analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

hdsentinel_setup_5304-lsir.zip

Full analysis: https://app.any.run/tasks/00210cf0-84ae-4fe9-88b2-027ef648e02c
Verdict: Malicious activity
Analysis date: December 14, 2018, 11:09:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

DD61E509504E2879513C61032C60B6B7

SHA1:

D5D458A329273BDB7A46DCB48A5990699D7E5AA1

SHA256:

504A7544223C7368FABC45270A38704A1031DE5666BFD408F43C1412551B49A5

SSDEEP:

393216:pntobv6Bn1EBCYB22tCFejdPq3I4ovx94LU3zjHjjGNd2LAmv/7M7ZNvIyzrbi37:EbCZoL2DFeVq3Kx94LU3XjjGEAWIEyzo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • hdsentinel_setup.exe (PID: 2296)
      • hdsentinel_setup.exe (PID: 2436)
      • HDSentinel.exe (PID: 4084)
      • detect.dll (PID: 3692)
      • detect.dll (PID: 2468)
      • detect.dll (PID: 864)
      • detect.dll (PID: 4024)
      • detect.dll (PID: 2892)
      • detect.dll (PID: 3952)
      • detect.dll (PID: 3028)
      • HDSAction.exe (PID: 3084)
      • HDSentinel.exe (PID: 4092)
      • HDSentinel.exe (PID: 1760)

    • Loads dropped or rewritten executable

      • svchost.exe (PID: 844)
      • HDSentinel.exe (PID: 4084)

    • Loads the Task Scheduler COM API

      • CSCRIPT.exe (PID: 3852)
      • CSCRIPT.exe (PID: 3488)
      • CSCRIPT.exe (PID: 2772)
      • CSCRIPT.exe (PID: 3784)
      • CSCRIPT.exe (PID: 3924)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • hdsentinel_setup.exe (PID: 2296)
      • WinRAR.exe (PID: 4056)
      • hdsentinel_setup.exe (PID: 2436)
      • hdsentinel_setup.tmp (PID: 2820)

    • Creates files in the user directory

      • hdsentinel_setup.tmp (PID: 2820)
      • HDSentinel.exe (PID: 4084)

    • Modifies the open verb of a shell class

      • HDSentinel.exe (PID: 4084)

    • Starts application with an unusual extension

      • HDSentinel.exe (PID: 4084)

    • Creates files in the program directory

      • HDSentinel.exe (PID: 4084)

    • Creates files in the Windows directory

      • svchost.exe (PID: 844)

    • Executes scripts

      • HDSentinel.exe (PID: 4084)

    • Low-level read access rights to disk partition

      • HDSentinel.exe (PID: 4084)

    • Reads internet explorer settings

      • HDSAction.exe (PID: 3084)

    • Starts Internet Explorer

      • HDSentinel.exe (PID: 4084)

  • INFO

    • Application was dropped or rewritten from another process

      • hdsentinel_setup.tmp (PID: 2820)
      • hdsentinel_setup.tmp (PID: 2692)

    • Loads dropped or rewritten executable

      • hdsentinel_setup.tmp (PID: 2820)

    • Creates a software uninstall entry

      • hdsentinel_setup.tmp (PID: 2820)

    • Creates files in the program directory

      • hdsentinel_setup.tmp (PID: 2820)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1812)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1812)

    • Creates files in the user directory

      • iexplore.exe (PID: 1812)

    • Changes internet zones settings

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3804)

    • Reads settings of System Certificates

      • HDSentinel.exe (PID: 4084)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1812)

    • Application launched itself

      • iexplore.exe (PID: 3804)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: hdsentinel_setup.exe
ZipUncompressedSize: 24318192
ZipCompressedSize: 24293675
ZipCRC: 0x3c7f4103
ZipModifyDate: 2018:12:11 13:07:11
ZipCompression: Deflated
ZipBitFlag: 0x0002
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
27
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start winrar.exe hdsentinel_setup.exe hdsentinel_setup.tmp no specs hdsentinel_setup.exe hdsentinel_setup.tmp hdsentinel.exe detect.dll no specs svchost.exe fsutil.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs detect.dll no specs detect.dll no specs detect.dll no specs detect.dll no specs detect.dll no specs detect.dll no specs hdsaction.exe cscript.exe no specs cscript.exe no specs iexplore.exe iexplore.exe iexplore.exe iexplore.exe hdsentinel.exe no specs hdsentinel.exe

Process information

PID
CMD
Path
Indicators
Parent process
4056"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hdsentinel_setup_5304-lsir.zip"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
2296"C:\Users\admin\AppData\Local\Temp\Rar$EXa4056.34590\hdsentinel_setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa4056.34590\hdsentinel_setup.exe
WinRAR.exe
User:
admin
Company:
Janos Mathe
Integrity Level:
MEDIUM
Description:
Hard Disk Sentinel Setup
Exit code:
0
Version:
5.30.0.0
2692"C:\Users\admin\AppData\Local\Temp\is-26ESH.tmp\hdsentinel_setup.tmp" /SL5="$3013C,23970703,56832,C:\Users\admin\AppData\Local\Temp\Rar$EXa4056.34590\hdsentinel_setup.exe" C:\Users\admin\AppData\Local\Temp\is-26ESH.tmp\hdsentinel_setup.tmp—hdsentinel_setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
2436"C:\Users\admin\AppData\Local\Temp\Rar$EXa4056.34590\hdsentinel_setup.exe" /SPAWNWND=$2015E /NOTIFYWND=$3013C C:\Users\admin\AppData\Local\Temp\Rar$EXa4056.34590\hdsentinel_setup.exe
hdsentinel_setup.tmp
User:
admin
Company:
Janos Mathe
Integrity Level:
HIGH
Description:
Hard Disk Sentinel Setup
Exit code:
0
Version:
5.30.0.0
2820"C:\Users\admin\AppData\Local\Temp\is-0B64C.tmp\hdsentinel_setup.tmp" /SL5="$3015C,23970703,56832,C:\Users\admin\AppData\Local\Temp\Rar$EXa4056.34590\hdsentinel_setup.exe" /SPAWNWND=$2015E /NOTIFYWND=$3013C C:\Users\admin\AppData\Local\Temp\is-0B64C.tmp\hdsentinel_setup.tmp
hdsentinel_setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
4084"C:\Program Files\Hard Disk Sentinel\HDSentinel.exe" /firstrunC:\Program Files\Hard Disk Sentinel\HDSentinel.exe
hdsentinel_setup.tmp
User:
admin
Company:
H.D.S. Hungary
Integrity Level:
HIGH
Description:
Hard Disk Sentinel
Version:
5.30.0.0
3692"C:\Program Files\Hard Disk Sentinel\detect.dll" *WMIC2* . "C:\Users\admin\AppData\Local\Temp\181214111122014.74889009.tmp" SELECT Index,PNPDeviceID FROM Win32_DiskDriveC:\Program Files\Hard Disk Sentinel\detect.dll—HDSentinel.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
844C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2376fsutil behavior query disabledeletenotifyC:\Windows\system32\fsutil.exe—HDSentinel.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
fsutil.exe
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3488CSCRIPT //NOLOGO "C:\Users\admin\AppData\Roaming\Hard Disk Sentinel\hds_control_remove.vbs"C:\Windows\system32\CSCRIPT.exe—HDSentinel.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
2 092
Read events
1 851
Write events
0
Delete events
0

Modification events

No data
Executable files
54
Suspicious files
7
Text files
87
Unknown types
23

Dropped files

PID
Process
Filename
Type
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-JD0FE.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-JRR86.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-6C8O3.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-JPQCR.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-IK1EU.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-49MSK.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-RU4HC.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-54TA8.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-C37SU.tmp —
MD5:—
SHA256:—
2820hdsentinel_setup.tmpC:\Program Files\Hard Disk Sentinel\is-K7E9L.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
30
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1812
iexplore.exe
GET
301
87.229.73.241:80
http://www.hdsentinel.com/store.php
HU
html
244 b
unknown
3832
iexplore.exe
GET
301
87.229.73.241:80
http://www.hdsentinel.com/store.php
HU
html
244 b
unknown
4008
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
3804
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4008
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
1812
iexplore.exe
216.58.215.238:443
apis.google.com
Google Inc.
US
whitelisted
1812
iexplore.exe
87.229.73.241:443
www.hdsentinel.com
Deninet KFT
HU
unknown
1812
iexplore.exe
87.229.73.241:80
www.hdsentinel.com
Deninet KFT
HU
unknown
3084
HDSAction.exe
87.229.73.241:443
www.hdsentinel.com
Deninet KFT
HU
unknown
4084
HDSentinel.exe
87.229.73.241:443
www.hdsentinel.com
Deninet KFT
HU
unknown
3804
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3832
iexplore.exe
87.229.73.241:80
www.hdsentinel.com
Deninet KFT
HU
unknown
1812
iexplore.exe
2.18.232.15:443
s7.addthis.com
Akamai International B.V.
—
whitelisted
3832
iexplore.exe
87.229.73.241:443
www.hdsentinel.com
Deninet KFT
HU
unknown

DNS requests

Domain
IP
Reputation
www.hdsentinel.com
  • 87.229.73.241
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
apis.google.com
  • 216.58.215.238
whitelisted
s7.addthis.com
  • 2.18.232.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
hdsentinel_setup_5304-lsir.zip