| File name: | 2b14373794ba0f8e1bb5e5986d4275503f16b1d2 |
| Full analysis: | https://app.any.run/tasks/649699e1-a693-43e7-b8fb-f267359e537d |
| Verdict: | Malicious activity |
| Analysis date: | September 20, 2024, 05:43:46 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | E9CFF4595BE329DA0B636AF02CF6DFE0 |
| SHA1: | 2B14373794BA0F8E1BB5E5986D4275503F16B1D2 |
| SHA256: | 62C1DC9A1A8986B0779DD893CFFBF2778D21E1BA3E2CB4788A031C08F49E349B |
| SSDEEP: | 98304:6zD9AR8yMaSqvi/5Mo4j2vw8DS6g/Zc/3CbW4P2cns7tJs3f7/6+OZcE9jHGA40P:xRWKEESglPg2E |
MALICIOUS
No malicious indicators.SUSPICIOUS
Process drops legitimate windows executable
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
Reads security settings of Internet Explorer
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
- LMIGuardianSvc.exe (PID: 6388)
- LMIIgnition.exe (PID: 1184)
Starts CMD.EXE for commands execution
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
- LMIIgnition.exe (PID: 1184)
Executing commands from ".cmd" file
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
- LMIIgnition.exe (PID: 1184)
Executable content was dropped or overwritten
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
Runs PING.EXE to delay simulation
- cmd.exe (PID: 6972)
- cmd.exe (PID: 864)
- cmd.exe (PID: 6284)
Checks Windows Trust Settings
- LMIGuardianSvc.exe (PID: 6388)
- LMIIgnition.exe (PID: 1184)
INFO
Create files in a temporary directory
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
- LMIIgnition.exe (PID: 1184)
Reads the computer name
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
- LMIIgnition.exe (PID: 1184)
- LMIGuardianSvc.exe (PID: 6388)
Checks supported languages
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
- LMIIgnition.exe (PID: 1184)
- LMIGuardianSvc.exe (PID: 6388)
Process checks computer location settings
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
- LMIIgnition.exe (PID: 1184)
The process uses the downloaded file
- 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe (PID: 6580)
- LMIIgnition.exe (PID: 1184)
Reads the machine GUID from the registry
- LMIGuardianSvc.exe (PID: 6388)
- LMIIgnition.exe (PID: 1184)
Reads the software policy settings
- LMIGuardianSvc.exe (PID: 6388)
- LMIIgnition.exe (PID: 1184)
Checks proxy server information
- LMIGuardianSvc.exe (PID: 6388)
- LMIIgnition.exe (PID: 1184)
Creates files or folders in the user directory
- LMIIgnition.exe (PID: 1184)
- LMIGuardianSvc.exe (PID: 6388)
Creates files in the program directory
- LMIGuardianSvc.exe (PID: 6388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:02:15 11:05:40+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.28 |
| CodeSize: | 73728 |
| InitializedDataSize: | 7453696 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x41b9 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.3.0.5538 |
| ProductVersionNumber: | 1.3.0.5538 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Unknown |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | LogMeIn, Inc. |
| FileDescription: | LogMeIn Client Application |
| FileVersion: | 1.3.5538 |
| InternalName: | LogMeIn Client |
| OriginalFileName: | LogMeIn Client.exe |
| LegalCopyright: | Copyright © 2006-2024 LogMeIn, Inc. All rights reserved. |
| ProductName: | LogMeIn Client |
| ProductVersion: | 1.3.5538 |
Total processes
144
Monitored processes
15
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 752 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 864 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\IgnB64A.tmp.cmd" " | C:\Windows\SysWOW64\cmd.exe | — | LMIIgnition.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1124 | ping -n 5 127.0.0.1 | C:\Windows\SysWOW64\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1184 | "C:\Users\admin\AppData\Local\Temp\IgnABBA.tmp\LMIIgnition.exe" -install | C:\Users\admin\AppData\Local\Temp\IgnABBA.tmp\LMIIgnition.exe | 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe | ||||||||||||
User: admin Company: LogMeIn, Inc. Integrity Level: MEDIUM Description: LogMeIn Client Exit code: 0 Version: 1.3.5538 Modules
| |||||||||||||||
| 1480 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2960 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3164 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4128 | ping -n 5 127.0.0.1 | C:\Windows\SysWOW64\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6284 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\IgnB5BC.tmp.cmd" " | C:\Windows\SysWOW64\cmd.exe | — | LMIIgnition.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6296 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
9 106
Read events
9 105
Write events
1
Delete events
0
Modification events
| (PID) Process: | (1184) LMIIgnition.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\LogMeIn Ignition |
| Operation: | write | Name: | @Salt |
Value: 41ACA42FDC39A876EB33ABCC21236A1DF0CDD5C5F99439CEDA0E0D80002AD5EF57DDB45296459822924AC7EE652A9AE9FCDD34E4B6EA80BCEFDC1CE489377A3EDFFA1A39678978A0940132675C1CE4A053E42C22BE6E45F62B570F21862EE3E5208A6A994D34736AE21DE1298C25F85098085BDB6640B61BA338DD3EBCA7ADA75F24301BC39A740B972596AC56EE674318EBA5D2E303446254F6FB261578627C1E0F812D98FE1FD7FB1655C5FCD1F1785AF9927DF46B4B75CAF9B2E7F0B1825A8ECC1C1175AB8754A95C7D19C0E52C0905481A17C1D804F24D7EC45079BD539D8607DA2D33AA2C6DDBC4790C95971AD91DEA2C54A15D67738A538CB71BFD2A46 | |||
Executable files
9
Suspicious files
6
Text files
7
Unknown types
4
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6580 | 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe | C:\Users\admin\AppData\Local\Temp\IgnABBA.tmp\LMIIgnition.exe | executable | |
MD5:CDBDF34821C788C28766E825F1033B5D | SHA256:8015E7E3BFB288702B25D831813962B65B9D9FE669CA7BECF6CF214084C47358 | |||
| 6580 | 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe | C:\Users\admin\AppData\Local\Temp\IgnABBA.tmp\LMIProxyHelper.exe | executable | |
MD5:4AC517ECE48FA1683DF19E86EED922B1 | SHA256:4C64AB865ECD6BDDE8414983E5520C2195B501379434D00A6EC6E357F62D4104 | |||
| 6580 | 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe | C:\Users\admin\AppData\Local\Temp\IgnABBA.tmp\LMIGuardianSvc.exe | executable | |
MD5:0927B7E7933491DAFD1A7B0876BF4578 | SHA256:413DBAE208E147A42B9C7CE622CAAEDDE47E85462A6561EC41DB7FB1977C972D | |||
| 6580 | 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe | C:\Users\admin\AppData\Local\Temp\IgnABBA.tmp\LMIGuardianDll.dll | executable | |
MD5:7A44E3665F03C2E46912B59F1614417E | SHA256:41B48537B2DBEE585BF08B928591B05A116BC6B6780044FE5E35445E0A3C58E7 | |||
| 6580 | 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe | C:\Users\admin\AppData\Local\Temp\IgnABBA.tmp\ractrlkeyhook.dll | executable | |
MD5:2E82F902AA3A55D8C87B40F0DBAF3E38 | SHA256:A7D3B22DEDAF702EDC7A06A338A50CA6996B3867D0D2C9DC767972DB9963D9C2 | |||
| 6580 | 2b14373794ba0f8e1bb5e5986d4275503f16b1d2.exe | C:\Users\admin\AppData\Local\Temp\IgnABBA.tmp.cmd | text | |
MD5:D606C73B10CBFFE94395B01C79892C90 | SHA256:370C3D3255F2CD060D9F20B006906BAB57E79CDBA94D625409614ED5CE98CFF7 | |||
| 6388 | LMIGuardianSvc.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB | der | |
MD5:0AEBCC2A9DE142AD8EF5FCE06677CB6D | SHA256:716617A0C49F500937259F0291B742C47CAC4B7AC83542D9D28B2AF07E089CC8 | |||
| 1184 | LMIIgnition.exe | C:\Users\admin\AppData\Local\LogMeInIgnition\LogMeInIgnition.log | text | |
MD5:2F95E207267B9C883CB5E5BEEC0BCE1D | SHA256:0B06D77196903B8B1F51E3BC60513F90846272F7611CD9E5E3D8438A323376B4 | |||
| 6388 | LMIGuardianSvc.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 | der | |
MD5:57CD5C98484CE3AF80F73F84B572111B | SHA256:7DAEC70DFABF88A7BECF144EFC3C267A281EDAA612A5C3CDBF373098BF3D63DF | |||
| 6388 | LMIGuardianSvc.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB | binary | |
MD5:6C89C82EEEC74FB2EE662A7D049F2F55 | SHA256:9A4C6B92E50D997120EDCF61E96A1C85271DAEDFA428F69AFAD9C5FED7C3D2C1 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
41
DNS requests
22
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6388 | LMIGuardianSvc.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D | unknown | — | — | whitelisted |
6388 | LMIGuardianSvc.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D | unknown | — | — | whitelisted |
6388 | LMIGuardianSvc.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAjegkJ27mLaGBP72%2FEoqPs%3D | unknown | — | — | whitelisted |
6388 | LMIGuardianSvc.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAc2N7ckVHzYR6z9KGYqXls%3D | unknown | — | — | whitelisted |
6388 | LMIGuardianSvc.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTjzY2p9Pa8oibmj%2BNSMWsz63kmWgQUuhbZbU2FL3MpdpovdYxqII%2BeyG8CEAVEr%2FOUnQg5pr%2FbP1%2FlYRY%3D | unknown | — | — | whitelisted |
3908 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
3908 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
4048 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5512 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1728 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 20.189.173.3:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6388 | LMIGuardianSvc.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1184 | LMIIgnition.exe | 158.120.24.40:443 | check-out-f76dfc59d2.lmi-app26-12.logmein.com | — | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
check-out-f76dfc59d2.lmi-app26-12.logmein.com |
| whitelisted |
login.live.com |
| whitelisted |
browser.pipe.aria.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |