Malware analysis 2024091122installer.exe Malicious activity

Add for printing

File name:	2024091122installer.exe
Full analysis:	https://app.any.run/tasks/6ca5d9b6-325b-4a9d-b04a-5ca21e59f1db
Verdict:	Malicious activity
Analysis date:	September 14, 2024, 01:20:31
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	xor-url generic
Indicators:
MIME:	application/x-dosexec
File info:	PE32+ executable (GUI) x86-64, for MS Windows
MD5:	696685F45CF3EBEDB070BC81DC41D544
SHA1:	4DA949EC37B7BBB6A530B38CAE9A7995461398E7
SHA256:	80F3C5FE7DD70D9DD53688568284B39C3640E728C6E38C18ABC48673F37A630C
SSDEEP:	98304:RwOW3/q23OCmhRnd0sdO1yhGLvDFOhjd/NWaCNpA6eEiBD66N8kCsEfpyh7y38+r:35vc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Runs injected code in another process
  - XXEmulator.exe (PID: 5468)
- Application was injected by another process
  - svchost.exe (PID: 1316)
- XORed URL has been found (YARA)
  - Taskmgr.exe (PID: 7040)
  - svchost.exe (PID: 7004)
  - dllhost.exe (PID: 5264)
SUSPICIOUS
- Executable content was dropped or overwritten
  - svchost.exe (PID: 4600)
- The process executes via Task Scheduler
  - XXEmulator.exe (PID: 5468)
  - svchost.exe (PID: 7004)
INFO
- Reads the computer name
  - 2024091122installer.exe (PID: 2092)
  - 2024091122installer.exe (PID: 4128)
  - XXEmulator.exe (PID: 6196)
  - XXEmulator.exe (PID: 5468)
- Checks supported languages
  - 2024091122installer.exe (PID: 2092)
  - 2024091122installer.exe (PID: 4128)
  - XXEmulator.exe (PID: 6196)
  - XXEmulator.exe (PID: 5468)
- Manual execution by a user
  - winver.exe (PID: 3316)
  - Taskmgr.exe (PID: 6172)
- Reads security settings of Internet Explorer
  - svchost.exe (PID: 4600)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic Win/DOS Executable (50)
.exe	\|	DOS Executable Generic (49.9)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2024:09:13 02:21:58+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	14
CodeSize:	5913088
InitializedDataSize:	1929216
UninitializedDataSize:	-
EntryPoint:	0x5729a8
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

145

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

964

C:\windows\system32\winver.exe

C:\Windows\System32\winver.exe

—

2024091122installer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Version Reporter Applet

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\winver.exe
c:\windows\system32\ntdll.dll

1316

C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\System32\svchost.exe

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

2092

"C:\Users\admin\AppData\Local\Temp\2024091122installer.exe"

C:\Users\admin\AppData\Local\Temp\2024091122installer.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\2024091122installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

3176

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

3316

C:\windows\system32\winver.exe

C:\Windows\System32\winver.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Version Reporter Applet

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\winver.exe
c:\windows\system32\ntdll.dll

4128

C:\Users\admin\AppData\Local\Temp\2024091122installer.exe

Taskmgr.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\2024091122installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

4248

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

4600

C:\WINDOWS\system32\svchost.exe -Install

C:\Windows\System32\svchost.exe

XXEmulator.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Host Process for Windows Services

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll

5264

C:\WINDOWS\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}

C:\Windows\System32\dllhost.exe

svchost.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

COM Surrogate

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

5468

"C:\Program Files\Windows Mail\XXEmulator.exe" -svc

C:\Program Files\Windows Mail\XXEmulator.exe

—

svchost.exe

User:

SYSTEM

Integrity Level:

SYSTEM

Exit code:

Modules

Images
c:\program files\windows mail\xxemulator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\windows mail\vulkan-1.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll

Add for printing

Total events

6 176

Read events

5 747

Write events

209

Delete events

220

Modification events


(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Microsoft Windows Mail
Operation:	write	Name:	SD
Value: 01000480B4000000C400000000000000140000000200A00007000000001018009F011F0001020000000000052000000020020000001014009F011F00010100000000000512000000001014008900120001010000000000050B0000000010140089001200010100000000000513000000001014008900120001010000000000051400000000101800FF011F000102000000000005200000002002000000001400890012000101000000000005120000000000000001020000000000052000000020020000010500000000000515000000AC8CF364854C30247ED94EAB01020000
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Microsoft Windows Mail
Operation:	write	Name:	Id
Value: {BA6A1369-AF8A-49F1-988D-C5743B75967E}
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Microsoft Windows Mail
Operation:	write	Name:	Index
Value: 1
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA6A1369-AF8A-49F1-988D-C5743B75967E}
Operation:	write	Name:	Path
Value: \Microsoft\Windows\Microsoft Windows Mail
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA6A1369-AF8A-49F1-988D-C5743B75967E}
Operation:	write	Name:	Hash
Value: 66C5EF9E15AE75B498450FB1D566F9884085C8379611069604B4400D0D716BFE
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA6A1369-AF8A-49F1-988D-C5743B75967E}
Operation:	write	Name:	Schema
Value: 65538
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA6A1369-AF8A-49F1-988D-C5743B75967E}
Operation:	delete value	Name:	Version
Value:
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA6A1369-AF8A-49F1-988D-C5743B75967E}
Operation:	delete value	Name:	Date
Value:
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA6A1369-AF8A-49F1-988D-C5743B75967E}
Operation:	delete value	Name:	SecurityDescriptor
Value:
(PID) Process:	(1316) svchost.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{BA6A1369-AF8A-49F1-988D-C5743B75967E}
Operation:	delete value	Name:	Source
Value:

