analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://kcsoftwares.com/files/sumo_lite.exe

Full analysis: https://app.any.run/tasks/5b791a89-84f3-4d17-8aec-10f7dd1e8054
Verdict: Malicious activity
Analysis date: January 17, 2019, 21:10:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MD5:

E1A24CFD2C6FAB2DA60783D4841DF3A3

SHA1:

5E6276931D369BE311B13649494F6FBDA2787C6E

SHA256:

6A099BE79F603AACCD849B6C8600042529A36B1B2BFA277C2A0CAC3E55ADD182

SSDEEP:

3:N8DWY0EXGU0KYhAC:2KY0EWqC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • sumo_lite.exe (PID: 3232)
      • sumo_lite.exe (PID: 2188)
      • SUMo.exe (PID: 3216)
      • SUMo.exe (PID: 2352)

    • Changes settings of System certificates

      • explorer.exe (PID: 2028)

    • Loads dropped or rewritten executable

      • SUMo.exe (PID: 3216)
      • SUMo.exe (PID: 2352)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3000)
      • sumo_lite.exe (PID: 3232)
      • sumo_lite.exe (PID: 2188)
      • sumo_lite.tmp (PID: 3272)

    • Creates files in the user directory

      • sumo_lite.tmp (PID: 3272)
      • SUMo.exe (PID: 3216)
      • SUMo.exe (PID: 2352)

    • Starts Internet Explorer

      • sumo_lite.tmp (PID: 3272)
      • SUMo.exe (PID: 3216)

    • Reads Internet Cache Settings

      • explorer.exe (PID: 2028)
      • SUMo.exe (PID: 3216)

    • Creates files in the program directory

      • iexplore.exe (PID: 1488)
      • SUMo.exe (PID: 2352)

  • INFO

    • Reads CPU info

      • firefox.exe (PID: 3620)
      • firefox.exe (PID: 3000)
      • firefox.exe (PID: 2608)
      • firefox.exe (PID: 3336)

    • Reads settings of System Certificates

      • explorer.exe (PID: 2028)
      • firefox.exe (PID: 3000)

    • Application launched itself

      • firefox.exe (PID: 3000)
      • iexplore.exe (PID: 2516)

    • Creates files in the user directory

      • firefox.exe (PID: 3000)
      • iexplore.exe (PID: 1488)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 3752)
      • iexplore.exe (PID: 2128)

    • Loads dropped or rewritten executable

      • sumo_lite.tmp (PID: 3272)

    • Application was dropped or rewritten from another process

      • sumo_lite.tmp (PID: 2812)
      • sumo_lite.tmp (PID: 3272)

    • Creates files in the program directory

      • sumo_lite.tmp (PID: 3272)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1488)

    • Changes internet zones settings

      • iexplore.exe (PID: 1944)
      • iexplore.exe (PID: 2516)

    • Creates a software uninstall entry

      • sumo_lite.tmp (PID: 3272)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1488)
      • iexplore.exe (PID: 2128)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1488)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 1488)
      • iexplore.exe (PID: 1944)
      • iexplore.exe (PID: 2128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
16
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start firefox.exe firefox.exe firefox.exe firefox.exe explorer.exe sumo_lite.exe sumo_lite.tmp no specs sumo_lite.exe sumo_lite.tmp iexplore.exe iexplore.exe sumo.exe iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs sumo.exe

Process information

PID
CMD
Path
Indicators
Parent process
3000"C:\Program Files\Mozilla Firefox\firefox.exe" https://kcsoftwares.com/files/sumo_lite.exeC:\Program Files\Mozilla Firefox\firefox.exe
explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
61.0.2
2608"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.0.281993157\1447491283" -childID 1 -isForBrowser -prefsHandle 1360 -prefsLen 8310 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 708 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
3336"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.6.743743226\721340068" -childID 2 -isForBrowser -prefsHandle 2492 -prefsLen 11442 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 2092 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
3620"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3000.12.207094855\760036938" -childID 3 -isForBrowser -prefsHandle 2964 -prefsLen 12017 -schedulerPrefs 0001,2 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3000 "\\.\pipe\gecko-crash-server-pipe.3000" 2960 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Version:
61.0.2
2028C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3232"C:\Users\admin\Downloads\sumo_lite.exe" C:\Users\admin\Downloads\sumo_lite.exe
explorer.exe
User:
admin
Company:
KC Softwares
Integrity Level:
MEDIUM
Description:
KC Softwares SUMo Setup
Exit code:
0
Version:
5.8.11.414
2812"C:\Users\admin\AppData\Local\Temp\is-AUP7P.tmp\sumo_lite.tmp" /SL5="$40204,2106972,163328,C:\Users\admin\Downloads\sumo_lite.exe" C:\Users\admin\AppData\Local\Temp\is-AUP7P.tmp\sumo_lite.tmp—sumo_lite.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
2188"C:\Users\admin\Downloads\sumo_lite.exe" /SPAWNWND=$301F6 /NOTIFYWND=$40204 C:\Users\admin\Downloads\sumo_lite.exe
sumo_lite.tmp
User:
admin
Company:
KC Softwares
Integrity Level:
HIGH
Description:
KC Softwares SUMo Setup
Exit code:
0
Version:
5.8.11.414
3272"C:\Users\admin\AppData\Local\Temp\is-SNRSC.tmp\sumo_lite.tmp" /SL5="$401FC,2106972,163328,C:\Users\admin\Downloads\sumo_lite.exe" /SPAWNWND=$301F6 /NOTIFYWND=$40204 C:\Users\admin\AppData\Local\Temp\is-SNRSC.tmp\sumo_lite.tmp
sumo_lite.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
1944"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
sumo_lite.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Total events
5 344
Read events
4 605
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
112
Text files
128
Unknown types
42

Dropped files

PID
Process
Filename
Type
3000firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
3000firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
3000firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm —
MD5:—
SHA256:—
3000firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm —
MD5:—
SHA256:—
3000firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm —
MD5:—
SHA256:—
3000firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db-journal —
MD5:—
SHA256:—
3000firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:707C12070C52E55C2A996AC15E219B95
SHA256:6C5410C655C8EFC48D123ABE708C8940A4218072C0DAF85E03AB45DA6D2CE6B9
3000firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.dbsqlite
MD5:782118752C9D0EE945DF68F7409C01E9
SHA256:9C1ADE8D81B2D460C30FD1CE0D052A2F5787B71EB93B898903959BEDBA090F9C
3000firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:3F32E638A55A20601090E7D590A927EA
SHA256:F9CBCFC3DA432074912991637A7CBBD934BFD22F48500A033412BB47B72B104F
3000firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\cache2\entries\E53F2EE24A155615482D34F5E87147E8DDADD57Dder
MD5:2876EBBC46080CE43B4F6DBCA6AD02F8
SHA256:309A4643E7CDF34EE497A0443DB6B1B1699B4AD2DAEE2DBB79B01F5591AF222F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
72
DNS requests
59
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3000
firefox.exe
POST
200
72.247.178.18:80
http://ocsp.int-x3.letsencrypt.org/
NL
der
527 b
whitelisted
3000
firefox.exe
POST
200
172.217.22.14:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
2128
iexplore.exe
GET
200
213.186.33.69:80
http://www.kcsoftwares.com/images/kclogo.png
FR
image
1.15 Kb
malicious
3000
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3000
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2128
iexplore.exe
GET
200
213.186.33.69:80
http://www.kcsoftwares.com/?page=dumo&showads
FR
html
5.80 Kb
malicious
2128
iexplore.exe
GET
200
172.217.22.34:80
http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
US
text
29.1 Kb
whitelisted
3000
firefox.exe
POST
200
172.217.22.14:80
http://ocsp.pki.goog/GTSGIAG3
US
der
463 b
whitelisted
2028
explorer.exe
GET
200
91.199.212.52:80
http://crt.comodoca.com/COMODORSAAddTrustCA.crt
GB
der
1.37 Kb
whitelisted
1944
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3000
firefox.exe
213.186.33.69:443
kcsoftwares.com
OVH SAS
FR
malicious
3000
firefox.exe
2.16.186.112:80
detectportal.firefox.com
Akamai International B.V.
—
whitelisted
3000
firefox.exe
172.217.22.10:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
3000
firefox.exe
34.211.202.13:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
3000
firefox.exe
52.89.32.107:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3000
firefox.exe
52.222.168.24:443
tracking-protection.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
3000
firefox.exe
52.34.107.172:443
tiles.services.mozilla.com
Amazon.com, Inc.
US
unknown
3000
firefox.exe
172.217.21.206:443
sb-ssl.google.com
Google Inc.
US
whitelisted
3000
firefox.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3000
firefox.exe
172.217.22.14:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
detectportal.firefox.com
  • 2.16.186.112
  • 2.16.186.50
  • 104.107.216.169
  • 104.107.216.187
whitelisted
kcsoftwares.com
  • 213.186.33.69
whitelisted
a1089.dscd.akamai.net
  • 2.16.186.50
  • 2.16.186.112
  • 104.107.216.187
  • 104.107.216.169
whitelisted
ocsp.int-x3.letsencrypt.org
  • 72.247.178.18
  • 72.247.178.16
whitelisted
search.services.mozilla.com
  • 52.89.32.107
  • 34.216.89.123
  • 52.27.184.151
whitelisted
search.r53-2.services.mozilla.com
  • 52.27.184.151
  • 34.216.89.123
  • 52.89.32.107
whitelisted
a771.dscq.akamai.net
  • 72.247.178.16
  • 72.247.178.18
whitelisted
tiles.services.mozilla.com
  • 52.34.107.172
  • 52.10.130.148
  • 52.25.70.97
  • 34.216.156.21
  • 52.41.60.30
  • 52.40.109.206
  • 52.39.131.77
  • 52.41.78.152
whitelisted
tiles.r53-2.services.mozilla.com
  • 52.41.78.152
  • 52.39.131.77
  • 52.40.109.206
  • 52.41.60.30
  • 34.216.156.21
  • 52.25.70.97
  • 52.10.130.148
  • 52.34.107.172
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://kcsoftwares.com/files/sumo_lite.exe