File name: | RiseProspectInstall.exe |
Full analysis: | https://app.any.run/tasks/b4335b4f-5f6e-4111-b4dd-6dd5e55851fe |
Verdict: | Malicious activity |
Analysis date: | April 01, 2023, 17:21:42 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 407FFEB3EDAA7E46A79715FF2E084190 |
SHA1: | 4CEE722E3C95DEFCF693E757024035F74002E10E |
SHA256: | 656DA08B3B51D30ADF8A77FEAEDD5C737815BC71730A77DE216629676C4F4525 |
SSDEEP: | 49152:k8ntDZAcCVT1ZgjfqcSQlkBg9HCx6CtcX4EwgGWIEb:XZAcCKjfq5ECuX4EwNU |
.exe | | | Win64 Executable (generic) (76.4) |
---|---|---|
.exe | | | Win32 Executable (generic) (12.4) |
.exe | | | Generic Win/DOS Executable (5.5) |
.exe | | | DOS Executable Generic (5.5) |
LegalCopyright: | - |
---|---|
FileVersion: | - |
FileDescription: | - |
CompanyName: | - |
CharacterSet: | Unicode |
LanguageCode: | Process default |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 0.0.0.0 |
FileVersionNumber: | 0.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5.1 |
ImageVersion: | - |
OSVersion: | 5.1 |
EntryPoint: | 0x63713 |
UninitializedDataSize: | - |
InitializedDataSize: | 437760 |
CodeSize: | 541184 |
LinkerVersion: | 14.16 |
PEType: | PE32 |
ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
TimeStamp: | 2023:01:04 17:47:34+00:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 04-Jan-2023 17:47:34 |
Detected languages: |
|
CompanyName: | - |
FileDescription: | - |
FileVersion: | - |
LegalCopyright: | - |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000108 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 5 |
Time date stamp: | 04-Jan-2023 17:47:34 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x000841F3 | 0x00084200 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.60186 |
.rdata | 0x00086000 | 0x0001A7C2 | 0x0001A800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 6.05374 |
.data | 0x000A1000 | 0x000027FC | 0x00001A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.99297 |
.rsrc | 0x000A4000 | 0x000484F8 | 0x00048600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.53114 |
.reloc | 0x000ED000 | 0x00006590 | 0x00006600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.72099 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.38799 | 1343 | Latin 1 / Western European | Process Default Language | RT_MANIFEST |
2 | 4.56065 | 2216 | Latin 1 / Western European | Process Default Language | RT_ICON |
3 | 3.94002 | 1384 | Latin 1 / Western European | Process Default Language | RT_ICON |
4 | 4.42223 | 270376 | Latin 1 / Western European | Process Default Language | RT_ICON |
5 | 3.66472 | 9640 | Latin 1 / Western European | Process Default Language | RT_ICON |
6 | 4.44076 | 4264 | Latin 1 / Western European | Process Default Language | RT_ICON |
7 | 4.62547 | 1128 | Latin 1 / Western European | Process Default Language | RT_ICON |
11 | 4.22193 | 20 | Latin 1 / Western European | Process Default Language | RT_RCDATA |
13 | 3.35334 | 860 | Latin 1 / Western European | Process Default Language | RT_STRING |
100 | 2.71787 | 104 | Latin 1 / Western European | Process Default Language | RT_GROUP_ICON |
COMCTL32.dll |
COMDLG32.dll |
GDI32.dll |
KERNEL32.dll |
MMFS2.dll (delay-loaded) |
SHELL32.dll |
USER32.dll |
WINMM.dll |
Title | Ordinal | Address |
---|---|---|
AmdPowerXpressRequestHighPerformance | 1 | 0x000A2260 |
NvOptimusEnablement | 2 | 0x000A2264 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2680 | "C:\Users\admin\AppData\Local\Temp\RiseProspectInstall.exe" | C:\Users\admin\AppData\Local\Temp\RiseProspectInstall.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
|
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
Operation: | write | Name: | Name |
Value: Explorer.EXE | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2680) RiseProspectInstall.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E |
Operation: | write | Name: | LanguageList |
Value: en-US |
PID | Process | Filename | Type | |
---|---|---|---|---|
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E | der | |
MD5:6A3B8331E801F083B403B0857ED8D574 | SHA256:98651A2DA4A4613BC2A03C4128926FE6B05F1AF8A7A21E1FEDEC75DB013706A0 | |||
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA | |||
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:92B1BE6328522D1BEE33B3A55CB8755C | SHA256:AB6C223C0EEC871927EEF3F1A4E28927B8B437CE59E3FA422EEE001A01BADF00 | |||
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77FCA2BBB4EC58C43A3E0BA9AD635B90 | binary | |
MD5:E8F7E8CC3242F4445449FA4251950486 | SHA256:AA55A1189029B575515F6BCF6A05FE48FA4E936768A838264A6850B449882209 | |||
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\Local\Temp\886e1e8e-21e0-4541-bd0a-9e1d55d617f2.FusionApp\mmfs2.dll | executable | |
MD5:98F647D1ED220E1D715AED9DCF69F387 | SHA256:3A288448E88A296B2BCEEAF093E76A22E3083E937A3C4EFEB6A61565CA7E35DF | |||
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\Local\Temp\886e1e8e-21e0-4541-bd0a-9e1d55d617f2.FusionApp\mmf2d3d8.dll | executable | |
MD5:59AEAB50440B9F50389A997BC6C44866 | SHA256:9CBA4D670209C69039D0D92598AAB6D916D9FBD215B634012FF9CEF55BFAF559 | |||
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77FCA2BBB4EC58C43A3E0BA9AD635B90 | der | |
MD5:51FB701C9E8A111E2DB8EA735EBC838A | SHA256:DD667E2ED239740E8E1B2E40E5EAECBBD2DD8CBAF53021FA42AD6D5654A93B9A | |||
2680 | RiseProspectInstall.exe | C:\ProgramData\soundinvolved.bat | text | |
MD5:C5127D628F372082C0078B3725A58EB7 | SHA256:079902640E83EBF0CC1A56867033C06586E61B95DA72E376BA8C8B49FA7DA022 | |||
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E | binary | |
MD5:19ECDECC5E6DEC7BD29D3398F695F65E | SHA256:B2C110B13712DDF24BB8085F7BDC9172DB787C96B0D2877CB05A75E576B9DD69 | |||
2680 | RiseProspectInstall.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D | binary | |
MD5:A82D1AD2DC911AF6576BBDD43511FF4C | SHA256:D34F26F26A57345DB801B856BAB808CA6D10F13F0564DDC81AF6B61D008F998F |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2680 | RiseProspectInstall.exe | GET | 200 | 172.64.155.188:80 | http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D | US | der | 1.42 Kb | whitelisted |
2680 | RiseProspectInstall.exe | GET | 200 | 104.18.32.68:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | US | der | 2.18 Kb | whitelisted |
2680 | RiseProspectInstall.exe | GET | 200 | 172.64.155.188:80 | http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQD0JNURqDVR009LOP%2BJiMx5 | US | der | 472 b | whitelisted |
2680 | RiseProspectInstall.exe | GET | 200 | 8.253.95.121:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4fb10617a3cfd060 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
2680 | RiseProspectInstall.exe | 172.64.155.188:80 | ocsp.comodoca.com | CLOUDFLARENET | US | suspicious |
2680 | RiseProspectInstall.exe | 199.188.200.254:443 | oukailab.com | NAMECHEAP-NET | US | malicious |
2680 | RiseProspectInstall.exe | 104.18.32.68:80 | ocsp.comodoca.com | CLOUDFLARENET | — | suspicious |
2680 | RiseProspectInstall.exe | 8.253.95.121:80 | ctldl.windowsupdate.com | LEVEL3 | US | suspicious |
Domain | IP | Reputation |
---|---|---|
oukailab.com |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.comodoca.com |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |
ocsp.sectigo.com |
| whitelisted |
Process | Message |
---|---|
RiseProspectInstall.exe | Start app
|
RiseProspectInstall.exe | Start app
|