Analysis date (UTC): 1 April 2024, 13:46Analysis environment: Windows 10 Pro, build 19044, x64

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe

MD5:85AEA19A596F59D0DBF368F99BE6A139

SHA1:9FD84C0780B6555CDEED499B30E5D67071998FBC

SHA256:7A95214E7077D7324C0E8DC7D20F2A4E625BC0AC7E14B1446E37C47DFF7EEB5B

Analysis result

Threat level:Malicious activity

Tags:

evasiongenericstealer

Full analysis:Analysis 7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (MD5: 85AEA19A596F59D0DBF368F99BE6A139) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)
SerenityTherapyInstaller.exe (PID: 7124)

Create files in the Startup directory

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)

Changes powershell execution policy (Unrestricted)

SerenityTherapyInstaller.exe (PID: 7124)

DISCORDGRABBER has been detected (YARA)

SerenityTherapyInstaller.exe (PID: 7124)

Actions looks like stealing of personal data

SerenityTherapyInstaller.exe (PID: 7124)

SUSPICIOUS

Malware-specific behavior (creating "System.dll" in Temp)

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)

The process creates files with name similar to system file names

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)
powershell.exe (PID: 6372)

Starts CMD.EXE for commands execution

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)
SerenityTherapyInstaller.exe (PID: 7124)

Get information on the list of running processes

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)
cmd.exe (PID: 6676)
SerenityTherapyInstaller.exe (PID: 7124)
cmd.exe (PID: 5844)

Drops 7-zip archiver for unpacking

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)

Process drops legitimate windows executable

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)

Reads security settings of Internet Explorer

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)

Creates a software uninstall entry

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)

Starts application with an unusual extension

cmd.exe (PID: 3784)

Starts POWERSHELL.EXE for commands execution

SerenityTherapyInstaller.exe (PID: 7124)

The process hides Powershell's copyright startup banner

SerenityTherapyInstaller.exe (PID: 7124)

Application launched itself

SerenityTherapyInstaller.exe (PID: 7124)

The process bypasses the loading of PowerShell profile settings

SerenityTherapyInstaller.exe (PID: 7124)

Checks for external IP

SerenityTherapyInstaller.exe (PID: 7124)

Using 'findstr.exe' to search for text patterns in files and output

cmd.exe (PID: 6836)

INFO

Checks supported languages

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)
SerenityTherapyInstaller.exe (PID: 7124)
chcp.com (PID: 5324)
SerenityTherapyInstaller.exe (PID: 2364)
SerenityTherapyInstaller.exe (PID: 4744)

Create files in a temporary directory

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)
SerenityTherapyInstaller.exe (PID: 7124)

Reads the computer name

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)
SerenityTherapyInstaller.exe (PID: 7124)
SerenityTherapyInstaller.exe (PID: 4744)
SerenityTherapyInstaller.exe (PID: 2364)

Creates files or folders in the user directory

7a95214e7077d7324c0e8dc7d20f2a4e625bc0ac7e14b1446e37c47dff7eeb5b.exe (PID: 7068)
SerenityTherapyInstaller.exe (PID: 7124)

Reads Environment values

SerenityTherapyInstaller.exe (PID: 7124)

Manual execution by a user

SerenityTherapyInstaller.exe (PID: 7124)

Checks proxy server information

SerenityTherapyInstaller.exe (PID: 7124)
slui.exe (PID: 5228)

Reads the machine GUID from the registry

SerenityTherapyInstaller.exe (PID: 7124)

Reads CPU info

SerenityTherapyInstaller.exe (PID: 7124)

Reads the software policy settings

slui.exe (PID: 5228)

Threats

PID	Process	Class	Message
7124	SerenityTherapyInstaller.exe	Device Retrieving External IP Address Detected	ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)