analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://209.126.105.33/DownloadBull/Sony.Vegas.Pro.13.0.453.rar

Full analysis: https://app.any.run/tasks/bfa3de66-032e-4424-bcf8-f36595308b98
Verdict: Malicious activity
Analysis date: March 16, 2019, 00:58:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MD5:

AC1DA4AF4AACF8BF52356E1A23BA6182

SHA1:

6B8F2B558F8C3AC4A5A4263F8EC202BF878EABDE

SHA256:

AEA5E6B42DC5C513B63B312CB23CC65D9A2CA35341CD81D283E22DDFEB565E3C

SSDEEP:

3:N1KkxEtRcJtO2hKTLEX:Cc8R4E2eL+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • VegasPortable.exe (PID: 3128)
      • KeyVegasPro13.exe (PID: 3948)
      • Keygen.exe (PID: 2568)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3400)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Sony.Vegas.Pro.13.0.453.exe (PID: 3532)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 2932)
      • iexplore.exe (PID: 3372)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 3372)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 4036)
      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 2932)
      • iexplore.exe (PID: 3372)

    • Dropped object may contain Bitcoin addresses

      • Sony.Vegas.Pro.13.0.453.exe (PID: 3532)

    • Changes internet zones settings

      • iexplore.exe (PID: 2932)

    • Application launched itself

      • iexplore.exe (PID: 2932)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2380)
      • iexplore.exe (PID: 3372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs iexplore.exe winrar.exe no specs sony.vegas.pro.13.0.453.exe vegasportable.exe no specs keyvegaspro13.exe no specs keygen.exe no specs searchprotocolhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2932"C:\Program Files\Internet Explorer\iexplore.exe" http://209.126.105.33/DownloadBull/Sony.Vegas.Pro.13.0.453.rarC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3372"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2932 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
4036C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
2380"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2932 CREDAT:203009C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3640"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Sony.Vegas.Pro.13.0.453.rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3532"C:\Users\admin\Desktop\Sony.Vegas.Pro.13.0.453.exe" C:\Users\admin\Desktop\Sony.Vegas.Pro.13.0.453.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7z SFX
Exit code:
0
Version:
9.38 beta
3128"C:\Users\admin\Desktop\vg\Sony Vegas 13\VegasPortable.exe" C:\Users\admin\Desktop\vg\Sony Vegas 13\VegasPortable.exe—explorer.exe
User:
admin
Company:
CWER.ws/portable
Integrity Level:
MEDIUM
Description:
Sony Vegas Pro 13 Portable
Version:
2015.06.12.0
3948"C:\Users\admin\Desktop\vg\Sony Vegas 13\MultiKeygen\KeyVegasPro13.exe"C:\Users\admin\Desktop\vg\Sony Vegas 13\MultiKeygen\KeyVegasPro13.exe—VegasPortable.exe
User:
admin
Integrity Level:
MEDIUM
Version:
3, 3, 8, 1
2568"C:\Users\admin\Desktop\vg\Sony Vegas 13\MultiKeygen\Keygen.exe"C:\Users\admin\Desktop\vg\Sony Vegas 13\MultiKeygen\Keygen.exe—KeyVegasPro13.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
3400"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe8_ Global\UsGthrCtrlFltPipeMssGthrPipe8 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Total events
2 295
Read events
2 077
Write events
0
Delete events
0

Modification events

No data
Executable files
242
Suspicious files
20
Text files
154
Unknown types
8

Dropped files

PID
Process
Filename
Type
2932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
2932iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3372iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[2].txt —
MD5:—
SHA256:—
3372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\search[1].txt —
MD5:—
SHA256:—
2932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
2932iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019031620190317\index.datdat
MD5:6B3676FE7491479476729B1ECB698EC7
SHA256:F4AE55FA0717505648F02C80E8574F7B32151AD9968B59CF9DF4D9C873C94167
3372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\search[1].htmhtml
MD5:3B554C6334F946012929A274E1F3E506
SHA256:ACC7FE7ACB40AC9786AA4A74FC9DD7AE7D4386789053AAC121A2588BCA8D2285
3372iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@bing[1].txttext
MD5:7DABB69539D9EEE22BC3C2E1ECB5F80C
SHA256:11228F5EEAB90EB4FA0B3A60DAC1124D207D07E68DD9090D15C8578AE443D6A3
3372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\f8c6dd44[1].jstext
MD5:0FD0568E7B5068E209AC15210AE56FF2
SHA256:B87A66DF064550755C00F605C7463007675490E64346A26DD60246D00E8A09DE
2932iexplore.exeC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:FC69D8D637C70B242CF04EBF51ED3F5C
SHA256:9E812C2F703C66588499526FC67FCEFE31F17E25EC56E46B753B53030C812990
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
91
TCP/UDP connections
53
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3372
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/2Z/1H/cj,nj/5983aa50/f8c6dd44.js
US
text
773 b
whitelisted
3372
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rb/15/cj,nj/1b7dfb88/cc8437ad.js?bu=DikuXGxwdGhgZKwBsAEuoAEu
US
text
7.54 Kb
whitelisted
3372
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rms/BingCore.Bundle/cj,nj/3e6a7d75/9a358300.js?bu=rms+answers+Shared+BingCore%24ClientInstV2%24DuplicateXlsDefaultConfig*BingCore%24ClientInstV2%24SharedLocalStorageConfigDefault*BingCore%24shared*BingCore%24env.override*Empty*BingCore%24event.custom.fix*BingCore%24event.native*BingCore%24onHTML*BingCore%24dom*BingCore%24cookies*BingCore%24rmsajax*BingCore%24ClientInstV2%24LogUploadCapFeatureDisabled*BingCore%24ClientInstV2%24ClientInstConfigSeparateOfflineQueue*BingCore%24clientinst*BingCore%24replay*BingCore%24Animation*BingCore%24fadeAnimation*BingCore%24framework
US
text
4.95 Kb
whitelisted
3372
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/search?q=downloadbull+sony+vegas+pro+13&src=IE-SearchBox&FORM=IE8SRC
US
html
48.4 Kb
whitelisted
3372
iexplore.exe
GET
403
209.126.105.33:80
http://209.126.105.33/DownloadBull/Sony.Vegas.Pro.13.0.453.rar
US
html
188 b
suspicious
3372
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/5f/2r/cj,nj/bab57e12/ea8fe300.js
US
text
2.75 Kb
whitelisted
3372
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/fd/ls/l?IG=862486E1D575464C90943EE0E75AFA7F&CID=0B47DB728EE069AE1EACD6538FC868D2&Type=Event.CPT&DATA={"pp":{"S":"L","FC":156,"BC":197,"SE":-1,"TC":-1,"H":319,"BP":381,"CT":397,"IL":5},"ad":[164,352,1260,560,1260,498,0]}&P=SERP&DA=DUB02
US
image
5.73 Kb
whitelisted
3372
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/rs/6q/4W/cj,nj/347afee2/33036ea1.js
US
text
1.77 Kb
whitelisted
3372
iexplore.exe
POST
204
204.79.197.200:80
http://www.bing.com/fd/ls/lsp.aspx
US
compressed
181 b
whitelisted
3372
iexplore.exe
GET
200
13.107.4.254:80
http://f977b9a50f3f8a5ec43fba72e82d1c84.clo.footprintdns.com/apc/trans.gif
US
image
43 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2932
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3372
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3372
iexplore.exe
204.79.197.222:80
fp.msedge.net
Microsoft Corporation
US
whitelisted
3372
iexplore.exe
2.20.189.59:80
a4.bing.com
Akamai International B.V.
—
whitelisted
3372
iexplore.exe
157.55.135.130:443
login.live.com
Microsoft Corporation
US
whitelisted
3372
iexplore.exe
13.107.4.254:80
f977b9a50f3f8a5ec43fba72e82d1c84.clo.footprintdns.com
Microsoft Corporation
US
whitelisted
3372
iexplore.exe
52.237.223.38:80
d453d0828044476abede324ccef54706.clo.footprintdns.com
Microsoft Corporation
AU
whitelisted
3372
iexplore.exe
209.126.105.33:80
—
server4you Inc.
US
suspicious
3372
iexplore.exe
89.248.174.147:80
downloadbull.com
Quasi Networks LTD.
SC
suspicious
3372
iexplore.exe
52.231.32.10:80
238c97c112dabbe06e34af5c249574fc.clo.footprintdns.com
Microsoft Corporation
KR
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
login.live.com
  • 157.55.135.130
  • 157.55.134.142
  • 157.55.135.134
whitelisted
f977b9a50f3f8a5ec43fba72e82d1c84.clo.footprintdns.com
  • 13.107.4.254
suspicious
238c97c112dabbe06e34af5c249574fc.clo.footprintdns.com
  • 52.231.32.10
unknown
d453d0828044476abede324ccef54706.clo.footprintdns.com
  • 52.237.223.38
unknown
fp.msedge.net
  • 204.79.197.222
whitelisted
a4.bing.com
  • 2.20.189.59
  • 2.20.189.34
whitelisted
downloadbull.com
  • 89.248.174.147
whitelisted
www.googletagmanager.com
  • 172.217.18.104
whitelisted
pagead2.googlesyndication.com
  • 172.217.21.194
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://209.126.105.33/DownloadBull/Sony.Vegas.Pro.13.0.453.rar