File name:

message_v4 (2).rpmsg

Full analysis: https://app.any.run/tasks/e96aaa88-07b6-40c5-a056-1cc049b3099d
Verdict: Malicious activity
Analysis date: May 12, 2023, 00:18:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/octet-stream
File info: rpmsg Restricted Permission Message
MD5:

E43BDBBAFA860A526CC21037406FE33A

SHA1:

22CE1D882F996BD137DCAF8A6A69440EDE50FE21

SHA256:

B9B7B15E0D9D8CF655E32273249E22B8D62BE51A4C25AFACC226360AE0C29FD5

SSDEEP:

1536:yAwRmxQ5ccYMCpI3hz+2qgQWpCWWdPDFPsvbmhMDHsOlqb:smxeYMCK3N+2qgQWpCH5UvbE6HFW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • rundll32.exe (PID: 3308)
      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 1756)
      • wmplayer.exe (PID: 3828)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3292)

    • Reads the computer name

      • wmplayer.exe (PID: 1756)
      • wmpshare.exe (PID: 3940)
      • wmplayer.exe (PID: 3828)
      • setup_wm.exe (PID: 2644)

    • Checks supported languages

      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 1756)
      • wmplayer.exe (PID: 3828)
      • wmpshare.exe (PID: 3940)

    • Process checks computer location settings

      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 3828)

    • The process checks LSA protection

      • unregmp2.exe (PID: 3756)
      • wmplayer.exe (PID: 1756)
      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 3828)
      • wmpshare.exe (PID: 3940)
      • unregmp2.exe (PID: 4076)

    • Manual execution by a user

      • wmplayer.exe (PID: 1756)

    • Reads Environment values

      • setup_wm.exe (PID: 2644)

    • Reads the machine GUID from the registry

      • setup_wm.exe (PID: 2644)
      • wmplayer.exe (PID: 3828)

    • Create files in a temporary directory

      • setup_wm.exe (PID: 2644)
      • iexplore.exe (PID: 3292)
      • wmplayer.exe (PID: 3828)

    • Checks proxy server information

      • wmplayer.exe (PID: 3828)

    • Creates files or folders in the user directory

      • wmplayer.exe (PID: 3828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rpmsg | Restricted-Permission Message (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs iexplore.exe iexplore.exe wmplayer.exe no specs setup_wm.exe no specs unregmp2.exe no specs unregmp2.exe no specs wmplayer.exe wmpshare.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1756"C:\Program Files\Windows Media Player\wmplayer.exe" /prefetch:1C:\Program Files\Windows Media Player\wmplayer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Exit code:
0
Version:
12.0.7601.23517 (win7sp1_ldr.160812-0732)
Modules
Images
c:\program files\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2360"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3292 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2644"C:\Program Files\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files\Windows Media Player\wmplayer.exe" /prefetch:1C:\Program Files\Windows Media Player\setup_wm.exe—wmplayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Configuration Utility
Exit code:
1
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\setup_wm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3292"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?LinkId=57426&Ext=rpmsg"C:\Program Files\Internet Explorer\iexplore.exe
rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3308"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL "C:\Users\admin\AppData\Local\Temp\message_v4 (2).rpmsg"C:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3756C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibraryC:\Windows\System32\unregmp2.exe—setup_wm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3828"C:\Program Files\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:1C:\Program Files\Windows Media Player\wmplayer.exe
setup_wm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Exit code:
0
Version:
12.0.7601.23517 (win7sp1_ldr.160812-0732)
Modules
Images
c:\program files\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3940"C:\Program Files\Windows Media Player\wmpshare.exe" C:\Program Files\Windows Media Player\wmpshare.exe—wmplayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Folder Sharing Executable
Exit code:
0
Version:
12.0.7601.24499 (win7sp1_ldr.190612-0600)
Modules
Images
c:\program files\windows media player\wmpshare.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wmp.dll
c:\windows\system32\user32.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
4076"C:\Windows\system32\unregmp2.exe" /PerformIndivIfNeededC:\Windows\System32\unregmp2.exe—setup_wm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\unregmp2.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
Total events
36 121
Read events
35 705
Write events
414
Delete events
2

Modification events

(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
27
Text files
236
Unknown types
1

