File name:

02344300_4

Full analysis: https://app.any.run/tasks/a7fc4b55-f93a-417d-a72d-aa88cc29644a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 17, 2020, 00:21:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A2609B28715F45077F44532B2197E531

SHA1:

F23F4434317B3183C2FCC6F1D0D2D71D2EF9B18B

SHA256:

A15DFD399C046105624CF121676C9CB5F8338549B542D2D5A6379DAD9805965A

SSDEEP:

49152:XgS2rnCKuDpxFfWb52OUTv++uCcEHymaG2AXWi4S93+0:wSgCjxFfWb52LPuCt2AQSB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • 02344300_4.exe (PID: 3476)
      • MsiExec.exe (PID: 4016)

    • Application was dropped or rewritten from another process

      • DRPROSetup.exe (PID: 2640)
      • machineid.exe (PID: 1680)
      • FighterSuiteService.exe (PID: 2176)
      • DRIVERfighter.exe (PID: 3008)
      • FighterSuiteService.exe (PID: 2868)
      • FighterSuiteService.exe (PID: 2468)
      • FightersTray.exe (PID: 1040)
      • DRIVERfighter.exe (PID: 2724)

    • Uses Microsoft Installer as loader

      • DRPROSetup.exe (PID: 2640)

    • Loads dropped or rewritten executable

      • FighterSuiteService.exe (PID: 2176)
      • FighterSuiteService.exe (PID: 2468)
      • FighterSuiteService.exe (PID: 2868)
      • DRIVERfighter.exe (PID: 3008)
      • FightersTray.exe (PID: 1040)
      • DRIVERfighter.exe (PID: 2724)

    • Loads the Task Scheduler DLL interface

      • DRIVERfighter.exe (PID: 3008)
      • DRIVERfighter.exe (PID: 2724)

    • Changes settings of System certificates

      • DRIVERfighter.exe (PID: 2724)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 02344300_4.exe (PID: 3476)
      • MsiExec.exe (PID: 4016)
      • MSIEXEC.EXE (PID: 3984)
      • msiexec.exe (PID: 1532)
      • FightersTray.exe (PID: 1040)

    • Drops a file that was compiled in debug mode

      • 02344300_4.exe (PID: 3476)
      • MsiExec.exe (PID: 4016)
      • msiexec.exe (PID: 1532)

    • Executed as Windows Service

      • vssvc.exe (PID: 3204)
      • FighterSuiteService.exe (PID: 2468)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 1532)

    • Creates files in the user directory

      • MsiExec.exe (PID: 2612)
      • DRIVERfighter.exe (PID: 3008)
      • DRIVERfighter.exe (PID: 2724)
      • FightersTray.exe (PID: 1040)
      • msiexec.exe (PID: 1532)

    • Creates files in the program directory

      • FighterSuiteService.exe (PID: 2176)
      • FighterSuiteService.exe (PID: 2468)
      • DRIVERfighter.exe (PID: 2724)

    • Creates files in the Windows directory

      • machineid.exe (PID: 1680)
      • DRIVERfighter.exe (PID: 3008)

    • Adds / modifies Windows certificates

      • DRIVERfighter.exe (PID: 2724)

    • Drops a file with too old compile date

      • msiexec.exe (PID: 1532)

  • INFO

    • Application launched itself

      • msiexec.exe (PID: 1532)
      • iexplore.exe (PID: 2420)

    • Searches for installed software

      • msiexec.exe (PID: 1532)

    • Creates files in the program directory

      • MsiExec.exe (PID: 4016)
      • MsiExec.exe (PID: 2612)
      • msiexec.exe (PID: 1532)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2612)
      • MsiExec.exe (PID: 4016)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3204)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 1532)

    • Creates a software uninstall entry

      • MsiExec.exe (PID: 2612)
      • msiexec.exe (PID: 1532)

    • Manual execution by user

      • FightersTray.exe (PID: 1040)
      • iexplore.exe (PID: 2420)

    • Changes internet zones settings

      • iexplore.exe (PID: 2420)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1796)
      • iexplore.exe (PID: 2420)

    • Creates files in the user directory

      • iexplore.exe (PID: 1796)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2420)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2420)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:02:23 11:41:07+01:00
PEType: PE32
LinkerVersion: 9
CodeSize: 191488
InitializedDataSize: 596992
UninitializedDataSize: -
EntryPoint: 0x1361a
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.2.15.0
ProductVersionNumber: 1.2.15.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: SPAMfighter ApS
LegalCopyright: Copyright (C) 2012 SPAMfighter ApS
FileVersion: 1.2.15
ProductVersion: 1.2.15
ProductName: DRIVERfighter
InternalName: DRIVERfighter Setup
OriginalFileName: DRIVERfighterSetup.exe
FileDescription: DRIVERfighter Installation Package

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 23-Feb-2019 10:41:07
Detected languages:
  • English - United States
Debug artifacts:
  • D:\Builds\Agent4\Sources\builds\Win32\Release\Reader.pdb
CompanyName: SPAMfighter ApS
LegalCopyright: Copyright (C) 2012 SPAMfighter ApS
FileVersion: 1.2.15
ProductVersion: 1.2.15
ProductName: DRIVERfighter
InternalName: DRIVERfighter Setup
OriginalFilename: DRIVERfighterSetup.exe
FileDescription: DRIVERfighter Installation Package

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 23-Feb-2019 10:41:07
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0002EA1E
0x0002EC00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62196
.rdata
0x00030000
0x0000A304
0x0000A400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.96614
.data
0x0003B000
0x00004888
0x00002A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.29694
.rsrc
0x00040000
0x0007E9D1
0x0007EA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.57992
.reloc
0x000BF000
0x0000630C
0x00006400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
3.68608

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.08302
521
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.37456
3752
Latin 1 / Western European
UNKNOWN
RT_ICON
3
5.89178
2216
Latin 1 / Western European
UNKNOWN
RT_ICON
4
5.48728
1736
Latin 1 / Western European
UNKNOWN
RT_ICON
5
3.98838
1384
Latin 1 / Western European
UNKNOWN
RT_ICON
6
5.49033
270376
Latin 1 / Western European
UNKNOWN
RT_ICON
7
5.623
67624
Latin 1 / Western European
UNKNOWN
RT_ICON
8
5.8406
38056
Latin 1 / Western European
UNKNOWN
RT_ICON
9
5.83017
21640
Latin 1 / Western European
UNKNOWN
RT_ICON
10
5.8084
16936
Latin 1 / Western European
UNKNOWN
RT_ICON

Imports

ADVAPI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
17
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start 02344300_4.exe drprosetup.exe no specs msiexec.exe msiexec.exe msiexec.exe vssvc.exe no specs msiexec.exe no specs fightersuiteservice.exe no specs fightersuiteservice.exe no specs fightersuiteservice.exe machineid.exe no specs driverfighter.exe no specs fighterstray.exe driverfighter.exe iexplore.exe iexplore.exe 02344300_4.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
892"C:\Users\admin\AppData\Local\Temp\02344300_4.exe" C:\Users\admin\AppData\Local\Temp\02344300_4.exe—explorer.exe
User:
admin
Company:
SPAMfighter ApS
Integrity Level:
MEDIUM
Description:
DRIVERfighter Installation Package
Exit code:
3221226540
Version:
1.2.15
Modules
Images
c:\users\admin\appdata\local\temp\02344300_4.exe
c:\systemroot\system32\ntdll.dll
1040"C:\Program Files\Fighters\Tray\FightersTray.exe" C:\Program Files\Fighters\Tray\FightersTray.exe
explorer.exe
User:
admin
Company:
SPAMfighter ApS
Integrity Level:
MEDIUM
Description:
FIGHTERtools Update Manager
Exit code:
0
Version:
4.0.278.0
Modules
Images
c:\program files\fighters\tray\fighterstray.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
1532C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1680machineid.exe {E9AD598C-A13B-4CE2-BC39-47C0D94C71F8}C:\Program Files\Fighters\machineid.exe—FighterSuiteService.exe
User:
SYSTEM
Company:
SPAMfighter ApS
Integrity Level:
SYSTEM
Description:
Machine ID Generation Tool
Exit code:
0
Version:
1.0.15.0
Modules
Images
c:\program files\fighters\machineid.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1796"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2420 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2176"C:\Program Files\Fighters\FighterSuiteService.exe" /installC:\Program Files\Fighters\FighterSuiteService.exe—MsiExec.exe
User:
admin
Company:
SPAMfighter ApS
Integrity Level:
HIGH
Description:
Fighter Suite Service
Exit code:
0
Version:
3.1.295.0
Modules
Images
c:\program files\fighters\fightersuiteservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2420"C:\Program Files\Internet Explorer\iexplore.exe" http://login.spamfighter.com/LoginSystem/GotoPage/?Login_Product=DVPRO&Login_Lang=EN-US&Login_UserID=83517230&Login_MachineID=1.1%3A9908f64b8f1a437fbeae6bead31c73c7-4.1%3A6e3aab7cb29bc9495dfde01272c66f39-dbcac5&Login_PartnerID=5&Goto_Page=WelcomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2468"C:\Program Files\Fighters\FighterSuiteService.exe"C:\Program Files\Fighters\FighterSuiteService.exe
services.exe
User:
SYSTEM
Company:
SPAMfighter ApS
Integrity Level:
SYSTEM
Description:
Fighter Suite Service
Exit code:
0
Version:
3.1.295.0
Modules
Images
c:\program files\fighters\fightersuiteservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2612C:\Windows\system32\MsiExec.exe -Embedding 0E5152244E34181CDC4227D97DB1CF51C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2640"C:\Users\admin\AppData\Local\Temp\DRF1608164507\DRPROSetup.exe" /V"/l*v \"C:\Users\admin\AppData\Local\Temp\DRPRO_msi.log.txt\" USER_BRAND_NAME=\"Fighters\" WEBINSTALLER=1"C:\Users\admin\AppData\Local\Temp\DRF1608164507\DRPROSetup.exe—02344300_4.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\drf1608164507\drprosetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
2 350
Read events
1 756
Write events
580
Delete events
14

Modification events

(PID) Process:(3476) 02344300_4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3476) 02344300_4.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3984) MSIEXEC.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3984) MSIEXEC.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3984) MSIEXEC.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3984) MSIEXEC.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A5000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(1532) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000005AE35AB00AD4D601FC050000E40B0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1532) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000005AE35AB00AD4D601FC050000E40B0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3204) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000005C1AB3B00AD4D601840C000014070000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3204) vssvc.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000005C1AB3B00AD4D601840C0000540B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
45
Suspicious files
86
Text files
934
Unknown types
59

Dropped files

PID
Process
Filename
Type
2640DRPROSetup.exeC:\Users\admin\AppData\Local\Temp\{3AB990FF-8D24-4430-9932-C20B13CE78D4}\Setup.INItext
MD5:—
SHA256:—
347602344300_4.exeC:\Users\admin\AppData\Local\Temp\DRF1608164507\DRPROSetup.exeexecutable
MD5:—
SHA256:—
2640DRPROSetup.exeC:\Users\admin\AppData\Local\Temp\{3AB990FF-8D24-4430-9932-C20B13CE78D4}\_ISMSIDEL.INItext
MD5:—
SHA256:—
2640DRPROSetup.exeC:\Users\admin\AppData\Local\Temp\{3AB990FF-8D24-4430-9932-C20B13CE78D4}\0x0402.initext
MD5:8846B9A3A28DF070A511988DCCC86F58
SHA256:5D3B6E8E93F00F45599C8EA292302EC94B317F0B00248071879CDE194BDBE6E3
2640DRPROSetup.exeC:\Users\admin\AppData\Local\Temp\{3AB990FF-8D24-4430-9932-C20B13CE78D4}\0x0408.initext
MD5:4D368F255C256FAA23D59172A4BA5CD3
SHA256:878BA297669CF123EAE71E771C4BCE0658C21DCE6D47D4F36D4294233E2C2C66
2640DRPROSetup.exeC:\Users\admin\AppData\Local\Temp\~7C7D.tmp —
MD5:—
SHA256:—
2640DRPROSetup.exeC:\Users\admin\AppData\Local\Temp\~7C7E.tmp —
MD5:—
SHA256:—
2640DRPROSetup.exeC:\Users\admin\AppData\Local\Temp\{3AB990FF-8D24-4430-9932-C20B13CE78D4}\0x0412.initext
MD5:EA1FE197FF8838CDF76D5EDF01772521
SHA256:26345F5CA9CD84F01847DFF88EA3C0E95114DE8F5E747C48FA98D95AD07B9DB3
3984MSIEXEC.EXEC:\Windows\Installer\MSI913D.tmp —
MD5:—
SHA256:—
2640DRPROSetup.exeC:\Users\admin\AppData\Local\Temp\{3AB990FF-8D24-4430-9932-C20B13CE78D4}\0x0407.initext
MD5:C19F30CAAA751082474E2153F5124693
SHA256:AB9B5B21487355C975C975E6BA88C1EB881E27657D5CAABE9CCB2EF8421D459E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
265
TCP/UDP connections
73
DNS requests
31
Threats
90

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3984
MSIEXEC.EXE
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/DRIVERfighter.msi
GB
executable
10.7 Mb
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/Notifi~1.cab
GB
compressed
136 Kb
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/Common~1.cab
GB
compressed
2.63 Kb
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/Common~2.cab
GB
compressed
1.48 Kb
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/SuiteC~1.cab
GB
compressed
302 Kb
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/MsgSys~1.cab
GB
compressed
316 Kb
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/Tray_T~1.cab
GB
compressed
1.03 Kb
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/Tray_C~1.cab
GB
compressed
416 b
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/Tray_M~1.cab
GB
compressed
5.38 Kb
malicious
1532
msiexec.exe
GET
200
51.124.128.217:80
http://download.spamfighter.com/DRIVERfighter/Web/1.2.15/Tray_e~1.cab
GB
compressed
506 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3984
MSIEXEC.EXE
51.124.128.217:80
download.spamfighter.com
Microsoft Corporation
GB
suspicious
1532
msiexec.exe
51.124.128.217:80
download.spamfighter.com
Microsoft Corporation
GB
suspicious
2468
FighterSuiteService.exe
51.144.56.51:80
update.spamfighter.com
Microsoft Corporation
NL
unknown
2468
FighterSuiteService.exe
51.124.128.217:80
download.spamfighter.com
Microsoft Corporation
GB
suspicious
1040
FightersTray.exe
51.144.56.51:80
update.spamfighter.com
Microsoft Corporation
NL
unknown
1040
FightersTray.exe
51.124.128.217:80
download.spamfighter.com
Microsoft Corporation
GB
suspicious
1796
iexplore.exe
51.144.56.51:80
update.spamfighter.com
Microsoft Corporation
NL
unknown
1796
iexplore.exe
151.139.128.14:80
ocsp.usertrust.com
Highwinds Network Group, Inc.
US
suspicious
1796
iexplore.exe
216.58.212.162:443
www.googleadservices.com
Google Inc.
US
whitelisted
1796
iexplore.exe
204.79.197.203:443
flex.msn.com
Microsoft Corporation
US
malicious

DNS requests

Domain
IP
Reputation
download.spamfighter.com
  • 51.124.128.217
malicious
update.spamfighter.com
  • 51.144.56.51
suspicious
download.dk.spamfighter.com
  • 51.124.128.217
malicious
login.spamfighter.com
  • 51.144.56.51
unknown
www.spamfighter.com
  • 51.144.56.51
unknown
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
fonts.googleapis.com
  • 64.233.162.95
whitelisted
use.fontawesome.com
  • 23.111.9.35
whitelisted
www.googleadservices.com
  • 216.58.212.162
whitelisted
flex.msn.com
  • 204.79.197.203
whitelisted

Threats

PID
Process
Class
Message
3984
MSIEXEC.EXE
Potential Corporate Privacy Violation
SUSPICIOUS [PTsecurity] Executable application_x-msi Download
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
1532
msiexec.exe
Misc activity
SUSPICIOUS [PTsecurity] Using msiexec.exe for Downloading non-MSI file
45 ETPRO signatures available at the full report
Process
Message
DRIVERfighter.exe
Begin logger initialization...
DRIVERfighter.exe
Initializing thread ID = 0xB88 - Context: DriverHiveEngine - entry point
DRIVERfighter.exe
Executable: C:\Program Files\Fighters\DRIVERfighter\DRIVERfighter.exe
DRIVERfighter.exe
Version: 1.0.12.15
DRIVERfighter.exe
Maximum filesize set to 4194304 bytes
DRIVERfighter.exe
ME not enabled
DRIVERfighter.exe
EL not enabled
DRIVERfighter.exe
End logger initialization
DRIVERfighter.exe
[2020-12-17 00:23:14:197] [dhEngineInit] Windows version: 6.1.7601 Platform: 2
DRIVERfighter.exe
[2020-12-17 00:23:14:206] [dhEngineInit] Default Locale ID: 1033
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
02344300_4