
HIGH
Description:
McAfee
Exit code:
10
Version:
9,8,124,0
996C:\ProgramData\McAfee\Direct\McDiReg.exe -MONITOR_PI2 4040C:\ProgramData\McAfee\Direct\McDiReg.exemcuicnt.exe
User:
admin
Company:
McAfee, LLC.
Integrity Level:
HIGH
Description:
McAfee Direct Registration
Exit code:
0
Version:
4,0,127,0
2748"C:\Windows\System32\cmd.exe" /C "C:\Users\admin\AppData\Local\Temp\selfdestruct.bat" C:\Windows\System32\cmd.exeMcDiReg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1744schtasks /Delete /TN McDiReg /FC:\Windows\system32\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
616timeout /T 20C:\Windows\system32\timeout.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
910
Read events
855
Write events
0
Delete events
0

Modification events

No data
Executable files
23
Suspicious files
3
Text files
166
Unknown types
2

Dropped files

PID
Process
Filename
Type
1800mcafee_trial_setup_433.0207.3919_key.exeC:\ProgramData\McAfee\Direct\McDiReg.xmlxml
MD5:932AD7C6BA8427735A3A475146B692E5
SHA256:07C23910C1D79D5E33C5BE867150E33C3C3844B1A9233007A84E5E1998EE8F8B
1800mcafee_trial_setup_433.0207.3919_key.exeC:\ProgramData\McAfee\Direct\Vi2_Fresh.jsontext
MD5:3312F4D48AEA692F2AA40A5CC079DFC7
SHA256:61EB0FC6A127B1BB4E4EB716F6E6BD058EBC12F158EEC5662A0367FB1E6D4806
1800mcafee_trial_setup_433.0207.3919_key.exeC:\ProgramData\McAfee\Direct\CreateMcDiRegTask.battext
MD5:673EA78C73F32E0EEFAB0544D00FBCB4
SHA256:D0E2E60D662C80DDD3835795F7C566FF9B6A84E6210817B4F01846DFA9736C11
1800mcafee_trial_setup_433.0207.3919_key.exeC:\Users\admin\AppData\Local\Temp\nsbA488.tmp\CreateMcDiRegTask.battext
MD5:673EA78C73F32E0EEFAB0544D00FBCB4
SHA256:D0E2E60D662C80DDD3835795F7C566FF9B6A84E6210817B4F01846DFA9736C11
1800mcafee_trial_setup_433.0207.3919_key.exeC:\ProgramData\McAfee\Direct\Vi2Res.dllexecutable
MD5:64EDF67E55DBA91762FBF9FB580F2E0B
SHA256:ABE28A757A84FDE0E59E004A4006C7D62F35D657E53BD0F6547F7A969ED9297C
1800mcafee_trial_setup_433.0207.3919_key.exeC:\ProgramData\McAfee\Direct\McDiReg.exeexecutable
MD5:8BD4082B64A38B05D4B2704801FE62A4
SHA256:A5B1A28FF8D39012FB600CED81D390918A9C43C29466AF36F7778AAA513E59A7
1800mcafee_trial_setup_433.0207.3919_key.exeC:\ProgramData\McAfee\Direct\McInstru.dllexecutable
MD5:26274E918C3A299F70F3EC03D79DE519
SHA256:5FCD614A810A12C6E12D56AD227351EF4B915AB677C476A5142C38BCC9ADE277
1800mcafee_trial_setup_433.0207.3919_key.exeC:\Users\admin\AppData\Local\Temp\nsbA488.tmp\MMIPDURes.dllexecutable
MD5:A5CE55E55A3E09FD116DBB47F59994B8
SHA256:87D6E8A78484A5C081A3B359E98A4CAA348E49EC08DFB365F7DAC34CAE9193FC
1800mcafee_trial_setup_433.0207.3919_key.exeC:\ProgramData\McAfee\Direct\DynamicAffid\1324\AWDET.initext
MD5:CA0AD538679EB415A098B1AB7FCD4451
SHA256:6478936F72C694F3134A2D4F41C3F0B9D35CE5A7698B995428C7DCF75FA4407A
1800mcafee_trial_setup_433.0207.3919_key.exeC:\ProgramData\McAfee\Direct\DynamicAffid\1333\AWDET.initext
MD5:F61C35712B1CACC8A336E1DAA5131EC7
SHA256:BD00F7964D796797E1E3B2020F8218C525C4712F98AFD7AA7FA6EEDF4B1622E8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4040
mcuicnt.exe
161.69.36.41:443
ws.mcafee.com
US
unknown

DNS requests

Domain
IP
Reputation
ws.mcafee.com
  • 161.69.36.41
unknown

Threats

No threats detected
No debug info