File name:

a.exe

Full analysis: https://app.any.run/tasks/5d72522a-24b8-430d-a8ce-a8b47088bf4e
Verdict: Malicious activity
Analysis date: August 24, 2024, 23:10:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
MD5:

8A16C4B0C08337F7E78AE8E04E72BDE4

SHA1:

63D3A549702ACEED4B3F69CC465A941FF15FEFEB

SHA256:

7934EEFC7C9B17C138433B13B8EF99F77E88153193525B416219240D47ECDD39

SSDEEP:

98304:rA16WTv7klWurdCfruBsrIuCZatIyYBE8V6gKryLRW6fx73q0n1q63KojOiqs4wV:P9jACKmQ/9bOgyP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • a.exe (PID: 6992)

    • Registers / Runs the DLL via REGSVR32.EXE

      • CagService.exe (PID: 6732)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • a.exe (PID: 6992)
      • CagService.exe (PID: 6732)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • a.exe (PID: 6992)

    • The process creates files with name similar to system file names

      • a.exe (PID: 6992)

    • Executable content was dropped or overwritten

      • a.exe (PID: 6992)
      • CagService.exe (PID: 6732)

    • Process drops legitimate windows executable

      • a.exe (PID: 6992)
      • CagService.exe (PID: 6732)

    • Creates a software uninstall entry

      • a.exe (PID: 6992)
      • CagService.exe (PID: 6732)

    • Executes as Windows Service

      • CagService.exe (PID: 6732)

    • Reads security settings of Internet Explorer

      • CagService.exe (PID: 6732)
      • Gui.exe (PID: 6744)

    • Searches for installed software

      • CagService.exe (PID: 6732)

    • Checks Windows Trust Settings

      • Gui.exe (PID: 6744)

    • Creates or modifies Windows services

      • CagService.exe (PID: 6732)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6284)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • CagService.exe (PID: 6732)

    • Executing commands from ".cmd" file

      • CagService.exe (PID: 6732)

    • Get information on the list of running processes

      • cmd.exe (PID: 7000)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7000)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • CagService.exe (PID: 6732)

    • Starts CMD.EXE for commands execution

      • CagService.exe (PID: 6732)

  • INFO

    • Checks supported languages

      • a.exe (PID: 6992)
      • CagService.exe (PID: 6732)
      • Gui.exe (PID: 6744)

    • Create files in a temporary directory

      • a.exe (PID: 6992)

    • Creates files in the program directory

      • a.exe (PID: 6992)
      • CagService.exe (PID: 6732)

    • Reads Environment values

      • a.exe (PID: 6992)
      • CagService.exe (PID: 6732)

    • Reads the computer name

      • a.exe (PID: 6992)
      • CagService.exe (PID: 6732)
      • Gui.exe (PID: 6744)

    • Reads the machine GUID from the registry

      • CagService.exe (PID: 6732)
      • Gui.exe (PID: 6744)

    • Reads the software policy settings

      • Gui.exe (PID: 6744)
      • CagService.exe (PID: 6732)

    • Checks proxy server information

      • CagService.exe (PID: 6732)
      • Gui.exe (PID: 6744)

    • Creates files or folders in the user directory

      • Gui.exe (PID: 6744)

    • Disables trace logs

      • CagService.exe (PID: 6732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:27 01:27:51+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.26
CodeSize: 35328
InitializedDataSize: 38912
UninitializedDataSize: 154112
EntryPoint: 0x4167
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
16
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start a.exe cagservice.exe conhost.exe no specs gui.exe regsvr32.exe no specs regsvr32.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs tasklist.exe no specs find.exe no specs sc.exe no specs a.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1748SC create uvnc_service binpath= "\"C:\Program Files (x86)\CentraStage\UltraVNC\winvnc.exe\" -service" start= autoC:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2340"netsh" advfirewall firewall delete rule name="RMM WINVNC"C:\Windows\System32\netsh.exe—CagService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2456\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CagService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2580\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3568tasklist /fi "imagename eq winvnc.exe" C:\Windows\System32\tasklist.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6272"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"C:\Windows\System32\regsvr32.exe—CagService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6284 /s "C:\Program Files (x86)\CentraStage\scvncctrl.dll"C:\Windows\SysWOW64\regsvr32.exe—regsvr32.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6380"netsh" advfirewall firewall add rule name="RMM WINVNC" dir=out action=block program="C:\Program Files (x86)\CentraStage\UltraVNC\winvnc.exe" enable=yesC:\Windows\System32\netsh.exe—CagService.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6732"C:\Program Files (x86)\CentraStage\CagService.exe"C:\Program Files (x86)\CentraStage\CagService.exe
services.exe
User:
SYSTEM
Company:
CentraStage
Integrity Level:
SYSTEM
Description:
CentraStage Service
Version:
4.4.2203.2203
Modules
Images
c:\program files (x86)\centrastage\cagservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
12 269
Read events
12 195
Write events
74
Delete events
0

Modification events

(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control
Operation:writeName:ServicesPipeTimeout
Value:
300000
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:CentraStage
Value:
C:\Program Files (x86)\CentraStage\Gui.exe
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:DisplayName
Value:
CentraStage
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:UninstallString
Value:
C:\Program Files (x86)\CentraStage\uninst.exe
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:DisplayIcon
Value:
C:\Program Files (x86)\CentraStage\CSIcon.ico
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:URLInfoAbout
Value:
http://www.centrastage.com
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\CentraStage
Operation:writeName:Publisher
Value:
CentraStage Limited
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage
Operation:writeName:AgentFolderLocation
Value:
C:\ProgramData\CentraStage
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\CentraStage
Operation:writeName:AgentFolderStatus
Value:
0
(PID) Process:(6992) a.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nsjE482.tmp\nsProcess.dll
Executable files
110
Suspicious files
22
Text files
75
Unknown types
0

Dropped files

PID
Process
Filename
Type
6992a.exeC:\Program Files (x86)\CentraStage\CSIcon.icoimage
MD5:2F6FD9AA57AA40728A65FA006C7E0F17
SHA256:B59A0E0570D2A22CD51FB51FC106913F9048F2889FC3BD94A5A51BE1A5D102F9
6992a.exeC:\Program Files (x86)\CentraStage\AxInterop.ViewerX.dllexecutable
MD5:EDC5E696C4AD70F0BE6301F703AB3672
SHA256:C6E5F17B2BC91202A1C6A9F3F0547CD7F208368B4CFEBB53F234A55F87C5ACD5
6992a.exeC:\Program Files (x86)\CentraStage\defaultbrand.zipcompressed
MD5:BE0A3C9E7408BDD9A9D9D004CA01ABF2
SHA256:865CC74F5B77E1DDFFA260084633236186F16139E08B4FB81DB4AAD2442BDC34
6992a.exeC:\Program Files (x86)\CentraStage\AxInterop.MSTSCLib.dllexecutable
MD5:0F581E56ED5BA500CE5D98D105B04A37
SHA256:F041747B5B6B20B6620CA13A7B276C9E9070E54CDA8C29F6ADD54CBA9A42A2F5
6992a.exeC:\Program Files (x86)\CentraStage\Core.dllexecutable
MD5:C52C091441560C25F69FC82EF963D3CF
SHA256:1AEA56FAD229EAD28E18E2EF953E7E949101865DD063BB69DF62194880CEF037
6992a.exeC:\Program Files (x86)\CentraStage\Core.XmlSerializers.dllexecutable
MD5:8E03044775B38CB3C3A1349A44C87B00
SHA256:6B531D00B2481CC14080F6903667F7DD529FA090C2855A777DA34EDE3173CFD5
6992a.exeC:\Program Files (x86)\CentraStage\Microsoft.Threading.Tasks.Extensions.Desktop.dllexecutable
MD5:E548A93D16964E52868C47CEF1C98F2E
SHA256:F71621C47C610E0886846CF53D955FD0E7448951F99ECC22FACD47493EF97A87
6992a.exeC:\Program Files (x86)\CentraStage\FSharp.Core.dllexecutable
MD5:99A817A04B25690B98EDF3370ED2EB83
SHA256:9292EB06BF4CD100C94ABD2949A96351A0F3710008674993C7491DA578E1EDE1
6992a.exeC:\Program Files (x86)\CentraStage\FsLexYacc.Runtime.dllexecutable
MD5:06B971620BDA7960F7D8E43CE69E3BBE
SHA256:B635BA89E9CC8455F252B7E24E5D2838F50AAF75121CA7D070BB7D6CF41A6235
6992a.exeC:\Program Files (x86)\CentraStage\Gui.exeexecutable
MD5:4E267EF9CC300B1C6A0B1C5861F35425
SHA256:E7AD4B2C3492574E404F2C2DC8D3AD6739F6A2ED820DA73019B0D07307D8DD6A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
34
DNS requests
17
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4064
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6744
Gui.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
6904
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6744
Gui.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAbiTXSc4AAz%2FHvBEkexq4M%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3840
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3376
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4064
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4064
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3840
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6744
Gui.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.20
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.74
  • 20.190.160.22
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
concordcc.centrastage.net
  • 52.7.200.96
whitelisted
update-concord.centrastage.net
  • 143.204.98.36
  • 143.204.98.43
  • 143.204.98.67
  • 143.204.98.14
whitelisted
concord-agent.centrastage.net
  • 3.33.215.54
  • 15.197.219.241
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET INFO DNS Query to Remote Monitoring and Management Domain (centrastage .net)
2256
svchost.exe
Misc activity
ET INFO DNS Query to Remote Monitoring and Management Domain (centrastage .net)
6732
CagService.exe
Misc activity
ET INFO Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
2256
svchost.exe
Misc activity
ET INFO DNS Query to Remote Monitoring and Management Domain (centrastage .net)
6732
CagService.exe
Misc activity
ET INFO Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
6732
CagService.exe
Misc activity
ET INFO Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
6732
CagService.exe
Misc activity
ET INFO Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
2256
svchost.exe
Misc activity
ET INFO DNS Query to Remote Monitoring and Management Domain (centrastage .net)
6732
CagService.exe
Misc activity
ET INFO Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
6732
CagService.exe
Misc activity
ET INFO Observed Remote Monitoring and Management Domain (centrastage .net in TLS SNI)
No debug info