File name:

CB-Keygen 3.2.exe

Full analysis: https://app.any.run/tasks/b15ada62-57db-4772-bb7a-ccb3cc884d53
Verdict: Malicious activity
Analysis date: March 01, 2025, 00:16:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

03EBA8A1A1ADB5337D8B43CCB6B554AF

SHA1:

114A86DEB1F51D36FA1398A16DC974DD98938A8F

SHA256:

916F8DFF7063ED6B1108E19E0F400F0969E7AE80F69F67C266E56F7055B92F2B

SSDEEP:

98304:Oyi35bgowHn0dteCCfLuhhVI+xDCnVR7ToG4a9rIeJAVxqakhi3ZxH/+AA6LA409:qpa+RB/r9n0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ChessBaseAdminTool.exe (PID: 6228)
      • ChessBaseAdminTool.exe (PID: 4180)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • CB-Keygen 3.2.exe (PID: 5072)
      • CB_KG.exe (PID: 5740)

    • The process drops C-runtime libraries

      • CB-Keygen 3.2.exe (PID: 5072)

    • Executable content was dropped or overwritten

      • CB-Keygen 3.2.exe (PID: 5072)
      • CB_KG.exe (PID: 5740)

    • Process drops legitimate windows executable

      • CB-Keygen 3.2.exe (PID: 5072)

    • There is functionality for taking screenshot (YARA)

      • CB-Keygen 3.2.exe (PID: 5072)
      • CB_KG.exe (PID: 5740)

  • INFO

    • Create files in a temporary directory

      • CB-Keygen 3.2.exe (PID: 5072)
      • CB_KG.exe (PID: 5740)

    • Process checks computer location settings

      • CB-Keygen 3.2.exe (PID: 5072)
      • CB_KG.exe (PID: 5740)

    • The sample compiled with english language support

      • CB-Keygen 3.2.exe (PID: 5072)

    • Checks supported languages

      • CB-Keygen 3.2.exe (PID: 5072)
      • CB_KG.exe (PID: 5740)
      • ChessBaseAdminTool.exe (PID: 6228)

    • Reads the computer name

      • CB-Keygen 3.2.exe (PID: 5072)
      • ChessBaseAdminTool.exe (PID: 6228)

    • Compiled with Borland Delphi (YARA)

      • CB_KG.exe (PID: 5740)

    • The sample compiled with german language support

      • CB_KG.exe (PID: 5740)

    • Reads the machine GUID from the registry

      • ChessBaseAdminTool.exe (PID: 6228)

    • Creates files in the program directory

      • ChessBaseAdminTool.exe (PID: 6228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 261632
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
5
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cb-keygen 3.2.exe cb_kg.exe sppextcomobj.exe no specs chessbaseadmintool.exe no specs chessbaseadmintool.exe

Process information

PID
CMD
Path
Indicators
Parent process
4180"C:\Users\admin\AppData\Local\Temp\RarSFX0\ChessBaseAdminTool.exe" /ActivationOffline "1678901504"C:\Users\admin\AppData\Local\Temp\RarSFX0\ChessBaseAdminTool.exe—CB_KG.exe
User:
admin
Company:
ChessBase GmbH
Integrity Level:
MEDIUM
Description:
ChessBase Admin Tool
Exit code:
3221226540
Version:
2, 0, 0, 3
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\chessbaseadmintool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5072"C:\Users\admin\AppData\Local\Temp\CB-Keygen 3.2.exe" C:\Users\admin\AppData\Local\Temp\CB-Keygen 3.2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\cb-keygen 3.2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
5740"C:\Users\admin\AppData\Local\Temp\RarSFX0\CB_KG.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\CB_KG.exe
CB-Keygen 3.2.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\syswow64\shlwapi.dll
c:\windows\syswow64\windows.storage.dll
c:\windows\syswow64\wldp.dll
c:\windows\syswow64\propsys.dll
c:\windows\syswow64\clbcatq.dll
c:\windows\syswow64\cfgmgr32.dll
c:\windows\syswow64\profapi.dll
c:\windows\syswow64\edputil.dll
c:\windows\syswow64\windows.staterepositoryps.dll
c:\windows\syswow64\urlmon.dll
6048C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
6228"C:\Users\admin\AppData\Local\Temp\RarSFX0\ChessBaseAdminTool.exe" /ActivationOffline "1678901504"C:\Users\admin\AppData\Local\Temp\RarSFX0\ChessBaseAdminTool.exe
CB_KG.exe
User:
admin
Company:
ChessBase GmbH
Integrity Level:
HIGH
Description:
ChessBase Admin Tool
Exit code:
0
Version:
2, 0, 0, 3
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\chessbaseadmintool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
884
Read events
884
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
1
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
5072CB-Keygen 3.2.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Messages\Deutsch\Countries.stringstext
MD5:E831412DB1A96BBA8BEFA223EF2849D6
SHA256:637829E1E9198E5ED1C6B6B2AB2D8E8FF7E9B0BD02005272FD56E6C48C093555
5072CB-Keygen 3.2.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\vcruntime140.dllexecutable
MD5:31CE620CB32AC950D31E019E67EFC638
SHA256:1E0F8F7F13502F5CEE17232E9BEBCA7B44DD6EC29F1842BB61033044C65B2BBF
5072CB-Keygen 3.2.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\SView3.dllexecutable
MD5:A04D243A7324084053A91F5B73A433D1
SHA256:5595FC73179F90D8ADFBC1FD82E57FEF9E6D17A0D992CC242C013FA8FB7F69D4
6228ChessBaseAdminTool.exeC:\ProgramData\ChessBase\ChssBaseCB.initext
MD5:5BEBF7F09E5D0E4C2988B5CD96DCF96C
SHA256:9957326981165272A35A2D554195D8FDC7D4D7F8A6617D564EFB8E6A60E1BEC7
6228ChessBaseAdminTool.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\0f5007522459c86e95ffcc62f32308f1_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:17011E7DB4379E83CD44DF33F3CD7982
SHA256:FE346C744FE79A7CC60B7F2F91A756A4B05590F31434898283A752B9DD6DB0DC
5740CB_KG.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\ChessBaseAdminTool.exeexecutable
MD5:154484EC3DF68A50ADAEEB122F33A2EB
SHA256:598B343954E8424FA9B69154046541F2D07185CE0C260C6CD713E1E4ED6ADCF9
5072CB-Keygen 3.2.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Messages\Deutsch\Frame.stringstext
MD5:FCDC77C0E15E65E130F9816F6BC81157
SHA256:240134ECA02DB1493C6195364833F2F0564E9AAD10F13B3A33AACC4F6B160338
5072CB-Keygen 3.2.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Messages\English\Countries.stringstext
MD5:90B850C19BDFDA9A852A786878B31CB0
SHA256:C52A78C82F7EEDD0CE5BE7BC678837496632C9DFD53A965E29F90D4367C8D211
5072CB-Keygen 3.2.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Messages\English\Frame.stringstext
MD5:DFF64D178593FB1EEC98072664F04268
SHA256:C304DF5ED37EE370E0920BED1A6E5DFB64C643E15CA684302EEBDEDADA05E117
5072CB-Keygen 3.2.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Messages\Countries.inctext
MD5:200710201C95F4E8A612299B132289DA
SHA256:A1FF5302B95A293433F77DB64B40F04A2BD6706521CF0A8702991D88378B015C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
23
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5344
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5344
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3008
backgroundTaskHost.exe
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted
2040
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5376
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.46
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.129
  • 40.126.31.3
  • 40.126.31.0
  • 20.190.159.4
  • 20.190.159.128
  • 20.190.159.71
  • 20.190.159.68
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.123
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CB-Keygen 3.2.exe