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
1316	svchost.exe	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work		xml
		MD5:5FADF13CCFBDCC5DD728380F7A615B28	SHA256:FF1F73395F6B5B22D5FDA367521FE0DCC31FF252849B7FA85FA346B953A40451
4600	svchost.exe	C:\Program Files\Windows Mail\XXEmulator.exe		executable
		MD5:69F4A4E280A980F8B0D6E0F5AC366D09	SHA256:4E33EF9B71B1D2B369B790181E007D8FC38B7B10C8BEEFDB519737F531C75C5D
1316	svchost.exe	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work		xml
		MD5:C6086D02F8CE044F5FA07A98303DC7EB	SHA256:8901D9C9AEA465DA4EA7AA874610A90B8CF0A71EBA0E321CF9675FCEEE0B54A0
1316	svchost.exe	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work		xml
		MD5:4838EE953DAB2C7A1BF57E0C6620A79D	SHA256:22C798E00C4793749EAC39CFB6EA3DD75112FD4453A3706E839038A64504D45D
1316	svchost.exe	C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon		xml
		MD5:8CBC84881481158749FD559D1D305C46	SHA256:F4902BEF1E82CDAB34A23A43A7F15C0D1C0A0B86E5DD187CACB75E3DF4024153
4600	svchost.exe	C:\Program Files\Windows Mail\mimidump.bin		binary
		MD5:8902F38E6379EFD964181606661287C7	SHA256:7A702ACE7CEE151BFFA1CA898DBD5D94243E0B2AAEAD806AA96149CF3BF6AC28
1316	svchost.exe	C:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork		xml
		MD5:18E755C987BFC19E9243E2297F9E5973	SHA256:28A47DB050051049E35249EA57B389E3946003173806D02064ADFCC5F46E0880
1316	svchost.exe	C:\Windows\System32\Tasks\Microsoft\Windows\Microsoft Windows Mail		xml
		MD5:431A2E3B5B80EC9FCBA517AF12FCD84D	SHA256:BC0E3DC16DC98C01501496982F91377F3204383543471C98807CDFF7966C58FA
4600	svchost.exe	C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms		binary
		MD5:4005C7892645825FA7C4DE58567FE2F6	SHA256:B6264348F3EA7FD87B2BE5E87AE522B25D3314892535D48117C2F76E48D60251
1316	svchost.exe	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan		xml
		MD5:11954764DE4745B35A42219A7C5E2DCA	SHA256:997FCF971A38394C30D9E5CA0C6B36E782630E83B52D2664C56F1DEFBA54CB6C

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

112

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7056	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2660	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6356	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
6356	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
7056	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2120	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6224	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2092	2024091122installer.exe	103.235.47.188:80	www.baidu.com	Beijing Baidu Netcom Science and Technology Co., Ltd.	HK	whitelisted
4128	2024091122installer.exe	103.235.47.188:80	www.baidu.com	Beijing Baidu Netcom Science and Technology Co., Ltd.	HK	whitelisted
7004	svchost.exe	154.82.93.149:80	—	TERAEXCH	HK	unknown
7004	svchost.exe	154.82.93.149:8080	—	TERAEXCH	HK	unknown
7056	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146 20.73.194.208	whitelisted
google.com	142.250.186.78	whitelisted
www.baidu.com	103.235.47.188 103.235.46.96	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
login.live.com	40.126.31.69 20.190.159.2 40.126.31.73 20.190.159.4 20.190.159.75 20.190.159.71 20.190.159.23 40.126.31.67	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted
slscr.update.microsoft.com	20.114.59.183	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted

Threats

PID	Process	Class	Message
7004	svchost.exe	Generic Protocol Command Decode	SURICATA HTTP Request line incomplete

Add for printing

No debug info

General Info

2024091122installer.exe

696685F45CF3EBEDB070BC81DC41D544

4DA949EC37B7BBB6A530B38CAE9A7995461398E7

80F3C5FE7DD70D9DD53688568284B39C3640E728C6E38C18ABC48673F37A630C

98304:RwOW3/q23OCmhRnd0sdO1yhGLvDFOhjd/NWaCNpA6eEiBD66N8kCsEfpyh7y38+r:35vc

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Runs injected code in another process

Application was injected by another process

XORed URL has been found (YARA)

SUSPICIOUS

Executable content was dropped or overwritten

The process executes via Task Scheduler

INFO

Reads the computer name

Checks supported languages

Manual execution by a user

Reads security settings of Internet Explorer

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings