| File name: | ASing-automount.exe |
| Full analysis: | https://app.any.run/tasks/9151f59a-a0ae-4a8e-830c-9322ab61c893 |
| Verdict: | Malicious activity |
| Analysis date: | March 20, 2024, 17:23:48 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows |
| MD5: | DFEA160D7ECD363525C71E0397DFE49B |
| SHA1: | 4E078144759BCCD2750B0AF08FA62EEC8368E8B8 |
| SHA256: | 70C5F29B297295EAA95FF8887A2C9C2A29022A77B7550D996B7D639BAF705746 |
| SSDEEP: | 98304:9RKGJi8WmpD6cFvpbPc2Zy+aMI5MnqJhmh6WsRH01RPXBfsSAm3TZ8pAYPxh8Qyp:9TDIjyMg3DO |
MALICIOUS
Drops the executable file immediately after the start
- ASing-automount.exe (PID: 120)
SUSPICIOUS
Reads the Internet Settings
- ASing-automount.exe (PID: 120)
Executable content was dropped or overwritten
- ASing-automount.exe (PID: 120)
INFO
Reads the computer name
- ASing-automount.exe (PID: 120)
Checks supported languages
- ASing-automount.exe (PID: 120)
Reads the machine GUID from the registry
- ASing-automount.exe (PID: 120)
Create files in a temporary directory
- ASing-automount.exe (PID: 120)
Application launched itself
- msedge.exe (PID: 2792)
- msedge.exe (PID: 3956)
- msedge.exe (PID: 3528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic CIL Executable (.NET, Mono, etc.) (56.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (21.3) |
| .scr | | | Windows screen saver (10.1) |
| .dll | | | Win32 Dynamic Link Library (generic) (5) |
| .exe | | | Win32 Executable (generic) (3.4) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:01:17 11:48:25+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 48 |
| CodeSize: | 6664704 |
| InitializedDataSize: | 37376 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x65cf2a |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.2.1.11 |
| ProductVersionNumber: | 0.2.1.11 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | - |
| CompanyName: | ASiNG |
| FileDescription: | ASiNG |
| FileVersion: | 0.2.1.11 |
| InternalName: | ASiNG.exe |
| LegalCopyright: | ShenZhen RuiSicong Technology Co.,Ltd |
| LegalTrademarks: | - |
| OriginalFileName: | ASiNG.exe |
| ProductName: | ASing |
| ProductVersion: | 0.2.1.11 |
| AssemblyVersion: | 0.2.1.11 |
Total processes
71
Monitored processes
35
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 120 | "C:\Users\admin\AppData\Local\Temp\ASing-automount.exe" | C:\Users\admin\AppData\Local\Temp\ASing-automount.exe | explorer.exe | ||||||||||||
User: admin Company: ASiNG Integrity Level: MEDIUM Description: ASiNG Exit code: 0 Version: 0.2.1.11 Modules
| |||||||||||||||
| 548 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=4200 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 992 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1112 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1636 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1172 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4028 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1316 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4500 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1608 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3212 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1628 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=652 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1644 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:3 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1784 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1472 --field-trial-handle=1236,i,15591661348829253052,8274364626255128301,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
Total events
10 742
Read events
10 619
Write events
117
Delete events
6
Modification events
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication |
| Operation: | write | Name: | Name |
Value: ASing-automount.exe | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | bDlIsChecked |
Value: True | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | bMagnifierIsChecked |
Value: True | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | bSpotlightIsChecked |
Value: True | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | bPenIsChecked |
Value: True | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | IsAntilost |
Value: False | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | IsAutoRun |
Value: True | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | bOneKeyShare |
Value: False | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | DlColor |
Value: #FFFF0000 | |||
| (PID) Process: | (120) ASing-automount.exe | Key: | HKEY_CURRENT_USER\Software\ASing |
| Operation: | write | Name: | lSize |
Value: 40 | |||
Executable files
3
Suspicious files
56
Text files
92
Unknown types
59
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF18b198.TMP | — | |
MD5:— | SHA256:— | |||
| 2792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF18b1b7.TMP | — | |
MD5:— | SHA256:— | |||
| 2792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF18b1f5.TMP | — | |
MD5:— | SHA256:— | |||
| 2792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 2792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old~RF18b198.TMP | text | |
MD5:BC5665331C6B5366D725CB1970BD7406 | SHA256:5D33599D48DC5F3D65BA548DDBAE25868B979EABA17BC310F0D2C7543341F80D | |||
| 2792 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variations | binary | |
MD5:961E3604F228B0D10541EBF921500C86 | SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED | |||
| 120 | ASing-automount.exe | C:\Users\admin\Desktop\ASiNG.lnk | lnk | |
MD5:A197A94A27135AEC0D903DA1D8CDE680 | SHA256:9759861D2834DBA57861F015F72BE5AFD3D062C5C76B1D065A4B0C38709D6391 | |||
| 2256 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma | binary | |
MD5:886E82F2CA62ECCCE64601B30592078A | SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
79
DNS requests
91
Threats
9
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1644 | msedge.exe | GET | 200 | 47.103.144.226:80 | http://doc.asing.com.cn/file/A8_Manual_cn.pdf | unknown | pdf | 918 Kb | unknown |
1644 | msedge.exe | GET | 204 | 13.107.6.158:80 | http://edge-http.microsoft.com/captiveportal/generate_204 | unknown | — | — | unknown |
1644 | msedge.exe | GET | 404 | 47.103.144.226:80 | http://doc.asing.com.cn/favicon.ico | unknown | text | 18 b | unknown |
1644 | msedge.exe | GET | — | 203.119.169.18:80 | http://daxingsm.world.tmall.com/?spm=a220o.1000855.1997427721.d4918089.dde1eb76RJ165b | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2792 | msedge.exe | 239.255.255.250:1900 | — | — | — | unknown |
1644 | msedge.exe | 13.107.21.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
1644 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
1644 | msedge.exe | 163.171.132.119:443 | mall.jd.com | QUANTILNETWORKS | DE | unknown |
1644 | msedge.exe | 2.16.202.114:443 | h5.360buyimg.com | Akamai International B.V. | NL | unknown |
1644 | msedge.exe | 104.126.37.163:443 | www.bing.com | Akamai International B.V. | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
mall.jd.com |
| unknown |
edge.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
jscss.360buyimg.com |
| unknown |
storage.360buyimg.com |
| unknown |
h5.360buyimg.com |
| unknown |
gias.jd.com |
| unknown |
misc.360buyimg.com |
| whitelisted |
img14.360buyimg.com |
| unknown |
img11.360buyimg.com |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1644 | msedge.exe | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
— | — | Misc activity | ET INFO Session Traversal Utilities for NAT (STUN Binding Request) |
Process | Message |
|---|---|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|
ASing-automount.exe | ??????
|