Malware analysis StarTrinity.Installer.exe Malicious activity

Add for printing

File name:	StarTrinity.Installer.exe
Full analysis:	https://app.any.run/tasks/832f8d19-73ee-4fb6-820a-32bc014956e2
Verdict:	Malicious activity
Analysis date:	August 15, 2024, 11:03:15
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	evasion opendir
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:	A44FEE190BE371E04F6AFBA1FAF5BB96
SHA1:	2CDD6FBBED6D7529E9F05D942C1BE1FB6CFCAA98
SHA256:	B721A0991E2411A7C652D55733B832CD1C7164CFB0449E7084DEFB360C1054B5
SSDEEP:	1536:/aV0Pp4PsTqUPCwc0KDs8EYXv0dgy2svJIy3r5uSxBdny2svJenqA5NDu8TQS:ScqyCwclDs17GIfEUnqALD15

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- PHISHING has been detected (SURICATA)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
SUSPICIOUS
- Drops the executable file immediately after the start
  - StarTrinity.Installer.exe (PID: 6792)
  - StarTrinity.Installer.exe (PID: 6544)
- Reads security settings of Internet Explorer
  - StarTrinity.Installer.exe (PID: 6792)
  - StarTrinity.Installer.exe (PID: 6544)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Application launched itself
  - StarTrinity.Installer.exe (PID: 6792)
- Reads the date of Windows installation
  - StarTrinity.Installer.exe (PID: 6792)
  - StarTrinity.Installer.exe (PID: 6544)
- Executable content was dropped or overwritten
  - StarTrinity.Installer.exe (PID: 6544)
- Process drops legitimate windows executable
  - StarTrinity.Installer.exe (PID: 6544)
- The process drops C-runtime libraries
  - StarTrinity.Installer.exe (PID: 6544)
- The process creates files with name similar to system file names
  - StarTrinity.Installer.exe (PID: 6544)
- Uses NETSH.EXE to add a firewall rule or allowed programs
  - StarTrinity.Installer.exe (PID: 6544)
- Searches for installed software
  - StarTrinity.Installer.exe (PID: 6544)
- Creates a software uninstall entry
  - StarTrinity.Installer.exe (PID: 6544)
- Suspicious use of NETSH.EXE
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Checks for external IP
  - svchost.exe (PID: 2256)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
INFO
- Checks supported languages
  - StarTrinity.Installer.exe (PID: 6792)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
  - TextInputHost.exe (PID: 5064)
  - StarTrinity.Installer.exe (PID: 6544)
- Process checks computer location settings
  - StarTrinity.Installer.exe (PID: 6792)
  - StarTrinity.Installer.exe (PID: 6544)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Reads the machine GUID from the registry
  - StarTrinity.Installer.exe (PID: 6792)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Reads the computer name
  - StarTrinity.Installer.exe (PID: 6792)
  - TextInputHost.exe (PID: 5064)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Disables trace logs
  - StarTrinity.Installer.exe (PID: 6544)
- Creates files in the program directory
  - StarTrinity.Installer.exe (PID: 6544)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Reads Environment values
  - StarTrinity.Installer.exe (PID: 6544)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Checks proxy server information
  - StarTrinity.Installer.exe (PID: 6544)
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Reads product name
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)
- Creates files or folders in the user directory
  - StarTrinity.Installer.exe (PID: 6544)
- Reads the software policy settings
  - StarTrinity.ContinuousSpeedTest.exe (PID: 2608)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (47.7)
.scr	\|	Windows screen saver (22.6)
.dll	\|	Win32 Dynamic Link Library (generic) (11.3)
.exe	\|	Win32 Executable (generic) (7.7)
.exe	\|	Win16/32 Executable Delphi generic (3.5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2054:05:24 09:26:45+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32
LinkerVersion:	48
CodeSize:	146944
InitializedDataSize:	64512
UninitializedDataSize:	-
EntryPoint:	0x25de2
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI
FileVersionNumber:	1.0.0.0
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	StarTrinity Web Installer
CompanyName:	StarTrinity
FileDescription:	StarTrinity.Installer
FileVersion:	1.0.0.0
InternalName:	StarTrinity.Installer.exe
LegalCopyright:	Copyright © StarTrinity 2019
LegalTrademarks:	-
OriginalFileName:	StarTrinity.Installer.exe
ProductName:	StarTrinity.Installer
ProductVersion:	1.0.0.0
AssemblyVersion:	1.0.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

