File name:

message_v4 (2).rpmsg

Full analysis: https://app.any.run/tasks/e96aaa88-07b6-40c5-a056-1cc049b3099d
Verdict: Malicious activity
Analysis date: May 12, 2023, 00:18:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/octet-stream
File info: rpmsg Restricted Permission Message
MD5:

E43BDBBAFA860A526CC21037406FE33A

SHA1:

22CE1D882F996BD137DCAF8A6A69440EDE50FE21

SHA256:

B9B7B15E0D9D8CF655E32273249E22B8D62BE51A4C25AFACC226360AE0C29FD5

SSDEEP:

1536:yAwRmxQ5ccYMCpI3hz+2qgQWpCWWdPDFPsvbmhMDHsOlqb:smxeYMCK3N+2qgQWpCH5UvbE6HFW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 1756)
      • rundll32.exe (PID: 3308)
      • wmplayer.exe (PID: 3828)

  • INFO

    • The process checks LSA protection

      • wmplayer.exe (PID: 1756)
      • unregmp2.exe (PID: 4076)
      • unregmp2.exe (PID: 3756)
      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 3828)
      • wmpshare.exe (PID: 3940)

    • Reads the computer name

      • wmplayer.exe (PID: 1756)
      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 3828)
      • wmpshare.exe (PID: 3940)

    • Checks supported languages

      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 1756)
      • wmplayer.exe (PID: 3828)
      • wmpshare.exe (PID: 3940)

    • Process checks computer location settings

      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 3828)

    • Reads the machine GUID from the registry

      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 3828)

    • Reads Environment values

      • setup_wm.exe (PID: 2644)

    • Application launched itself

      • iexplore.exe (PID: 3292)

    • Manual execution by a user

      • wmplayer.exe (PID: 1756)

    • Create files in a temporary directory

      • setup_wm.exe (PID: 2644)
      • iexplore.exe (PID: 3292)
      • wmplayer.exe (PID: 3828)

    • Checks proxy server information

      • wmplayer.exe (PID: 3828)

    • Creates files or folders in the user directory

      • wmplayer.exe (PID: 3828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rpmsg | Restricted-Permission Message (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs iexplore.exe iexplore.exe wmplayer.exe no specs setup_wm.exe no specs unregmp2.exe no specs unregmp2.exe no specs wmplayer.exe wmpshare.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3308"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\AppData\Local\Temp\message_v4 (2).rpmsg"C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3292"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkId=57426&Ext=rpmsg"C:\Program Files\Internet Explorer\iexplore.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2360"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3292 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1756"C:\Program Files\Windows Media Player\wmplayer.exe" /prefetch:1C:\Program Files\Windows Media Player\wmplayer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Exit code:
0
Version:
12.0.7601.23517 (win7sp1_ldr.160812-0732)
Modules
Images
c:\program files\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2644"C:\Program Files\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files\Windows Media Player\wmplayer.exe" /prefetch:1C:\Program Files\Windows Media Player\setup_wm.exe—wmplayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Configuration Utility
Exit code:
1
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\setup_wm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3756C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibraryC:\Windows\System32\unregmp2.exe—setup_wm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4076"C:\Windows\system32\unregmp2.exe" /PerformIndivIfNeededC:\Windows\System32\unregmp2.exe—setup_wm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\unregmp2.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
3828"C:\Program Files\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:1C:\Program Files\Windows Media Player\wmplayer.exe
setup_wm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Version:
12.0.7601.23517 (win7sp1_ldr.160812-0732)
Modules
Images
c:\program files\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3940"C:\Program Files\Windows Media Player\wmpshare.exe" C:\Program Files\Windows Media Player\wmpshare.exe—wmplayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Folder Sharing Executable
Exit code:
0
Version:
12.0.7601.24499 (win7sp1_ldr.190612-0600)
Modules
Images
c:\program files\windows media player\wmpshare.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wmp.dll
c:\windows\system32\user32.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
Total events
36 121
Read events
35 705
Write events
414
Delete events
2

Modification events

(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
27
Text files
236
Unknown types
1

Dropped files

PID
Process
Filename
Type
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:BC78FBF119F317E3C904A09845575122
SHA256:F87AEB8099C9A03C4845FAD91F44D4B4921AFF58A2D2A5873E9E8B65EB3512CC
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:A74B0BFDCBB756C3B1D388619D1C07FB
SHA256:05852594129B0C220D9A11AAE5F71C0C85DF701F1E9A7A658A5C585C888CFF35
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F1F8C3725F50C41FBA97791E6E505FC4
SHA256:7B77791AE1D9D588AD73AA9FD305DE4BA00CC4845628DB7D74DEF5BFD40B4563
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\B84EX6UL.txttext
MD5:A6DA08B41CE92F176127458462BBBB80
SHA256:08B765D5BFE7DB458495C5113C51E25C720FF90000E0B45968C2E137CDA54FD4
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEbinary
MD5:0704BEB02D6E1E4B5BFFE088D4804D16
SHA256:49627F0D0C25AF0660996980A2AC235E91E64EE68CD78BE3937397029B079FF0
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\TV3O41PC.txttext
MD5:11F5A1AD2A82D27C18AB696189EA4CFC
SHA256:018B54D62F44DBB893BC98CA3E49DF1105D496B68FDE25F0947FE3AC4D69C3B9
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\JF1R2IU6.txttext
MD5:370FFD05DBA8561F940C34FFD224FE1D
SHA256:6EB2C7F4DE4177C4AE62F6978A8A1122AC5EFAD93CE9CEE3952CFA2DFF131797
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEbinary
MD5:DC1B9D40DD537E4CEE9124C18456492F
SHA256:1315EA77FF7B30D0D671DC612C1C884D39CA612062B1C63EB6A6CC9E56F8E517
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\638LC22J.txttext
MD5:7B37D2C8F05C0A050EE2587073D63870
SHA256:6CD9DACA16F8BDFE3185A644B3C36AAE666F1DE8B6EA62AD7E2338622F9AE1A4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
27
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2360
iexplore.exe
GET
301
23.33.118.33:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=rpmsg%22
US
—
—
whitelisted
3828
wmplayer.exe
GET
302
23.33.118.11:80
http://redir.metaservices.microsoft.com/redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.24499&userlocale=409
US
—
—
whitelisted
2360
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2360
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
binary
471 b
whitelisted
2360
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dbc1c67960d08081
US
compressed
4.70 Kb
whitelisted
2360
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3267496a6f178f37
US
compressed
4.70 Kb
whitelisted
2360
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3828
wmplayer.exe
GET
200
23.33.118.16:80
http://onlinestores.metaservices.microsoft.com/bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.24499&userlocale=409
US
text
523 b
whitelisted
3828
wmplayer.exe
GET
200
23.33.118.16:80
http://onlinestores.metaservices.microsoft.com/serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.24499&userlocale=409
US
xml
546 b
whitelisted
3828
wmplayer.exe
GET
200
23.33.118.11:80
http://images.windowsmedia.com/svcswitch/mg4_wmp12_30x30_2.png
US
image
2.00 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2360
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2360
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2360
iexplore.exe
2.22.197.32:443
go.microsoft.com
AKAMAI-AS
FR
unknown
2360
iexplore.exe
23.33.118.33:80
shell.windows.com
Akamai International B.V.
CH
unknown
2360
iexplore.exe
40.126.31.67:443
login.microsoftonline.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2360
iexplore.exe
95.101.110.57:443
r.bing.com
TELXIUS TELXIUS Cable
NL
unknown
3292
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
—
—
23.33.118.16:80
onlinestores.metaservices.microsoft.com
Akamai International B.V.
CH
unknown
2360
iexplore.exe
92.123.100.177:443
www.bing.com
Akamai International B.V.
FR
unknown
3828
wmplayer.exe
23.33.118.11:80
redir.metaservices.microsoft.com
Akamai International B.V.
CH
suspicious

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 2.22.197.32
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
shell.windows.com
  • 23.33.118.33
whitelisted
www.bing.com
  • 92.123.100.177
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
r.bing.com
  • 95.101.110.57
whitelisted
th.bing.com
  • 95.101.110.57
whitelisted
login.microsoftonline.com
  • 40.126.31.67
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
message_v4 (2).rpmsg