analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://www.displaylink.com/downloads/windows

Full analysis: https://app.any.run/tasks/520bed68-60df-45aa-94d1-f45552b890fa
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Analysis date: April 25, 2019, 08:45:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

90BB5E429B05FD7BF696533F08EF94B2

SHA1:

65C2CC4551A5BFB25BE576D3E21FA86ED32FC03D

SHA256:

C6762F7FE6F2B4091700BFC26D16820E74D22F4CB201B5C455BDDDEC062190DC

SSDEEP:

3:N8DSLaVK8XK/1Kl:2OLaaIl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe (PID: 1324)
      • f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe (PID: 3468)
    • Downloads executable files from the Internet

      • iexplore.exe (PID: 324)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2344)
      • iexplore.exe (PID: 324)
      • f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe (PID: 3468)
      • f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe (PID: 1324)
  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2344)
    • Application launched itself

      • iexplore.exe (PID: 2344)
    • Reads internet explorer settings

      • iexplore.exe (PID: 324)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 324)
      • iexplore.exe (PID: 2344)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 2344)
    • Creates files in the user directory

      • iexplore.exe (PID: 324)
      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 1876)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2344)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2344)
    • Application was dropped or rewritten from another process

      • f1273_Actual%20Multiple%20Monitors%208.13.2[1].tmp (PID: 2584)
      • f1273_Actual%20Multiple%20Monitors%208.13.2[1].tmp (PID: 3360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs f1273_actual%20multiple%20monitors%208.13.2[1].exe f1273_actual%20multiple%20monitors%208.13.2[1].tmp no specs f1273_actual%20multiple%20monitors%208.13.2[1].exe f1273_actual%20multiple%20monitors%208.13.2[1].tmp no specs

Process information

PID
CMD
Path
Indicators
Parent process
2344"C:\Program Files\Internet Explorer\iexplore.exe" https://www.displaylink.com/downloads/windowsC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
324"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2344 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
1876C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exesvchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Version:
26,0,0,131
3468"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe
iexplore.exe
User:
admin
Company:
Actual Tools
Integrity Level:
MEDIUM
Description:
Actual Multiple Monitors Setup
Exit code:
1
Version:
8.13.2_en_DisplayLin
2584"C:\Users\admin\AppData\Local\Temp\is-C0U5P.tmp\f1273_Actual%20Multiple%20Monitors%208.13.2[1].tmp" /SL5="$3022A,10566074,79360,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe" C:\Users\admin\AppData\Local\Temp\is-C0U5P.tmp\f1273_Actual%20Multiple%20Monitors%208.13.2[1].tmpf1273_Actual%20Multiple%20Monitors%208.13.2[1].exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
1
Version:
51.52.0.0
1324"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe" /SPAWNWND=$201F8 /NOTIFYWND=$3022A C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe
f1273_Actual%20Multiple%20Monitors%208.13.2[1].tmp
User:
admin
Company:
Actual Tools
Integrity Level:
HIGH
Description:
Actual Multiple Monitors Setup
Exit code:
1
Version:
8.13.2_en_DisplayLin
3360"C:\Users\admin\AppData\Local\Temp\is-G08V1.tmp\f1273_Actual%20Multiple%20Monitors%208.13.2[1].tmp" /SL5="$301F6,10566074,79360,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I0488CJO\f1273_Actual%20Multiple%20Monitors%208.13.2[1].exe" /SPAWNWND=$201F8 /NOTIFYWND=$3022A C:\Users\admin\AppData\Local\Temp\is-G08V1.tmp\f1273_Actual%20Multiple%20Monitors%208.13.2[1].tmpf1273_Actual%20Multiple%20Monitors%208.13.2[1].exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
1
Version:
51.52.0.0
Total events
1 197
Read events
1 103
Write events
88
Delete events
6

Modification events

(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{905DB60D-6736-11E9-A370-5254004A04AF}
Value:
0
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(2344) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E30704000400190008002E000700D400
Executable files
4
Suspicious files
5
Text files
29
Unknown types
9

Dropped files

PID
Process
Filename
Type
2344iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico
MD5:
SHA256:
2344iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
MD5:
SHA256:
324iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab24CB.tmp
MD5:
SHA256:
324iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar24CC.tmp
MD5:
SHA256:
324iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab24EC.tmp
MD5:
SHA256:
324iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar24ED.tmp
MD5:
SHA256:
324iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab258A.tmp
MD5:
SHA256:
324iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar258B.tmp
MD5:
SHA256:
324iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Z944EACR\windows[1].txt
MD5:
SHA256:
324iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:0449053A848EE8278C919ABD1C5B70ED
SHA256:FBB8CBCF621BB33C7BECAC5F14DC661D7E5A95AD4EAF331B601EE58EDDDFE797
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
33
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
324
iexplore.exe
GET
200
52.218.37.211:80
http://assets.displaylink.com/live/downloads/software/f1273_Actual%20Multiple%20Monitors%208.13.2.exe?AWSAccessKeyId=AKIAJHGQWPVXWHEDJUEA&Expires=1556183049&Signature=0b7WUJ2er253MLxoou1p6dg5t0Q%3D
IE
executable
10.4 Mb
shared
324
iexplore.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.6 Kb
whitelisted
324
iexplore.exe
GET
200
52.85.188.202:80
http://x.ss2.us/x.cer
US
der
1.27 Kb
whitelisted
2344
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
324
iexplore.exe
172.217.22.10:443
ajax.googleapis.com
Google Inc.
US
whitelisted
324
iexplore.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
324
iexplore.exe
54.77.143.153:443
www.displaylink.com
Amazon.com, Inc.
IE
unknown
324
iexplore.exe
23.111.8.154:443
oss.maxcdn.com
netDNA
US
unknown
2344
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
324
iexplore.exe
52.85.188.202:80
x.ss2.us
Amazon.com, Inc.
US
unknown
324
iexplore.exe
216.58.205.234:443
ajax.googleapis.com
Google Inc.
US
whitelisted
2344
iexplore.exe
54.77.143.153:443
www.displaylink.com
Amazon.com, Inc.
IE
unknown
324
iexplore.exe
34.192.123.20:443
t2.trackalyzer.com
Amazon.com, Inc.
US
unknown
324
iexplore.exe
54.173.179.199:443
t2.trackalyzer.com
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
www.displaylink.com
  • 54.77.143.153
  • 34.246.147.251
  • 52.212.141.17
  • 18.203.109.3
unknown
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
x.ss2.us
  • 52.85.188.202
  • 52.85.188.159
  • 52.85.188.74
  • 52.85.188.163
whitelisted
www.download.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.10
  • 205.185.216.10
  • 205.185.216.42
whitelisted
ajax.googleapis.com
  • 172.217.22.10
  • 172.217.18.10
  • 172.217.23.138
  • 172.217.16.170
  • 216.58.208.42
  • 172.217.16.138
  • 172.217.22.42
  • 172.217.22.74
  • 172.217.22.106
  • 216.58.210.10
  • 172.217.16.202
  • 172.217.18.106
  • 172.217.23.170
  • 172.217.21.202
  • 216.58.205.234
  • 172.217.21.234
whitelisted
oss.maxcdn.com
  • 23.111.8.154
whitelisted
fonts.googleapis.com
  • 216.58.205.234
whitelisted
t2.trackalyzer.com
  • 54.173.179.199
  • 34.192.123.20
unknown
www.google-analytics.com
  • 172.217.18.110
whitelisted
stats.g.doubleclick.net
  • 64.233.167.157
  • 64.233.167.155
  • 64.233.167.154
  • 64.233.167.156
whitelisted

Threats

PID
Process
Class
Message
324
iexplore.exe
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
324
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
324
iexplore.exe
Misc activity
ET INFO EXE - Served Attached HTTP
324
iexplore.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
No debug info