File name:

HelpDesk_781759823.exe

Full analysis: https://app.any.run/tasks/25cb74c2-c6b1-4f55-a168-a3a0e7f8d185
Verdict: Malicious activity
Analysis date: June 18, 2024, 20:24:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
remote
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

D69DBAEB804A196DD85411DF28E0993D

SHA1:

7122BCE6B915A647FECE89FA2945A7470CF1C1F4

SHA256:

9625488CA66EF479266CC174A3F74D42941A3500F1621201189174BEC43911C9

SSDEEP:

6144:Rh9bZWNe3vN/L6hf78+t6qEDNMCvNxLahb7r+t6kreCy:nWNGN2hf78+t6LDNXN4hb7r+t6YHy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • HelpDesk_781759823.exe (PID: 3532)

    • Drops the executable file immediately after the start

      • HelpDesk_781759823.exe (PID: 3532)

  • SUSPICIOUS

    • Reads the Internet Settings

      • HelpDesk_781759823.exe (PID: 3532)
      • Helpdesk.exe (PID: 2840)
      • RPCHDKillService.exe (PID: 3552)
      • RPCHelpDeskSuite.exe (PID: 3884)

    • Reads settings of System Certificates

      • HelpDesk_781759823.exe (PID: 3532)
      • RPCHelpDeskSuite.exe (PID: 3884)

    • Executable content was dropped or overwritten

      • HelpDesk_781759823.exe (PID: 3532)

    • Process drops legitimate windows executable

      • HelpDesk_781759823.exe (PID: 3532)

    • The process drops C-runtime libraries

      • HelpDesk_781759823.exe (PID: 3532)

    • The process creates files with name similar to system file names

      • HelpDesk_781759823.exe (PID: 3532)

    • Reads security settings of Internet Explorer

      • HelpDesk_781759823.exe (PID: 3532)
      • Helpdesk.exe (PID: 2840)
      • RPCHelpDeskSuite.exe (PID: 3884)
      • RPCHDKillService.exe (PID: 3552)

    • Starts CMD.EXE for commands execution

      • Helpdesk.exe (PID: 2840)
      • RPCHelpDeskSuite.exe (PID: 3884)
      • RPCHDKillService.exe (PID: 3552)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 996)
      • Helpdesk.exe (PID: 2840)

    • Executes as Windows Service

      • RPCHelpDeskServiceUAC.exe (PID: 3336)

    • Potential Corporate Privacy Violation

      • RPCHelpDeskSuite.exe (PID: 3884)

    • The process executes via Task Scheduler

      • RPCHDKillService.exe (PID: 3552)

    • Creates file in the systems drive root

      • RPCHDKillService.exe (PID: 3552)

  • INFO

    • Checks supported languages

      • HelpDesk_781759823.exe (PID: 3532)
      • Helpdesk.exe (PID: 2840)
      • RPCHelpDeskServiceUAC.exe (PID: 3336)
      • RPCHelpDeskSuite.exe (PID: 3884)
      • RPCFirewallHelpDesk.exe (PID: 2524)
      • RPCHDKillService.exe (PID: 3552)

    • Reads the machine GUID from the registry

      • HelpDesk_781759823.exe (PID: 3532)
      • Helpdesk.exe (PID: 2840)
      • RPCHelpDeskSuite.exe (PID: 3884)
      • RPCHDKillService.exe (PID: 3552)

    • Creates files in the program directory

      • HelpDesk_781759823.exe (PID: 3532)
      • Helpdesk.exe (PID: 2840)
      • RPCHDKillService.exe (PID: 3552)

    • Reads Environment values

      • HelpDesk_781759823.exe (PID: 3532)
      • RPCHelpDeskSuite.exe (PID: 3884)

    • Reads the computer name

      • HelpDesk_781759823.exe (PID: 3532)
      • Helpdesk.exe (PID: 2840)
      • RPCHelpDeskServiceUAC.exe (PID: 3336)
      • RPCHelpDeskSuite.exe (PID: 3884)
      • RPCFirewallHelpDesk.exe (PID: 2524)
      • RPCHDKillService.exe (PID: 3552)

    • Checks proxy server information

      • HelpDesk_781759823.exe (PID: 3532)
      • RPCHelpDeskSuite.exe (PID: 3884)

    • Create files in a temporary directory

      • HelpDesk_781759823.exe (PID: 3532)
      • Helpdesk.exe (PID: 2840)
      • RPCHelpDeskServiceUAC.exe (PID: 3336)
      • RPCHelpDeskSuite.exe (PID: 3884)
      • RPCHDKillService.exe (PID: 3552)

    • Reads the software policy settings

      • HelpDesk_781759823.exe (PID: 3532)
      • RPCHelpDeskSuite.exe (PID: 3884)

    • Disables trace logs

      • HelpDesk_781759823.exe (PID: 3532)
      • RPCHelpDeskSuite.exe (PID: 3884)

