analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

drfone_unlock_setup_full3372.exe

Full analysis: https://app.any.run/tasks/a4080a0f-4c7b-4635-8405-e9b1eab0737f
Verdict: Malicious activity
Analysis date: April 24, 2019, 03:55:49
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1F81B7B803327DC172690C5C5DA1E5FC

SHA1:

EB7C8DF1819538646EDA7D33507F4ED61A5C165D

SHA256:

96EDD981C62CCFEFE17CB47DFF8B73058DD3BD34F5A525E13F1AD6172425645A

SSDEEP:

12288:SMRfauvtHMxljmQ5rX+XbKNDkS8mWlWYwU0fClaLMkUtfvHB1+j1:lEmQ5ubKNDkS8m9Yw0WVUFvv+p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • NFWCHK.exe (PID: 3680)
      • devcon_x86.exe (PID: 2212)
      • devcon_x86.exe (PID: 2380)

    • Changes settings of System certificates

      • NFWCHk.exe (PID: 3924)
      • CertUtil.exe (PID: 4056)
      • CertUtil.exe (PID: 3380)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • drfone_unlock_setup_full3372.exe (PID: 3840)
      • drfone_unlock_full3372.exe (PID: 3872)
      • drfone_unlock_full3372.tmp (PID: 2644)
      • devcon_x86.exe (PID: 2380)
      • DrvInst.exe (PID: 4020)
      • DrFoneToolKit.exe (PID: 328)
      • WsAppService.exe (PID: 2968)
      • DrFoneUnlock.exe (PID: 3532)
      • DrFoneToolKit.tmp (PID: 2952)
      • DrFoneUnlock.tmp (PID: 3376)

    • Reads Windows owner or organization settings

      • NetFxLite.tmp (PID: 2992)
      • drfone_unlock_full3372.tmp (PID: 2644)
      • WAFSetup.tmp (PID: 3760)
      • DrFoneToolKit.tmp (PID: 2952)
      • DrFoneUnlock.tmp (PID: 3376)

    • Creates files in the Windows directory

      • drfone_unlock_full3372.tmp (PID: 2644)
      • NetFxLite.tmp (PID: 2992)
      • WAFSetup.tmp (PID: 3760)
      • DrvInst.exe (PID: 2124)
      • DrvInst.exe (PID: 4020)
      • InstallUtil.exe (PID: 3548)
      • CertUtil.exe (PID: 3380)
      • CertUtil.exe (PID: 4056)

    • Reads Internet Cache Settings

      • drfone_unlock_setup_full3372.exe (PID: 3840)
      • RegAsm.exe (PID: 3096)

    • Reads internet explorer settings

      • drfone_unlock_setup_full3372.exe (PID: 3840)

    • Low-level read access rights to disk partition

      • drfone_unlock_setup_full3372.exe (PID: 3840)

    • Reads the Windows organization settings

      • drfone_unlock_full3372.tmp (PID: 2644)
      • NetFxLite.tmp (PID: 2992)
      • WAFSetup.tmp (PID: 3760)
      • DrFoneToolKit.tmp (PID: 2952)
      • DrFoneUnlock.tmp (PID: 3376)

    • Adds / modifies Windows certificates

      • NFWCHk.exe (PID: 3924)

    • Creates files in the program directory

      • RegAsm.exe (PID: 2732)
      • RegAsm.exe (PID: 2380)
      • RegAsm.exe (PID: 3096)
      • WsAppService.exe (PID: 2968)
      • RegAsm.exe (PID: 3768)
      • InstallUtil.exe (PID: 3548)

    • Modifies the open verb of a shell class

      • RegAsm.exe (PID: 2380)

    • Creates COM task schedule object

      • RegAsm.exe (PID: 3096)
      • RegAsm.exe (PID: 2380)
      • RegAsm.exe (PID: 3768)

    • Reads Environment values

      • RegAsm.exe (PID: 3096)
      • WsAppService.exe (PID: 2968)

    • Creates or modifies windows services

      • WAFSetup.tmp (PID: 3760)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2124)
      • DrvInst.exe (PID: 4020)
      • CertUtil.exe (PID: 3380)
      • CertUtil.exe (PID: 4056)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 4020)
      • DrvInst.exe (PID: 2124)

    • Searches for installed software

      • RegAsm.exe (PID: 3096)
      • DrFoneToolKit.tmp (PID: 2952)
      • WsAppService.exe (PID: 2968)
      • DrFoneUnlock.tmp (PID: 3376)

