File name:

OfficeTeam.Installer.dll

Full analysis: https://app.any.run/tasks/aac42598-1fa5-40b3-93a9-71c4e94a0a54
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: August 29, 2024, 12:48:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5:

EBFA0F0A9C1FE1FEEEA166A6FF933D0B

SHA1:

384F7D533EAF151CF99B1147AAE74BC0DEA5C487

SHA256:

A7BBFF68720A38C2491BB0886A84331D765C6F6ED29F5658A73A7664F28765AE

SSDEEP:

98304:hNo51dNZ/mBinOyhCszMuZwVNSl1EhnH2R6bx0BAMmG3xxBNm+M7:ozNxI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Actions looks like stealing of personal data

      • rundll32.exe (PID: 1480)
  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 1480)
    • Access to an unwanted program domain was detected

      • rundll32.exe (PID: 1480)
  • INFO

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 1480)
    • Checks proxy server information

      • rundll32.exe (PID: 1480)
    • Reads the software policy settings

      • rundll32.exe (PID: 1480)
    • Creates files or folders in the user directory

      • rundll32.exe (PID: 1480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:31 08:54:37+00:00
ImageFileCharacteristics: Executable, 32-bit, DLL
PEType: PE32
LinkerVersion: 14.16
CodeSize: 1778688
InitializedDataSize: 702976
UninitializedDataSize: -
EntryPoint: 0x64fb5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
119
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe

Process information

PID
CMD
Path
Indicators
Parent process
1480"C:\WINDOWS\SysWOW64\rundll32.exe" C:\Users\admin\AppData\Local\Temp\OfficeTeam.Installer.dll, #1C:\Windows\SysWOW64\rundll32.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
1 059
Read events
1 047
Write events
12
Delete events
0

Modification events

(PID) Process:(1480) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1480) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1480) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1480) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1480) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1480) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1480) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1480) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MINIE
Operation:writeName:LinksBandEnabled
Value:
1
Executable files
0
Suspicious files
11
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1480rundll32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475binary
MD5:07667D5AC5EA7AA040E1D5AD30F3BB2C
SHA256:C5CC8D8C022A78768D03F7ADB5954111342D48A99C5447838B26FEE09F558320
1480rundll32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CF14D1855652602540DFCFECD21854DB_0B0F0404F69AB9B4CB987F5770E5D618der
MD5:10D92194C33A16A1C5DB990D22804D3B
SHA256:81B89EA3C92EBE8C72A884A2D7A95288DADE7CE34B996F7653EC2E437E792DA0
1480rundll32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_786387CC77858B88BA3234B304062475der
MD5:7A18B513A1822DD01D511F081CAB682A
SHA256:3E626301C78890B0664DB4D9E757DA715312FB0F10179A6C91E1110ECD7775DA
1480rundll32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CF14D1855652602540DFCFECD21854DB_0B0F0404F69AB9B4CB987F5770E5D618binary
MD5:D6A192EF1A6D36F2E4D99D0841EE61BB
SHA256:39DB3EC15B5BCCCCE50420E084332EAD4D820082A7DDFCB4565E6D0C6A72EC89
1480rundll32.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Bookmarksbinary
MD5:E95C85AB2475DCFFF6E266D75D11082F
SHA256:63E775A9CFAFB8C320ABFDC01E72541643685A8B3E4BC6C437E806BC016D43C8
1480rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Bookmarksbinary
MD5:E95C85AB2475DCFFF6E266D75D11082F
SHA256:63E775A9CFAFB8C320ABFDC01E72541643685A8B3E4BC6C437E806BC016D43C8
1480rundll32.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferencesbinary
MD5:6F67B979487459CFFE3ED8DFD525A4CB
SHA256:F8305EC7A743894E33952CFA2074ADF3627D94BDB935D82B886076CC93AE1A48
1480rundll32.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\places.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1480rundll32.exeC:\Users\admin\Favorites\Bing.urlurl
MD5:B628FB120D306A9A72D65FAC0E06AC11
SHA256:E6127AF28ACDF1B4F8AA817C9417A1C8D33EA224B213A07320F54F6B036C4B10
1480rundll32.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferencesbinary
MD5:FC2F304120D94B38C00C8CDF1257ADD9
SHA256:283DD396805D205D46FA51CE622A1261199F9F1C50027151D39A708F6D7B7B46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
15
DNS requests
10
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1480
rundll32.exe
GET
200
151.101.66.133:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkcHsQGaDFetObPhfan5
US
binary
1.41 Kb
whitelisted
1480
rundll32.exe
POST
200
43.159.200.212:80
http://ofsg.fh67k.com/
HK
text
152 b
unknown
1480
rundll32.exe
GET
200
151.101.66.133:80
http://ocsp2.globalsign.com/gsorganizationvalsha2g3/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSVLM6m9XSaK2pXyc357yFJVjgNwQQUaIa4fXrZbUlrhy8YixU0bNe0eg4CDGVFedNjiGIliJjigQ%3D%3D
US
binary
1.43 Kb
whitelisted
1480
rundll32.exe
POST
200
43.159.200.212:80
http://of2sg.fh67k.com/
HK
text
8.94 Kb
unknown
1480
rundll32.exe
POST
200
43.159.200.212:80
http://ofres.fh67k.com/
HK
unknown
1480
rundll32.exe
POST
200
43.159.200.212:80
http://ofres.fh67k.com/
HK
unknown
1480
rundll32.exe
POST
200
43.159.200.212:80
http://ofres.fh67k.com/
HK
unknown
1480
rundll32.exe
POST
200
43.159.200.212:80
http://ofres.fh67k.com/
HK
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
whitelisted
7072
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
whitelisted
1480
rundll32.exe
43.159.200.212:80
ofsg.fh67k.com
Tencent Building, Kejizhongyi Avenue
HK
unknown
1480
rundll32.exe
159.75.57.35:443
sg-xj-1306567145.cos.ap-guangzhou.myqcloud.com
Shenzhen Tencent Computer Systems Company Limited
CN
whitelisted
1480
rundll32.exe
151.101.66.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
7072
svchost.exe
20.44.239.154:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.44.239.154
whitelisted
google.com
  • 142.250.184.238
whitelisted
ofsg.fh67k.com
  • 43.159.200.212
unknown
sg-xj-1306567145.cos.ap-guangzhou.myqcloud.com
  • 159.75.57.35
  • 159.75.57.69
whitelisted
ocsp.globalsign.com
  • 151.101.66.133
  • 151.101.194.133
  • 151.101.2.133
  • 151.101.130.133
whitelisted
ocsp2.globalsign.com
  • 151.101.66.133
  • 151.101.2.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted
of2sg.fh67k.com
  • 43.159.200.212
unknown
ofres.fh67k.com
  • 43.159.200.212
unknown
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com)
1480
rundll32.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User-Agent (User-Agent Mozilla/4.0 (compatible ))
1480
rundll32.exe
Misc activity
ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)
1480
rundll32.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User-Agent (User-Agent Mozilla/4.0 (compatible ))
1480
rundll32.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User-Agent (User-Agent Mozilla/4.0 (compatible ))
1480
rundll32.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User-Agent (User-Agent Mozilla/4.0 (compatible ))
1480
rundll32.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User-Agent (User-Agent Mozilla/4.0 (compatible ))
1480
rundll32.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User-Agent (User-Agent Mozilla/4.0 (compatible ))
Process
Message
rundll32.exe
LoadMemModuleIco Start!
rundll32.exe
logkit_report start!!!
rundll32.exe
logkit_report finish!!!