Dropped files

PID
Process
Filename
Type
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:BC78FBF119F317E3C904A09845575122
SHA256:F87AEB8099C9A03C4845FAD91F44D4B4921AFF58A2D2A5873E9E8B65EB3512CC
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\JF1R2IU6.txttext
MD5:370FFD05DBA8561F940C34FFD224FE1D
SHA256:6EB2C7F4DE4177C4AE62F6978A8A1122AC5EFAD93CE9CEE3952CFA2DFF131797
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECEbinary
MD5:0704BEB02D6E1E4B5BFFE088D4804D16
SHA256:49627F0D0C25AF0660996980A2AC235E91E64EE68CD78BE3937397029B079FF0
2360iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:A74B0BFDCBB756C3B1D388619D1C07FB
SHA256:05852594129B0C220D9A11AAE5F71C0C85DF701F1E9A7A658A5C585C888CFF35
2360iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\tfpoqzYv42r7UjQvzw0PVIoT2nY[1].pngimage
MD5:83C9AF188DAEA75971437F3F67DAA05F
SHA256:96054AD091360D568C6D01633833AC8988981696E14B1EC230E96A2457884990
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\7WU47F67.txttext
MD5:A5C216BF25EDBD89EE3181B72F4F9CC8
SHA256:4D8C1C10679C32C2BD6E4A67701C8DF9DDEACD89774F76E2BAFD3E88C7F67A81
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\TV3O41PC.txttext
MD5:11F5A1AD2A82D27C18AB696189EA4CFC
SHA256:018B54D62F44DBB893BC98CA3E49DF1105D496B68FDE25F0947FE3AC4D69C3B9
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\638LC22J.txttext
MD5:7B37D2C8F05C0A050EE2587073D63870
SHA256:6CD9DACA16F8BDFE3185A644B3C36AAE666F1DE8B6EA62AD7E2338622F9AE1A4
2360iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\4ZS5D9N6.txttext
MD5:2DB156B1CE290EF1642A4DF3384AE2A7
SHA256:D82F7F426E7B2B1A3F39D6FAA324338922FF3B0F0B908BF5E893C26769B1411C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
27
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2360
iexplore.exe
GET
301
23.33.118.33:80
http://shell.windows.com/fileassoc/fileassoc.asp?Ext=rpmsg%22
US
—
—
whitelisted
3828
wmplayer.exe
GET
302
23.33.118.11:80
http://redir.metaservices.microsoft.com/redir/allservices/?sv=5&locale=409&geoid=f4&version=12.0.7601.24499&userlocale=409
US
—
—
whitelisted
2360
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2360
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3267496a6f178f37
US
compressed
4.70 Kb
whitelisted
3828
wmplayer.exe
GET
200
23.33.118.11:80
http://images.windowsmedia.com/svcswitch/mg4_wmp12_30x30_2.png
US
image
2.00 Kb
whitelisted
2360
iexplore.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?dbc1c67960d08081
US
compressed
4.70 Kb
whitelisted
3828
wmplayer.exe
GET
200
23.33.118.16:80
http://onlinestores.metaservices.microsoft.com/serviceswitching/AllServices.aspx?sv=5&locale=409&geoid=f4&version=12.0.7601.24499&userlocale=409
US
xml
546 b
whitelisted
3828
wmplayer.exe
GET
200
23.33.118.11:80
http://images.windowsmedia.com/svcswitch/media_guide_16x16.png
US
image
897 b
whitelisted
2360
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
binary
471 b
whitelisted
3828
wmplayer.exe
GET
200
23.33.118.16:80
http://onlinestores.metaservices.microsoft.com/bing/bing.xml?locale=409&geoid=f4&version=12.0.7601.24499&userlocale=409
US
text
523 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2360
iexplore.exe
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2360
iexplore.exe
2.22.197.32:443
go.microsoft.com
AKAMAI-AS
FR
unknown
2360
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3292
iexplore.exe
92.123.100.177:443
www.bing.com
Akamai International B.V.
FR
unknown
2360
iexplore.exe
40.126.31.67:443
login.microsoftonline.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.33.118.16:80
onlinestores.metaservices.microsoft.com
Akamai International B.V.
CH
unknown
3828
wmplayer.exe
23.33.118.11:80
redir.metaservices.microsoft.com
Akamai International B.V.
CH
suspicious
2360
iexplore.exe
95.101.110.57:443
r.bing.com
TELXIUS TELXIUS Cable
NL
unknown
2360
iexplore.exe
23.33.118.33:80
shell.windows.com
Akamai International B.V.
CH
unknown
2360
iexplore.exe
92.123.100.177:443
www.bing.com
Akamai International B.V.
FR
unknown

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 2.22.197.32
whitelisted
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
shell.windows.com
  • 23.33.118.33
whitelisted
www.bing.com
  • 92.123.100.177
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
r.bing.com
  • 95.101.110.57
whitelisted
th.bing.com
  • 95.101.110.57
whitelisted
login.microsoftonline.com
  • 40.126.31.67
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
message_v4 (2).rpmsg