  • INFO

    • Application was dropped or rewritten from another process

      • drfone_unlock_full3372.tmp (PID: 2644)
      • DrFoneUnlock.exe (PID: 3532)
      • DrFoneToolKit.tmp (PID: 2952)
      • DrFoneUnlock.tmp (PID: 3376)
      • NetFxLite.tmp (PID: 2992)

    • Loads dropped or rewritten executable

      • drfone_unlock_full3372.tmp (PID: 2644)

    • Creates a software uninstall entry

      • drfone_unlock_full3372.tmp (PID: 2644)

    • Dropped object may contain Bitcoin addresses

      • drfone_unlock_full3372.tmp (PID: 2644)

    • Creates files in the program directory

      • WAFSetup.tmp (PID: 3760)
      • drfone_unlock_full3372.tmp (PID: 2644)
      • DrFoneToolKit.tmp (PID: 2952)
      • DrFoneUnlock.tmp (PID: 3376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

ProductVersion: 9.6.3
ProductName: drfone
LegalCopyright: Copyright©2017 Wondershare. All rights reserved.
FileVersion: 2.0.10.2
FileDescription: drfone_setup_full3372.exe
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0017
ProductVersionNumber: 2.0.10.2
FileVersionNumber: 2.0.10.2
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x51205
UninitializedDataSize: -
InitializedDataSize: 534528
CodeSize: 451072
LinkerVersion: 9
PEType: PE32
TimeStamp: 2018:07:05 11:49:09+02:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
29
Malicious processes
10
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drfone_unlock_setup_full3372.exe no specs drfone_unlock_setup_full3372.exe nfwchk.exe no specs drfone_unlock_full3372.exe drfone_unlock_full3372.tmp netfxlite.exe no specs netfxlite.tmp no specs nfwchk.exe wafsetup.exe no specs wafsetup.tmp no specs regasm.exe no specs regasm.exe regasm.exe regasm.exe no specs regasm.exe regasm.exe no specs wsappservice.exe devcon_x86.exe drvinst.exe devcon_x86.exe no specs drvinst.exe no specs drfonetoolkit.exe drfonetoolkit.tmp regasm.exe no specs installutil.exe no specs certutil.exe no specs certutil.exe no specs drfoneunlock.exe drfoneunlock.tmp

Process information

PID
CMD
Path
Indicators
Parent process
3056"C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3372.exe" C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3372.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
drfone_setup_full3372.exe
Exit code:
3221226540
Version:
2.0.10.2
3840"C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3372.exe" C:\Users\admin\AppData\Local\Temp\drfone_unlock_setup_full3372.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
drfone_setup_full3372.exe
Version:
2.0.10.2
3680C:\Users\Public\Documents\Wondershare\NFWCHK.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exe—drfone_unlock_setup_full3372.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3872"C:\Users\Public\Documents\Wondershare\drfone_unlock_full3372.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-drfone.log" /installpath: "C:\Program Files\Wondershare\drfone\" /DIR="C:\Program Files\Wondershare\drfone\"C:\Users\Public\Documents\Wondershare\drfone_unlock_full3372.exe
drfone_unlock_setup_full3372.exe
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
dr.fone
Version:
9.9.8.41
2644"C:\Users\admin\AppData\Local\Temp\is-4CLAQ.tmp\drfone_unlock_full3372.tmp" /SL5="$8011C,57896865,134144,C:\Users\Public\Documents\Wondershare\drfone_unlock_full3372.exe" /VERYSILENT /NOPAGE /LANG=ENG /LOG="C:\Users\admin\AppData\Local\Temp\WAE-drfone.log" /installpath: "C:\Program Files\Wondershare\drfone\" /DIR="C:\Program Files\Wondershare\drfone\"C:\Users\admin\AppData\Local\Temp\is-4CLAQ.tmp\drfone_unlock_full3372.tmp
drfone_unlock_full3372.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
2320"C:\Users\admin\AppData\Local\Temp\is-89S86.tmp\NetFxLite.exe" /verysilent /NORESTARTC:\Users\admin\AppData\Local\Temp\is-89S86.tmp\NetFxLite.exe—drfone_unlock_full3372.tmp
User:
admin
Company:
© Wondershare Corporation. All rights reserved.
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 2.0 Client Profile Basic SP2
Exit code:
1
Version:
2.0.0.29
2992"C:\Users\admin\AppData\Local\Temp\is-OV99F.tmp\NetFxLite.tmp" /SL5="$20176,9653206,121344,C:\Users\admin\AppData\Local\Temp\is-89S86.tmp\NetFxLite.exe" /verysilent /NORESTARTC:\Users\admin\AppData\Local\Temp\is-OV99F.tmp\NetFxLite.tmp—NetFxLite.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
3924C:\Users\admin\AppData\Local\Temp\is-T06G4.tmp\NFWCHk.exeC:\Users\admin\AppData\Local\Temp\is-T06G4.tmp\NFWCHk.exe
NetFxLite.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
.NET Framework Checker
Exit code:
0
Version:
1.0.0.0
3300"C:\Program Files\Wondershare\drfone\WAFSetup.exe" /SP- /silent /VERYSILENT /CanUpdateC:\Program Files\Wondershare\drfone\WAFSetup.exe—drfone_unlock_full3372.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
Wondershare Passport
Exit code:
0
Version:
2.4.3.237
3760"C:\Users\admin\AppData\Local\Temp\is-9GV3Q.tmp\WAFSetup.tmp" /SL5="$30176,7547099,140288,C:\Program Files\Wondershare\drfone\WAFSetup.exe" /SP- /silent /VERYSILENT /CanUpdateC:\Users\admin\AppData\Local\Temp\is-9GV3Q.tmp\WAFSetup.tmp—WAFSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Total events
2 624
Read events
1 143
Write events
0
Delete events
0

Modification events

No data
Executable files
78
Suspicious files
26
Text files
64
Unknown types
30

Dropped files

PID
Process
Filename
Type
3840drfone_unlock_setup_full3372.exeC:\Users\Public\Documents\Wondershare\drfone_unlock_full3372.exe.~P2S —
MD5:—
SHA256:—
3840drfone_unlock_setup_full3372.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\3372-20181030143622[1].htm —
MD5:—
SHA256:—
3840drfone_unlock_setup_full3372.exeC:\Users\Public\Documents\Wondershare\drfone_unlock_full3372.exe —
MD5:—
SHA256:—
2644drfone_unlock_full3372.tmpC:\Program Files\Wondershare\drfone\is-QODBC.tmp —
MD5:—
SHA256:—
2644drfone_unlock_full3372.tmpC:\Program Files\Wondershare\drfone\is-7FNDK.tmp —
MD5:—
SHA256:—
2644drfone_unlock_full3372.tmpC:\Program Files\Wondershare\drfone\Library\CBS\is-47OK2.tmp —
MD5:—
SHA256:—
3840drfone_unlock_setup_full3372.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019042420190425\index.datdat
MD5:FAE47758DFE6B6EC4D7248B21FF7A219
SHA256:F4BAFF0B1E88ED4674CCDEA4A423496A7DE5E5B07B5A620AE09F959835C9103A
2644drfone_unlock_full3372.tmpC:\Program Files\Wondershare\drfone\Library\ADB\is-3KGSG.tmp —
MD5:—
SHA256:—
3840drfone_unlock_setup_full3372.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\2[1].pngimage
MD5:06FABB594A39343A71EB6ED318C04E59
SHA256:3CAAC7FF1CDD9A9CB1F1BB46A6FE36505C38416C5E4100ABFA0E3BCCCA148BE2
3840drfone_unlock_setup_full3372.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\3372-20181030143622[1].htmhtml
MD5:37D72454364E45C0ED026FFF120BF789
SHA256:290DB7BD605DE251FFED2EDB2A224FAA4A8656BDBE9DDF41D3F632072E7FD2F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
42
TCP/UDP connections
46
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3840
drfone_unlock_setup_full3372.exe
GET
—
2.16.186.83:80
http://download.wondershare.com/cbs_down/drfone_unlock_full3372.exe
unknown
—
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
GET
—
2.16.186.83:80
http://download.wondershare.com/cbs_down/drfone_unlock_full3372.exe
unknown
—
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
GET
—
2.16.186.83:80
http://download.wondershare.com/cbs_down/drfone_unlock_full3372.exe
unknown
—
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
GET
—
2.16.186.90:80
http://download.wondershare.com/cbs_down/drfone_unlock_full3372.exe
unknown
—
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
GET
—
2.16.186.83:80
http://download.wondershare.com/cbs_down/drfone_unlock_full3372.exe
unknown
—
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
HEAD
200
2.16.186.83:80
http://download.wondershare.com/cbs_down/drfone_unlock_full3372.exe
unknown
—
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
GET
—
63.159.217.165:80
http://dlinst.wondershare.com/player/style/orbit-1.3.0.css
US
—
—
suspicious
3840
drfone_unlock_setup_full3372.exe
GET
—
2.16.186.90:80
http://download.wondershare.com/cbs_down/drfone_unlock_full3372.exe
unknown
—
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
GET
—
2.16.186.90:80
http://download.wondershare.com/cbs_down/drfone_unlock_full3372.exe
unknown
—
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
GET
200
47.91.67.36:80
http://platform.wondershare.com/rest/v2/downloader/runtime/?client_sign={C4BA3647-0000-0QM0-0001-5254004A04AF}&product_id=3372
US
xml
1.54 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
47.91.67.36:80
platform.wondershare.com
Alibaba (China) Technology Co., Ltd.
US
suspicious
3840
drfone_unlock_setup_full3372.exe
2.16.186.83:80
download.wondershare.com
Akamai International B.V.
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
2.16.186.90:80
download.wondershare.com
Akamai International B.V.
—
whitelisted
3840
drfone_unlock_setup_full3372.exe
63.159.217.165:80
dlinst.wondershare.com
QUANTIL, INC
US
unknown
3924
NFWCHk.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3096
RegAsm.exe
203.130.48.150:80
was.wondershare.com
QUANTIL, INC
CN
unknown
2968
WsAppService.exe
63.159.217.174:80
was-stats.wondershare.com
QUANTIL, INC
US
suspicious
3096
RegAsm.exe
63.159.217.174:80
was-stats.wondershare.com
QUANTIL, INC
US
suspicious
2968
WsAppService.exe
203.130.48.150:80
was.wondershare.com
QUANTIL, INC
CN
unknown
2968
WsAppService.exe
208.67.222.222:53
—
OpenDNS, LLC
US
malicious

DNS requests

Domain
IP
Reputation
platform.wondershare.com
  • 47.91.67.36
suspicious
download.wondershare.com
  • 2.16.186.83
  • 2.16.186.90
  • 2.16.106.194
  • 2.16.106.224
  • 23.50.52.130
  • 23.50.52.128
whitelisted
dlinst.wondershare.com
  • 63.159.217.165
suspicious
www.download.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.10
  • 205.185.216.10
  • 205.185.216.42
whitelisted
us.wondershare.com
  • —
unknown
was.wondershare.com
  • 203.130.48.150
  • 203.130.48.151
unknown
was-stats.wondershare.com
  • 63.159.217.174
suspicious

Threats

PID
Process
Class
Message
3840
drfone_unlock_setup_full3372.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3840
drfone_unlock_setup_full3372.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3840
drfone_unlock_setup_full3372.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3840
drfone_unlock_setup_full3372.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3840
drfone_unlock_setup_full3372.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
Process
Message
RegAsm.exe
Program.InitApp 2.4.3.237: Start
RegAsm.exe
Load ClientSign:
RegAsm.exe
HttpRequestTask.OnWork URL: http://us.wondershare.com/interface.php?api_version=v3&appid=com.wondershare.waf&cs=%7BC4BA3647-0000-0QM0-0001-5254004A04AF%7D&id=245791cd-3d2c-44b9-89da-4376055e75be&iver=2.4.3.237&m=download&pid=1833&pver=2.4.3.237&start=1556078215&timestamp=1556078216&type=init&tz=1&key=47342D1BEE153385294760BDDB8A7F49&vc=2a9f5a435703dba0f6fe4fbe26c8338d
RegAsm.exe
Http Request Error: : System.Net.WebException: The remote name could not be resolved: 'us.wondershare.com' at System.Net.HttpWebRequest.GetResponse() at b0.a(Object A_0)
RegAsm.exe
NewClientSign: {C4BA3647-FBFF-0005-06E3-5254004A04AF}
RegAsm.exe
NewClientSign: {C4BA3647-FBFF-0005-06E3-5254004A04AF}
RegAsm.exe
Save ClientSign:{C4BA3647-FBFF-0005-06E3-5254004A04AF}
RegAsm.exe
Save ClientSign:{C4BA3647-FBFF-0005-06E3-5254004A04AF}
RegAsm.exe
HttpRequestTask.OnWork URL: http://us.wondershare.com/interface.php?api_version=v2&client_sign=%7BC4BA3647-FBFF-0005-06E3-5254004A04AF%7D&info=%5B%0D%0A%20%20%5B%0D%0A%20%20%20%201833%2C%0D%0A%20%20%20%20%222.4.3.237%22%0D%0A%20%20%5D%0D%0A%5D&m=download&type=DataPrivTotal&key=47342D1BEE153385294760BDDB8A7F49&vc=8003b0c9e05fc044916957279ed3f595
RegAsm.exe
Http Request Error: : System.Net.WebException: The remote name could not be resolved: 'us.wondershare.com' at System.Net.HttpWebRequest.GetResponse() at b0.a(Object A_0)
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
drfone_unlock_setup_full3372.exe