Malware analysis 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe Malicious activity

Add for printing

File name:	9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe
Full analysis:	https://app.any.run/tasks/040a00dc-a02c-4b42-b630-dfae2e9a624a
Verdict:	Malicious activity
Analysis date:	April 19, 2024, 11:26:47
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	mysql
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	D5F317DC88E71E133B8B4F547E7762A8
SHA1:	867E8E1790FAF642B680E84DC128BF51842A5350
SHA256:	9D694811B5C1915FCEBBE45352118CBFC22737E95ABA2C2ACC69667F7F7E7A34
SSDEEP:	49152:D08/Kjq2Pl1a1HyJjLDt1YKAjaQvFZvsSrNhImZU8Q/7I7JorpH0YEeZe4qC7Zoy:T1HydqFZLHI7I2t3XlLCSJg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
SUSPICIOUS
- Reads the date of Windows installation
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Reads security settings of Internet Explorer
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Connects to unusual port
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Start notepad (likely ransomware note)
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
INFO
- Reads the computer name
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Checks supported languages
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Process checks computer location settings
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Create files in a temporary directory
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Checks proxy server information
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Creates files or folders in the user directory
  - 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe (PID: 3252)
- Reads security settings of Internet Explorer
  - notepad.exe (PID: 236)
- Reads the software policy settings
  - slui.exe (PID: 2924)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Inno Setup installer (67.7)
.exe	\|	Win32 EXE PECompact compressed (generic) (25.6)
.exe	\|	Win32 Executable (generic) (2.7)
.exe	\|	Win16/32 Executable Delphi generic (1.2)
.exe	\|	Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2018:09:26 08:39:07+00:00
ImageFileCharacteristics:	Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	2898432
InitializedDataSize:	492544
UninitializedDataSize:	-
EntryPoint:	0x2c5690
OSVersion:	5
ImageVersion:	-
SubsystemVersion:	5
Subsystem:	Windows GUI
FileVersionNumber:	1.2.18.1
ProductVersionNumber:	1.2.18.1
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Ukrainian
CharacterSet:	Windows, Cyrillic
CompanyName:	softBOVformat
FileDescription:	Export of price lists
FileVersion:	1.2.18.1
InternalName:	Export of price lists
LegalCopyright:	-
LegalTrademarks:	-
OriginalFileName:	-
ProductName:	Export of price lists
ProductVersion:	1.0.0.0
Comments:	http://ttc.bovsoft.com/index.html#exporterpricelists

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

128

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

236

"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\help.txt

C:\Windows\SysWOW64\notepad.exe

—

9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Notepad

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll

1136

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

2924

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

3252

"C:\Users\admin\AppData\Local\Temp\9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe"

C:\Users\admin\AppData\Local\Temp\9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe

explorer.exe

User:

admin

Company:

softBOVformat

Integrity Level:

MEDIUM

Description:

Export of price lists

Version:

1.2.18.1

Modules

Images
c:\users\admin\appdata\local\temp\9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll

4132

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

Add for printing

Total events

5 245

Read events

5 232

Write events

Delete events

Modification events


(PID) Process:	(3252) 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithProgids
Operation:	write	Name:	txtfile
Value:
(PID) Process:	(3252) 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(3252) 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(3252) 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(3252) 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(3252) 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:	write	Name:	CachePrefix
Value:
(PID) Process:	(3252) 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:	write	Name:	CachePrefix
Value: Cookie:
(PID) Process:	(3252) 9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:	write	Name:	CachePrefix
Value: Visited:
(PID) Process:	(1136) slui.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:	write	Name:	@%SystemRoot%\System32\sppcomapi.dll,-3200
Value: Software Licensing

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3252	9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	C:\Users\admin\AppData\Local\Temp\ExporterPriceLists.ini		text
		MD5:ECAA88F7FA0BF610A5A26CF545DCD3AA	SHA256:F1945CD6C19E56B3C1C78943EF5EC18116907A4CA1EFC40A57D48AB1DB7ADFC5
3252	9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\versionhistoryforcreatorpricelist[1].txt		text
		MD5:4004F62F50B7BDA22F2772EE920D3E5C	SHA256:AE6FAEBA676FF84254D24365E5DBB75E2820B6DDD9E8AF1F545D8B9006769F1A
3252	9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	C:\Users\admin\AppData\Local\Temp\help.txt		text
		MD5:E36FF594BFB9E63C2D04AAD8A6C7015F	SHA256:E1FDA86D9AC7BE80FCAF61E73B3D81D40DB0958932120B94E7A7597734B00DA0

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7148	svchost.exe	GET	200	23.211.9.92:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	unknown
3252	9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	GET	—	51.75.19.11:80	http://ttc.bovsoft.com/download/versionhistoryforcreatorpricelist.txt	unknown	—	—	unknown
4104	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	unknown
5388	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D	unknown	—	—	unknown
3992	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	unknown
3992	SIHClient.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	unknown
2980	svchost.exe	GET	200	23.211.9.92:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl	unknown	—	—	unknown
2980	svchost.exe	GET	200	23.211.9.92:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl	unknown	—	—	unknown
2980	svchost.exe	GET	200	23.211.9.92:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl	unknown	—	—	unknown
2980	svchost.exe	GET	200	23.211.9.92:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	104.126.37.161:443	—	Akamai International B.V.	DE	unknown
—	—	104.126.37.131:443	—	Akamai International B.V.	DE	unknown
4	System	192.168.100.255:138	—	—	—	whitelisted
4008	svchost.exe	239.255.255.250:1900	—	—	—	unknown
7148	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3252	9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	51.75.19.11:3306	bovsoft.com	OVH SAS	FR	unknown
6972	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5152	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
7148	svchost.exe	23.211.9.92:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3252	9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	51.75.19.11:80	bovsoft.com	OVH SAS	FR	unknown

DNS requests

Domain	IP	Reputation
bovsoft.com	51.75.19.11	unknown
settings-win.data.microsoft.com	51.124.78.146 40.127.240.158	whitelisted
www.microsoft.com	23.211.9.92 95.101.149.131 88.221.125.143	whitelisted
ttc.bovsoft.com	51.75.19.11	unknown
client.wns.windows.com	40.113.103.199	whitelisted
login.live.com	20.190.159.75 40.126.31.73 40.126.31.71 20.190.159.2 20.190.159.73 20.190.159.68 40.126.31.69 20.190.159.23	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
r.bing.com	184.86.251.14 184.86.251.17 184.86.251.16 184.86.251.13 184.86.251.19 184.86.251.15 184.86.251.20 184.86.251.11 184.86.251.18	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	13.85.23.206	whitelisted

Threats

PID	Process	Class	Message
3252	9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe	Misc activity	INFO [ANY.RUN] Native Connection to External MySql Server

Add for printing

No debug info

General Info

9d694811b5c1915fcebbe45352118cbfc22737e95aba2c2acc69667f7f7e7a34.exe

D5F317DC88E71E133B8B4F547E7762A8

867E8E1790FAF642B680E84DC128BF51842A5350

9D694811B5C1915FCEBBE45352118CBFC22737E95ABA2C2ACC69667F7F7E7A34

49152:D08/Kjq2Pl1a1HyJjLDt1YKAjaQvFZvsSrNhImZU8Q/7I7JorpH0YEeZe4qC7Zoy:T1HydqFZLHI7I2t3XlLCSJg

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

SUSPICIOUS

Reads the date of Windows installation

Reads security settings of Internet Explorer

Connects to unusual port

Start notepad (likely ransomware note)

INFO

Reads the computer name

Checks supported languages

Process checks computer location settings

Create files in a temporary directory

Checks proxy server information

Creates files or folders in the user directory

Reads security settings of Internet Explorer

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings