Malware analysis a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe Malicious activity

Add for printing

File name:	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe
Full analysis:	https://app.any.run/tasks/a407736c-26e3-4b4b-b459-767045d5598d
Verdict:	Malicious activity
Analysis date:	July 13, 2024, 15:36:51
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:	AEFAEBE48F578958C832F359D62406C1
SHA1:	DA6313C09DDBC2BB7EC5E0ACC8A0C9D49D5D0051
SHA256:	A5238E60CBE814A8021050DDEB4C9569EEA12CF8379D689E0CD84BB83A9B8266
SSDEEP:	393216:13+j4AZh6SYujeDsw3wBgZBVfR4TGcqMULE7Xo8In5w4pFtki614ywHrIlP:13+j7ZhRYujsbPVnc5UL+Inq43ykjcR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
  - genp.exe (PID: 3808)
- Actions looks like stealing of personal data
  - cmd.exe (PID: 3152)
SUSPICIOUS
- Malware-specific behavior (creating "System.dll" in Temp)
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
- The process creates files with name similar to system file names
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
- Process drops legitimate windows executable
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
  - genp.exe (PID: 3808)
- Drops 7-zip archiver for unpacking
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
- Reads security settings of Internet Explorer
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
- Executable content was dropped or overwritten
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
  - genp.exe (PID: 3808)
- Creates a software uninstall entry
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
- Application launched itself
  - genp.exe (PID: 3808)
- Starts CMD.EXE for commands execution
  - genp.exe (PID: 3808)
- The process drops C-runtime libraries
  - genp.exe (PID: 3808)
- Process drops python dynamic module
  - genp.exe (PID: 3808)
INFO
- Reads the computer name
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
  - genp.exe (PID: 3808)
  - genp.exe (PID: 2992)
  - genp.exe (PID: 6216)
- Checks supported languages
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
  - genp.exe (PID: 3808)
  - genp.exe (PID: 2992)
  - genp.exe (PID: 6216)
- Create files in a temporary directory
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
  - genp.exe (PID: 3808)
- Creates files or folders in the user directory
  - a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe (PID: 2128)
  - genp.exe (PID: 3808)
- Manual execution by a user
  - genp.exe (PID: 3808)
- Reads Environment values
  - genp.exe (PID: 3808)
- Reads product name
  - genp.exe (PID: 3808)
- Checks proxy server information
  - genp.exe (PID: 3808)
- Reads the software policy settings
  - slui.exe (PID: 7152)
- Process checks computer location settings
  - genp.exe (PID: 3808)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable MS Visual C++ (generic) (67.4)
.dll	\|	Win32 Dynamic Link Library (generic) (14.2)
.exe	\|	Win32 Executable (generic) (9.7)
.exe	\|	Generic Win/DOS Executable (4.3)
.exe	\|	DOS Executable Generic (4.3)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2018:01:30 03:58:52+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	26624
InitializedDataSize:	473088
UninitializedDataSize:	16384
EntryPoint:	0x338f
OSVersion:	4
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	1.0.0.0
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x0000
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Windows, Latin1
FileDescription:	Adobe-GenP
FileVersion:	1.0.0
LegalCopyright:	Copyright © 2024 genp
ProductName:	genp
ProductVersion:	1.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

145

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2128

"C:\Users\admin\AppData\Local\Temp\a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe"

C:\Users\admin\AppData\Local\Temp\a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

Adobe-GenP

Exit code:

Version:

1.0.0

Modules

Images
c:\users\admin\appdata\local\temp\a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

2556

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

2992

"C:\Users\admin\AppData\Local\Programs\genp\genp.exe" --type=gpu-process --field-trial-handle=1564,821718500632672469,12559025279710570603,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1276 /prefetch:2

C:\Users\admin\AppData\Local\Programs\genp\genp.exe

—

genp.exe

User:

admin

Company:

GitHub, Inc.

Integrity Level:

LOW

Description:

genp

Version:

1.0.0

Modules

Images
c:\users\admin\appdata\local\programs\genp\genp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

3152

C:\WINDOWS\system32\cmd.exe /d /s /c ""C:\Users\admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe"

C:\Windows\System32\cmd.exe

genp.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll

3808

"C:\Users\admin\AppData\Local\Programs\genp\genp.exe"

C:\Users\admin\AppData\Local\Programs\genp\genp.exe

explorer.exe

User:

admin

Company:

GitHub, Inc.

Integrity Level:

MEDIUM

Description:

genp

Version:

1.0.0

Modules

Images
c:\users\admin\appdata\local\programs\genp\genp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\combase.dll

6216

"C:\Users\admin\AppData\Local\Programs\genp\genp.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,821718500632672469,12559025279710570603,131072 --enable-features=WebComponentsV0Enabled --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2172 /prefetch:8

C:\Users\admin\AppData\Local\Programs\genp\genp.exe

—

genp.exe

User:

admin

Company:

GitHub, Inc.

Integrity Level:

MEDIUM

Description:

genp

Version:

1.0.0

Modules

Images
c:\users\admin\appdata\local\programs\genp\genp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6292

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Component Package Support Server

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\comppkgsrv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll

6892

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

7120

C:\WINDOWS\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\SppExtComObj.Exe

—

svchost.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

KMS Connection Broker

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll

7152

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

Add for printing

Total events

5 449

Read events

5 437

Write events

Delete events

Modification events


(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	InstallLocation
Value: C:\Users\admin\AppData\Local\Programs\genp
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	KeepShortcuts
Value: true
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	ShortcutName
Value: genp
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	DisplayName
Value: uninstaller
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	UninstallString
Value: "C:\Users\admin\AppData\Local\Programs\genp\Uninstall genp.exe" /currentuser
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	QuietUninstallString
Value: "C:\Users\admin\AppData\Local\Programs\genp\Uninstall genp.exe" /currentuser /S
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	DisplayVersion
Value: 1.0.0
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	DisplayIcon
Value: C:\Users\admin\AppData\Local\Programs\genp\uninstallerIcon.ico
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	NoModify
Value: 1
(PID) Process:	(2128) a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\7b478d44-4f6e-56a1-a650-4cd9601cd76e
Operation:	write	Name:	NoRepair
Value: 1

Add for printing

Executable files

137

Suspicious files

838

Text files

1 062

Unknown types

Dropped files

PID	Process	Filename		Type
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Temp\nsv1CA4.tmp\app-64.7z		—
		MD5:—	SHA256:—
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Programs\genp\icudtl.dat		—
		MD5:—	SHA256:—
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Programs\genp\LICENSES.chromium.html		—
		MD5:—	SHA256:—
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Temp\nsv1CA4.tmp\StdUtils.dll		executable
		MD5:33B4E69E7835E18B9437623367DD1787	SHA256:72D38EF115E71FC73DC5978987C583FC8C6B50FF12E4A5D30649A4D164A8B6AE
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Temp\nsv1CA4.tmp\nsis7z.dll		executable
		MD5:C6A070B3E68B292BB0EFC9B26E85E9CC	SHA256:66AC8BD1F273A73E17A3F31D6ADD739D3CB0330A6417FAEDA11A9CAE00B62D8B
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Temp\nsv1CA4.tmp\SpiderBanner.dll		executable
		MD5:17309E33B596BA3A5693B4D3E85CF8D7	SHA256:996A259E53CA18B89EC36D038C40148957C978C0FD600A268497D4C92F882A93
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Programs\genp\uninstallerIcon.ico		image
		MD5:8BB6E1FDFA73800A111DA6D61291966F	SHA256:77C0611EA80D584DA71DAE5DD266278CCF1647262CA496D7A593D8DF44D2D2B0
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Programs\genp\chrome_100_percent.pak		binary
		MD5:06BAF0AD34E0231BD76651203DBA8326	SHA256:5AE14147992A92548BCAD76867DD88CDFCDB69D951C8720920CCE6FB135E3189
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Programs\genp\chrome_200_percent.pak		binary
		MD5:57C27201E7CD33471DA7EC205FE9973C	SHA256:DD8146B2EE289E4D54A4A0F1FD3B2F61B979C6A2BAABA96A406D96C3F4FDB33B
2128	a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe	C:\Users\admin\AppData\Local\Temp\nsv1CA4.tmp\nsProcess.dll		executable
		MD5:F0438A894F3A7E01A4AAE8D1B5DD0289	SHA256:30C6C3DD3CC7FCEA6E6081CE821ADC7B2888542DAE30BF00E881C0A105EB4D11

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4656	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
2568	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6552	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
2340	svchost.exe	GET	200	23.48.23.143:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
6552	SIHClient.exe	GET	200	88.221.169.152:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
2340	svchost.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5236	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
3228	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
3040	OfficeClickToRun.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
2088	MoUsoCoreWorker.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
—	—	239.255.255.250:1900	—	—	—	whitelisted
—	—	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2340	svchost.exe	23.48.23.143:80	crl.microsoft.com	Akamai International B.V.	DE	unknown
2340	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	unknown
4656	SearchApp.exe	2.23.209.162:443	www.bing.com	Akamai International B.V.	GB	unknown
2088	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
google.com	142.250.186.46	whitelisted
settings-win.data.microsoft.com	51.124.78.146 20.73.194.208	whitelisted
crl.microsoft.com	23.48.23.143 23.48.23.156	whitelisted
www.microsoft.com	184.30.21.171 88.221.169.152	whitelisted
www.bing.com	2.23.209.162 2.23.209.156 2.23.209.135 2.23.209.141 2.23.209.140 2.23.209.161 2.23.209.173 2.23.209.149 2.23.209.150	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	20.190.159.73 20.190.159.64 20.190.159.0 20.190.159.2 40.126.31.71 40.126.31.67 20.190.159.68 40.126.31.73	whitelisted
rentry.co	172.67.75.40 104.26.3.16 104.26.2.16	unknown
cosmoplwnets.xyz	188.114.97.3 188.114.96.3	unknown
go.microsoft.com	184.28.89.167	whitelisted

Threats

PID	Process	Class	Message
3808	genp.exe	Misc activity	ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
2168	svchost.exe	Misc activity	ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)

Add for printing

No debug info

General Info

a5238e60cbe814a8021050ddeb4c9569eea12cf8379d689e0cd84bb83a9b8266.exe

AEFAEBE48F578958C832F359D62406C1

DA6313C09DDBC2BB7EC5E0ACC8A0C9D49D5D0051

A5238E60CBE814A8021050DDEB4C9569EEA12CF8379D689E0CD84BB83A9B8266

393216:13+j4AZh6SYujeDsw3wBgZBVfR4TGcqMULE7Xo8In5w4pFtki614ywHrIlP:13+j7ZhRYujsbPVnc5UL+Inq43ykjcR

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Actions looks like stealing of personal data

SUSPICIOUS

Malware-specific behavior (creating "System.dll" in Temp)

The process creates files with name similar to system file names

Process drops legitimate windows executable

Drops 7-zip archiver for unpacking

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

Creates a software uninstall entry

Application launched itself

Starts CMD.EXE for commands execution

The process drops C-runtime libraries

Process drops python dynamic module

INFO

Reads the computer name

Checks supported languages

Create files in a temporary directory

Creates files or folders in the user directory

Manual execution by a user

Reads Environment values

Reads product name

Checks proxy server information

Reads the software policy settings

Process checks computer location settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings