Malware analysis SetupProd_OffScrub.exe Malicious activity

Add for printing

File name:	SetupProd_OffScrub.exe
Full analysis:	https://app.any.run/tasks/11ea1618-eec0-4425-984c-6cadca6d629f
Verdict:	Malicious activity
Analysis date:	August 09, 2024, 03:38:31
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	A9A189E7C270B711628D3E8C546700BC
SHA1:	A236FFD2C90D5F4E9CEBBC53FA60B17949950CC8
SHA256:	6895CE7DFAFE88CB01C8017E1BAFE31D6B311E72C151D20EDF27BF779C3868BB
SSDEEP:	3072:VA/cdv7411xlZ9bxAZLi7+T6e0Q2vKH2wlh:V44T4VPAci2wlh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Changes powershell execution policy (Unrestricted)
  - Microsoft.Sara.exe (PID: 4436)
  - powershell.exe (PID: 6720)
SUSPICIOUS
- Drops the executable file immediately after the start
  - SetupProd_OffScrub.exe (PID: 6428)
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 4436)
- Process drops legitimate windows executable
  - SetupProd_OffScrub.exe (PID: 6428)
  - dfsvc.exe (PID: 6488)
- Starts a Microsoft application from unusual location
  - SetupProd_OffScrub.exe (PID: 6380)
  - SetupProd_OffScrub.exe (PID: 6428)
- Searches for installed software
  - SetupProd_OffScrub.exe (PID: 6428)
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - Microsoft.Sara.exe (PID: 4436)
- Reads security settings of Internet Explorer
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 4436)
- Reads Internet Explorer settings
  - dfsvc.exe (PID: 6488)
- Executable content was dropped or overwritten
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 4436)
- Reads the date of Windows installation
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
- Creates a software uninstall entry
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
- The process drops C-runtime libraries
  - dfsvc.exe (PID: 6488)
- The process creates files with name similar to system file names
  - dfsvc.exe (PID: 6488)
- Checks Windows Trust Settings
  - dfsvc.exe (PID: 6488)
  - dfsvc.exe (PID: 5464)
- Reads the Windows owner or organization settings
  - Microsoft.Sara.exe (PID: 6748)
  - Microsoft.Sara.exe (PID: 4436)
- Reads Microsoft Outlook installation path
  - Microsoft.Sara.exe (PID: 6748)
  - Microsoft.Sara.exe (PID: 4436)
- Starts POWERSHELL.EXE for commands execution
  - Microsoft.Sara.exe (PID: 4436)
  - powershell.exe (PID: 6720)
- Uses SYSTEMINFO.EXE to read the environment
  - powershell.exe (PID: 7048)
- The process executes Powershell scripts
  - Microsoft.Sara.exe (PID: 4436)
  - powershell.exe (PID: 6720)
- Application launched itself
  - powershell.exe (PID: 6720)
INFO
- Checks supported languages
  - SetupProd_OffScrub.exe (PID: 6428)
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 4436)
- Create files in a temporary directory
  - SetupProd_OffScrub.exe (PID: 6428)
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 4436)
- Reads the machine GUID from the registry
  - dfsvc.exe (PID: 6488)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 6748)
  - Microsoft.Sara.exe (PID: 4436)
- Creates files or folders in the user directory
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - Microsoft.Sara.exe (PID: 4436)
  - dfsvc.exe (PID: 5464)
- Reads Environment values
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 4436)
- Reads the computer name
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 4436)
- Disables trace logs
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 4436)
- Checks proxy server information
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 4436)
- Reads the software policy settings
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
  - Microsoft.Sara.exe (PID: 4436)
- Process checks whether UAC notifications are on
  - dfsvc.exe (PID: 6488)
- Dropped object may contain TOR URL's
  - dfsvc.exe (PID: 6488)
- The process uses the downloaded file
  - dfsvc.exe (PID: 6488)
  - dfsvc.exe (PID: 5464)
- Process checks computer location settings
  - dfsvc.exe (PID: 6488)
  - Microsoft.Sara.exe (PID: 6748)
  - dfsvc.exe (PID: 5464)
- Reads Microsoft Office registry keys
  - Microsoft.Sara.exe (PID: 6748)
  - Microsoft.Sara.exe (PID: 4436)
- Creates files in the program directory
  - Microsoft.Sara.exe (PID: 6748)
- Reads CPU info
  - Microsoft.Sara.exe (PID: 6748)
  - Microsoft.Sara.exe (PID: 4436)
- Gets the execution policy for the powershell session
  - Microsoft.Sara.exe (PID: 4436)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (76.4)
.exe	\|	Win32 Executable (generic) (12.4)
.exe	\|	Generic Win/DOS Executable (5.5)
.exe	\|	DOS Executable Generic (5.5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2020:05:30 03:39:47+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	14.12
CodeSize:	74752
InitializedDataSize:	114688
UninitializedDataSize:	-
EntryPoint:	0x2b03
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI
FileVersionNumber:	1.0.0.0
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Support and Recovery Assistant for Office 365
FileVersion:	1.0.0.0
LegalCopyright:	© Microsoft Corporation. All rights reserved.
ProductName:	Microsoft Support and Recovery Assistant for Office 365
ProductVersion:	1.0.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

161

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1948

"powershell.exe" Get-ExecutionPolicy

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

—

Microsoft.Sara.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll

2228

"C:\WINDOWS\system32\systeminfo.exe" /fo csv

C:\Windows\SysWOW64\systeminfo.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Displays system information

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\systeminfo.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll

2872

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

3076

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

4436

"C:\Users\admin\AppData\Local\Apps\2.0\HL3OWQTJ.505\7PLRGVR9.0ZV\micr..tion_5661bd3e342e4e9f_0011.0001_26fca47aefbf1d7f\Microsoft.Sara.exe"

C:\Users\admin\AppData\Local\Apps\2.0\HL3OWQTJ.505\7PLRGVR9.0ZV\micr..tion_5661bd3e342e4e9f_0011.0001_26fca47aefbf1d7f\Microsoft.Sara.exe

dfsvc.exe

User:

admin

Company:

Microsoft Corporation.

Integrity Level:

HIGH

Description:

Microsoft Support and Recovery Assistant

Version:

17.01.2011.000

Modules

Images
c:\users\admin\appdata\local\apps\2.0\hl3owqtj.505\7plrgvr9.0zv\micr..tion_5661bd3e342e4e9f_0011.0001_26fca47aefbf1d7f\microsoft.sara.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll

5040

C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -Embedding

C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe

—

svchost.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Modules Installer Worker

Version:

10.0.19041.3989 (WinBuild.160101.0800)

Modules

Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll

5464

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe

rundll32.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

ClickOnce

Version:

4.8.9037.0 built by: NET481REL1

Modules

Images
c:\windows\microsoft.net\framework64\v4.0.30319\dfsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

6124

"C:\WINDOWS\SysWOW64\rundll32.exe" dfshim.dll, ShOpenVerbApplication https://outlookdiagnostics.azureedge.net/sarafiles/Microsoft.Sara.Prod.application?usergroup=Prod&Ring=Prod&runasadmin=true

C:\Windows\SysWOW64\rundll32.exe

Microsoft.Sara.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll

6380

"C:\Users\admin\AppData\Local\Temp\SetupProd_OffScrub.exe"

C:\Users\admin\AppData\Local\Temp\SetupProd_OffScrub.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Support and Recovery Assistant for Office 365

Exit code:

3221226540

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\setupprod_offscrub.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

6428

"C:\Users\admin\AppData\Local\Temp\SetupProd_OffScrub.exe"

C:\Users\admin\AppData\Local\Temp\SetupProd_OffScrub.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Microsoft Support and Recovery Assistant for Office 365

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\setupprod_offscrub.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll

Add for printing

Total events

63 730

Read events

59 311

Write events

3 467

Delete events

952

Modification events


(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:	write	Name:	ComponentStore_RandomString
Value: 5H5TMMCG4Q7B8RYMMW6PAQMC
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:	delete value	Name:	ComponentStore_RandomString
Value: 5H5TMMCG4Q7B8RYMMW6PAQMC
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:	delete key	Name:	(default)
Value:
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0
Operation:	write	Name:	ComponentStore_RandomString
Value: HL3OWQTJ5057PLRGVR90ZV2E
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager
Operation:	write	Name:	StateStore_RandomString
Value: MWJXOQNW2LMXC713XM4MGKVL
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(6488) dfsvc.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:

Add for printing

Executable files

396

Suspicious files

203

Text files

527

Unknown types

Dropped files

PID	Process	Filename		Type
6488	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\CKANDN45.P9V\5QPG5JMR.M91\SaraEULA.txt		text
		MD5:A811F7A46C12ED29C5713A64F528569A	SHA256:30AFE28070DD647EFB545549CBDDCBBF9D40C7424BC93FECC8E7AE51A668D7EB
6488	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\CKANDN45.P9V\5QPG5JMR.M91\en\excel.crashes.config.xml		xml
		MD5:18DE8EB6DDFDCADF929D0CEDD963BA6D	SHA256:D8117328E9020E3623AE144BAB81412B189C72D0A8C28BAFDFE8D49933B2FE65
6488	dfsvc.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\36AC0BE60E1243344AE145F746D881FE		binary
		MD5:DA10A40995DF7CA317BA9329E52EB18F	SHA256:AFF064F84D210DA2D02F18052AD09ADA2552A8E73ADEF7C1001C63F0148ACA26
6488	dfsvc.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850		binary
		MD5:4A67FCAB16594BE8EE51280A71FAA68B	SHA256:6A60108FF005C1CDEB2EF06934A8F6E4DA09932A512EABBD54A6B417A78B8F05
6488	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\CKANDN45.P9V\5QPG5JMR.M91\en\offcat.config.xml		xml
		MD5:146D0C42C4F6111DC20CCE076B7F5DB4	SHA256:FD3D83ABB166819AD9EA49350456BC39A191F7C58F4B97C94B309DD2C71D2587
6428	SetupProd_OffScrub.exe	C:\Users\admin\AppData\Local\Temp\SaraSetup.log		binary
		MD5:396047AFCE4DED80E2777C9CA6CB8209	SHA256:474437587D28CC67F9076DA89FEDBF0286AB572B492467494301FCB404138585
6488	dfsvc.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\36AC0BE60E1243344AE145F746D881FE		der
		MD5:A20961D8BD1A5A7D241026D0011751FB	SHA256:4D6AE5BBEF0EACFDC09D5ADE4D145E883CF41B131E4C6988738769F1D32E12F3
6488	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\CKANDN45.P9V\5QPG5JMR.M91\Microsoft.IdentityModel.Clients.ActiveDirectory.WindowsForms.dll		executable
		MD5:DAD75B06FCDBA45BC622BAF0582E806A	SHA256:C24A11C0E4AE4BD202DBC2002CBA4E29B18A5008063DCE2ABC922B7078E7519B
6488	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\CKANDN45.P9V\5QPG5JMR.M91\en\lync.config.xml		xml
		MD5:C9AED8918515A0B7D64080E75E55705D	SHA256:2CA2FD970AABE2682C3D851C41F0A4058246BC39CCAA98BA6B6136CB9979D072
6488	dfsvc.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850		binary
		MD5:C7D1234376F3389D6C220F0DCF24341B	SHA256:F67F7E62B47D1C4D9059F9F01FF40D52044EE81F594C5B8C8925C254381061E5

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6488	dfsvc.exe	GET	200	2.16.164.49:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl	unknown	—	—	whitelisted
6488	dfsvc.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
6488	dfsvc.exe	GET	200	2.16.164.49:80	http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl	unknown	—	—	whitelisted
3160	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6868	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6896	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6488	dfsvc.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
2436	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
2388	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
2120	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
6488	dfsvc.exe	152.199.19.160:443	outlookdiagnostics.azureedge.net	EDGECAST	US	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
2436	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6488	dfsvc.exe	2.16.164.49:80	crl.microsoft.com	Akamai International B.V.	NL	unknown
6488	dfsvc.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.104.136.2 4.231.128.59	whitelisted
google.com	142.250.74.206	whitelisted
outlookdiagnostics.azureedge.net	152.199.19.160	whitelisted
crl.microsoft.com	2.16.164.49 2.16.164.106	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
www.bing.com	2.23.209.187 2.23.209.182 2.23.209.130 2.23.209.133 2.23.209.149	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted
login.live.com	40.126.32.74 40.126.32.140 40.126.32.68 20.190.160.17 20.190.160.14 20.190.160.20 40.126.32.136 40.126.32.138	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
fd.api.iris.microsoft.com	20.223.35.26	whitelisted

Threats

No threats detected

Add for printing

Process	Message
SetupProd_OffScrub.exe	Version verficiation success
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe	Current .net version is 533325
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe	Fail to query SaraInstalled value
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe	C:\WINDOWS\system32\rundll32.exe dfshim.dll, ShOpenVerbApplication https://outlookdiagnostics.azureedge.net/sarafiles/Microsoft.Sara.Prod.application?usergroup=Prod&Ring=Prod&symptomid=3a1b3aa0-0969-4860-a9b8-ad13e3c81cf8
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe	Start to install Office 365 Support and Recovery Assistant
SetupProd_OffScrub.exe

General Info

SetupProd_OffScrub.exe

A9A189E7C270B711628D3E8C546700BC

A236FFD2C90D5F4E9CEBBC53FA60B17949950CC8

6895CE7DFAFE88CB01C8017E1BAFE31D6B311E72C151D20EDF27BF779C3868BB

3072:VA/cdv7411xlZ9bxAZLi7+T6e0Q2vKH2wlh:V44T4VPAci2wlh

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes powershell execution policy (Unrestricted)

SUSPICIOUS

Drops the executable file immediately after the start

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Searches for installed software

Reads security settings of Internet Explorer

Reads Internet Explorer settings

Executable content was dropped or overwritten

Reads the date of Windows installation

Creates a software uninstall entry

The process drops C-runtime libraries

The process creates files with name similar to system file names

Checks Windows Trust Settings

Reads the Windows owner or organization settings

Reads Microsoft Outlook installation path

Starts POWERSHELL.EXE for commands execution

Uses SYSTEMINFO.EXE to read the environment

The process executes Powershell scripts

Application launched itself

INFO

Checks supported languages

Create files in a temporary directory

Reads the machine GUID from the registry

Creates files or folders in the user directory

Reads Environment values

Reads the computer name

Disables trace logs

Checks proxy server information

Reads the software policy settings

Process checks whether UAC notifications are on

Dropped object may contain TOR URL's

The process uses the downloaded file

Process checks computer location settings

Reads Microsoft Office registry keys

Creates files in the program directory

Reads CPU info

Gets the execution policy for the powershell session

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules