Analysis date (UTC): 5 March 2024, 11:51Analysis environment: Windows 7 Pro, build 7601, x86

HopToDesk.exe

MD5:E7F8E468320521203FA50B202F5925E4

SHA1:7120E4F990E99E89840482F32501BE69168A485E

SHA256:B85D91231F81820547DF65A29074CB209D20EDEA8ADC74A51C1DF48E6F71E8EE

Analysis result

Threat level:Malicious activity

Full analysis:Analysis HopToDesk.exe (MD5: E7F8E468320521203FA50B202F5925E4) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk.exe (PID: 3140)
cmd.exe (PID: 752)

Create files in the Startup directory

cmd.exe (PID: 752)

SUSPICIOUS

Executable content was dropped or overwritten

HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk.exe (PID: 3140)
cmd.exe (PID: 752)

Starts CMD.EXE for commands execution

HopToDesk.exe (PID: 2160)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 3140)
HopToDesk.exe (PID: 2860)

Uses NETSH.EXE to add a firewall rule or allowed programs

HopToDesk.exe (PID: 1040)
HopToDesk-update.exe (PID: 568)
cmd.exe (PID: 752)

Reads security settings of Internet Explorer

HopToDesk.exe (PID: 1040)
HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk-update.exe (PID: 568)
HopToDesk.exe (PID: 3140)

Reads the Internet Settings

HopToDesk.exe (PID: 1040)
HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk-update.exe (PID: 568)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 3140)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 1608)

Application launched itself

HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 2564)
HopToDesk.exe (PID: 2788)

Suspicious use of NETSH.EXE

HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 3140)
cmd.exe (PID: 752)

Uses TASKKILL.EXE to kill process

cmd.exe (PID: 2292)
HopToDesk-update.exe (PID: 2592)
cmd.exe (PID: 2808)
cmd.exe (PID: 752)
cmd.exe (PID: 1992)

Reads settings of System Certificates

HopToDesk.exe (PID: 2160)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 1608)

Connects to unusual port

HopToDesk.exe (PID: 2160)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 2860)
HopToDesk.exe (PID: 1608)

Starts itself from another location

HopToDesk-update.exe (PID: 2592)
HopToDesk.exe (PID: 3140)

Executing commands from a ".bat" file

HopToDesk.exe (PID: 3140)

Starts application with an unusual extension

cmd.exe (PID: 752)

Starts SC.EXE for service management

cmd.exe (PID: 752)

Uses NETSH.EXE to delete a firewall rule or allowed programs

cmd.exe (PID: 752)

Uses REG/REGEDIT.EXE to modify registry

cmd.exe (PID: 752)

Creates a software uninstall entry

reg.exe (PID: 3044)
reg.exe (PID: 3040)
reg.exe (PID: 3748)
reg.exe (PID: 2536)
reg.exe (PID: 2836)
reg.exe (PID: 3636)
reg.exe (PID: 3752)
reg.exe (PID: 3548)
reg.exe (PID: 3640)
reg.exe (PID: 3420)
reg.exe (PID: 2824)
reg.exe (PID: 3756)

Searches for installed software

reg.exe (PID: 3044)
reg.exe (PID: 3040)
reg.exe (PID: 3748)
reg.exe (PID: 2536)
reg.exe (PID: 2836)
reg.exe (PID: 3636)
reg.exe (PID: 3548)
reg.exe (PID: 3752)
reg.exe (PID: 3640)
reg.exe (PID: 2824)
reg.exe (PID: 3420)
reg.exe (PID: 3756)
HopToDesk.exe (PID: 2472)
HopToDesk.exe (PID: 2564)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 2860)
HopToDesk.exe (PID: 1608)

The process executes VB scripts

cmd.exe (PID: 752)

Executes as Windows Service

HopToDesk.exe (PID: 2472)
HopToDesk.exe (PID: 2564)

Using 'findstr.exe' to search for text patterns in files and output

cmd.exe (PID: 752)

INFO

Creates files or folders in the user directory

HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 3140)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 1608)

Create files in a temporary directory

HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk.exe (PID: 3140)
cscript.exe (PID: 4028)
cscript.exe (PID: 2952)
cscript.exe (PID: 3300)

Reads the computer name

HopToDesk.exe (PID: 1040)
HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 568)
HopToDesk-update.exe (PID: 2592)
HopToDesk.exe (PID: 3140)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 2472)
HopToDesk.exe (PID: 2564)
HopToDesk.exe (PID: 2860)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 1608)
wmpnscfg.exe (PID: 3496)

Checks supported languages

HopToDesk.exe (PID: 1040)
HopToDesk.exe (PID: 2160)
HopToDesk-update.exe (PID: 2592)
HopToDesk-update.exe (PID: 568)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 3140)
chcp.com (PID: 2416)
chcp.com (PID: 3524)
chcp.com (PID: 3716)
HopToDesk.exe (PID: 2472)
HopToDesk.exe (PID: 2564)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 2860)
wmpnscfg.exe (PID: 3496)
HopToDesk.exe (PID: 1608)

Checks proxy server information

HopToDesk.exe (PID: 2160)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 1608)

Reads the software policy settings

HopToDesk.exe (PID: 2160)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 2860)
HopToDesk.exe (PID: 1608)

Reads the machine GUID from the registry

HopToDesk.exe (PID: 2160)
HopToDesk.exe (PID: 1484)
HopToDesk.exe (PID: 2860)
HopToDesk.exe (PID: 2788)
HopToDesk.exe (PID: 1608)

Creates files in the program directory

cmd.exe (PID: 752)

Reads security settings of Internet Explorer

cscript.exe (PID: 4028)
cscript.exe (PID: 2952)
cscript.exe (PID: 3300)

Manual execution by a user

wmpnscfg.exe (PID: 3496)

Threats

PID	Process	Class	Message
2160	HopToDesk.exe	Potential Corporate Privacy Violation	POLICY [ANY.RUN] Websocket update request to external network
1484	HopToDesk.exe	Potential Corporate Privacy Violation	POLICY [ANY.RUN] Websocket update request to external network
2860	HopToDesk.exe	Potential Corporate Privacy Violation	POLICY [ANY.RUN] Websocket update request to external network
1608	HopToDesk.exe	Potential Corporate Privacy Violation	POLICY [ANY.RUN] Websocket update request to external network