Malware analysis escargot-msn-7.5.0324-fr.msi Malicious activity

Add for printing

File name:	escargot-msn-7.5.0324-fr.msi
Full analysis:	https://app.any.run/tasks/73b0127e-7e8a-4b1a-8720-29d47a9abe2f
Verdict:	Malicious activity
Analysis date:	May 22, 2018, 23:39:41
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:	generated-doc
Indicators:
MIME:	application/x-msi
File info:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: MSN Messenger setup package, Author: Microsoft Corporation, Keywords: Installer,MSI,Database, Comments: MSN Messenger, Template: Intel;1036, Revision Number: {68340736-17D0-4ACA-AB16-9CF2FD600324}, Create Time/Date: Tue Jan 24 11:37:00 2006, Last Saved Time/Date: Tue Jan 24 11:37:00 2006, Number of Pages: 200, Number of Words: 2, Name of Creating Application: Windows Installer XML v2 (candle/light), Security: 1
MD5:	F07252C94E8A87DC3C52F8E3AB753005
SHA1:	CA21EACE15A77BCE2EDD0FB53D7F0C2CF66DCEF8
SHA256:	AC54BEB1DD82CE47F1F5680F411438F8A5A5362714DA4E50205B363F0DDF9F29
SSDEEP:	196608:qi8b2fM1IEARgYCz7A0iFBJ9vcYVGq1Q9pG7pDRuIIb:qilfawgZz0FBJDgGZRZIb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:

Software preset

Internet Explorer 8.0.7601.17514 undefined
7-Zip 16.04 (16.04)
Adobe Acrobat Reader DC MUI (15.007.20033)
Adobe Flash Player 26 ActiveX (26.0.0.137)
CCleaner (5.35)
FileZilla Client 3.31.0 (3.31.0)
Google Chrome (61.0.3163.100)
Google Update Helper (1.3.33.5)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Home and Business 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2005 Redistributable (8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (11.0.61030.0)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030 (11.0.61030)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030 (11.0.61030)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.12.25810 (14.12.25810.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.12.25810 (14.12.25810)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.12.25810 (14.12.25810)
Mozilla Firefox 55.0.3 (x86 en-US) (55.0.3)
Mozilla Maintenance Service (55.0.3)
Notepad++ (32-bit x86) (7.5.4)
Opera 12.15 (12.15.1748)
Skype™ 7.39 (7.39.102)
VLC media player (2.2.6)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition
WinMan WinIP Package TopLevel

Add for printing

MALICIOUS
- Loads dropped or rewritten executable
  - msiexec.exe (PID: 3588)
  - msnmsgr.exe (PID: 2624)
  - mtbs.exe (PID: 1448)
- Application was dropped or rewritten from another process
  - msnsearch.exe (PID: 2400)
  - msnmsgr.exe (PID: 2624)
  - mtbs.exe (PID: 3340)
  - mtbs.exe (PID: 1448)
- Changes the autorun value in the registry
  - msnsearch.exe (PID: 2400)
SUSPICIOUS
- Creates files in the Windows directory
  - msiexec.exe (PID: 3176)
- Executable content was dropped or overwritten
  - msiexec.exe (PID: 3588)
  - msiexec.exe (PID: 3176)
  - msnsearch.exe (PID: 2400)
- Changes the autorun value in the registry
  - msiexec.exe (PID: 3176)
- Creates COM task schedule object
  - msiexec.exe (PID: 3176)
- Creates files in the user directory
  - msiexec.exe (PID: 3176)
  - mtbs.exe (PID: 1448)
- Reads internet explorer settings
  - mtbs.exe (PID: 1448)
- Starts Internet Explorer
  - msnmsgr.exe (PID: 2624)
INFO
- Dropped object may contain URL's
  - msiexec.exe (PID: 3588)
  - msiexec.exe (PID: 3176)
  - iexplore.exe (PID: 2548)
  - msnsearch.exe (PID: 2400)
- Loads dropped or rewritten executable
  - MsiExec.exe (PID: 3136)
  - MsiExec.exe (PID: 2040)
- Low-level read access rights to disk partition
  - vssvc.exe (PID: 3312)
- Creates or modifies windows services
  - msiexec.exe (PID: 3176)
  - vssvc.exe (PID: 3312)
- Application launched itself
  - msiexec.exe (PID: 3176)
- Creates a software uninstall entry
  - msiexec.exe (PID: 3176)
- Creates files in the program directory
  - msiexec.exe (PID: 3176)
- Creates files in the user directory
  - iexplore.exe (PID: 2548)
- Changes internet zones settings
  - iexplore.exe (PID: 3040)
- Reads Internet Cache Settings
  - iexplore.exe (PID: 2548)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.msi	\|	Microsoft Windows Installer (95.3)
.doc	\|	Microsoft Word document (old ver.) (3.2)
.	\|	Generic OLE2 / Multistream Compound File (1.3)

EXIF

FlashPix

CodePage:	Windows Latin 1 (Western European)
Title:	Installation Database
Subject:	MSN Messenger setup package
Author:	Microsoft Corporation
Keywords:	Installer,MSI,Database
Comments:	MSN Messenger
Template:	Intel;1036
RevisionNumber:	{68340736-17D0-4ACA-AB16-9CF2FD600324}
CreateDate:	2006:01:24 11:37:00
ModifyDate:	2006:01:24 11:37:00
Pages:	200
Words:	2
Software:	Windows Installer XML v2 (candle/light)
Security:	Password protected

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1448

C:\Users\admin\AppData\Local\Temp\IXP000.TMP\mtbs.exe e

C:\Users\admin\AppData\Local\Temp\IXP000.TMP\mtbs.exe

msnsearch.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

MSN Toolbar setup program

Exit code:

Version:

01.01.2607.0

Modules

Images
c:\users\admin\appdata\local\temp\ixp000.tmp\mtbs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll

2040

C:\Windows\system32\MsiExec.exe -Embedding A72615C733B7B6A451BACE38DC27E9F3

C:\Windows\system32\MsiExec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

2400

"C:\Users\admin\AppData\Local\Temp\msnsearch.exe" /C:"mtbs.exe e"

C:\Users\admin\AppData\Local\Temp\msnsearch.exe

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Win32 Cabinet Self-Extractor

Exit code:

Version:

1.0.2607.0

Modules

Images
c:\users\admin\appdata\local\temp\msnsearch.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll

2548

"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3040 CREDAT:71937

C:\Program Files\Internet Explorer\iexplore.exe

iexplore.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Internet Explorer

Exit code:

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

2624

"C:\Program Files\MSN Messenger\msnmsgr.exe"

C:\Program Files\MSN Messenger\msnmsgr.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

MSN Messenger

Exit code:

Version:

7.5.0324

Modules

Images
c:\program files\msn messenger\msnmsgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll

3040

"C:\Program Files\Internet Explorer\iexplore.exe" -nohome

C:\Program Files\Internet Explorer\iexplore.exe

msnmsgr.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Internet Explorer

Exit code:

Version:

8.00.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3136

C:\Windows\system32\MsiExec.exe -Embedding 0E49E956858689DC81CF8CA5D06E4271 C

C:\Windows\system32\MsiExec.exe

—

msiexec.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows® installer

Exit code:

Version:

5.0.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3176

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\msiexec.exe

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows® installer

Exit code:

Version:

5.0.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3312

C:\Windows\system32\vssvc.exe

—

services.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Microsoft® Volume Shadow Copy Service

Exit code:

Version:

6.1.7600.16385 (win7_rtm.090713-1255)

Modules

Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll

3340

C:\Users\admin\AppData\Local\Temp\IXP000.TMP\mtbs.exe e

C:\Users\admin\AppData\Local\Temp\IXP000.TMP\mtbs.exe

—

msnsearch.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

MSN Toolbar setup program

Exit code:

3221226540

Version:

01.01.2607.0

Modules

Images
c:\users\admin\appdata\local\temp\ixp000.tmp\mtbs.exe
c:\systemroot\system32\ntdll.dll

Add for printing

Total events

1 585

Read events

852

Write events

719

Delete events

Modification events


(PID) Process:	(3176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:	write	Name:	SrCreateRp (Enter)
Value: 40000000000000001E1D303D26F2D301680C0000FC0B0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:	write	Name:	SppCreate (Enter)
Value: 40000000000000001E1D303D26F2D301680C0000FC0B0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3312) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000007AB68A3D26F2D301F00C0000A4080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3312) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000007AB68A3D26F2D301F00C0000700F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3312) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000007AB68A3D26F2D301F00C00003C020000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3312) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000007AB68A3D26F2D301F00C0000800F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:	write	Name:	LastIndex
Value: 50
(PID) Process:	(3176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:	write	Name:	SppGatherWriterMetadata (Enter)
Value: 400000000000000004067A3D26F2D301680C0000FC0B0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:	(3176) msiexec.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:	write	Name:	IDENTIFY (Enter)
Value: 40000000000000005E687C3D26F2D301680C0000740D0000E80300000100000000000000000000004212DA60292D124CB8E30053CEA783C80000000000000000
(PID) Process:	(3312) vssvc.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:	write	Name:	IDENTIFY (Leave)
Value: 400000000000000088DD913D26F2D301F00C0000800F0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3588	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI955.tmp		—
		MD5:—	SHA256:—
3176	msiexec.exe	C:\System Volume Information\SPP\metadata-2		—
		MD5:—	SHA256:—
3176	msiexec.exe	C:\Windows\Installer\144da1.msi		—
		MD5:—	SHA256:—
3312	vssvc.exe	C:		—
		MD5:—	SHA256:—
3176	msiexec.exe	C:\Users\admin\AppData\Local\Temp\~DFA881B17256202DA0.TMP		—
		MD5:—	SHA256:—
3176	msiexec.exe	C:\Windows\Installer\MSI735C.tmp		—
		MD5:—	SHA256:—
3176	msiexec.exe	C:\Windows\Installer\MSI732C.tmp		binary
		MD5:—	SHA256:—
3176	msiexec.exe	C:\Program Files\MSN Messenger\mailtmpl.txt		text
		MD5:—	SHA256:—
3588	msiexec.exe	C:\Users\admin\AppData\Local\Temp\MSI16A4.tmp		executable
		MD5:416FD1413E34A2DD22D36B30A84C916F	SHA256:1E14BAE53A42415A1B1F9CDDD097692BEB3C46E99F652EC618C814A8B92D813F
3176	msiexec.exe	C:\System Volume Information\SPP\snapshot-2		binary
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2548	iexplore.exe	GET	—	65.55.253.15:80	http://messenger.msn.com/redirs/PORTAL.asp?GeoID=000000f4&Plcid=040c&CLCID=0409&Country=00&BrandID=msmsgs&Build=7.5.0324&OS=Win&Version=7.5	US	—	—	whitelisted
2548	iexplore.exe	GET	302	207.46.194.14:80	http://g.msn.com/5meen_us/103?GeoID=000000f4&Plcid=040c&CLCID=0409&Country=00&BrandID=msmsgs&Build=7.5.0324&OS=Win&Version=7.5	IE	—	—	whitelisted
3040	iexplore.exe	GET	200	204.79.197.200:80	http://www.bing.com/favicon.ico	US	image	237 b	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2548	iexplore.exe	65.55.253.15:80	messenger.msn.com	Microsoft Corporation	US	whitelisted
3040	iexplore.exe	204.79.197.200:80	www.bing.com	Microsoft Corporation	US	whitelisted
2548	iexplore.exe	207.46.194.14:80	g.msn.com	Microsoft Corporation	IE	whitelisted

DNS requests

Domain	IP	Reputation
runonce.msn.com	23.99.81.176	whitelisted
www.bing.com	204.79.197.200 13.107.21.200	whitelisted
g.msn.com	207.46.194.14	whitelisted
messenger.msn.com	65.55.253.15	whitelisted

Threats

No threats detected

Add for printing

Process	Message
mtbs.exe	1347 OS: 0x6, 0x1
mtbs.exe	* Assertion: Unknown IE Build Format (A) *
mtbs.exe	* Assertion: Unknown IE Major Version *

General Info

escargot-msn-7.5.0324-fr.msi

F07252C94E8A87DC3C52F8E3AB753005

CA21EACE15A77BCE2EDD0FB53D7F0C2CF66DCEF8

AC54BEB1DD82CE47F1F5680F411438F8A5A5362714DA4E50205B363F0DDF9F29

196608:qi8b2fM1IEARgYCz7A0iFBJ9vcYVGq1Q9pG7pDRuIIb:qilfawgZz0FBJDgGZRZIb

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Loads dropped or rewritten executable

Application was dropped or rewritten from another process

Changes the autorun value in the registry

SUSPICIOUS

Creates files in the Windows directory

Executable content was dropped or overwritten

Changes the autorun value in the registry

Creates COM task schedule object

Creates files in the user directory

Reads internet explorer settings

Starts Internet Explorer

INFO

Dropped object may contain URL's

Loads dropped or rewritten executable

Low-level read access rights to disk partition

Creates or modifies windows services

Application launched itself

Creates a software uninstall entry

Creates files in the program directory

Creates files in the user directory

Changes internet zones settings

Reads Internet Cache Settings

Malware configuration

Static information

TRiD

EXIF

FlashPix

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings