| URL: | http://software.bigfix.com/download/bes/95/BigFix-BES-Client-9.5.13.130.exe |
| Full analysis: | https://app.any.run/tasks/25480e49-8e22-49d1-a1d9-3ed543331cfd |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | June 24, 2019, 08:18:10 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 51F504D0ED01FE5BE0995B9A94CB4B29 |
| SHA1: | B451B5489D9A7CBE054564FB7DF4297B0D1BD3B8 |
| SHA256: | 5BBFD8282013428C9C1C383F8A9FF26F1863F72EF8EC697B88CDBA082529546C |
| SSDEEP: | 3:N1KNK3LKKBKLTHn5km+cXMtkAn:CY7KK8JrcD |
MALICIOUS
Application was dropped or rewritten from another process
- BigFix-BES-Client-9.5.13.130.exe (PID: 1396)
- BigFix-BES-Client-9.5.13.130.exe (PID: 3856)
- BigFix-BES-Client-9.5.13.130.exe (PID: 3004)
- BigFix-BES-Client-9.5.13.130.exe (PID: 2764)
Downloads executable files from the Internet
- iexplore.exe (PID: 1868)
SUSPICIOUS
Executable content was dropped or overwritten
- iexplore.exe (PID: 1868)
- iexplore.exe (PID: 3316)
- BigFix-BES-Client-9.5.13.130.exe (PID: 3856)
- msiexec.exe (PID: 1864)
Starts Microsoft Installer
- BigFix-BES-Client-9.5.13.130.exe (PID: 3856)
Executed as Windows Service
- vssvc.exe (PID: 1972)
Executed via COM
- DrvInst.exe (PID: 2620)
INFO
Application launched itself
- iexplore.exe (PID: 3316)
- msiexec.exe (PID: 1864)
Changes internet zones settings
- iexplore.exe (PID: 3316)
Manual execution by user
- BigFix-BES-Client-9.5.13.130.exe (PID: 1396)
- BigFix-BES-Client-9.5.13.130.exe (PID: 3856)
- BigFix-BES-Client-9.5.13.130.exe (PID: 3004)
- BigFix-BES-Client-9.5.13.130.exe (PID: 2764)
Creates files in the user directory
- iexplore.exe (PID: 1868)
Reads Internet Cache Settings
- iexplore.exe (PID: 3316)
- iexplore.exe (PID: 1868)
Searches for installed software
- msiexec.exe (PID: 1864)
Low-level read access rights to disk partition
- vssvc.exe (PID: 1972)
Changes settings of System certificates
- DrvInst.exe (PID: 2620)
Adds / modifies Windows certificates
- DrvInst.exe (PID: 2620)
Loads dropped or rewritten executable
- MsiExec.exe (PID: 2704)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
52
Monitored processes
12
Malicious processes
0
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1396 | "C:\Users\admin\Desktop\BigFix-BES-Client-9.5.13.130.exe" | C:\Users\admin\Desktop\BigFix-BES-Client-9.5.13.130.exe | — | explorer.exe | |||||||||||
User: admin Company: IBM Corp. Integrity Level: MEDIUM Description: Setup Launcher Unicode Exit code: 3221226540 Version: 9.5.13.130 Modules
| |||||||||||||||
| 1864 | C:\Windows\system32\msiexec.exe /V | C:\Windows\system32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1868 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3316 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1972 | C:\Windows\system32\vssvc.exe | C:\Windows\system32\vssvc.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2444 | "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Users\admin\AppData\Local\Temp\{E08F0DC4-BAC6-4A94-ACBC-B5FF4FB0023E}\BigFixAgent.msi" SETUPEXE=1 TRANSFORMS="C:\Users\admin\AppData\Local\Temp\{E08F0DC4-BAC6-4A94-ACBC-B5FF4FB0023E}\1033.MST" SETUPEXEDIR="C:\Users\admin\Desktop" SETUPEXENAME="BigFix-BES-Client-9.5.13.130.exe" | C:\Windows\system32\MSIEXEC.EXE | — | BigFix-BES-Client-9.5.13.130.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 1602 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2620 | DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000004C0" "000005A0" | C:\Windows\system32\DrvInst.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2704 | C:\Windows\system32\MsiExec.exe -Embedding D94433DCA7C1E915560E5746C0242E91 | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2764 | "C:\Users\admin\Desktop\BigFix-BES-Client-9.5.13.130.exe" | C:\Users\admin\Desktop\BigFix-BES-Client-9.5.13.130.exe | explorer.exe | ||||||||||||
User: admin Company: IBM Corp. Integrity Level: HIGH Description: Setup Launcher Unicode Exit code: 0 Version: 9.5.13.130 Modules
| |||||||||||||||
| 2836 | C:\Windows\system32\MsiExec.exe -Embedding A1A5531742B6FCB6A8DE996312A48281 C | C:\Windows\system32\MsiExec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3004 | "C:\Users\admin\Desktop\BigFix-BES-Client-9.5.13.130.exe" | C:\Users\admin\Desktop\BigFix-BES-Client-9.5.13.130.exe | — | explorer.exe | |||||||||||
User: admin Company: IBM Corp. Integrity Level: MEDIUM Description: Setup Launcher Unicode Exit code: 3221226540 Version: 9.5.13.130 Modules
| |||||||||||||||
Total events
1 406
Read events
1 128
Write events
273
Delete events
5
Modification events
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {A89BF0D5-9658-11E9-A09E-5254004A04AF} |
Value: 0 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Type |
Value: 4 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Count |
Value: 1 | |||
| (PID) Process: | (3316) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Time |
Value: E3070600010018000800120023006402 | |||
Executable files
17
Suspicious files
8
Text files
258
Unknown types
5
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3316 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFBCCD728D82156C96.TMP | — | |
MD5:— | SHA256:— | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 1868 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.dat | dat | |
MD5:— | SHA256:— | |||
| 3316 | iexplore.exe | C:\Users\admin\Desktop\BigFix-BES-Client-9.5.13.130.exe | executable | |
MD5:— | SHA256:— | |||
| 3316 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{A89BF0D6-9658-11E9-A09E-5254004A04AF}.dat | binary | |
MD5:— | SHA256:— | |||
| 1868 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1APERP31\BigFix-BES-Client-9.5.13.130[1].exe | executable | |
MD5:— | SHA256:— | |||
| 1868 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019062420190625\index.dat | dat | |
MD5:— | SHA256:— | |||
| 1868 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.dat | dat | |
MD5:— | SHA256:— | |||
| 1868 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\desktop.ini | ini | |
MD5:4A3DEB274BB5F0212C2419D3D8D08612 | SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1868 | iexplore.exe | GET | 200 | 169.53.158.150:80 | http://software.bigfix.com/download/bes/95/BigFix-BES-Client-9.5.13.130.exe | US | executable | 16.1 Mb | suspicious |
3316 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1868 | iexplore.exe | 169.53.158.150:80 | software.bigfix.com | SoftLayer Technologies Inc. | US | suspicious |
3316 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
software.bigfix.com |
| suspicious |
www.bing.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1868 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |