| File name: | Humax suite.exe |
| Full analysis: | https://app.any.run/tasks/b37b0309-bf4c-4271-9126-b913f9d2871d |
| Verdict: | Malicious activity |
| Analysis date: | February 17, 2024, 12:03:49 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 56ABFEE00F1ECAA96F8D2E4CB1E35B3A |
| SHA1: | 7180EE2DB11845C3370D9E3496F276BE5CC24DEE |
| SHA256: | BC7E8DE8022F8ADEED46183238E46133F207C0D32E37D7FB104F65063F0810B6 |
| SSDEEP: | 98304:jHKrCxX3zyZpCPjrRT6iGNX+05+ri6LAp1gBMmffDf/s79RpDZVJW2+VNdIibhaE:n9iWLpRPsSDfQcKY6ZXMT |
MALICIOUS
Drops the executable file immediately after the start
- Humax suite.exe (PID: 3216)
- irsetup.exe (PID: 2848)
SUSPICIOUS
Reads security settings of Internet Explorer
- Humax suite.exe (PID: 3216)
- HTTHTS.exe (PID: 3640)
Reads the Internet Settings
- Humax suite.exe (PID: 3216)
- taskmgr.exe (PID: 3940)
- HTTHTS.exe (PID: 3640)
Executable content was dropped or overwritten
- Humax suite.exe (PID: 3216)
- irsetup.exe (PID: 2848)
Reads the Windows owner or organization settings
- irsetup.exe (PID: 2848)
Process drops legitimate windows executable
- irsetup.exe (PID: 2848)
Creates a software uninstall entry
- irsetup.exe (PID: 2848)
Application launched itself
- taskmgr.exe (PID: 3940)
INFO
Checks supported languages
- Humax suite.exe (PID: 3216)
- irsetup.exe (PID: 2848)
- HTraySuite.exe (PID: 2580)
- HTTHTS.exe (PID: 3640)
- PMCTool.exe (PID: 2020)
- HTraySuite.exe (PID: 3072)
- HTraySuite.exe (PID: 3092)
Reads the computer name
- Humax suite.exe (PID: 3216)
- irsetup.exe (PID: 2848)
- HTTHTS.exe (PID: 3640)
Create files in a temporary directory
- Humax suite.exe (PID: 3216)
- irsetup.exe (PID: 2848)
Creates files in the program directory
- irsetup.exe (PID: 2848)
Creates files or folders in the user directory
- irsetup.exe (PID: 2848)
- HTTHTS.exe (PID: 3640)
Manual execution by a user
- HTraySuite.exe (PID: 2580)
- HTraySuite.exe (PID: 3092)
- taskmgr.exe (PID: 3940)
- HTraySuite.exe (PID: 3072)
- PMCTool.exe (PID: 2020)
- HTTHTS.exe (PID: 3640)
Reads security settings of Internet Explorer
- taskmgr.exe (PID: 3940)
Checks proxy server information
- HTTHTS.exe (PID: 3640)
Reads the machine GUID from the registry
- HTTHTS.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.8) |
|---|---|---|
| .exe | | | Win32 EXE Yoda's Crypter (36.4) |
| .dll | | | Win32 Dynamic Link Library (generic) (9) |
| .exe | | | Win32 Executable (generic) (6.1) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2009:11:06 19:53:27+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 32768 |
| InitializedDataSize: | 110592 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x3079 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.2.0.0 |
| ProductVersionNumber: | 1.2.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | ASCII |
| Comments: | http://digital.mastertopforum.com/index.php |
| CompanyName: | Digital Key Sat |
| FileDescription: | Setup Application |
| FileVersion: | 1.2.0.0 |
| InternalName: | sf_rt |
| LegalCopyright: | Copyright © 2011 Digital Key Sat |
| LegalTrademarks: | Humax suite is a trademark of DigitalKey Sat |
| OriginalFileName: | suf80_launch.exe |
| PrivateBuild: | 1.0.2 |
| ProductName: | Humax suite |
| ProductVersion: | 1.2.0.0 |
| SpecialBuild: | 1.0.2 |
Total processes
61
Monitored processes
10
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2020 | "C:\Program Files\humax suite\_PMCT Tools\PMCTool\PMCTool.exe" | C:\Program Files\humax suite\_PMCT Tools\PMCTool\PMCTool.exe | — | explorer.exe | |||||||||||
User: admin Company: PMCTool Integrity Level: MEDIUM Description: PMCT Editor für Humax 5400 mit ToH Exit code: 0 Version: 0.1.4.0 Modules
| |||||||||||||||
| 2152 | "C:\Windows\system32\taskmgr.exe" /1 | C:\Windows\System32\taskmgr.exe | taskmgr.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Task Manager Exit code: 1073807364 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2580 | "C:\Program Files\humax suite\HTraySuite.exe" | C:\Program Files\humax suite\HTraySuite.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 1073807364 Modules
| |||||||||||||||
| 2848 | "C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:727586 "__IRAFN:C:\Users\admin\Desktop\Humax suite.exe" "__IRCT:1" "__IRTSS:0" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000" | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Humax suite.exe | ||||||||||||
User: admin Company: Indigo Rose Corporation Integrity Level: HIGH Description: Setup Application Exit code: 0 Version: 8.2.1.0 Modules
| |||||||||||||||
| 3072 | "C:\Program Files\humax suite\HTraySuite.exe" | C:\Program Files\humax suite\HTraySuite.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3092 | "C:\Program Files\humax suite\HTraySuite.exe" | C:\Program Files\humax suite\HTraySuite.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3216 | "C:\Users\admin\Desktop\Humax suite.exe" | C:\Users\admin\Desktop\Humax suite.exe | explorer.exe | ||||||||||||
User: admin Company: Digital Key Sat Integrity Level: HIGH Description: Setup Application Exit code: 0 Version: 1.2.0.0 Modules
| |||||||||||||||
| 3640 | "C:\Program Files\humax suite\_Modules Upload Tools\HTSuite\HTTHTS.exe" | C:\Program Files\humax suite\_Modules Upload Tools\HTSuite\HTTHTS.exe | — | explorer.exe | |||||||||||
User: admin Company: Humax Turbo Team Integrity Level: MEDIUM Description: Humax Turbo Suite Exit code: 0 Version: 2.3.7.0 Modules
| |||||||||||||||
| 3668 | "C:\Users\admin\Desktop\Humax suite.exe" | C:\Users\admin\Desktop\Humax suite.exe | — | explorer.exe | |||||||||||
User: admin Company: Digital Key Sat Integrity Level: MEDIUM Description: Setup Application Exit code: 3221226540 Version: 1.2.0.0 Modules
| |||||||||||||||
| 3940 | "C:\Windows\system32\taskmgr.exe" /4 | C:\Windows\System32\taskmgr.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Task Manager Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
5 312
Read events
5 255
Write events
51
Delete events
6
Modification events
| (PID) Process: | (3216) Humax suite.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3216) Humax suite.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3216) Humax suite.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3216) Humax suite.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2848) irsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\humax suite4.0 |
| Operation: | write | Name: | DisplayName |
Value: humax suite | |||
| (PID) Process: | (2848) irsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\humax suite4.0 |
| Operation: | write | Name: | NoModify |
Value: 1 | |||
| (PID) Process: | (2848) irsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\humax suite4.0 |
| Operation: | write | Name: | NoRepair |
Value: 1 | |||
| (PID) Process: | (2848) irsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\humax suite4.0 |
| Operation: | write | Name: | UninstallString |
Value: "C:\Program Files\humax suite\uninstall.exe" "/U:C:\Program Files\humax suite\Uninstall\uninstall.xml" | |||
| (PID) Process: | (2848) irsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\humax suite4.0 |
| Operation: | write | Name: | Publisher |
Value: ALMASOFT-DIGITAL KEY SAT | |||
| (PID) Process: | (2848) irsetup.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\humax suite4.0 |
| Operation: | write | Name: | URLInfoAbout |
Value: http://digital.mastertopforum.com/index.php | |||
Executable files
69
Suspicious files
11
Text files
108
Unknown types
24
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2848 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG | image | |
MD5:C21B908747C752B78F49FE9DD33BDBBA | SHA256:6698E19A5370606A674ED5D79FCEE1243E27B779CB2644B532F1563B20DD623A | |||
| 2848 | irsetup.exe | C:\Program Files\humax suite\HTraySuite.dat | image | |
MD5:12377FBCB1254C5BE2886948E5517BAE | SHA256:3A5640956D4893C737F5250B268800DE7ED2CD1BCBF46906598D57E4661CF47D | |||
| 2848 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat | binary | |
MD5:B4ECE4C976F5F00F8F0E3F5B863A1D7B | SHA256:1D1853250B2A679500D4169AD1A18AB478ADB781920F9EB9013DDF8F3F96448E | |||
| 2848 | irsetup.exe | C:\Program Files\humax suite\Uninstall\uninstall.dat | binary | |
MD5:10127FFBD06E4DBB28D2BD2F4AAEA794 | SHA256:65A34A0D1FED4F409F28DF8D1E100A59B031A75D22CA733307B70EBE5365099A | |||
| 2848 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG3.JPG | image | |
MD5:2E05DC8B4AF185A4419958750F87ACB8 | SHA256:170816D3308FE22487CA229FBD47C945494E644754FC9CC9DB6AD2D6DC3F5939 | |||
| 2848 | irsetup.exe | C:\Program Files\humax suite\HTraySuite.exe | executable | |
MD5:F41FCD16F74B7E0AE531318BE350A0EF | SHA256:DCDC6B187DF9565B2AA01772B79E25F421143C026EE0C5D1A645ADF1BF6C0A2D | |||
| 2848 | irsetup.exe | C:\Program Files\humax suite\Uninstall\uninstall.xml | xml | |
MD5:B39D708A94973CA849B8FA8BCFCBECD0 | SHA256:DF6F90E65CEF863BD8EE758196A18CFF2065FE12CD1A99732D1E1F855835C109 | |||
| 2848 | irsetup.exe | C:\Program Files\humax suite\HTraySuite.ini | text | |
MD5:9A0A8AEC0CB5524290057F6F09A53E81 | SHA256:59EC573B48EDB41637387B8D003ADC1C2CD0BE8F32945E2AE57D50C3C05B6FCF | |||
| 2848 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG | image | |
MD5:B6B52D02A3D748D330EC34A03F6CC57F | SHA256:CB12FEFDCC5D794D531BB542A89ED3CA3AFA01DEFD4D4534FC835692A3AD89E0 | |||
| 2848 | irsetup.exe | C:\Program Files\humax suite\uninstall.exe | executable | |
MD5:3FE7C92DBA5C9240B4AB0D6A87E6166A | SHA256:A7818C1E0DAD1CBBA4D17809688887ADEEAFE940A3CB53A6AEABDFCD196F7258 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.humax-zone.tv |
| unknown |