download:

/i486/VxKex/releases/download/Version1.1.1.1375/KexSetup_Release_1_1_1_1375.exe

Full analysis: https://app.any.run/tasks/0c878a61-100c-4e7e-83f4-73656fa7bef8
Verdict: Malicious activity
Analysis date: November 01, 2024, 16:14:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

8B690D6134FCFA6E742F190E6D607F46

SHA1:

78E08CE01A08431799FE13EF308A7E6903950812

SHA256:

652F6D2901C86DE4A05743B5F808FAFB6E28B9720C39BCE5E7E031D26CAC9035

SSDEEP:

98304:ibR022rJmW8zzMBfS46NQLLG+opnHPO3edC8jZXt2be09Z2S/SeIcuZN9fgvXd03:eU5vihQ4H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
      • KexSetup.exe (PID: 3700)
    • Reads the Internet Settings

      • KexSetup.exe (PID: 3680)
    • The process drops C-runtime libraries

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
      • KexSetup.exe (PID: 3700)
    • Process drops legitimate windows executable

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
      • KexSetup.exe (PID: 3700)
    • Reads security settings of Internet Explorer

      • KexSetup.exe (PID: 3680)
    • Creates a software uninstall entry

      • KexSetup.exe (PID: 3700)
    • Application launched itself

      • KexSetup.exe (PID: 3680)
    • Creates/Modifies COM task schedule object

      • KexSetup.exe (PID: 3700)
  • INFO

    • Create files in a temporary directory

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
    • Checks supported languages

      • KexSetup_Release_1_1_1_1375.exe (PID: 3212)
      • KexSetup.exe (PID: 3680)
      • KexSetup.exe (PID: 3700)
    • Creates files in the program directory

      • KexSetup.exe (PID: 3700)
    • Reads the computer name

      • KexSetup.exe (PID: 3680)
      • KexSetup.exe (PID: 3700)
    • The process uses the downloaded file

      • KexSetup.exe (PID: 3680)
    • Creates files or folders in the user directory

      • KexSetup.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:06:20 07:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 28160
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x7b04
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.1.1.1375
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
LegalCopyright: https://github.com/vxiiduu/VxKex
FileDescription: VxKex Setup and Maintenance Tool
FileVersion: 1.1.1.1375
InternalName: KexSetup
OriginalFileName: KEXSETUP.EXE
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start kexsetup_release_1_1_1_1375.exe kexsetup.exe no specs kexsetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3212"C:\Users\admin\AppData\Local\Temp\KexSetup_Release_1_1_1_1375.exe" C:\Users\admin\AppData\Local\Temp\KexSetup_Release_1_1_1_1375.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
VxKex Setup and Maintenance Tool
Exit code:
0
Version:
1.1.1.1375
Modules
Images
c:\users\admin\appdata\local\temp\kexsetup_release_1_1_1_1375.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3680C:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\KexSetup.exe C:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\KexSetup.exeKexSetup_Release_1_1_1_1375.exe
User:
admin
Integrity Level:
MEDIUM
Description:
VxKex Setup and Maintenance Tool
Exit code:
0
Version:
1.1.1.1375
Modules
Images
c:\users\admin\appdata\local\temp\7z2e4afc8c\kexsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3700"C:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\KexSetup.exe" /SILENTUNATTEND /HWND:2490904 /KEXDIR:"C:\Program Files\VxKex"C:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\KexSetup.exe
KexSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
VxKex Setup and Maintenance Tool
Exit code:
0
Version:
1.1.1.1375
Modules
Images
c:\users\admin\appdata\local\temp\7z2e4afc8c\kexsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
360
Read events
316
Write events
44
Delete events
0

Modification events

(PID) Process:(3680) KexSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3680) KexSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3680) KexSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3680) KexSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\VXsoft\VxKex
Operation:writeName:InstalledVersion
Value:
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\VXsoft\VxKex
Operation:writeName:KexDir
Value:
C:\Program Files\VxKex
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\VXsoft\VxKex
Operation:writeName:LogDir
Value:
C:\ProgramData\VxKex\Logs
(PID) Process:(3700) KexSetup.exeKey:HKEY_CURRENT_USER\Software\VXsoft\VxKex
Operation:writeName:LogDir
Value:
C:\Users\admin\AppData\Local\VxKex\Logs
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}
Operation:writeName:GlobalFlag
Value:
256
(PID) Process:(3700) KexSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\{VxKexPropagationVirtualKey}
Operation:writeName:VerifierFlags
Value:
Executable files
59
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core32\VxlView.exeexecutable
MD5:15CAE89F9B91A11A0EC2D96EE4AACC10
SHA256:EE370037C274ED82495C9492B6C3671DCDCEDD89F2715C9E12D9DBDF6C566F05
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core\Changelog.txttext
MD5:D180A404032B3D06000C46567A4A3F8D
SHA256:56C6A8DBD412011C95E83491FCFCD3EEF3E9591C4990B4EAB4FECC82D32A0F1F
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core32\VxKexLdr.exeexecutable
MD5:310AA0923755D1B75A42B15C1A6D1957
SHA256:7BD7D52C81B263FB6CF96BEDA2E54475DE6FF11D2EC40CCF8A50A14E5DFC4FBD
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Kex32\KxCom.dllexecutable
MD5:4A82F2E278C067B1BC96A8E2C5908546
SHA256:CB377547C39C312DA0847962325BA4357EF275C98C2E66FB36070FD88A4AB3D0
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Kex32\dcow8.dllexecutable
MD5:C819BABCF29DDB94D08F4A2ABDA12439
SHA256:1C6EF7DE493F26AB22D9B1C872000CF09B5FE38E6A0A414CAC9BDCBA4B21E145
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core64\CpiwBypa.dllexecutable
MD5:313020D2D18B5516E005D77FC5CD4E4E
SHA256:219D639EE4B554F63D64F633515898C0F16671479893391DEFE5E9E4B95BF458
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core32\KexShlEx.dllexecutable
MD5:DC12C92ADCF72DAF6EA4648DE98EEECE
SHA256:17ECFBA7BEE3D9A7F581BB341DB75B848589CEC7462F5FD206B3DAF75E71B0DC
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Kex32\KxBase.dllexecutable
MD5:7EE6F569C6573C7E9B217BE26C285A5B
SHA256:87FDED325BFC33459A3012817772490EF905248C40195B3B4F4364D24BDC9277
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Kex32\KxCrt.dllexecutable
MD5:D72CF63F058558E68EE58E860767B576
SHA256:64600A93AC23467C96ADD455AEE11038E6537998DF7F1EBFC89C23C341158AFC
3212KexSetup_Release_1_1_1_1375.exeC:\Users\admin\AppData\Local\Temp\7z2E4AFC8C\Core64\VxlView.exeexecutable
MD5:1BF82A4F30D50611BFBA5C83758A893A
SHA256:DBA30FB077309CB7B0FF14E9845D598932596D9ABF17409D9CF3B50235206018
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
4
System
192.168.100.255:137
whitelisted
224.0.0.252:5355
whitelisted
1060
svchost.exe
224.0.0.252:5355
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.212.142
whitelisted

Threats

No threats detected
No debug info