Find similar analyses in TI Lookup

Analysis date (UTC): 26 January 2022, 09:52Analysis environment: Windows 7 Pro, build 7601, x86

a10ad777b5762de2e7b84c99346e5556

MD5:A10AD777B5762DE2E7B84C99346E5556

SHA1:8BF5C3294FEAA17B9E29A28EB7F75445D0E99282

SHA256:5FD1C0CA483FAC14D2BC830430AC8ED5F2676A68656301DFEFC8514057D01907

Analysis result

Threat level:Malicious activity

Tags:

loader

Full analysis:Analysis a10ad777b5762de2e7b84c99346e5556 (MD5: A10AD777B5762DE2E7B84C99346E5556) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Changes the autorun value in the registry

283394258.exe (PID: 3840)

Application was dropped or rewritten from another process

283394258.exe (PID: 3840)
1531711239.exe (PID: 3640)
mwupsrcvc.exe (PID: 2156)
894232983.exe (PID: 3628)
280613114.exe (PID: 2996)

Changes Security Center notification settings

mwupsrcvc.exe (PID: 2156)
894232983.exe (PID: 3628)

SUSPICIOUS

Checks supported languages

a10ad777b5762de2e7b84c99346e5556.exe (PID: 3548)
283394258.exe (PID: 3840)
1531711239.exe (PID: 3640)
mwupsrcvc.exe (PID: 2156)
2712322444.exe (PID: 3340)
853610288.exe (PID: 1784)
3107522707.exe (PID: 3920)
894232983.exe (PID: 3628)
280613114.exe (PID: 2996)
13229533.exe (PID: 1004)

Reads the computer name

a10ad777b5762de2e7b84c99346e5556.exe (PID: 3548)
mwupsrcvc.exe (PID: 2156)
2712322444.exe (PID: 3340)
894232983.exe (PID: 3628)

Executable content was dropped or overwritten

a10ad777b5762de2e7b84c99346e5556.exe (PID: 3548)
283394258.exe (PID: 3840)

Drops a file with a compile date too recent

a10ad777b5762de2e7b84c99346e5556.exe (PID: 3548)
283394258.exe (PID: 3840)

Starts itself from another location

mwupsrcvc.exe (PID: 2156)
283394258.exe (PID: 3840)
894232983.exe (PID: 3628)

Creates files in the user directory

2712322444.exe (PID: 3340)

INFO

Dropped object may contain Bitcoin addresses

283394258.exe (PID: 3840)
a10ad777b5762de2e7b84c99346e5556.exe (PID: 3548)

Threats

PID	Process	Class	Message
3548	a10ad777b5762de2e7b84c99346e5556.exe	Misc Attack	ET DROP Spamhaus DROP Listed Traffic Inbound group 24
3548	a10ad777b5762de2e7b84c99346e5556.exe	A Network Trojan was detected	ET INFO Executable Download from dotted-quad Host
3548	a10ad777b5762de2e7b84c99346e5556.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP
3548	a10ad777b5762de2e7b84c99346e5556.exe	Potentially Bad Traffic	ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2156	mwupsrcvc.exe	Generic Protocol Command Decode	SURICATA STREAM CLOSEWAIT FIN out of window