Analysis date (UTC): 1 July 2024, 22:27Analysis environment: Windows 10 Pro, build 19045, x64

VirusTotal Scanner_64424.exe

MD5:BF063C97747FC43DBD0B74CC540913DE

SHA1:79D9B261A7074442CE2C9F31E6CA6B0A8001062F

SHA256:AA49D7526627C77BB9C987717C9E84E41A40D1D9DF73459DAA9D9CF64C538534

Analysis result

Threat level:Malicious activity

Tags:

loader

Full analysis:Analysis VirusTotal Scanner_64424.exe (MD5: BF063C97747FC43DBD0B74CC540913DE) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

VirusTotal Scanner_64424.exe (PID: 876)
ContentI3.exe (PID: 4048)
pmropn.exe (PID: 2568)

Scans artifacts that could help determine the target

VirusTotal Scanner_64424.exe (PID: 876)
pmropn.exe (PID: 1224)

Creates a writable file in the system directory

pmropn.exe (PID: 2568)

Runs injected code in another process

rundll32.exe (PID: 1388)

Application was injected by another process

svchost.exe (PID: 1312)

Actions looks like stealing of personal data

pmropn.exe (PID: 1224)

Change Internet Settings

pmropn.exe (PID: 1224)

SUSPICIOUS

Reads security settings of Internet Explorer

VirusTotal Scanner_64424.exe (PID: 876)
ContentI3.exe (PID: 4048)
pmropn.exe (PID: 2568)
pmropn.exe (PID: 1224)
VirusTotal Scanner_64424.exe (PID: 6324)

Process requests binary or script from the Internet

VirusTotal Scanner_64424.exe (PID: 876)

Checks Windows Trust Settings

VirusTotal Scanner_64424.exe (PID: 876)
pmropn.exe (PID: 2568)
pmropn.exe (PID: 1224)
VirusTotal Scanner_64424.exe (PID: 6324)

Potential Corporate Privacy Violation

VirusTotal Scanner_64424.exe (PID: 876)

Executable content was dropped or overwritten

VirusTotal Scanner_64424.exe (PID: 876)
ContentI3.exe (PID: 4048)
pmropn.exe (PID: 2568)

Reads the date of Windows installation

VirusTotal Scanner_64424.exe (PID: 876)

Creates a software uninstall entry

pmropn.exe (PID: 2568)
pmservice.exe (PID: 3168)
ContentI3.exe (PID: 4048)
pmropn.exe (PID: 1224)

Searches for installed software

pmropn.exe (PID: 2568)
pmservice.exe (PID: 3168)
rundll32.exe (PID: 1388)
svchost.exe (PID: 1312)
reg.exe (PID: 5864)
pmropn.exe (PID: 1224)
ContentI3.exe (PID: 4048)
pmropn32.exe (PID: 6848)
VirusTotal Scanner_64424.exe (PID: 6324)
pmropn64.exe (PID: 6860)
unsecapp.exe (PID: 6584)
pmropn.exe (PID: 2472)

Executes as Windows Service

pmservice.exe (PID: 3168)

Uses RUNDLL32.EXE to load library

pmservice.exe (PID: 3168)

Adds/modifies Windows certificates

pmservice.exe (PID: 3168)
pmropn.exe (PID: 2568)

Starts CMD.EXE for commands execution

pmservice.exe (PID: 3168)

Reads Microsoft Outlook installation path

pmropn.exe (PID: 1224)

Reads Internet Explorer settings

pmropn.exe (PID: 1224)

INFO

Checks supported languages

VirusTotal Scanner_64424.exe (PID: 876)
ContentI3.exe (PID: 4048)
pmropn.exe (PID: 2568)
pmservice.exe (PID: 3168)
pmropn.exe (PID: 1224)
pmropn64.exe (PID: 6860)
pmropn32.exe (PID: 6848)
VirusTotal Scanner_64424.exe (PID: 6324)
pmropn.exe (PID: 2472)

Reads the computer name

VirusTotal Scanner_64424.exe (PID: 876)
pmropn.exe (PID: 2568)
pmservice.exe (PID: 3168)
pmropn.exe (PID: 1224)
VirusTotal Scanner_64424.exe (PID: 6324)
ContentI3.exe (PID: 4048)

Reads the machine GUID from the registry

VirusTotal Scanner_64424.exe (PID: 876)
pmropn.exe (PID: 2568)
pmservice.exe (PID: 3168)
pmropn.exe (PID: 1224)
VirusTotal Scanner_64424.exe (PID: 6324)

Checks proxy server information

VirusTotal Scanner_64424.exe (PID: 876)
pmropn.exe (PID: 2568)
pmropn.exe (PID: 1224)
VirusTotal Scanner_64424.exe (PID: 6324)

Creates files or folders in the user directory

VirusTotal Scanner_64424.exe (PID: 876)
pmropn.exe (PID: 2568)
pmropn.exe (PID: 1224)
VirusTotal Scanner_64424.exe (PID: 6324)
ContentI3.exe (PID: 4048)

Create files in a temporary directory

VirusTotal Scanner_64424.exe (PID: 876)
ContentI3.exe (PID: 4048)

Reads the software policy settings

VirusTotal Scanner_64424.exe (PID: 876)
pmropn.exe (PID: 2568)
pmservice.exe (PID: 3168)
pmropn.exe (PID: 1224)
VirusTotal Scanner_64424.exe (PID: 6324)

Process checks computer location settings

VirusTotal Scanner_64424.exe (PID: 876)

Reads Environment values

pmropn.exe (PID: 2568)
pmropn.exe (PID: 1224)

Creates files in the program directory

ContentI3.exe (PID: 4048)
pmropn.exe (PID: 2568)
pmservice.exe (PID: 3168)
pmropn.exe (PID: 1224)

Reads security settings of Internet Explorer

cmd.exe (PID: 6612)
cmd.exe (PID: 6592)

Disables trace logs

pmropn.exe (PID: 1224)

Manual execution by a user

VirusTotal Scanner_64424.exe (PID: 6324)

Process checks Internet Explorer phishing filters

pmropn.exe (PID: 1224)

Threats

PID	Process	Class	Message
876	VirusTotal Scanner_64424.exe	A Network Trojan was detected	ET MALWARE Possible Malicious Macro DL EXE Feb 2016
876	VirusTotal Scanner_64424.exe	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP