We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
29 January 2024, 13:01
Analysis environment:
Windows 7 Pro, build 7601, x86
MSDisplay_MultiDev_v1.0.0.18.0.exe
MD5:
F505CBCAB0670A376C866DE177A5C097
SHA1:
18DED789BC554FDA5941AA2707DF9A78DE44C7C5
SHA256:
7BE04791DF7CC79FC8427098BF9E3C11206E54D2D613D470E4B4D5855451E816
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis MSDisplay_MultiDev_v1.0.0.18.0.exe (MD5: F505CBCAB0670A376C866DE177A5C097) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Drops the executable file immediately after the start
MSDisplay_MultiDev_v1.0.0.18.0.exe (PID: 1392)
MSDisplay_MultiDev_v1.0.0.18.0.exe (PID: 668)
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
devcon.exe (PID: 3084)
drvinst.exe (PID: 2768)
drvinst.exe (PID: 3920)
devcon.exe (PID: 3880)
drvinst.exe (PID: 3700)
devcon.exe (PID: 3892)
drvinst.exe (PID: 1776)
drvinst.exe (PID: 2892)
Creates a writable file in the system directory
drvinst.exe (PID: 2768)
drvinst.exe (PID: 3920)
SUSPICIOUS
Executable content was dropped or overwritten
MSDisplay_MultiDev_v1.0.0.18.0.exe (PID: 668)
MSDisplay_MultiDev_v1.0.0.18.0.exe (PID: 1392)
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
devcon.exe (PID: 3084)
drvinst.exe (PID: 2768)
devcon.exe (PID: 3880)
drvinst.exe (PID: 3920)
drvinst.exe (PID: 1776)
drvinst.exe (PID: 2892)
drvinst.exe (PID: 3700)
devcon.exe (PID: 3892)
Reads the Windows owner or organization settings
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
The process drops C-runtime libraries
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
Process drops legitimate windows executable
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
Drops a system driver (possible attempt to evade defenses)
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
devcon.exe (PID: 3084)
drvinst.exe (PID: 2768)
devcon.exe (PID: 3880)
drvinst.exe (PID: 3920)
drvinst.exe (PID: 3700)
devcon.exe (PID: 3892)
drvinst.exe (PID: 1776)
drvinst.exe (PID: 2892)
Creates files in the driver directory
drvinst.exe (PID: 2768)
drvinst.exe (PID: 3920)
Checks Windows Trust Settings
drvinst.exe (PID: 2768)
devcon.exe (PID: 3880)
drvinst.exe (PID: 3920)
drvinst.exe (PID: 3700)
Reads settings of System Certificates
rundll32.exe (PID: 3376)
devcon.exe (PID: 3880)
Reads security settings of Internet Explorer
devcon.exe (PID: 3880)
INFO
Checks supported languages
MSDisplay_MultiDev_v1.0.0.18.0.exe (PID: 1392)
MSDisplay_MultiDev_v1.0.0.18.0.exe (PID: 668)
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 1588)
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
drvinst.exe (PID: 2768)
devcon.exe (PID: 3084)
devcon.exe (PID: 3880)
drvinst.exe (PID: 3920)
drvinst.exe (PID: 3700)
Create files in a temporary directory
MSDisplay_MultiDev_v1.0.0.18.0.exe (PID: 1392)
MSDisplay_MultiDev_v1.0.0.18.0.exe (PID: 668)
devcon.exe (PID: 3084)
devcon.exe (PID: 3880)
Reads the computer name
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 1588)
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
devcon.exe (PID: 3084)
drvinst.exe (PID: 2768)
drvinst.exe (PID: 3920)
drvinst.exe (PID: 3700)
devcon.exe (PID: 3880)
Creates files in the program directory
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
Creates files or folders in the user directory
MSDisplay_MultiDev_v1.0.0.18.0.tmp (PID: 2380)
Reads the machine GUID from the registry
devcon.exe (PID: 3084)
drvinst.exe (PID: 2768)
devcon.exe (PID: 3880)
drvinst.exe (PID: 3920)
drvinst.exe (PID: 3700)
Adds/modifies Windows certificates
drvinst.exe (PID: 2768)
Reads security settings of Internet Explorer
rundll32.exe (PID: 3376)
Threats
No threats detected