File name:

rufus-4.5.exe

Full analysis: https://app.any.run/tasks/6c229aa1-22b5-4fa5-ad5d-0de43d170692
Verdict: Malicious activity
Analysis date: June 30, 2024, 04:54:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

129E5BBF63D8299D027186EAFE92754A

SHA1:

C50BD94AF6AF186EDC536EC6FF83BDD233586618

SHA256:

C6E6CDBA209F899E5087F1A1A4BABC759414B4A687B60BA4BCE62B6B37E8E82B

SSDEEP:

49152:fylf3tq20TVtna0ErcAD9tFM8rQB+ddDu31xwW+P03D4Ih8vvXXM9wpA7tiwLShJ:e3QZrErcADTqEd0nwxOJ46wiTShAVfGp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • rufus-4.5.exe (PID: 5060)

    • Changes the Windows auto-update feature

      • rufus-4.5.exe (PID: 5060)

  • SUSPICIOUS

    • Executes as Windows Service

      • vds.exe (PID: 5096)

    • Checks Windows Trust Settings

      • rufus-4.5.exe (PID: 5060)

    • Reads security settings of Internet Explorer

      • rufus-4.5.exe (PID: 5060)

  • INFO

    • Checks supported languages

      • rufus-4.5.exe (PID: 5060)

    • Reads the machine GUID from the registry

      • rufus-4.5.exe (PID: 5060)

    • Reads the computer name

      • rufus-4.5.exe (PID: 5060)

    • Create files in a temporary directory

      • rufus-4.5.exe (PID: 5060)

    • Reads the software policy settings

      • rufus-4.5.exe (PID: 5060)

    • Process checks whether UAC notifications are on

      • rufus-4.5.exe (PID: 5060)

    • Creates files or folders in the user directory

      • rufus-4.5.exe (PID: 5060)

    • Checks proxy server information

      • rufus-4.5.exe (PID: 5060)

    • UPX packer has been detected

      • rufus-4.5.exe (PID: 5060)

    • Manual execution by a user

      • mspaint.exe (PID: 7040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:22 11:06:27+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.42
CodeSize: 1462272
InitializedDataSize: 45056
UninitializedDataSize: 2809856
EntryPoint: 0x412bc0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 4.5.2180.0
ProductVersionNumber: 4.5.2180.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: https://rufus.ie
CompanyName: Akeo Consulting
FileDescription: Rufus
FileVersion: 4.5.2180
InternalName: Rufus
LegalCopyright: � 2011-2024 Pete Batard (GPL v3)
LegalTrademarks: https://www.gnu.org/licenses/gpl-3.0.html
OriginalFileName: rufus-4.5.exe
ProductName: Rufus
ProductVersion: 4.5.2180
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT rufus-4.5.exe vdsldr.exe no specs vds.exe no specs mspaint.exe no specs rufus-4.5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696"C:\Users\admin\AppData\Local\Temp\rufus-4.5.exe" C:\Users\admin\AppData\Local\Temp\rufus-4.5.exe—explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
MEDIUM
Description:
Rufus
Exit code:
3221226540
Version:
4.5.2180
Modules
Images
c:\users\admin\appdata\local\temp\rufus-4.5.exe
c:\windows\system32\ntdll.dll
1200C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5060"C:\Users\admin\AppData\Local\Temp\rufus-4.5.exe" C:\Users\admin\AppData\Local\Temp\rufus-4.5.exe
explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
HIGH
Description:
Rufus
Exit code:
0
Version:
4.5.2180
Modules
Images
c:\users\admin\appdata\local\temp\rufus-4.5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5096C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7040"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\image_2024-06-26_185301077-transformed.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
2 560
Read events
2 399
Write events
95
Delete events
66

Modification events

(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\AppHVSI
Operation:writeName:AllowAppHVSI_ProviderSet
Value:
0
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\EdgeUpdate
Operation:writeName:UpdateDefault
Value:
0
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\Network Connections
Operation:writeName:NC_DoNotShowLocalOnlyIcon
Value:
1
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\Windows Feeds
Operation:writeName:EnableFeeds
Value:
0
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUServer
Value:
http://neverupdatewindows10.com
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUStatusServer
Value:
http://neverupdatewindows10.com
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:UpdateServiceUrlAlternate
Value:
http://neverupdatewindows10.com
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:**del.FillEmptyContentUrls
Value:
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:UseWUServer
Value:
1
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
0
Executable files
0
Suspicious files
10
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
5060rufus-4.5.exeC:\Users\admin\AppData\Local\Temp\RufDBCB.tmptext
MD5:711B1476D716A52EEB5EE7565F612D0E
SHA256:B5C7B62A8281A940A479D8E6496710A7B96F45B406D10FB2E09C910FCE50949D
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:76E3D6E9D4D42BD6DD1C44484C8F3D97
SHA256:211668662260A74AA06090242A2BA359AA62B1F78AA424B54346BAF28FD694F3
5060rufus-4.5.exeC:\WINDOWS\System32\GroupPolicy\Machine\Registry.polbinary
MD5:0C014C71A70DC7758BFDC822E974F1F3
SHA256:8EBD915268E16B55A3ABDE6F612363576FAB5DF656F955D672CCE8889C5FF9CA
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25der
MD5:549200E908EAD6F98AFA4D0DC4C20392
SHA256:9B8EB24703EBDF4BC921597380D0281C739ACB62D9B70D44DEF08A8E48A97984
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A66A8DB907BADC9D16AD67B2FBFFDD5Cder
MD5:B7ACB791FC30F01B9C3791F62F641D57
SHA256:107C3FC9C586F563933E094E2B3083BEB4BFD305A70E4AE6B412B60A016EF1DB
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:2EC5F7AE7F69EEDE5DBC00DB21A5505D
SHA256:2367DFCC20343415DF4275A3DA6E7DDA3DE7203280AD4204A8C7E6DE10DD25F7
5060rufus-4.5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Rufus_win[1].vertext
MD5:B071392D8264070FF6E4CA0FA0FD06A6
SHA256:7C1D2CFAF6CF893C186ABF59B21B63FD38C818267F179F36E90171F80C91641E
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5Cbinary
MD5:63B8B69F049E4ACBB8392DA67471AC3D
SHA256:236BEDA6994BB80A44AC119EF4630AB70EB7A332BF7FB75066F6C544F845D7E6
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:EE70FEE188F215D1F70713994464DE9D
SHA256:9CB70816403208ABE78DF888D1CCCB13605F616CE18E27AA484BB1E097FD2C5C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
78
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
5060
rufus-4.5.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
unknown
5060
rufus-4.5.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
unknown
5060
rufus-4.5.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D
unknown
—
—
unknown
5060
rufus-4.5.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
2468
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6252
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6252
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3580
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3680
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4656
SearchApp.exe
104.126.37.145:443
r.bing.com
Akamai International B.V.
DE
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2168
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2168
svchost.exe
224.0.0.251:5353
—
—
—
unknown
4656
SearchApp.exe
104.126.37.131:443
r.bing.com
Akamai International B.V.
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.20
whitelisted
r.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
rufus.ie
  • 185.199.110.153
  • 185.199.109.153
  • 185.199.108.153
  • 185.199.111.153
unknown
github.com
  • 140.82.121.3
shared
go.microsoft.com
  • 184.28.89.167
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

No threats detected
Process
Message
rufus-4.5.exe
*** Rufus init ***
rufus-4.5.exe
Cur dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.5.exe
App dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.5.exe
Sys dir: 'C:\WINDOWS\system32'
rufus-4.5.exe
Usr dir: 'C:\Users\admin'
rufus-4.5.exe
Dat dir: 'C:\Users\admin\AppData\Local'
rufus-4.5.exe
Tmp dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.5.exe
Binary executable is signed by 'Akeo Consulting'
rufus-4.5.exe
Will use settings from registry
rufus-4.5.exe
loc file not found in current directory - embedded one will be used
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rufus-4.5.exe