Analysis date (UTC): 25 April 2025, 00:51Analysis environment: Windows 10 Pro, build 19044, x64

yt118.com

MD5:3A0688623AF7CB68FB73C2C93D19A86B

SHA1:22D217754A6650830164A7767B6F4C05C495A0DE

SHA256:514C8CA3B9E6B5A4494B3337C5487103381C3CD72D7C9B8F32D25D67E2DE3429

Analysis result

Threat level:Malicious activity

Tags:

upx

Full analysis:Analysis yt118.com Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Deletes shadow copies

TotalAV_Setup.exe (PID: 8976)

Starts NET.EXE for service management

epp-sdk.tmp (PID: 8576)
net.exe (PID: 9152)
net.exe (PID: 7136)
net.exe (PID: 1276)
net.exe (PID: 8652)
net.exe (PID: 1272)
net.exe (PID: 6456)
net.exe (PID: 5548)
net.exe (PID: 864)
net.exe (PID: 6272)
net.exe (PID: 6584)
net.exe (PID: 5864)
net.exe (PID: 8672)
net.exe (PID: 9160)

SUSPICIOUS

The process creates files with name similar to system file names

TotalAV_Setup.exe (PID: 5084)
TotalAV_Setup.exe (PID: 616)
TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8908)
TotalAV_Setup (1).exe (PID: 8940)
TotalAV_Setup.exe (PID: 8976)

Malware-specific behavior (creating "System.dll" in Temp)

TotalAV_Setup.exe (PID: 5084)
TotalAV_Setup.exe (PID: 616)
TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8908)
TotalAV_Setup (1).exe (PID: 8940)
TotalAV_Setup.exe (PID: 8976)

Executable content was dropped or overwritten

TotalAV_Setup.exe (PID: 5084)
TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8908)
TotalAV_Setup.exe (PID: 616)
TotalAV_Setup (1).exe (PID: 8940)
TotalAV_Setup.exe (PID: 8976)
epp-sdk.tmp (PID: 8576)
epp-sdk.exe (PID: 5048)
SecurityService.exe (PID: 3676)

Reads security settings of Internet Explorer

TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8940)

There is functionality for taking screenshot (YARA)

TotalAV_Setup.exe (PID: 5084)
TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup.exe (PID: 616)
TotalAV_Setup (1).exe (PID: 8908)
TotalAV_Setup (1).exe (PID: 8940)
TotalAV_Setup.exe (PID: 8976)

The process verifies whether the antivirus software is installed

conhost.exe (PID: 9036)
TotalAV_Setup.exe (PID: 8976)
WMIC.exe (PID: 9028)
taskkill.exe (PID: 9128)
conhost.exe (PID: 8196)
taskkill.exe (PID: 9208)
taskkill.exe (PID: 6040)
conhost.exe (PID: 8216)
WMIC.exe (PID: 6660)
conhost.exe (PID: 4728)
conhost.exe (PID: 9136)

Uses TASKKILL.EXE to kill process

TotalAV_Setup.exe (PID: 8976)

Uses WMIC.EXE

TotalAV_Setup.exe (PID: 8976)

Get information on the list of running processes

TotalAV_Setup.exe (PID: 8976)

Searches for installed software

dllhost.exe (PID: 5984)

Executes as Windows Service

VSSVC.exe (PID: 3020)
SecurityService.exe (PID: 8296)

Process drops legitimate windows executable

TotalAV_Setup.exe (PID: 8976)

Drops a system driver (possible attempt to evade defenses)

TotalAV_Setup.exe (PID: 8976)
epp-sdk.tmp (PID: 8576)

The process drops C-runtime libraries

TotalAV_Setup.exe (PID: 8976)

Creates a new Windows service

sc.exe (PID: 8276)

Windows service management via SC.EXE

sc.exe (PID: 6040)
sc.exe (PID: 6256)
sc.exe (PID: 5736)
sc.exe (PID: 2776)
sc.exe (PID: 2908)
sc.exe (PID: 6136)
sc.exe (PID: 9052)
sc.exe (PID: 8020)
sc.exe (PID: 4736)
sc.exe (PID: 5384)
sc.exe (PID: 2516)
sc.exe (PID: 8616)
sc.exe (PID: 8752)
sc.exe (PID: 4272)

Application launched itself

SecurityService.exe (PID: 8296)

Starts SC.EXE for service management

epp-sdk.tmp (PID: 8576)

INFO

Checks supported languages

identity_helper.exe (PID: 3888)
TotalAV_Setup.exe (PID: 5084)
TotalAV_Setup.exe (PID: 616)
TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8940)
TotalAV_Setup (1).exe (PID: 8908)
TotalAV_Setup.exe (PID: 8976)

Reads Environment values

identity_helper.exe (PID: 3888)

Reads the computer name

identity_helper.exe (PID: 3888)
TotalAV_Setup.exe (PID: 5084)
TotalAV_Setup.exe (PID: 616)
TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8908)
TotalAV_Setup (1).exe (PID: 8940)
TotalAV_Setup.exe (PID: 8976)

Executable content was dropped or overwritten

msedge.exe (PID: 7312)
msedge.exe (PID: 5960)

Application launched itself

msedge.exe (PID: 5960)

The sample compiled with english language support

msedge.exe (PID: 7312)
msedge.exe (PID: 5960)
TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8940)
TotalAV_Setup.exe (PID: 8976)
epp-sdk.tmp (PID: 8576)

Create files in a temporary directory

TotalAV_Setup.exe (PID: 5084)
TotalAV_Setup.exe (PID: 616)
TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8908)
TotalAV_Setup (1).exe (PID: 8940)
TotalAV_Setup.exe (PID: 8976)

Creates files or folders in the user directory

TotalAV_Setup.exe (PID: 7612)

Reads the machine GUID from the registry

TotalAV_Setup.exe (PID: 7612)

Reads the software policy settings

TotalAV_Setup.exe (PID: 7612)

Checks proxy server information

TotalAV_Setup.exe (PID: 7612)
TotalAV_Setup (1).exe (PID: 8940)

Creates files in the program directory

TotalAV_Setup.exe (PID: 8976)

Reads security settings of Internet Explorer

WMIC.exe (PID: 9028)
WMIC.exe (PID: 6660)

UPX packer has been detected

TotalAV_Setup.exe (PID: 8976)
TotalAV.exe (PID: 4868)

Manages system restore points

SrTasks.exe (PID: 8840)

Threats

No threats detected