analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Extreme Injector v3.exe

Full analysis: https://app.any.run/tasks/3156bef1-4d5a-42d0-a96b-24af21eb549a
Verdict: Malicious activity
Analysis date: June 19, 2024, 13:25:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

EC801A7D4B72A288EC6C207BB9FF0131

SHA1:

32EEC2AE1F9E201516FA7FCDC16C4928F7997561

SHA256:

B65F40618F584303CA0BCF9B5F88C233CC4237699C0C4BF40BA8FACBE8195A46

SSDEEP:

49152:NNEVtO1U1y1DDDDDD7Llngq7NNMqU0p2Vhk9ap:NNEVJyZlng4p2VD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Extreme Injector v3.exe (PID: 3344)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Extreme Injector v3.exe (PID: 3344)

    • Application launched itself

      • Extreme Injector v3.exe (PID: 3344)

    • Reads the Internet Settings

      • Extreme Injector v3.exe (PID: 3344)
      • Extreme Injector v3.exe (PID: 3196)

    • Reads settings of System Certificates

      • Extreme Injector v3.exe (PID: 3196)

  • INFO

    • Checks supported languages

      • Extreme Injector v3.exe (PID: 3344)
      • Extreme Injector v3.exe (PID: 3196)

    • Reads the computer name

      • Extreme Injector v3.exe (PID: 3344)
      • Extreme Injector v3.exe (PID: 3196)

    • Reads the machine GUID from the registry

      • Extreme Injector v3.exe (PID: 3344)
      • Extreme Injector v3.exe (PID: 3196)

    • Create files in a temporary directory

      • Extreme Injector v3.exe (PID: 3196)

    • Disables trace logs

      • Extreme Injector v3.exe (PID: 3196)

    • Reads Environment values

      • Extreme Injector v3.exe (PID: 3196)

    • Reads the software policy settings

      • Extreme Injector v3.exe (PID: 3196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

AssemblyVersion: 3.7.3.0
ProductVersion: 3.7.3.0
ProductName: Extreme Injector
OriginalFileName: Extreme Injector.exe
LegalTrademarks: master131
LegalCopyright: Copyright © 2017
InternalName: Extreme Injector.exe
FileVersion: 3.7.3.0
FileDescription: Extreme Injector
CompanyName: master131
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 3.7.3.0
FileVersionNumber: 3.7.3.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1dd65e
UninitializedDataSize: -
InitializedDataSize: 19968
CodeSize: 1947648
LinkerVersion: 8
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2017:12:10 09:47:39+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start extreme injector v3.exe no specs extreme injector v3.exe

Process information

PID
CMD
Path
Indicators
Parent process
3344"C:\Users\admin\AppData\Local\Temp\Extreme Injector v3.exe" C:\Users\admin\AppData\Local\Temp\Extreme Injector v3.exe—explorer.exe
User:
admin
Company:
master131
Integrity Level:
MEDIUM
Description:
Extreme Injector
Exit code:
0
Version:
3.7.3.0
Modules
Images
c:\users\admin\appdata\local\temp\extreme injector v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3196"C:\Users\admin\AppData\Local\Temp\Extreme Injector v3.exe" C:\Users\admin\AppData\Local\Temp\Extreme Injector v3.exe
Extreme Injector v3.exe
User:
admin
Company:
master131
Integrity Level:
HIGH
Description:
Extreme Injector
Exit code:
0
Version:
3.7.3.0
Modules
Images
c:\users\admin\appdata\local\temp\extreme injector v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
11 056
Read events
10 994
Write events
61
Delete events
1

Modification events

(PID) Process:(3344) Extreme Injector v3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3344) Extreme Injector v3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3344) Extreme Injector v3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3344) Extreme Injector v3.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3196) Extreme Injector v3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Extreme Injector v3_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3196) Extreme Injector v3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Extreme Injector v3_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3196) Extreme Injector v3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Extreme Injector v3_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3196) Extreme Injector v3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Extreme Injector v3_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3196) Extreme Injector v3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Extreme Injector v3_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3196) Extreme Injector v3.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Extreme Injector v3_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
0
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3196Extreme Injector v3.exeC:\Users\admin\AppData\Local\Temp\settings.xmlxml
MD5:0BA6FCFBA60C80EEB037630F64CDDE95
SHA256:76BA23B20B7356E25BC783ED482940857A62A7A278940BF96338BECBA5FAA32E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
11
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
95.101.54.131:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1060
svchost.exe
GET
304
95.101.54.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbe613066ac7852b
unknown
—
—
unknown
1372
svchost.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
1372
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3196
Extreme Injector v3.exe
185.199.109.133:443
raw.githubusercontent.com
FASTLY
US
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1372
svchost.exe
95.101.54.131:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
1372
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
1060
svchost.exe
95.101.54.128:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
raw.githubusercontent.com
  • 185.199.109.133
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.110.133
shared
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
ctldl.windowsupdate.com
  • 95.101.54.131
  • 95.101.54.195
  • 95.101.54.128
  • 95.101.54.121
  • 95.101.54.136
  • 95.101.54.105
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Extreme Injector v3.exe