File name:

rufus-4.5.exe

Full analysis: https://app.any.run/tasks/6c229aa1-22b5-4fa5-ad5d-0de43d170692
Verdict: Malicious activity
Analysis date: June 30, 2024, 04:54:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5:

129E5BBF63D8299D027186EAFE92754A

SHA1:

C50BD94AF6AF186EDC536EC6FF83BDD233586618

SHA256:

C6E6CDBA209F899E5087F1A1A4BABC759414B4A687B60BA4BCE62B6B37E8E82B

SSDEEP:

49152:fylf3tq20TVtna0ErcAD9tFM8rQB+ddDu31xwW+P03D4Ih8vvXXM9wpA7tiwLShJ:e3QZrErcADTqEd0nwxOJ46wiTShAVfGp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • rufus-4.5.exe (PID: 5060)

    • Changes the Windows auto-update feature

      • rufus-4.5.exe (PID: 5060)

  • SUSPICIOUS

    • Executes as Windows Service

      • vds.exe (PID: 5096)

    • Reads security settings of Internet Explorer

      • rufus-4.5.exe (PID: 5060)

    • Checks Windows Trust Settings

      • rufus-4.5.exe (PID: 5060)

  • INFO

    • Checks supported languages

      • rufus-4.5.exe (PID: 5060)

    • Reads the computer name

      • rufus-4.5.exe (PID: 5060)

    • Reads the machine GUID from the registry

      • rufus-4.5.exe (PID: 5060)

    • Process checks whether UAC notifications are on

      • rufus-4.5.exe (PID: 5060)

    • Checks proxy server information

      • rufus-4.5.exe (PID: 5060)

    • Create files in a temporary directory

      • rufus-4.5.exe (PID: 5060)

    • Reads the software policy settings

      • rufus-4.5.exe (PID: 5060)

    • Creates files or folders in the user directory

      • rufus-4.5.exe (PID: 5060)

    • UPX packer has been detected

      • rufus-4.5.exe (PID: 5060)

    • Manual execution by a user

      • mspaint.exe (PID: 7040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:05:22 11:06:27+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.42
CodeSize: 1462272
InitializedDataSize: 45056
UninitializedDataSize: 2809856
EntryPoint: 0x412bc0
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 4.5.2180.0
ProductVersionNumber: 4.5.2180.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: https://rufus.ie
CompanyName: Akeo Consulting
FileDescription: Rufus
FileVersion: 4.5.2180
InternalName: Rufus
LegalCopyright: � 2011-2024 Pete Batard (GPL v3)
LegalTrademarks: https://www.gnu.org/licenses/gpl-3.0.html
OriginalFileName: rufus-4.5.exe
ProductName: Rufus
ProductVersion: 4.5.2180
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
5
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT rufus-4.5.exe vdsldr.exe no specs vds.exe no specs mspaint.exe no specs rufus-4.5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
696"C:\Users\admin\AppData\Local\Temp\rufus-4.5.exe" C:\Users\admin\AppData\Local\Temp\rufus-4.5.exe—explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
MEDIUM
Description:
Rufus
Exit code:
3221226540
Version:
4.5.2180
Modules
Images
c:\users\admin\appdata\local\temp\rufus-4.5.exe
c:\windows\system32\ntdll.dll
1200C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5060"C:\Users\admin\AppData\Local\Temp\rufus-4.5.exe" C:\Users\admin\AppData\Local\Temp\rufus-4.5.exe
explorer.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
HIGH
Description:
Rufus
Exit code:
0
Version:
4.5.2180
Modules
Images
c:\users\admin\appdata\local\temp\rufus-4.5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5096C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7040"C:\WINDOWS\system32\mspaint.exe" "C:\Users\admin\Desktop\image_2024-06-26_185301077-transformed.png"C:\Windows\System32\mspaint.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Paint
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mspaint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
2 560
Read events
2 399
Write events
95
Delete events
66

Modification events

(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\AppHVSI
Operation:writeName:AllowAppHVSI_ProviderSet
Value:
0
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\EdgeUpdate
Operation:writeName:UpdateDefault
Value:
0
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\Network Connections
Operation:writeName:NC_DoNotShowLocalOnlyIcon
Value:
1
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\Windows Feeds
Operation:writeName:EnableFeeds
Value:
0
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUServer
Value:
http://neverupdatewindows10.com
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:WUStatusServer
Value:
http://neverupdatewindows10.com
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:UpdateServiceUrlAlternate
Value:
http://neverupdatewindows10.com
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:**del.FillEmptyContentUrls
Value:
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:UseWUServer
Value:
1
(PID) Process:(5060) rufus-4.5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy Objects\{0C06BBE4-6FF4-4D7B-A8AE-860AECF6803B}Machine\Software\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
0
Executable files
0
Suspicious files
10
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A66A8DB907BADC9D16AD67B2FBFFDD5Cbinary
MD5:63B8B69F049E4ACBB8392DA67471AC3D
SHA256:236BEDA6994BB80A44AC119EF4630AB70EB7A332BF7FB75066F6C544F845D7E6
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25der
MD5:549200E908EAD6F98AFA4D0DC4C20392
SHA256:9B8EB24703EBDF4BC921597380D0281C739ACB62D9B70D44DEF08A8E48A97984
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:76E3D6E9D4D42BD6DD1C44484C8F3D97
SHA256:211668662260A74AA06090242A2BA359AA62B1F78AA424B54346BAF28FD694F3
5060rufus-4.5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Fido[1].vertext
MD5:0A586EA05296D8D5DBF1794623549EF7
SHA256:BE54C9BD09907B0753DFE3A3C6F02457CA0EA607ED086AC0EB8F2DA99DB37AF2
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:2EC5F7AE7F69EEDE5DBC00DB21A5505D
SHA256:2367DFCC20343415DF4275A3DA6E7DDA3DE7203280AD4204A8C7E6DE10DD25F7
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:ACC325C6051B4C70FCD162A216E65FB7
SHA256:5B3E6442EE3760445E676ACF17678BF76D436829F87454D3C3FA25C1D7A0F9EA
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90der
MD5:541ED390A8828C2AFEB2929E03C5FF5A
SHA256:A23B22C5C90B48825577A8BCE53AA9C04BE2CEB75072CF96F5FFA33680857A09
5060rufus-4.5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:EE70FEE188F215D1F70713994464DE9D
SHA256:9CB70816403208ABE78DF888D1CCCB13605F616CE18E27AA484BB1E097FD2C5C
5060rufus-4.5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Rufus_win.ver[1].sigbinary
MD5:2C85BF12103135E5B608A713AA2C588D
SHA256:12C0A821F3341D537672D5B8B3C144D5ADDC49597F5655A1447C9955FDF46F77
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
78
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
5060
rufus-4.5.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
unknown
5060
rufus-4.5.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
unknown
5060
rufus-4.5.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEE4o94a2bBo7lCzSxA63QqU%3D
unknown
—
—
unknown
5060
rufus-4.5.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
2468
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6252
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
3032
svchost.exe
GET
304
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3580
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3680
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4656
SearchApp.exe
104.126.37.145:443
r.bing.com
Akamai International B.V.
DE
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2168
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2168
svchost.exe
224.0.0.251:5353
—
—
—
unknown
4656
SearchApp.exe
104.126.37.131:443
r.bing.com
Akamai International B.V.
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.76
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.20
whitelisted
r.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
rufus.ie
  • 185.199.110.153
  • 185.199.109.153
  • 185.199.108.153
  • 185.199.111.153
unknown
github.com
  • 140.82.121.3
shared
go.microsoft.com
  • 184.28.89.167
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

No threats detected
Process
Message
rufus-4.5.exe
*** Rufus init ***
rufus-4.5.exe
Cur dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.5.exe
App dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.5.exe
Sys dir: 'C:\WINDOWS\system32'
rufus-4.5.exe
Usr dir: 'C:\Users\admin'
rufus-4.5.exe
Dat dir: 'C:\Users\admin\AppData\Local'
rufus-4.5.exe
Tmp dir: 'C:\Users\admin\AppData\Local\Temp\'
rufus-4.5.exe
Binary executable is signed by 'Akeo Consulting'
rufus-4.5.exe
Will use settings from registry
rufus-4.5.exe
loc file not found in current directory - embedded one will be used
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
rufus-4.5.exe