File name:

KeyUpdateTool_ger17.exe

Full analysis: https://app.any.run/tasks/e6994171-4e1f-4bbc-aca1-e31642af4069
Verdict: Malicious activity
Analysis date: January 06, 2025, 01:25:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

A3A839E0486A791D59E270D1CC215EEE

SHA1:

C1C1C9501E4C620B9ACCFBAB50A8356775E417DE

SHA256:

C09CDD83DB2EDC70EBC7C0ED6B94437FF800515D14157B24FBDD4695621D4945

SSDEEP:

24576:DcNA/4qOYI4Aej86eXnm4eymAPTHSyR8WFnDH72XiVZcohsjfL85ViK9MMeX3aEk:DcNA/4qOYI4Aej86eXnZeymAPTHSyR8K

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • KeyUpdateTool_ger17.exe (PID: 6580)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • KeyUpdateTool_ger17.exe (PID: 6580)

    • Starts a Microsoft application from unusual location

      • KeyUpdateTool_ger17.exe (PID: 6424)
      • KeyUpdateTool_ger17.exe (PID: 6580)
      • KeyUpdateTool.exe (PID: 6748)

    • Executable content was dropped or overwritten

      • KeyUpdateTool_ger17.exe (PID: 6580)

  • INFO

    • Checks supported languages

      • KeyUpdateTool_ger17.exe (PID: 6580)
      • KeyUpdateTool.exe (PID: 6748)

    • Create files in a temporary directory

      • KeyUpdateTool_ger17.exe (PID: 6580)

    • Reads the computer name

      • KeyUpdateTool.exe (PID: 6748)

    • The sample compiled with english language support

      • KeyUpdateTool_ger17.exe (PID: 6580)

    • The sample compiled with german language support

      • KeyUpdateTool_ger17.exe (PID: 6580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (82.5)
.exe | Win32 Executable MS Visual C++ (generic) (7.3)
.exe | Win64 Executable (generic) (6.5)
.dll | Win32 Dynamic Link Library (generic) (1.5)
.exe | Win32 Executable (generic) (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:03:25 07:08:18+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7.1
CodeSize: 36864
InitializedDataSize: 771072
UninitializedDataSize: -
EntryPoint: 0x5d3c
OSVersion: 5.2
ImageVersion: 5.2
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.0.3790.0
ProductVersionNumber: 6.0.3790.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Windows Product Key-Aktualisierungstool
FileVersion: 1.7.0021.0
InternalName: KeyUpdateTool.exe
LegalCopyright: © 1995-2006 Microsoft Corporation
OriginalFileName: KeyUpdateTool.exe
ProductName: Windows Genuine Advantage
ProductVersion: 1.7.0021.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
127
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start keyupdatetool_ger17.exe keyupdatetool.exe no specs keyupdatetool_ger17.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6424"C:\Users\admin\Desktop\KeyUpdateTool_ger17.exe" C:\Users\admin\Desktop\KeyUpdateTool_ger17.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Product Key-Aktualisierungstool
Exit code:
3221226540
Version:
1.7.0021.0
Modules
Images
c:\users\admin\desktop\keyupdatetool_ger17.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6580"C:\Users\admin\Desktop\KeyUpdateTool_ger17.exe" C:\Users\admin\Desktop\KeyUpdateTool_ger17.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Product Key-Aktualisierungstool
Exit code:
0
Version:
1.7.0021.0
Modules
Images
c:\users\admin\desktop\keyupdatetool_ger17.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6748C:\Users\admin\AppData\Local\Temp\IXP000.TMP\KeyUpdateTool.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\KeyUpdateTool.exe—KeyUpdateTool_ger17.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Product Key-Aktualisierungstool
Exit code:
0
Version:
1.7.0021.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\keyupdatetool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
45
Read events
43
Write events
1
Delete events
1

Modification events

(PID) Process:(6580) KeyUpdateTool_ger17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:wextract_cleanup0
Value:
rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\"
(PID) Process:(6580) KeyUpdateTool_ger17.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:wextract_cleanup0
Value:
rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\"
Executable files
1
Suspicious files
7
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\KeyUpdateTool.exeexecutable
MD5:7AE17C07B0EF43662E837F16DAE961B3
SHA256:48A4B39E50FDF4D35ABC7C3948352130295D92FBC3730B9B1229B09ABD2A1131
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\home-retail-5.1.2600.2180.cabcompressed
MD5:207D28AE1308CFBA07E0DADF539B6872
SHA256:FECC0944467C2E9835E71D902BC04316810DE092BF6EA1BB092EC9ADFA5AD536
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\pro-retail-5.1.2600.1210.cabcompressed
MD5:1D07A96A50965E37AAA60742FCE4E228
SHA256:84BC5B6B259E29893F6909D23E15894B26799B3D2D6017F51C9842B2E93BD3FB
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\home_eula.txttext
MD5:36D866D50977FAE090F0239CCA05880D
SHA256:691B6E6F59C21A42892584B3D7C44C46BA2E63E965DC4E48FF40CCA869A7C190
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\PRO_EULA.txttext
MD5:3C89457B29ED152A3FED8C9EC6D4B13C
SHA256:25BBDCB354E41F573244D6C10E2477B44EEA4A452D9F11439D54EDDCFC7A1D43
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\pro-retail-5.1.2600.1106.cabcompressed
MD5:D652AC7CEC35041C42F8998686D2CC55
SHA256:F04CEA1513E88232D864AB7CF80ED640F645A82CA9A2F071A9A536830AAA35F6
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\home-retail-5.1.2600.0.cabcompressed
MD5:F57AAED34EB3654B773E5127D01F5E1E
SHA256:6E6589F9165141AC0CBDD51062F4002BBD954EA98C5ACA72C5E382FE0418C5C0
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\pro-retail-5.1.2600.2180.cabcompressed
MD5:B4EA0619BE53C95BBB6A593EB9185F48
SHA256:256DCC0A5166CF00C89D00347B121DDB4F2878C6230866546BEDA0BDA3A6E686
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\home-retail-5.1.2600.1106.cabcompressed
MD5:40B1DEB1D4589CF8BDB05FDC72D89FFA
SHA256:21BD57378B382411B998631D76E21A7D1A5078111BC0503CDFCC9AEFE3074791
6580KeyUpdateTool_ger17.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\pro-retail-5.1.2600.0.cabcompressed
MD5:B94613A0C4DCA22C699DA760DBA38649
SHA256:661AB6AFA0FB823C5C14DD96891DA8E05B58CF29C55FF4644C17A2934C9E1A74
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
40
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.144:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
1076
svchost.exe
184.30.17.189:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.144
  • 104.126.37.137
  • 104.126.37.136
  • 104.126.37.185
  • 104.126.37.145
  • 104.126.37.176
  • 104.126.37.177
  • 104.126.37.129
  • 104.126.37.139
  • 104.126.37.154
  • 104.126.37.160
  • 104.126.37.155
  • 104.126.37.170
  • 104.126.37.186
  • 104.126.37.178
  • 104.126.37.161
  • 104.126.37.128
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.73
  • 20.190.159.68
  • 20.190.159.75
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.4
  • 40.126.31.67
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.30.17.189
  • 23.56.254.14
whitelisted
arc.msn.com
  • 20.74.19.45
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KeyUpdateTool_ger17.exe