| URL: | https://www.spacedesk.net/ |
| Full analysis: | https://app.any.run/tasks/c18183c7-461a-4a42-ac6f-e20a929421d9 |
| Verdict: | Malicious activity |
| Analysis date: | May 10, 2024, 14:56:20 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 0E100C7105E45F28152E83ED8867B8E7 |
| SHA1: | 5B98379F50187DAA2F28C3BCD8CB20B450147F8A |
| SHA256: | 870DA162DBC7B9E1A4A7E0223338FA4876920563266C17D0FF54A5992A8B3EE0 |
| SSDEEP: | 3:N8DSLq:2OLq |
MALICIOUS
Drops the executable file immediately after the start
- msiexec.exe (PID: 2452)
SUSPICIOUS
Executes as Windows Service
- VSSVC.exe (PID: 2904)
Checks Windows Trust Settings
- msiexec.exe (PID: 2452)
Reads the Windows owner or organization settings
- msiexec.exe (PID: 2452)
INFO
Manual execution by a user
- wmpnscfg.exe (PID: 1944)
- explorer.exe (PID: 2448)
- spacedeskWindowsVIEWER.exe (PID: 3928)
Reads the computer name
- wmpnscfg.exe (PID: 1944)
- msiexec.exe (PID: 2452)
- msiexec.exe (PID: 1248)
- spacedeskWindowsVIEWER.exe (PID: 3928)
Checks supported languages
- wmpnscfg.exe (PID: 1944)
- msiexec.exe (PID: 2452)
- msiexec.exe (PID: 1248)
- spacedeskWindowsVIEWER.exe (PID: 3928)
Application launched itself
- iexplore.exe (PID: 3968)
- msiexec.exe (PID: 2452)
Reads the software policy settings
- msiexec.exe (PID: 2516)
- msiexec.exe (PID: 2928)
- msiexec.exe (PID: 2452)
Reads security settings of Internet Explorer
- msiexec.exe (PID: 2516)
- msiexec.exe (PID: 2928)
Reads the machine GUID from the registry
- msiexec.exe (PID: 2452)
- msiexec.exe (PID: 1248)
Modifies the phishing filter of IE
- iexplore.exe (PID: 3968)
Executable content was dropped or overwritten
- iexplore.exe (PID: 2348)
- msiexec.exe (PID: 2928)
- msiexec.exe (PID: 2452)
The process uses the downloaded file
- iexplore.exe (PID: 3968)
Drops the executable file immediately after the start
- iexplore.exe (PID: 2348)
- msiexec.exe (PID: 2928)
Create files in a temporary directory
- msiexec.exe (PID: 2452)
Creates a software uninstall entry
- msiexec.exe (PID: 2452)
Creates files or folders in the user directory
- spacedeskWindowsVIEWER.exe (PID: 3928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
52
Monitored processes
11
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1248 | C:\Windows\system32\MsiExec.exe -Embedding 49F1248576913351A5D796A103AAF4DF C | C:\Windows\System32\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1944 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2348 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3968 CREDAT:3937549 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2448 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2452 | C:\Windows\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2516 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\spacedesk_driver_Win_10_64_v2116.msi" | C:\Windows\System32\msiexec.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 1633 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2904 | C:\Windows\system32\vssvc.exe | C:\Windows\System32\VSSVC.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Volume Shadow Copy Service Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2928 | "C:\Windows\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\spacedeskWindowsVIEWER_v0945_BETA.msi" | C:\Windows\System32\msiexec.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows® installer Exit code: 0 Version: 5.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3928 | "C:\Program Files\datronicsoft\spacedeskWindowsVIEWER\spacedeskWindowsVIEWER.exe" | C:\Program Files\datronicsoft\spacedeskWindowsVIEWER\spacedeskWindowsVIEWER.exe | explorer.exe | ||||||||||||
User: admin Company: datronicsoft Integrity Level: MEDIUM Description: spacedesk Windows VIEWER Exit code: 0 Version: 1.1.305.44 Modules
| |||||||||||||||
| 3968 | "C:\Program Files\Internet Explorer\iexplore.exe" "https://www.spacedesk.net/" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
Total events
47 372
Read events
46 923
Write events
390
Delete events
59
Modification events
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 31105770 | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 31105770 | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (3968) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
5
Suspicious files
50
Text files
45
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4036 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:D55FC7751C15DD205842690A6B6E3DDC | SHA256:D2761587A36B2702CD47E84C6D466BA4952426D62918623B1142071D8BF49B84 | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\502NLL25.htm | html | |
MD5:F9C614191CA4ABC64F958C28D037B8FE | SHA256:70EDB5AB09BD8194A3FF31AA3E185A63FB2A36CF1259F04627B847D7EF2C719E | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2AE4FBF97F1C5C0C9996A5111909F082 | binary | |
MD5:9BF97E238D813101169B4A6A1289C356 | SHA256:527F3F2D82C3466E3FD46C1BD7EBF7CA3A3539BE8CAA30838BED7781C55A6906 | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\slick[1].css | text | |
MD5:F38B2DB10E01B1572732A3191D538707 | SHA256:DE1E399B07289F3B0A8D35142E363E128124A1185770E214E25E58030DAD48E5 | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:A6DB28F1D8F797995E8185E15DC87AD0 | SHA256:E88FD4AA48F949F22BA726BCCFFA10DEF632E445653D1102115A0510B76E18C2 | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:822467B728B7A66B081C91795373789A | SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9 | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2AE4FBF97F1C5C0C9996A5111909F082 | binary | |
MD5:8E9DE693363CE2B2EBC92FB4EA2CF83B | SHA256:F7735A8F1A13C73A90C2F1E51DE045D97F529259E6BFA916D5A2D86C612AAA6F | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\de[1].png | image | |
MD5:F352B99440063710BAA4CF062AC7D674 | SHA256:BD40F381FC03E81B9A9D857CBCC5DF175334904674477CFF34582FD083219F0C | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\us[1].png | image | |
MD5:0CF0AC4E463765FA1F3D920B90F2DD6F | SHA256:84AB5136777906AFCE3BB0D794EF169983728CABF8B7C07F2932E7B9C37E33F4 | |||
| 4036 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\styles[1].css | text | |
MD5:38B318FAD41006902062E8F6E0628681 | SHA256:3F16108C331353F08C5EB4C2518F21081EB7C02B74F211B9D9B7320C7CCB5AFD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
35
DNS requests
25
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4036 | iexplore.exe | GET | 304 | 173.222.108.210:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?068eb670bb243701 | unknown | — | — | unknown |
4036 | iexplore.exe | GET | 304 | 173.222.108.147:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9d16a895bffb80f6 | unknown | — | — | unknown |
4036 | iexplore.exe | GET | 200 | 72.246.169.163:80 | http://x1.c.lencr.org/ | unknown | — | — | unknown |
4036 | iexplore.exe | GET | 200 | 23.63.84.154:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgRnEFH1FGThKNFA9q6C7RadMA%3D%3D | unknown | — | — | unknown |
3968 | iexplore.exe | GET | 304 | 173.222.108.147:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?375896791b56e52b | unknown | — | — | unknown |
4036 | iexplore.exe | GET | 200 | 104.18.38.233:80 | http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D | unknown | — | — | unknown |
4036 | iexplore.exe | GET | 200 | 104.18.38.233:80 | http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEF8F%2FqZJvbebCgyHDkP5Spk%3D | unknown | — | — | unknown |
3968 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D | unknown | — | — | unknown |
3968 | iexplore.exe | GET | 304 | 173.222.108.147:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a0d881e768a03905 | unknown | — | — | unknown |
1088 | svchost.exe | GET | 304 | 173.222.108.226:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?447844e0dd862571 | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4036 | iexplore.exe | 213.182.2.115:443 | www.spacedesk.net | IDKOM Networks GmbH | DE | unknown |
4036 | iexplore.exe | 173.222.108.210:80 | ctldl.windowsupdate.com | Akamai International B.V. | CH | unknown |
4036 | iexplore.exe | 173.222.108.147:80 | ctldl.windowsupdate.com | Akamai International B.V. | CH | unknown |
4036 | iexplore.exe | 72.246.169.163:80 | x1.c.lencr.org | AKAMAI-AS | DE | unknown |
4036 | iexplore.exe | 23.63.84.154:80 | r3.o.lencr.org | Akamai International B.V. | IN | unknown |
4036 | iexplore.exe | 88.217.191.218:443 | matomo.datronic.de | M-net Telekommunikations GmbH | DE | unknown |
4036 | iexplore.exe | 104.18.38.233:80 | ocsp.usertrust.com | CLOUDFLARENET | — | shared |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.spacedesk.net |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
matomo.datronic.de |
| unknown |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.usertrust.com |
| whitelisted |
ocsp.sectigo.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
Threats
Process | Message |
|---|---|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SASettings::SettingsOptionEnableGet SAUtilRegistryValueGet failed!
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SASettings::MenuAdvancedEnableGet SAUtilRegistryValueGet failed!
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SASettings::MenuAdvancedEnableGet SAUtilRegistryValueGet failed!
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SAWndCtrlTreeView::SetViewPosition SetViewPos failed! LastError 1400
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SAFstm::SAFstm Count states:7 Current state initial:0
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SASettings::SettingsMenuTouchGet SAUtilRegistryValueGet failed!
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SAUtilWindowsVersionCheck dwMajorVersion: 6 dwMinorVersion: 1
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SAMvcViewFrmDisplay::OnSize failed! NULL == m_pRenderer
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SASettings::SettingsOptionEnableGet SAUtilRegistryValueGet failed!
|
spacedeskWindowsVIEWER.exe | SA [3928:3932]:SASettings::SettingsOptionEnableGet SAUtilRegistryValueGet failed!
|