analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://anonfiles.com/l9j6gfBby6/Kayne_Premium_Injector_rar

Full analysis: https://app.any.run/tasks/89f14317-21b4-4e52-bcd8-dd3de70517c1
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: October 04, 2022, 22:33:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MD5:

79A3040DEF408712F72A1E01315D571E

SHA1:

040ACB03C8CB87AF0D1B593F054889ACCD78AC3B

SHA256:

CB3044DEDF463B4E3C3EAC73A0B0FF354CC17D7CCB9152832364B0671CD0C8D9

SSDEEP:

3:N8M2ScE8XLV+QKQlX:2M2vE8sQKKX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Kayne Premium Injector.exe (PID: 2300)

    • Drops executable file immediately after starts

      • Kayne Premium Injector.exe (PID: 2300)

    • Application was dropped or rewritten from another process

      • Synaptics.exe (PID: 2276)

    • Changes settings of System certificates

      • Synaptics.exe (PID: 2276)

    • Connects to CnC server

      • Synaptics.exe (PID: 2276)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2700)

    • Reads the computer name

      • WinRAR.exe (PID: 752)
      • ._cache_Kayne Premium Injector.exe (PID: 3784)
      • Kayne Premium Injector.exe (PID: 2300)
      • Synaptics.exe (PID: 2276)

    • Checks supported languages

      • WinRAR.exe (PID: 752)
      • Kayne Premium Injector.exe (PID: 2300)
      • ._cache_Kayne Premium Injector.exe (PID: 3784)
      • Synaptics.exe (PID: 2276)

    • Creates files in the program directory

      • Kayne Premium Injector.exe (PID: 2300)

    • Executable content was dropped or overwritten

      • Kayne Premium Injector.exe (PID: 2300)

    • Drops a file with a compile date too recent

      • Kayne Premium Injector.exe (PID: 2300)

    • Reads the date of Windows installation

      • Kayne Premium Injector.exe (PID: 2300)

    • Adds / modifies Windows certificates

      • Synaptics.exe (PID: 2276)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 1160)
      • iexplore.exe (PID: 2700)

    • Checks supported languages

      • iexplore.exe (PID: 2700)
      • iexplore.exe (PID: 1160)

    • Application launched itself

      • iexplore.exe (PID: 1160)

    • Changes internet zones settings

      • iexplore.exe (PID: 1160)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2700)
      • iexplore.exe (PID: 1160)
      • Synaptics.exe (PID: 2276)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2700)
      • iexplore.exe (PID: 1160)
      • Synaptics.exe (PID: 2276)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1160)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1160)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2700)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1160)

    • Manual execution by user

      • Kayne Premium Injector.exe (PID: 2300)

    • Creates files in the user directory

      • iexplore.exe (PID: 1160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe winrar.exe no specs kayne premium injector.exe ._cache_kayne premium injector.exe no specs synaptics.exe

Process information

PID
CMD
Path
Indicators
Parent process
1160"C:\Program Files\Internet Explorer\iexplore.exe" "https://anonfiles.com/l9j6gfBby6/Kayne_Premium_Injector_rar"C:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2700"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1160 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
752"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\Kayne Premium Injector.rar"C:\Program Files\WinRAR\WinRAR.exe—iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
2300"C:\Users\admin\Desktop\Kayne Premium Injector.exe" C:\Users\admin\Desktop\Kayne Premium Injector.exe
Explorer.EXE
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\desktop\kayne premium injector.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
3784"C:\Users\admin\Desktop\._cache_Kayne Premium Injector.exe" C:\Users\admin\Desktop\._cache_Kayne Premium Injector.exe—Kayne Premium Injector.exe
User:
admin
Company:
Kayne Premium Cheats
Integrity Level:
MEDIUM
Description:
Kayne Premium Injector
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\._cache_kayne premium injector.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2276"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdateC:\ProgramData\Synaptics\Synaptics.exe
Kayne Premium Injector.exe
User:
admin
Company:
Synaptics
Integrity Level:
HIGH
Description:
Synaptics Pointing Device Driver
Version:
1.0.0.4
Modules
Images
c:\programdata\synaptics\synaptics.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
21 152
Read events
20 882
Write events
265
Delete events
5

Modification events

(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30988353
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30988353
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1160) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
2
Suspicious files
23
Text files
41
Unknown types
16

Dropped files

PID
Process
Filename
Type
2700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
2700iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab98B8.tmpcompressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
2700iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9858.tmpcompressed
MD5:D15AAA7C9BE910A9898260767E2490E1
SHA256:F8EBAAF487CBA0C81A17C8CD680BDD2DD8E90D2114ECC54844CFFC0CC647848E
1160iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442der
MD5:B8BDA0B382A7D056A4241B388338B778
SHA256:7BAA967F6686CCE471826B20FFA5CB7FEB4BF3C5C0BF43F51F08E84EB5850DD2
2700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1730E8844DE71B39763A90AF666B175Fbinary
MD5:3EE686AF3B2B1CF3211D352BEE2B9825
SHA256:3604B194F94F2EA9B033C4B61F147442BFA67BED640F05AC58C0C2EEA625C282
2700iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar98B9.tmpcat
MD5:C75C82DE5128C3E55D72A4FF9C73F5E4
SHA256:379E2F7218F036D70E2C474BF6A09364C5623C1C5F8D5A1A16F1B9B1EC243B55
2700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\app[1].jstext
MD5:EBF881A573C65E946D0B67BBAE1F7D8D
SHA256:EE607A4919A33F6946C245C09D6DB9DD3085EF77BF9F8A7A3A819F3CFFE178A7
2700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:D7B0E4D706C6802F650A8BFB1B899E68
SHA256:38FD6A99F39C1F13BE9ADB2E2B75670398EDDABF9DFDE08AF773C375F6FC376D
2700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\Kayne_Premium_Injector_rar[1].htmhtml
MD5:40DF608EAE0D7D0FAE55C10BA82512C2
SHA256:C32B1EC43567C86883227C0ECF173B73FBCBDD26B8231625D287CB039642CB4A
1160iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442binary
MD5:A95081796240916E20868590337AF0EA
SHA256:263D3C1865046FF8038B9AC78D05D17EA1065B575FF6FCCF564539D6BA3F43E9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
43
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2276
Synaptics.exe
GET
—
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
US
—
—
whitelisted
1160
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2700
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHwqDCE%2FxlVTRckfGR%2B4Tvo%3D
US
der
1.40 Kb
whitelisted
2700
iexplore.exe
GET
200
195.138.255.17:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgR%2FwA4ZeNvVw8rA7Gw5fk6aUw%3D%3D
DE
der
503 b
shared
2276
Synaptics.exe
GET
200
142.250.187.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2700
iexplore.exe
GET
200
13.226.156.65:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
2700
iexplore.exe
GET
200
8.238.29.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?ed8ed47fe1f5dabe
US
compressed
4.70 Kb
whitelisted
2700
iexplore.exe
GET
200
8.238.29.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2d51f1b9c4bc0bff
US
compressed
60.9 Kb
whitelisted
1160
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
2700
iexplore.exe
GET
200
8.238.29.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8672151e4333f977
US
compressed
60.9 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2700
iexplore.exe
96.16.145.230:80
x1.c.lencr.org
AKAMAI-AS
DE
suspicious
1160
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2700
iexplore.exe
45.154.253.151:443
anonfiles.com
Svea Hosting AB
GB
suspicious
2700
iexplore.exe
104.18.21.226:80
ocsp2.globalsign.com
CLOUDFLARENET
—
shared
2700
iexplore.exe
151.101.2.217:443
vjs.zencdn.net
FASTLY
US
suspicious
1160
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2700
iexplore.exe
13.226.156.63:443
djv99sxoqpv11.cloudfront.net
AMAZON-02
US
unknown
2700
iexplore.exe
195.138.255.17:80
r3.o.lencr.org
AS33891 Netzbetrieb GmbH
DE
whitelisted
2700
iexplore.exe
8.238.29.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
2700
iexplore.exe
13.226.156.74:80
o.ss2.us
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
anonfiles.com
  • 45.154.253.151
  • 45.154.253.152
  • 45.154.253.150
shared
ctldl.windowsupdate.com
  • 8.238.29.254
  • 67.27.157.254
  • 8.248.147.254
  • 67.26.83.254
  • 8.248.113.254
whitelisted
x1.c.lencr.org
  • 96.16.145.230
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
r3.o.lencr.org
  • 195.138.255.17
  • 195.138.255.18
shared
vjs.zencdn.net
  • 151.101.2.217
  • 151.101.66.217
  • 151.101.130.217
  • 151.101.194.217
whitelisted
djv99sxoqpv11.cloudfront.net
  • 13.226.156.63
  • 13.226.156.64
  • 13.226.156.187
  • 13.226.156.117
shared
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to Abused Domain *.mooo.com
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://anonfiles.com/l9j6gfBby6/Kayne_Premium_Injector_rar