    • Creates files or folders in the user directory

      • HelpDesk_781759823.exe (PID: 3532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:07 07:55:27+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 214016
InitializedDataSize: 153088
UninitializedDataSize: -
EntryPoint: 0x362ea
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: HelpDeskInstaller
FileVersion: 1.0.0.0
InternalName: HelpDeskInstaller.exe
LegalCopyright: Copyright © 2019
LegalTrademarks: -
OriginalFileName: HelpDeskInstaller.exe
ProductName: HelpDeskInstaller
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
16
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start helpdesk_781759823.exe helpdesk.exe no specs helpdesk.exe cmd.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs rpchelpdeskserviceuac.exe no specs rpchelpdesksuite.exe rpcfirewallhelpdesk.exe no specs cmd.exe no specs choice.exe no specs schtasks.exe no specs rpchdkillservice.exe no specs cmd.exe no specs choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
996"cmd" /c SC delete "HelpDeskService"C:\Windows\System32\cmd.exe—Helpdesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1060
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1952SC delete "HelpDeskService"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2420"sc.exe" Create HelpDeskService binPath= "C:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\RPCHelpDeskServiceUAC.exe" displayName= "HelpDeskService" start= "auto" C:\Windows\System32\sc.exe—Helpdesk.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2520choice /C Y /N /D Y /T 20 C:\Windows\System32\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
2524"C:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\RPCFirewallHelpDesk.exe" 1 C:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDeskC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\RPCFirewallHelpDesk.exe—Helpdesk.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\helpdesk\6h\helpdesk\rpcfirewallhelpdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2532schtasks /RUN /TN KillHelpDeskServiceC:\Windows\System32\schtasks.exe—RPCHelpDeskServiceUAC.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2692"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 1 & Del /s /q C:\ProgramData\HelpDeskHostC:\Windows\System32\cmd.exe—RPCHDKillService.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2840"C:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\HelpDesk.exe" C:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\Helpdesk.exe
HelpDesk_781759823.exe
User:
admin
Integrity Level:
HIGH
Description:
RPCOTA
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\helpdesk\6h\helpdesk\helpdesk.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2960"C:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\HelpDesk.exe" C:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\Helpdesk.exe—HelpDesk_781759823.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RPCOTA
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\helpdesk\6h\helpdesk\helpdesk.exe
c:\windows\system32\ntdll.dll
3336C:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\RPCHelpDeskServiceUAC.exeC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\RPCHelpDeskServiceUAC.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\helpdesk\6h\helpdesk\rpchelpdeskserviceuac.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
20 760
Read events
20 658
Write events
92
Delete events
10

Modification events

(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
HelpDesk_781759823.exe
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3532) HelpDesk_781759823.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\HelpDesk_781759823_RASMANCS
Operation:writeName:FileTracingMask
Value:
Executable files
135
Suspicious files
6
Text files
14
Unknown types
1

Dropped files

PID
Process
Filename
Type
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\TarECED.tmpbinary
MD5:4EA6026CF93EC6338144661BF1202CD1
SHA256:8EFBC21559EF8B1BCF526800D8070BAAD42474CE7198E26FA771DBB41A76B1D8
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\avformat-58.dllexecutable
MD5:3EE884E7E5C4A69BE3736566D7C40875
SHA256:8710497AEB719E9CE41C556BFC768C517E43EA85C8A156FD252D140EDDB1290C
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\aw_sas32.dllexecutable
MD5:2946A6E8C23C641011CD9A6BAA2B954D
SHA256:3CBFAFDB1C929DAA5849766381E0DCA5FA0AF5FAA8D8134878FA4BF49F9D4D52
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\AdminAuthorization.exeexecutable
MD5:095CA94E609F00503A3143A11101DF9F
SHA256:EE7D8FB8E5B5A36F14C77836EA329C7FE181B61EBB77C699318F52DE4644A806
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\CabECDD.tmpcompressed
MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
SHA256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\HelpDesk_1.0.0.zipcompressed
MD5:4B8079150C8CD9A5AB3DD04286A2EEFC
SHA256:EFC91A763E70C92B69201A45C0FBC115030B9E5ABBE898E0D7F570AB3665704E
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\arial.ttfbinary
MD5:5995C725CA5A13BE62D3DC75C2FC59FC
SHA256:413C78F91BD39E134F3C0BB204B1D5A90F29DF9EFDDC8FD26950A178058D5D74
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\CbtHook.dllexecutable
MD5:7C888914EE230BE6075F0D0BE9647C1D
SHA256:13452B2383E4EFCD0B727A6408B11C0F52C25B81228D4989C38669BA0FCF5C44
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\avutil-56.dllexecutable
MD5:927EED1FE18623381604F7784F56456B
SHA256:45C4CB13FCDD475969CEBF84F6A70FF58E201FA9BD090F24A99AF09F2F63ED58
3532HelpDesk_781759823.exeC:\Users\admin\AppData\Local\Temp\HelpDesk\6h\HelpDesk\de\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:6B3A079036B11C439110766F0D004B59
SHA256:4546FEF3A118127643CCA4E6A00E223EA61C05A12AC3D7D604FF88325D28DE65
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
8
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3532
HelpDesk_781759823.exe
GET
200
23.50.131.209:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1bc38c26a0800cc8
unknown
—
—
unknown
1060
svchost.exe
GET
304
23.50.131.213:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a9f83325acc8ca75
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3532
HelpDesk_781759823.exe
104.22.40.86:443
static.remotepc.com
CLOUDFLARENET
—
unknown
3532
HelpDesk_781759823.exe
23.50.131.209:80
—
Akamai International B.V.
DE
unknown
3884
RPCHelpDeskSuite.exe
64.90.202.200:443
web1.remotepc.com
ASN-VINS
US
unknown
1060
svchost.exe
23.50.131.213:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
static.remotepc.com
  • 104.22.40.86
  • 172.67.37.123
  • 104.22.41.86
unknown
web1.remotepc.com
  • 64.90.202.200
unknown
ctldl.windowsupdate.com
  • 23.50.131.213
  • 23.50.131.223
  • 23.50.131.196
  • 23.50.131.199
  • 23.50.131.215
  • 23.50.131.217
  • 23.50.131.220
  • 23.50.131.221
  • 23.50.131.222
whitelisted

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HelpDesk_781759823.exe