Analysis date (UTC): 22 October 2023, 17:18Analysis environment: Windows 7 Pro, build 7601, x86

cpu-z_2.08-en.exe

MD5:579AD85EC10C4C5751FE4410F2C96AC6

SHA1:59ABDFA654EDA10922EF6F37A1B2B7A4F59085CC

SHA256:9B2C6C1AB49A5FEEBA0ED653E54449EE52E391E949F71939827751D88814C8F3

Analysis result

Threat level:Malicious activity

Full analysis:Analysis cpu-z_2.08-en.exe (MD5: 579AD85EC10C4C5751FE4410F2C96AC6) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

cpu-z_2.08-en.exe (PID: 1240)
cpu-z_2.08-en.tmp (PID: 604)
cpu-z_2.08-en.exe (PID: 2900)
cpuz.exe (PID: 2424)

Application was dropped or rewritten from another process

cpuz.exe (PID: 1588)
cpuz.exe (PID: 2424)

SUSPICIOUS

Reads the Windows owner or organization settings

cpu-z_2.08-en.tmp (PID: 604)

Start notepad (likely ransomware note)

cpu-z_2.08-en.tmp (PID: 2080)

Reads the Internet Settings

cpuz.exe (PID: 2424)

Reads settings of System Certificates

cpuz.exe (PID: 2424)

Drops a system driver (possible attempt to evade defenses)

cpuz.exe (PID: 2424)

Checks Windows Trust Settings

cpuz.exe (PID: 2424)

Reads security settings of Internet Explorer

cpuz.exe (PID: 2424)

INFO

Create files in a temporary directory

cpu-z_2.08-en.exe (PID: 2900)
cpu-z_2.08-en.exe (PID: 1240)
cpuz.exe (PID: 2424)

Checks supported languages

cpu-z_2.08-en.tmp (PID: 604)
cpu-z_2.08-en.exe (PID: 1240)
cpu-z_2.08-en.exe (PID: 2900)
cpu-z_2.08-en.tmp (PID: 2080)
cpuz.exe (PID: 2424)

Manual execution by a user

cpuz.exe (PID: 1588)
cpuz.exe (PID: 2424)

Application was dropped or rewritten from another process

cpu-z_2.08-en.tmp (PID: 2080)
cpu-z_2.08-en.tmp (PID: 604)

Reads the computer name

cpu-z_2.08-en.tmp (PID: 2080)
cpu-z_2.08-en.tmp (PID: 604)
cpuz.exe (PID: 2424)

Creates files in the program directory

cpu-z_2.08-en.tmp (PID: 604)

Checks proxy server information

cpuz.exe (PID: 2424)

Reads Environment values

cpuz.exe (PID: 2424)

Reads the machine GUID from the registry

cpuz.exe (PID: 2424)

Creates files or folders in the user directory

cpuz.exe (PID: 2424)

Threats

No threats detected