File name:

hr.exe

Full analysis: https://app.any.run/tasks/35ae9278-75c7-4bf4-b143-3153b714f3d9
Verdict: Malicious activity
Analysis date: October 27, 2023, 15:49:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4C7A12D97900295A87AC6B40B8EB0ACF

SHA1:

791E10364E6F212081626796005C9D81676B533B

SHA256:

980C163FCF9D9666EDDDEAF379A9E82E27607FD044783DC627BF3CFDE56149C0

SSDEEP:

98304:vFBz1CvLGXRweInoMBw0U9ZNoS4IOaHl+b/bSKvNTDgwhTcMnutMbZuIG+2jFKQo:cpX4ihK/ONS2R6jti

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3152)

    • Creates a writable file the system directory

      • msiexec.exe (PID: 3152)

    • Application was dropped or rewritten from another process

      • hrsrv.exe (PID: 2508)
      • hrsrv.exe (PID: 2312)
      • HDD Regenerator.exe (PID: 1620)
      • HDD Regenerator.exe (PID: 1588)
      • Shell.exe (PID: 2736)
      • HDD Regenerator.exe (PID: 3900)
      • HDD Regenerator.exe (PID: 1192)

    • Loads dropped or rewritten executable

      • hrsrv.exe (PID: 2508)
      • hrsrv.exe (PID: 2312)
      • Shell.exe (PID: 2736)
      • HDD Regenerator.exe (PID: 3900)

  • SUSPICIOUS

    • Adds/modifies Windows certificates

      • hr.exe (PID: 3268)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3944)
      • hrsrv.exe (PID: 2312)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3152)

    • The process creates files with name similar to system file names

      • msiexec.exe (PID: 3152)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 3152)

    • Application launched itself

      • HDD Regenerator.exe (PID: 1620)
      • HDD Regenerator.exe (PID: 1192)

    • Reads the BIOS version

      • HDD Regenerator.exe (PID: 1588)
      • HDD Regenerator.exe (PID: 3900)

    • Detected use of alternative data streams (AltDS)

      • HDD Regenerator.exe (PID: 1588)
      • HDD Regenerator.exe (PID: 3900)

    • Reads the Internet Settings

      • msiexec.exe (PID: 3336)

  • INFO

    • Reads the computer name

      • hr.exe (PID: 3268)
      • msiexec.exe (PID: 3152)
      • msiexec.exe (PID: 3336)
      • hrsrv.exe (PID: 2508)
      • hrsrv.exe (PID: 2312)
      • MSIF944.tmp (PID: 1912)
      • HDD Regenerator.exe (PID: 1588)
      • Shell.exe (PID: 2736)
      • HDD Regenerator.exe (PID: 3900)

    • Checks supported languages

      • hr.exe (PID: 3268)
      • msiexec.exe (PID: 3152)
      • msiexec.exe (PID: 3336)
      • hrsrv.exe (PID: 2508)
      • MSIF944.tmp (PID: 1912)
      • hrsrv.exe (PID: 2312)
      • HDD Regenerator.exe (PID: 1620)
      • Shell.exe (PID: 2736)
      • HDD Regenerator.exe (PID: 3900)
      • HDD Regenerator.exe (PID: 1588)
      • HDD Regenerator.exe (PID: 1192)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2608)

    • Creates files or folders in the user directory

      • hr.exe (PID: 3268)

    • Create files in a temporary directory

      • hr.exe (PID: 3268)
      • msiexec.exe (PID: 3152)

    • Application launched itself

      • msiexec.exe (PID: 3152)

    • Reads the machine GUID from the registry

      • hr.exe (PID: 3268)
      • msiexec.exe (PID: 3152)
      • msiexec.exe (PID: 3336)
      • HDD Regenerator.exe (PID: 1588)
      • HDD Regenerator.exe (PID: 3900)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 2608)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 3152)

    • Application was dropped or rewritten from another process

      • MSIF944.tmp (PID: 1912)

    • Creates files in the program directory

      • HDD Regenerator.exe (PID: 1588)
      • HDD Regenerator.exe (PID: 3900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (46.3)
.exe | Win64 Executable (generic) (41)
.exe | Win32 Executable (generic) (6.6)
.exe | Generic Win/DOS Executable (2.9)
.exe | DOS Executable Generic (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2008:08:05 12:42:57+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 434176
InitializedDataSize: 196608
UninitializedDataSize: -
EntryPoint: 0x37339
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 15.0.0.573
ProductVersionNumber: 15.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Abstradrome
FileDescription: Setup Launcher Unicode
FileVersion: 20.11.0011
InternalName: Setup
LegalCopyright: Copyright (C) 2008 Acresso Software Inc. and/or InstallShield Co. Inc. All Rights Reserved.
OriginalFileName: Setup.exe
ProductName: HDD Regenerator
ProductVersion: 20.11.0011
InternalBuildNumber: 81067
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start hr.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs vssvc.exe no specs hrsrv.exe no specs msif944.tmp no specs hrsrv.exe no specs hdd regenerator.exe hdd regenerator.exe no specs shell.exe no specs hdd regenerator.exe hdd regenerator.exe hr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1192"HDD Regenerator.exe"C:\Program Files\HDD Regenerator\HDD Regenerator.exe
hrsrv.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\hdd regenerator\hdd regenerator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
1372"C:\Users\admin\AppData\Local\Temp\hr.exe" C:\Users\admin\AppData\Local\Temp\hr.exe—explorer.exe
User:
admin
Company:
Abstradrome
Integrity Level:
MEDIUM
Description:
Setup Launcher Unicode
Exit code:
3221226540
Version:
20.11.0011
Modules
Images
c:\users\admin\appdata\local\temp\hr.exe
c:\windows\system32\ntdll.dll
1588"C:\Program Files\HDD Regenerator\HDD Regenerator.exe" quietregister DEMO, C569-2946-2468-AE8FC:\Program Files\HDD Regenerator\HDD Regenerator.exe—HDD Regenerator.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\hdd regenerator\hdd regenerator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
1620"C:\Program Files\HDD Regenerator\HDD Regenerator.exe" quietregister DEMO, C569-2946-2468-AE8FC:\Program Files\HDD Regenerator\HDD Regenerator.exe
msiexec.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\hdd regenerator\hdd regenerator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
1912"C:\Windows\Installer\MSIF944.tmp" start hddrsrvC:\Windows\Installer\MSIF944.tmp—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
5.1.2600.5755 (xpsp_sp3_gdr.090206-1234)
Modules
Images
c:\windows\installer\msif944.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2312"C:\Program Files\HDD Regenerator\hrsrv.exe"C:\Program Files\HDD Regenerator\hrsrv.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\hdd regenerator\hrsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\vcl160.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\rtl160.bpl
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
2508"C:\Program Files\HDD Regenerator\hrsrv.exe" /INSTALL /SILENTC:\Program Files\HDD Regenerator\hrsrv.exe—msiexec.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\hdd regenerator\hrsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\vcl160.bpl
c:\windows\system32\rtl160.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
2608MSIEXEC.EXE /i "C:\Users\admin\AppData\Local\Downloaded Installations\{00A298C5-38B7-4D2D-88E2-750670C3F204}\HDD Regenerator.msi" SETUPEXEDIR="C:\Users\admin\AppData\Local\Temp" SETUPEXENAME="hr.exe"C:\Windows\System32\msiexec.exe—hr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
2736"C:\Program Files\HDD Regenerator\Shell.exe" C:\Program Files\HDD Regenerator\Shell.exe—msiexec.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\hdd regenerator\shell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\rtl160.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3152C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
11 155
Read events
11 072
Write events
73
Delete events
10

Modification events

(PID) Process:(2608) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2608) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
Operation:writeName:Blob
Value:
090000000100000022000000302006082B06010505070303060A2B0601040182370A030406082B060105050703080F0000000100000014000000F45A0858C9CD920E647BAD539AB9F1CFC77F24CB030000000100000014000000E12DFB4B41D7D9C32B30514BAC1D81D8385E2D461D0000000100000010000000F919B9CCCE1E59C2E785F7DC2CCF6708140000000100000014000000DAED6474149C143CABDD99A9BD5B284D8B3CC9D86200000001000000200000006FFF78E400A70C11011CD85977C459FB5AF96A3DF0540820D0F4B8607875E58F0B000000010000002A0000005300650063007400690067006F0020002800550054004E0020004F0062006A0065006300740029000000190000000100000010000000E843AC3B52EC8C297FA948C9B1FB281920000000010000006A040000308204663082034EA003020102021044BE0C8B500024B411D3362DE0B35F1B300D06092A864886F70D0101050500308195310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311D301B0603550403131455544E2D5553455246697273742D4F626A656374301E170D3939303730393138333132305A170D3139303730393138343033365A308195310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311D301B0603550403131455544E2D5553455246697273742D4F626A65637430820122300D06092A864886F70D01010105000382010F003082010A0282010100CEAA813FA3A36178AA31005595119E270F1F1CDF3A9B826830C04A611DF12F0EFABE79F7A523EF55519684CDDBE3B96E3E31D80A2067C7F4D9BF94EB47043E02CE2AA25D870409F6309D188A97B2AA1CFC41D2A136CBFB3D91BAE7D97035FAE4E790C39BA39BD33CF5129977B1B709E068E61CB8F39463886A6AFE0B76C9BEF422E467B9AB1A5E77C18507DD0D6CBFEE06C7776A419EA70FD7FBEE9417B7FC85BEA4ABC41C31DDD7B6D1E4F0EFDF168FB25293D7A1D489A1072EBFE10112421E1AE1D89534DB647928FFBA2E11C2E5E85B9248FB470BC26CDAAD328341F3A5E54170FD65906DFAFA51C4F9BD962B19042CD36DA7DCF07F6F8365E26AAB8786750203010001A381AF3081AC300B0603551D0F0404030201C6300F0603551D130101FF040530030101FF301D0603551D0E04160414DAED6474149C143CABDD99A9BD5B284D8B3CC9D830420603551D1F043B30393037A035A0338631687474703A2F2F63726C2E7573657274727573742E636F6D2F55544E2D5553455246697273742D4F626A6563742E63726C30290603551D250422302006082B0601050507030306082B06010505070308060A2B0601040182370A0304300D06092A864886F70D01010505000382010100081F52B1374478DBFDCEB9DA959698AA556480B55A40DD21A5C5C1F35F2C4CC8475A69EAE8F03535F4D025F3C8A6A4874ABD1BB17308BDD4C3CAB635BB59867731CDA78014AE13EFFCB148F96B25252D51B62C6D45C198C88A565D3EEE434E3E6B278ED03A4B850B5FD3ED6AA775CBD15A872F3975135A72B002819FBEF00F845420626C69D4E14DC60D9943010D12968C789DBF50A2B144AA6ACF177ACF6F0FD4F824555FF0341649663E5046C96371383162B862B9F353AD6CB52BA212AA194F09DA5EE793C68E1408FEF0308018A086854DC87DD78B03FE6ED5F79D16AC922CA023E59C91521F94DF179473C3B3C1C17105200078BD13521DA83ECD001FC8
(PID) Process:(2608) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
Operation:writeName:Blob
Value:
040000000100000010000000A7F2E41606411150306B9CE3B49CB0C9190000000100000010000000E843AC3B52EC8C297FA948C9B1FB28190B000000010000002A0000005300650063007400690067006F0020002800550054004E0020004F0062006A00650063007400290000006200000001000000200000006FFF78E400A70C11011CD85977C459FB5AF96A3DF0540820D0F4B8607875E58F140000000100000014000000DAED6474149C143CABDD99A9BD5B284D8B3CC9D81D0000000100000010000000F919B9CCCE1E59C2E785F7DC2CCF6708030000000100000014000000E12DFB4B41D7D9C32B30514BAC1D81D8385E2D460F0000000100000014000000F45A0858C9CD920E647BAD539AB9F1CFC77F24CB090000000100000022000000302006082B06010505070303060A2B0601040182370A030406082B0601050507030820000000010000006A040000308204663082034EA003020102021044BE0C8B500024B411D3362DE0B35F1B300D06092A864886F70D0101050500308195310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311D301B0603550403131455544E2D5553455246697273742D4F626A656374301E170D3939303730393138333132305A170D3139303730393138343033365A308195310B3009060355040613025553310B3009060355040813025554311730150603550407130E53616C74204C616B652043697479311E301C060355040A131554686520555345525452555354204E6574776F726B3121301F060355040B1318687474703A2F2F7777772E7573657274727573742E636F6D311D301B0603550403131455544E2D5553455246697273742D4F626A65637430820122300D06092A864886F70D01010105000382010F003082010A0282010100CEAA813FA3A36178AA31005595119E270F1F1CDF3A9B826830C04A611DF12F0EFABE79F7A523EF55519684CDDBE3B96E3E31D80A2067C7F4D9BF94EB47043E02CE2AA25D870409F6309D188A97B2AA1CFC41D2A136CBFB3D91BAE7D97035FAE4E790C39BA39BD33CF5129977B1B709E068E61CB8F39463886A6AFE0B76C9BEF422E467B9AB1A5E77C18507DD0D6CBFEE06C7776A419EA70FD7FBEE9417B7FC85BEA4ABC41C31DDD7B6D1E4F0EFDF168FB25293D7A1D489A1072EBFE10112421E1AE1D89534DB647928FFBA2E11C2E5E85B9248FB470BC26CDAAD328341F3A5E54170FD65906DFAFA51C4F9BD962B19042CD36DA7DCF07F6F8365E26AAB8786750203010001A381AF3081AC300B0603551D0F0404030201C6300F0603551D130101FF040530030101FF301D0603551D0E04160414DAED6474149C143CABDD99A9BD5B284D8B3CC9D830420603551D1F043B30393037A035A0338631687474703A2F2F63726C2E7573657274727573742E636F6D2F55544E2D5553455246697273742D4F626A6563742E63726C30290603551D250422302006082B0601050507030306082B06010505070308060A2B0601040182370A0304300D06092A864886F70D01010505000382010100081F52B1374478DBFDCEB9DA959698AA556480B55A40DD21A5C5C1F35F2C4CC8475A69EAE8F03535F4D025F3C8A6A4874ABD1BB17308BDD4C3CAB635BB59867731CDA78014AE13EFFCB148F96B25252D51B62C6D45C198C88A565D3EEE434E3E6B278ED03A4B850B5FD3ED6AA775CBD15A872F3975135A72B002819FBEF00F845420626C69D4E14DC60D9943010D12968C789DBF50A2B144AA6ACF177ACF6F0FD4F824555FF0341649663E5046C96371383162B862B9F353AD6CB52BA212AA194F09DA5EE793C68E1408FEF0308018A086854DC87DD78B03FE6ED5F79D16AC922CA023E59C91521F94DF179473C3B3C1C17105200078BD13521DA83ECD001FC8
(PID) Process:(3152) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3152) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000F2B487BA16B0D901C80700002C0A0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3152) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
72
(PID) Process:(3152) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008C62D6BA16B0D901C80700002C0A0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3152) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3152) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Enter)
Value:
400000000000000064514ABC16B0D901C80700002C0A0000D4070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3152) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppAddInterestingComponents (Leave)
Value:
400000000000000034645DBC16B0D901C80700002C0A0000D4070000010000000000000000000000000000000000000000000000000000000000000000000000
Executable files
22
Suspicious files
18
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3268hr.exeC:\Users\admin\AppData\Local\Temp\_isB95F.tmp —
MD5:—
SHA256:—
3268hr.exeC:\Users\admin\AppData\Local\Temp\{27478BD2-40BB-4774-9637-9D838E55DCCB}\HDD Regenerator.msi —
MD5:—
SHA256:—
3268hr.exeC:\Users\admin\AppData\Local\Downloaded Installations\{00A298C5-38B7-4D2D-88E2-750670C3F204}\HDD Regenerator.msi —
MD5:—
SHA256:—
3152msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3152msiexec.exeC:\Windows\Installer\1ef059.msi —
MD5:—
SHA256:—
3152msiexec.exeC:\Program Files\HDD Regenerator\DSCK.TR —
MD5:—
SHA256:—
3152msiexec.exeC:\Program Files\HDD Regenerator\tt —
MD5:—
SHA256:—
3152msiexec.exeC:\Program Files\HDD Regenerator\st —
MD5:—
SHA256:—
3268hr.exeC:\Users\admin\AppData\Local\Temp\{27478BD2-40BB-4774-9637-9D838E55DCCB}\0x0409.initext
MD5:758747727E96A23C7C5A5BBB011656E4
SHA256:BAD3B2E854149DF9413F06E6C1C7B7C875545393877F59B59907F6B083CE5825
3268hr.exeC:\Users\admin\AppData\Local\Temp\_isBDA7.tmpbinary
MD5:6A02958842B312128FA07749CB5152D2
SHA256:FD2EBD5117A0ED30E31077451B1BECB7F4131D854F10517224795A03BACC816F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3900
HDD Regenerator.exe
GET
200
217.112.43.73:80
http://www.dposoft.net/vers/hr2011/jshy87sj
unknown
html
131 b
unknown
3900
HDD Regenerator.exe
GET
200
217.112.43.73:80
http://www.dposoft.net/vers/hr2011/jshy87sj?433536392D323934362D323436382D4145384640343735332D42313244
unknown
html
131 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3900
HDD Regenerator.exe
217.112.43.73:80
www.dposoft.net
ZAO Web Hosting
RU
unknown

DNS requests

Domain
IP
Reputation
www.dposoft.net
  • 217.112.43.73
unknown

Threats

No threats detected
Process
Message
HDD Regenerator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
HDD Regenerator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
HDD Regenerator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
HDD Regenerator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
HDD Regenerator.exe
%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hr.exe