File name:

725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1

Full analysis: https://app.any.run/tasks/1c771cb4-aa1e-4f96-84b1-10d26306e373
Verdict: Malicious activity
Analysis date: December 08, 2020, 19:47:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

904840CAE5035526E0D563CCB9963E4F

SHA1:

FCE9572BDAC07F3B4784B011A871B4E015618B6F

SHA256:

725457856AF60FACAB85A10A11014E4E695B42404F81D192803B7380C9D97BB1

SSDEEP:

12288:iI/qRFQC7zJqFddaqKCXL9UA2DPNKT1zH3xIqYLvqEhj:7/qR2C79qFddaHCRUfDu173ajzhhj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ns352A.tmp (PID: 560)
      • tt-installer-helper.exe (PID: 3032)
      • ns15E5.tmp (PID: 1520)
      • downloader.exe (PID: 2764)
      • tt-installer-helper.exe (PID: 1488)

    • Drops executable file immediately after starts

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)
      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 1120)

    • Changes settings of System certificates

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)

    • Loads dropped or rewritten executable

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 1120)
      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)
      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 1120)

    • Executable content was dropped or overwritten

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)
      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 1120)

    • Application launched itself

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)

    • Adds / modifies Windows certificates

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)

    • Drops a file that was compiled in debug mode

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)
      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 1120)

    • Drops a file with a compile date too recent

      • 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe (PID: 3540)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:07:21 15:57:47+02:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 28672
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x36c6
OSVersion: 5.1
ImageVersion: 6
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.111.0
ProductVersionNumber: 1.0.111.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 1.0.111.0
ProductVersion: 1.0.111

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Jul-2020 13:57:47
Detected languages:
  • English - United States
FileVersion: 1.0.111.0
ProductVersion: 1.0.111

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 21-Jul-2020 13:57:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00006E74
0x00007000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.40353
.rdata
0x00008000
0x0000199C
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.039
.data
0x0000A000
0x0002AB00
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.03174
.ndata
0x00035000
0x00022000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00057000
0x00007428
0x00007600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.50088

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.30515
1077
UNKNOWN
English - United States
RT_MANIFEST
2
4.8682
4136
UNKNOWN
English - United States
RT_ICON
3
3.04822
2344
UNKNOWN
English - United States
RT_ICON
4
4.39436
1384
UNKNOWN
English - United States
RT_ICON
5
0
1128
UNKNOWN
English - United States
RT_ICON
6
0
744
UNKNOWN
English - United States
RT_ICON
7
0
296
UNKNOWN
English - United States
RT_ICON
103
1.7506
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start start drop and start 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe ns352a.tmp no specs tt-installer-helper.exe downloader.exe 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe ns15e5.tmp no specs tt-installer-helper.exe 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
560"C:\Users\admin\AppData\Local\Temp\nsc3519.tmp\ns352A.tmp" "C:\Users\admin\AppData\Local\Temp\nsc3519.tmp\tt-installer-helper.exe" --getuidC:\Users\admin\AppData\Local\Temp\nsc3519.tmp\ns352A.tmp—725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsc3519.tmp\ns352a.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1120"C:\Users\admin\AppData\Local\Temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe" --uid=9b7416c5-7102-4f9e-aedb-c2d649078027-0dad434ed819cbfce63c4394f52d918ded161f18 --partner=ogC:\Users\admin\AppData\Local\Temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.111.0
Modules
Images
c:\users\admin\appdata\local\temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1488"C:\Users\admin\AppData\Local\Temp\nsg15C5.tmp\tt-installer-helper.exe" --getuidC:\Users\admin\AppData\Local\Temp\nsg15C5.tmp\tt-installer-helper.exe
ns15E5.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsg15c5.tmp\tt-installer-helper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1520"C:\Users\admin\AppData\Local\Temp\nsg15C5.tmp\ns15E5.tmp" "C:\Users\admin\AppData\Local\Temp\nsg15C5.tmp\tt-installer-helper.exe" --getuidC:\Users\admin\AppData\Local\Temp\nsg15C5.tmp\ns15E5.tmp—725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsg15c5.tmp\ns15e5.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2408"C:\Users\admin\AppData\Local\Temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe" C:\Users\admin\AppData\Local\Temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.0.111.0
Modules
Images
c:\users\admin\appdata\local\temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
c:\systemroot\system32\ntdll.dll
2764C:\Users\admin\AppData\Local\Temp\nsc3519.tmp\downloader.exe --partner 19568 --distr /quiet /msicl "VID=110 YABROWSER=y YAQSEARCH=y YAHOMEPAGE=y"C:\Users\admin\AppData\Local\Temp\nsc3519.tmp\downloader.exe
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup Downloader
Exit code:
0
Version:
0.1.0.32
Modules
Images
c:\users\admin\appdata\local\temp\nsc3519.tmp\downloader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3032"C:\Users\admin\AppData\Local\Temp\nsc3519.tmp\tt-installer-helper.exe" --getuidC:\Users\admin\AppData\Local\Temp\nsc3519.tmp\tt-installer-helper.exe
ns352A.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsc3519.tmp\tt-installer-helper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3540"C:\Users\admin\AppData\Local\Temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe" C:\Users\admin\AppData\Local\Temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.111.0
Modules
Images
c:\users\admin\appdata\local\temp\725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
798
Read events
753
Write events
45
Delete events
0

Modification events

(PID) Process:(3032) tt-installer-helper.exeKey:HKEY_CURRENT_USER\Software\Telamon
Operation:writeName:installer_uid
Value:
9b7416c5-7102-4f9e-aedb-c2d649078027-0dad434ed819cbfce63c4394f52d918ded161f18
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3540) 725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E
Operation:writeName:Blob
Value:
0400000001000000100000001BFE69D191B71933A372A80FE155E5B50F000000010000003000000066B764A96581128168CF208E374DDA479D54E311F32457F4AEE0DBD2A6C8D171D531289E1CD22BFDBBD4CFD9796254830300000001000000140000002B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E0B00000001000000100000005300650063007400690067006F0000001D0000000100000010000000885010358D29A38F059B028559C95F901400000001000000140000005379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB620000000100000020000000E793C9B02FD8AA13E21C31228ACCB08119643B749C898964B1746D46C3D4CBD253000000010000002600000030243022060C2B06010401B231010201050130123010060A2B0601040182373C0101030200C0090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B06010505070308060A2B0601040182370A030406082B0601050507030606082B06010505070307190000000100000010000000EA6089055218053DD01E37E1D806EEDF2000000001000000E2050000308205DE308203C6A003020102021001FD6D30FCA3CA51A81BBC640E35032D300D06092A864886F70D01010C0500308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F72697479301E170D3130303230313030303030305A170D3338303131383233353935395A308188310B3009060355040613025553311330110603550408130A4E6577204A6572736579311430120603550407130B4A65727365792043697479311E301C060355040A131554686520555345525452555354204E6574776F726B312E302C06035504031325555345525472757374205253412043657274696669636174696F6E20417574686F7269747930820222300D06092A864886F70D01010105000382020F003082020A028202010080126517360EC3DB08B3D0AC570D76EDCD27D34CAD508361E2AA204D092D6409DCCE899FCC3DA9ECF6CFC1DCF1D3B1D67B3728112B47DA39C6BC3A19B45FA6BD7D9DA36342B676F2A93B2B91F8E26FD0EC162090093EE2E874C918B491D46264DB7FA306F188186A90223CBCFE13F087147BF6E41F8ED4E451C61167460851CB8614543FBC33FE7E6C9CFF169D18BD518E35A6A766C87267DB2166B1D49B7803C0503AE8CCF0DCBC9E4CFEAF0596351F575AB7FFCEF93DB72CB6F654DDC8E7123A4DAE4C8AB75C9AB4B7203DCA7F2234AE7E3B68660144E7014E46539B3360F794BE5337907343F332C353EFDBAAFE744E69C76B8C6093DEC4C70CDFE132AECC933B517895678BEE3D56FE0CD0690F1B0FF325266B336DF76E47FA7343E57E0EA566B1297C3284635589C40DC19354301913ACD37D37A7EB5D3A6C355CDB41D712DAA9490BDFD8808A0993628EB566CF2588CD84B8B13FA4390FD9029EEB124C957CF36B05A95E1683CCB867E2E8139DCC5B82D34CB3ED5BFFDEE573AC233B2D00BF3555740949D849581A7F9236E651920EF3267D1C4D17BCC9EC4326D0BF415F40A94444F499E757879E501F5754A83EFD74632FB1506509E658422E431A4CB4F0254759FA041E93D426464A5081B2DEBE78B7FC6715E1C957841E0F63D6E962BAD65F552EEA5CC62808042539B80E2BA9F24C971C073F0D52F5EDEF2F820F0203010001A3423040301D0603551D0E041604145379BF5AAA2B4ACF5480E1D89BC09DF2B20366CB300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF300D06092A864886F70D01010C050003820201005CD47C0DCFF7017D4199650C73C5529FCBF8CF99067F1BDA43159F9E0255579614F1523C27879428ED1F3A0137A276FC5350C0849BC66B4EBA8C214FA28E556291F36915D8BC88E3C4AA0BFDEFA8E94B552A06206D55782919EE5F305C4B241155FF249A6E5E2A2BEE0B4D9F7FF70138941495430709FB60A9EE1CAB128CA09A5EA7986A596D8B3F08FBC8D145AF18156490120F73282EC5E2244EFC58ECF0F445FE22B3EB2F8ED2D9456105C1976FA876728F8B8C36AFBF0D05CE718DE6A66F1F6CA67162C5D8D083720CF16711890C9C134C7234DFBCD571DFAA71DDE1B96C8C3C125D65DABD5712B6436BFFE5DE4D661151CF99AEEC17B6E871918CDE49FEDD3571A21527941CCF61E326BB6FA36725215DE6DD1D0B2E681B3B82AFEC836785D4985174B1B9998089FF7F78195C794A602E9240AE4C372A2CC9C762C80E5DF7365BCAE0252501B4DD1A079C77003FD0DCD5EC3DD4FABB3FCC85D66F7FA92DDFB902F7F5979AB535DAC367B0874AA9289E238EFF5C276BE1B04FF307EE002ED45987CB524195EAF447D7EE6441557C8D590295DD629DC2B9EE5A287484A59BB790C70C07DFF589367432D628C1B0B00BE09C4CC31CD6FCE369B54746812FA282ABD3634470C48DFF2D33BAAD8F7BB57088AE3E19CF4028D8FCC890BB5D9922F552E658C51F883143EE881DD7C68E3C436A1DA718DE7D3D16F162F9CA90A8FD
Executable files
17
Suspicious files
6
Text files
6
Unknown types
3

Dropped files

PID
Process
Filename
Type
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\Local\Temp\Cab5313.tmp —
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\Local\Temp\Tar5314.tmp —
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\Local\Temp\nsc3519.tmp\tt-installer-helper.exeexecutable
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\Local\Temp\nsc3519.tmp\ns352A.tmpexecutable
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dder
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\47D38924FB969B7C826E67BD2D7EB5DEder
MD5:—
SHA256:—
3540725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\47D38924FB969B7C826E67BD2D7EB5DEbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
7
DNS requests
7
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
GET
200
151.139.128.14:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
US
der
471 b
whitelisted
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
POST
200
44.242.24.237:80
http://api.amplitude.com/httpapi
US
text
7 b
whitelisted
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
POST
200
44.242.24.237:80
http://api.amplitude.com/httpapi
US
text
7 b
whitelisted
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
POST
200
44.242.24.237:80
http://api.amplitude.com/httpapi
US
text
7 b
whitelisted
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
POST
200
44.242.24.237:80
http://api.amplitude.com/httpapi
US
text
7 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
51.158.107.110:443
dwnld.telamoncleaner.pro
—
GB
unknown
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
2764
downloader.exe
5.45.205.243:80
downloader.yandex.net
YANDEX LLC
RU
whitelisted
1120
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
44.238.32.176:80
api.amplitude.com
University of California, San Diego
US
suspicious
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
44.242.24.237:80
api.amplitude.com
University of California, San Diego
US
suspicious

DNS requests

Domain
IP
Reputation
api.amplitude.com
  • 44.242.24.237
  • 44.239.2.158
  • 44.239.7.208
  • 44.241.77.10
  • 54.68.158.172
  • 52.33.249.174
  • 44.238.193.139
  • 44.240.69.85
  • 44.238.32.176
  • 52.40.97.110
  • 52.40.100.235
  • 34.211.216.112
  • 35.165.241.223
  • 34.214.12.183
  • 52.25.155.100
whitelisted
dwnld.telamoncleaner.pro
  • 51.158.107.110
unknown
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted
downloader.yandex.net
  • 5.45.205.243
  • 5.45.205.244
  • 5.45.205.242
  • 5.45.205.241
  • 5.45.205.245
whitelisted

Threats

PID
Process
Class
Message
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3540
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
Process
Message
tt-installer-helper.exe
[2020-12-08 19:48:01] E regstorage.cpp:62 [RegStorage] get<std::wstring>() RegOpenKeyEx failed. 2
tt-installer-helper.exe
[2020-12-08 19:48:58] E regstorage.cpp:62 [RegStorage] get<std::wstring>() Cannot get size of string value: RegGetValue failed. 2
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
725457856af60facab85a10a11014e4e695b42404f81d192803b7380c9d97bb1