136

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2256

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

2608

"C:\Program Files\StarTrinity CST\StarTrinity.ContinuousSpeedTest.exe"

C:\Program Files\StarTrinity CST\StarTrinity.ContinuousSpeedTest.exe

StarTrinity.Installer.exe

User:

admin

Company:

StarTrinity

Integrity Level:

HIGH

Description:

StarTrinity.ContinuousSpeedTest

Version:

1.0.0.0

Modules

Images
c:\program files\startrinity cst\startrinity.continuousspeedtest.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

5064

"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Version:

123.26505.0.0

Modules

Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll

6016

"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="StarTrinity CST" dir=in action=allow program="C:\Program Files\StarTrinity CST\StarTrinity.ContinuousSpeedTest.exe" enable=yes

C:\Windows\System32\netsh.exe

—

StarTrinity.Installer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Network Command Shell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

6436

"netsh" advfirewall firewall show rule name="StarTrinity CST" verbose

C:\Windows\System32\netsh.exe

—

StarTrinity.ContinuousSpeedTest.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Network Command Shell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

6544

"C:\Users\admin\Downloads\StarTrinity.Installer.exe"

C:\Users\admin\Downloads\StarTrinity.Installer.exe

StarTrinity.Installer.exe

User:

admin

Company:

StarTrinity

Integrity Level:

HIGH

Description:

StarTrinity.Installer

Version:

1.0.0.0

Modules

Images
c:\windows\system32\textinputframework.dll
c:\windows\system32\coremessaging.dll
c:\windows\system32\coreuicomponents.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\wintypes.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\msctfui.dll
c:\windows\system32\uiautomationcore.dll
c:\windows\system32\propsys.dll
c:\windows\system32\d3dcompiler_47.dll

6768

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

netsh.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6792

"C:\Users\admin\Downloads\StarTrinity.Installer.exe"

C:\Users\admin\Downloads\StarTrinity.Installer.exe

—

explorer.exe

User:

admin

Company:

StarTrinity

Integrity Level:

MEDIUM

Description:

StarTrinity.Installer

Version:

1.0.0.0

Modules

Images
c:\users\admin\downloads\startrinity.installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

7180

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

netsh.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

HIGH

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

20 829

Read events

20 792

Write events

Delete events

Modification events


(PID) Process:	(6792) StarTrinity.Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(6792) StarTrinity.Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(6792) StarTrinity.Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(6792) StarTrinity.Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(6544) StarTrinity.Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StarTrinity_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6544) StarTrinity.Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StarTrinity_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(6544) StarTrinity.Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StarTrinity_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6544) StarTrinity.Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StarTrinity_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(6544) StarTrinity.Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StarTrinity_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(6544) StarTrinity.Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\StarTrinity_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576

Add for printing

Executable files

501

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\Accessibility.dll		executable
		MD5:645C18302025E84C56101D5EFA301CB4	SHA256:9393A8049A6AD24E780A7CFE3AAA36A6F9A9E4ACFC9D636CB645D8655EDB2E90
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-file-l1-2-0.dll		executable
		MD5:D92E6A007FC22A1E218552EBFB65DA93	SHA256:03BD3217EAE0EF68521B39556E7491292DB540F615DA873DD8DA538693B81862
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-heap-l1-1-0.dll		executable
		MD5:2EDC82C3DA339A4A138B4E84DC11E580	SHA256:E36B72EAFFFFFB09B3F3A615678A72D561B9469A09F3B4891ABA9D809DA937A5
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-debug-l1-1-0.dll		executable
		MD5:720DB2235C4193151FF8987F8A729135	SHA256:092B72832C47F9C4EDCDE61F1A111C20EB73452984E0A6109482DE74EB03C34D
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-console-l1-2-0.dll		executable
		MD5:039D612693E56CCF32AE81C99443EA77	SHA256:4E978EE035B72032D0B7693E09EED6E112DCED6965780BC3E6B8E024EA2366AB
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-errorhandling-l1-1-0.dll		executable
		MD5:ECDD006AAE56427C3555740F1ABFA8D6	SHA256:13BC8B3F90DA149030897B8F9F08D71E5D1561E3AE604472A82F58DAB2B103F9
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-fibers-l1-1-0.dll		executable
		MD5:EB065ED1B5CABDBB90E2403B8564778F	SHA256:BB2D740333AFAEA2A73A163F95FA102D018CCD68DEF28B6815A2BE0696AB57DB
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-file-l1-1-0.dll		executable
		MD5:36277B52C64CC66216751AAD135528F9	SHA256:F353B6C2DF7AADB457263A02BCE59C44BBAB55F98AE6509674CFBC3751F761B9
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-datetime-l1-1-0.dll		executable
		MD5:2A8065DC6E6E60FB90B4B3F9E6BA7288	SHA256:55E5F10D0DD9C85FF1C6DC7798E46B3A4422FB7EBC583BB00D06A7DF2494397B
6544	StarTrinity.Installer.exe	C:\Program Files\StarTrinity CST\api-ms-win-core-file-l2-1-0.dll		executable
		MD5:50ABF0A7EE67F00F247BADA185A7661C	SHA256:F957A4C261506484B53534A9BE8931C02EC1A349B3F431A858F8215CECFEC3F7

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

524

TCP/UDP connections

1 123

DNS requests

969

Threats

214

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6884	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6544	StarTrinity.Installer.exe	GET	200	84.38.185.158:80	http://startrinity.com/InternetQuality/startrinity_cst.zip?source=web_installer	unknown	—	—	unknown
6908	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
2608	StarTrinity.ContinuousSpeedTest.exe	GET	308	188.34.203.166:80	http://mirror.dogecloud.org/Linux/Mint/stable/19.3/linuxmint-19.3-xfce-64bit.iso	unknown	—	—	unknown
2608	StarTrinity.ContinuousSpeedTest.exe	GET	—	54.149.129.116:80	http://prek-math-te.stanford.edu/user/login	unknown	—	—	whitelisted
2608	StarTrinity.ContinuousSpeedTest.exe	GET	301	89.42.218.39:80	http://www.in-cuiul-catarii.info/contac	unknown	—	—	unknown
2608	StarTrinity.ContinuousSpeedTest.exe	GET	—	213.135.36.94:80	http://headlex16.ipipan.waw.pl/index.php/login/	unknown	—	—	unknown
2608	StarTrinity.ContinuousSpeedTest.exe	GET	200	202.120.223.188:80	http://ieen.usst.edu.cn/8827/list.htm	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
2876	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
3260	svchost.exe	40.115.3.253:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	40.126.31.73:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
—	—	13.107.21.200:443	www.bing.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
—	—	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
6840	backgroundTaskHost.exe	13.107.21.200:443	www.bing.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
4920	svchost.exe	40.126.31.73:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59	whitelisted
google.com	142.250.186.46	whitelisted
client.wns.windows.com	40.115.3.253	whitelisted
login.live.com	40.126.31.73 40.126.31.67 20.190.159.23 20.190.159.68 20.190.159.0 40.126.31.71 20.190.159.71 20.190.159.4	whitelisted
www.bing.com	13.107.21.200 204.79.197.200	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
th.bing.com	2.23.209.176 2.23.209.185 2.23.209.179 2.23.209.188 2.23.209.186 2.23.209.183 2.23.209.182 2.23.209.181 2.23.209.187	whitelisted
arc.msn.com	20.199.58.43 20.24.121.134	whitelisted
startrinity.com	84.38.185.158	unknown
fd.api.iris.microsoft.com	20.103.156.88	whitelisted

Threats

PID	Process	Class	Message
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded
2608	StarTrinity.ContinuousSpeedTest.exe	Misc activity	ET INFO ISO File Downloaded

Add for printing

No debug info

General Info

StarTrinity.Installer.exe

A44FEE190BE371E04F6AFBA1FAF5BB96

2CDD6FBBED6D7529E9F05D942C1BE1FB6CFCAA98

B721A0991E2411A7C652D55733B832CD1C7164CFB0449E7084DEFB360C1054B5

1536:/aV0Pp4PsTqUPCwc0KDs8EYXv0dgy2svJIy3r5uSxBdny2svJenqA5NDu8TQS:ScqyCwclDs17GIfEUnqALD15

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

PHISHING has been detected (SURICATA)

SUSPICIOUS

Drops the executable file immediately after the start

Reads security settings of Internet Explorer

Application launched itself

Reads the date of Windows installation

Executable content was dropped or overwritten

Process drops legitimate windows executable

The process drops C-runtime libraries

The process creates files with name similar to system file names

Uses NETSH.EXE to add a firewall rule or allowed programs

Searches for installed software

Creates a software uninstall entry

Suspicious use of NETSH.EXE

Checks for external IP

INFO

Checks supported languages

Process checks computer location settings

Reads the machine GUID from the registry

Reads the computer name

Disables trace logs

Creates files in the program directory

Reads Environment values

Checks proxy server information

Reads product name

Creates files or folders in the user directory

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings