Analysis date (UTC): 24 August 2019, 20:52Analysis environment: Windows 7 Pro, build 7601, x86

MRPQTGv98.1.exe

MD5:43412619617A74B67EA734FA4C92CBC3

SHA1:FA52B9D52F36BD032DA207B2C8B7EB28198A1532

SHA256:9BF9CC8BB6106C9A8F1D104702BFF8089990EB344792941187D6281AE51CFF90

Analysis result

Threat level:Malicious activity

Full analysis:Analysis MRPQTGv98.1.exe (MD5: 43412619617A74B67EA734FA4C92CBC3) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

IsSSD.exe (PID: 3608)
BDTBT.exe (PID: 2656)
ChkValid.exe (PID: 3340)
ChkValid.exe (PID: 2404)
ChkValid.exe (PID: 2340)
ChkValid.exe (PID: 3020)
ChkValid.exe (PID: 3568)
ChkValid.exe (PID: 3888)
ChkValid.exe (PID: 3428)
Generic.exe (PID: 2640)
Generic.exe (PID: 4008)
Generic.exe (PID: 3740)
Generic.exe (PID: 3560)
Generic.exe (PID: 3448)
ChkValid.exe (PID: 2244)
Generic.exe (PID: 3204)
ChkValid.exe (PID: 2396)
ChkValid.exe (PID: 2060)
Generic.exe (PID: 3924)
Generic.exe (PID: 3680)
ChkValid.exe (PID: 2720)
ChkValid.exe (PID: 2956)
ChkValid.exe (PID: 3296)

Executes PowerShell scripts

cmd.exe (PID: 2516)

SUSPICIOUS

Executable content was dropped or overwritten

MRPQTGv98.1.exe (PID: 2336)
cmd.exe (PID: 3392)

Starts CMD.EXE for commands execution

MRPQTGv98.1.exe (PID: 2336)
cmd.exe (PID: 3392)
cmd.exe (PID: 2372)
cmd.exe (PID: 3932)
cmd.exe (PID: 2340)
cmd.exe (PID: 3368)
cmd.exe (PID: 3332)
cmd.exe (PID: 1260)
cmd.exe (PID: 3088)

Uses REG.EXE to modify Windows registry

cmd.exe (PID: 2128)
cmd.exe (PID: 2668)
cmd.exe (PID: 3940)
cmd.exe (PID: 4068)
cmd.exe (PID: 2776)
cmd.exe (PID: 3336)
cmd.exe (PID: 3808)
cmd.exe (PID: 3392)
cmd.exe (PID: 2772)
cmd.exe (PID: 2764)
cmd.exe (PID: 2776)
cmd.exe (PID: 2444)
cmd.exe (PID: 3140)
cmd.exe (PID: 4060)
cmd.exe (PID: 3988)
cmd.exe (PID: 3408)
cmd.exe (PID: 3488)
cmd.exe (PID: 2384)
cmd.exe (PID: 2852)
cmd.exe (PID: 3312)
cmd.exe (PID: 3844)
cmd.exe (PID: 3056)
cmd.exe (PID: 2440)
cmd.exe (PID: 3624)
cmd.exe (PID: 3752)
cmd.exe (PID: 3600)
cmd.exe (PID: 2264)
cmd.exe (PID: 3776)
cmd.exe (PID: 3668)
cmd.exe (PID: 2704)
cmd.exe (PID: 2596)
cmd.exe (PID: 3468)
cmd.exe (PID: 3536)
cmd.exe (PID: 3432)
cmd.exe (PID: 2260)
cmd.exe (PID: 3064)
cmd.exe (PID: 504)
cmd.exe (PID: 2840)
cmd.exe (PID: 2820)
cmd.exe (PID: 2436)
cmd.exe (PID: 2428)
cmd.exe (PID: 2980)
cmd.exe (PID: 4064)
cmd.exe (PID: 2836)
cmd.exe (PID: 4080)
cmd.exe (PID: 3500)
cmd.exe (PID: 3216)
cmd.exe (PID: 2300)
cmd.exe (PID: 3372)
cmd.exe (PID: 3076)
cmd.exe (PID: 2304)
cmd.exe (PID: 2952)
cmd.exe (PID: 3616)
cmd.exe (PID: 3896)
cmd.exe (PID: 3636)
cmd.exe (PID: 2724)
cmd.exe (PID: 2444)
cmd.exe (PID: 2992)
cmd.exe (PID: 3076)
cmd.exe (PID: 4024)
cmd.exe (PID: 3480)
cmd.exe (PID: 3028)
cmd.exe (PID: 1260)
cmd.exe (PID: 3324)
cmd.exe (PID: 4024)
cmd.exe (PID: 2796)
cmd.exe (PID: 2216)
cmd.exe (PID: 2780)
cmd.exe (PID: 3320)
cmd.exe (PID: 3548)
cmd.exe (PID: 3384)
cmd.exe (PID: 2808)
cmd.exe (PID: 3196)
cmd.exe (PID: 3008)
cmd.exe (PID: 3440)
cmd.exe (PID: 1428)
cmd.exe (PID: 2428)
cmd.exe (PID: 3728)
cmd.exe (PID: 2328)
cmd.exe (PID: 3864)
cmd.exe (PID: 2220)
cmd.exe (PID: 2616)
cmd.exe (PID: 2856)
cmd.exe (PID: 3716)
cmd.exe (PID: 3144)
cmd.exe (PID: 2520)
cmd.exe (PID: 2708)
cmd.exe (PID: 2368)
cmd.exe (PID: 3224)
cmd.exe (PID: 3692)
cmd.exe (PID: 2400)
cmd.exe (PID: 2948)
cmd.exe (PID: 2496)
cmd.exe (PID: 4008)

Uses WMIC.EXE to obtain a system information

cmd.exe (PID: 3392)
cmd.exe (PID: 2396)
cmd.exe (PID: 2300)
cmd.exe (PID: 2704)
cmd.exe (PID: 2420)
cmd.exe (PID: 2388)
cmd.exe (PID: 2604)
cmd.exe (PID: 3956)
cmd.exe (PID: 3676)
cmd.exe (PID: 2204)
cmd.exe (PID: 3960)
cmd.exe (PID: 2788)
cmd.exe (PID: 2252)
cmd.exe (PID: 3068)
cmd.exe (PID: 3236)
cmd.exe (PID: 3280)
cmd.exe (PID: 2288)
cmd.exe (PID: 3472)
cmd.exe (PID: 2124)
cmd.exe (PID: 1216)
cmd.exe (PID: 2840)
cmd.exe (PID: 2908)
cmd.exe (PID: 2552)
cmd.exe (PID: 3652)
cmd.exe (PID: 3408)
cmd.exe (PID: 3492)
cmd.exe (PID: 3564)
cmd.exe (PID: 3364)
cmd.exe (PID: 2904)
cmd.exe (PID: 3356)
cmd.exe (PID: 3000)
cmd.exe (PID: 3780)
cmd.exe (PID: 2720)
cmd.exe (PID: 1640)
cmd.exe (PID: 3552)
cmd.exe (PID: 3936)
cmd.exe (PID: 3656)
cmd.exe (PID: 2928)
cmd.exe (PID: 3992)
cmd.exe (PID: 3500)
cmd.exe (PID: 3884)
cmd.exe (PID: 1440)
cmd.exe (PID: 3496)
cmd.exe (PID: 3172)
cmd.exe (PID: 3624)
cmd.exe (PID: 4044)
cmd.exe (PID: 3584)
cmd.exe (PID: 2164)
cmd.exe (PID: 3648)
cmd.exe (PID: 3016)
cmd.exe (PID: 2580)
cmd.exe (PID: 2892)
cmd.exe (PID: 2632)
cmd.exe (PID: 1876)
cmd.exe (PID: 3292)
cmd.exe (PID: 3720)
cmd.exe (PID: 2588)
cmd.exe (PID: 2388)
cmd.exe (PID: 3520)
cmd.exe (PID: 3304)
cmd.exe (PID: 3568)
cmd.exe (PID: 704)
cmd.exe (PID: 3828)
cmd.exe (PID: 2224)
cmd.exe (PID: 2828)
cmd.exe (PID: 3072)
cmd.exe (PID: 3040)
cmd.exe (PID: 3688)
cmd.exe (PID: 2604)
cmd.exe (PID: 2944)
cmd.exe (PID: 4076)
cmd.exe (PID: 2484)
cmd.exe (PID: 4032)

Uses ATTRIB.EXE to modify file attributes

cmd.exe (PID: 3392)

Reads Environment values

reg.exe (PID: 3584)
reg.exe (PID: 3464)
reg.exe (PID: 2524)
reg.exe (PID: 2052)
reg.exe (PID: 3724)
reg.exe (PID: 3972)
reg.exe (PID: 2992)
reg.exe (PID: 2316)

Uses WMIC.EXE to obtain a list of AntiViruses

cmd.exe (PID: 3392)

Starts SC.EXE for service management

cmd.exe (PID: 3392)

Executes scripts

cmd.exe (PID: 3392)
cmd.exe (PID: 3456)
cmd.exe (PID: 2792)
cmd.exe (PID: 2736)
cmd.exe (PID: 3020)
cmd.exe (PID: 3744)
cmd.exe (PID: 2976)
cmd.exe (PID: 3700)

Uses WMIC.EXE to obtain a list of video controllers

cmd.exe (PID: 3392)
cmd.exe (PID: 3364)

Application launched itself

cmd.exe (PID: 3392)

Reads the BIOS version

reg.exe (PID: 3928)
reg.exe (PID: 3412)
reg.exe (PID: 3920)
reg.exe (PID: 3096)

Creates files in the user directory

powershell.exe (PID: 3432)

INFO

No info indicators.

Threats

No threats detected