download:

/i486/VxKex/releases/download/Version1.1.1.1375/KexSetup_Release_1_1_1_1375.exe

Full analysis: https://app.any.run/tasks/0c878a61-100c-4e7e-83f4-73656fa7bef8
Verdict: Malicious activity
Analysis date: November 01, 2024, 16:14:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

8B690D6134FCFA6E742F190E6D607F46

SHA1:

78E08CE01A08431799FE13EF308A7E6903950812

SHA256:

652F6D2901C86DE4A05743B5F808FAFB6E28B9720C39BCE5E7E031D26CAC9035

SSDEEP:

98304:ibR022rJmW8zzMBfS46NQLLG+opnHPO3edC8jZXt2be09Z2S/SeIcuZN9fgvXd03:eU5vihQ4H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Process drops legitimate windows executable

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
      • KexSetup.exe (PID: 3700)
    • Executable content was dropped or overwritten

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
      • KexSetup.exe (PID: 3700)
    • The process drops C-runtime libraries

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
      • KexSetup.exe (PID: 3700)
    • Reads the Internet Settings

      • KexSetup.exe (PID: 3680)
    • Reads security settings of Internet Explorer

      • KexSetup.exe (PID: 3680)
    • Application launched itself

      • KexSetup.exe (PID: 3680)
    • Creates a software uninstall entry

      • KexSetup.exe (PID: 3700)
    • Creates/Modifies COM task schedule object

      • KexSetup.exe (PID: 3700)
  • INFO

    • Checks supported languages

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
      • KexSetup.exe (PID: 3680)
      • KexSetup.exe (PID: 3700)
    • Create files in a temporary directory

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
    • Reads the computer name

      • KexSetup.exe (PID: 3680)
      • KexSetup.exe (PID: 3700)
    • The process uses the downloaded file

      • KexSetup.exe (PID: 3680)
    • Creates files in the program directory

      • KexSetup.exe (PID: 3700)
    • Creates files or folders in the user directory

      • KexSetup.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:06:20 07:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 28160
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x7b04
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.1.1.1375
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
LegalCopyright: https://github.com/vxiiduu/VxKex
FileDescription: VxKex Setup and Maintenance Tool
FileVersion: 1.1.1.1375
InternalName: KexSetup
OriginalFileName: KEXSETUP.EXE
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start kexsetup_release_1_1_1_1375.exe kexsetup.exe no specs kexsetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3212"C:\Users\admin\AppData\Local\Temp\KexSetup_Release_1_1_1_1375.exe" C:\Users\admin\AppData\Local\Temp\KexSetup_Release_1_1_1_1375.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
VxKex Setup and Maintenance Tool
Exit code:
0
Version:
1.1.1.1375
Modules
Images
c:\users\admin\appdata\local\temp\kexsetup_release_1_1_1_1375.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3680C:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\KexSetup.exe C:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\KexSetup.exeKexSetup_Release_1_1_1_1375.exe
User:
admin
Integrity Level:
MEDIUM
Description:
VxKex Setup and Maintenance Tool
Exit code:
0
Version:
1.1.1.1375
Modules
Images
c:\users\admin\appdata\local\temp\7z2e4afc8c\kexsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3700"C:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\KexSetup.exe" /SILENTUNATTEND /HWND:2490904 /KEXDIR:"C:\Program Files\VxKex"C:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\KexSetup.exe
KexSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
VxKex Setup and Maintenance Tool
Exit code:
0
Version:
1.1.1.1375
Modules
Images
c:\users\admin\appdata\local\temp\7z2e4afc8c\kexsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
360
Read events
316
Write events
44
Delete events
0

Modification events

(PID) Process:(3680) KexSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3680) KexSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3680) KexSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3680) KexSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\VXsoft\VxKex
Operation:writeName:InstalledVersion
Value:
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\VXsoft\VxKex
Operation:writeName:KexDir
Value:
C:\Program Files\VxKex
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\VXsoft\VxKex
Operation:writeName:LogDir
Value:
C:\ProgramData\VxKex\Logs
(PID) Process:(3700) KexSetup.exeKey:HKEY_CURRENT_USER\Software\VXsoft\VxKex
Operation:writeName:LogDir
Value:
C:\Users\admin\AppData\Local\VxKex\Logs
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}
Operation:writeName:GlobalFlag
Value:
256
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}
Operation:writeName:VerifierFlags
Value:
Executable files
59
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core32\VxKexLdr.exeexecutable
MD5:310AA0923755D1B75A42B15C1A6D1957
SHA256:7BD7D52C81B263FB6CF96BEDA2E54475DE6FF11D2EC40CCF8A50A14E5DFC4FBD
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core32\KexShlEx.dllexecutable
MD5:DC12C92ADCF72DAF6EA4648DE98EEECE
SHA256:17ECFBA7BEE3D9A7F581BB341DB75B848589CEC7462F5FD206B3DAF75E71B0DC
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core32\KexCfg.exeexecutable
MD5:BF2A75DCB0BF8FBF2905B0D4D058C50D
SHA256:50D4BFBC76749C74497E7F8298681F131715D6010E42F02DA0090D5B7F24A5B4
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core64\KexCfg.exeexecutable
MD5:A344490BA1201AFD14108F3F4290C82E
SHA256:56EB15C4E3BE0A755A3FAE174E9FED86F80EAABFE4E02666FD4D901CBA5D5DF9
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core\Changelog.txttext
MD5:D180A404032B3D06000C46567A4A3F8D
SHA256:56C6A8DBD412011C95E83491FCFCD3EEF3E9591C4990B4EAB4FECC82D32A0F1F
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core\Application Compatibility List.docxdocument
MD5:88736BC47410E38343DA7C24B37EB655
SHA256:3B57106D36449E28649887E129A13CC71DFDF486606F8CD991B45BA2BAE23FD7
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core32\KexDll.dllexecutable
MD5:24FF4221A3C5023AF61C0AFAC7CF24CD
SHA256:EFF34BC61BEA965A965E9708951513FC7C79BF78E26D0301DFA1CA600BF42D0C
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Kex32\KxCrt.dllexecutable
MD5:D72CF63F058558E68EE58E860767B576
SHA256:64600A93AC23467C96ADD455AEE11038E6537998DF7F1EBFC89C23C341158AFC
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core32\VxlView.exeexecutable
MD5:15CAE89F9B91A11A0EC2D96EE4AACC10
SHA256:EE370037C274ED82495C9492B6C3671DCDCEDD89F2715C9E12D9DBDF6C566F05
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core64\CpiwBypa.dllexecutable
MD5:313020D2D18B5516E005D77FC5CD4E4E
SHA256:219D639EE4B554F63D64F633515898C0F16671479893391DEFE5E9E4B95BF458
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
4
System
192.168.100.255:137
whitelisted
224.0.0.252:5355
whitelisted
1060
svchost.exe
224.0.0.252:5355
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.142
whitelisted

Threats

No threats detected
No debug info