analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zip

Full analysis: https://app.any.run/tasks/6149641e-df53-485c-8056-39c5a9f0c3b7
Verdict: Malicious activity
Analysis date: June 19, 2019, 11:18:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
opendir
Indicators:
MD5:

8E5EEC4D19DC46850F3AC3EDAF519D7B

SHA1:

EE50C9771F8A9F24D793814A5FBA89726FC58D71

SHA256:

CC84210F35F467CDAF5830301A58F4CD105080AFD98FB271940F34F5D83C3A1D

SSDEEP:

3:N1KJS4JsRx/YkzLqrSkzLqqc:Cc4JGxNqrXqv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GetLocalAdminsGUISetup.exe (PID: 3244)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1000)
      • GetLocalAdminsGUISetup.exe (PID: 3244)
      • WinRAR.exe (PID: 1712)
      • msiexec.exe (PID: 3880)

    • Executed as Windows Service

      • vssvc.exe (PID: 2084)

    • Creates files in the user directory

      • GetLocalAdminsGUISetup.exe (PID: 3244)

    • Executed via COM

      • DrvInst.exe (PID: 3632)

  • INFO

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1452)

    • Reads Internet Cache Settings

      • opera.exe (PID: 3172)

    • Manual execution by user

      • WinRAR.exe (PID: 1712)
      • GetLocalAdminsGUISetup.exe (PID: 3244)

    • Application launched itself

      • msiexec.exe (PID: 3880)

    • Creates files in the user directory

      • opera.exe (PID: 3172)

    • Adds / modifies Windows certificates

      • DrvInst.exe (PID: 3632)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2084)

    • Changes settings of System certificates

      • DrvInst.exe (PID: 3632)

    • Searches for installed software

      • msiexec.exe (PID: 3880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start opera.exe winrar.exe getlocaladminsguisetup.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs drvinst.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3172"C:\Program Files\Opera\opera.exe" http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zipC:\Program Files\Opera\opera.exe
explorer.exe
User:
admin
Company:
Opera Software
Integrity Level:
MEDIUM
Description:
Opera Internet Browser
Version:
1748
1712"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\GetLocalAdminsGUI.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
3244"C:\Users\admin\Desktop\GetLocalAdminsGUISetup.exe" C:\Users\admin\Desktop\GetLocalAdminsGUISetup.exe
explorer.exe
User:
admin
Company:
Cjwdev
Integrity Level:
MEDIUM
Description:
This installer database contains the logic and data required to install Get Local Admins GUI.
Version:
2.4.0
1000 /i "C:\Users\admin\AppData\Roaming\Cjwdev\Get Local Admins GUI 2.4.0\install\GetLocalAdminsGUISetup.msi" AI_SETUPEXEPATH="C:\Users\admin\Desktop\GetLocalAdminsGUISetup.exe" SETUPEXEDIR="C:\Users\admin\Desktop\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "C:\Windows\system32\msiexec.exe
GetLocalAdminsGUISetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
3880C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
1452C:\Windows\system32\MsiExec.exe -Embedding 71A7208EA3B72749C91C2EF4F3A4A1D9 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
2084C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3632DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "000003C4" "00000334"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
1 148
Read events
869
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
34
Text files
131
Unknown types
0

Dropped files

PID
Process
Filename
Type
3172opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprFFF8.tmp —
MD5:—
SHA256:—
3172opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr9.tmp —
MD5:—
SHA256:—
3172opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr96.tmp —
MD5:—
SHA256:—
3172opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr00002.tmp —
MD5:—
SHA256:—
3172opera.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1U3CHPV1GMFESNWWK4UJ.temp —
MD5:—
SHA256:—
3172opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.datbinary
MD5:5BDC4A873BF44302FE081B30247102F1
SHA256:DA890B951306F1B98A5A359C777BA3C624BB9D06966AB2E357C49F1D7054DA1D
3172opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.initext
MD5:2A5E48E98F685FC8080903FFF02B3D21
SHA256:517C650F6B9E17F6C275DE2ECAA76244EC9B7A0E4C287588938674ACB798228B
3172opera.exeC:\Users\admin\AppData\Local\Opera\Opera\cache\g_0000\opr00001.tmpcompressed
MD5:00F64C054629CD44F322449E7C0AB559
SHA256:E30E571DDE7ED8C267605EEA968DC786CD77523334CEB286A2BD61DB557AE5C5
3172opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xmlxml
MD5:FFA86434295A8E2E2B3F5596D375415D
SHA256:5B7F1E91606592DB0FBF85BAB27F0EBEB30B95444C969D631B2BE0F0521FCD22
3172opera.exeC:\Users\admin\AppData\Roaming\Opera\Opera\opr5E67.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
6
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3172
opera.exe
GET
—
94.136.40.103:80
http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zip
GB
—
—
malicious
3172
opera.exe
GET
200
94.136.40.103:80
http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zip
GB
compressed
2.25 Mb
malicious
—
—
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
543 b
whitelisted
3172
opera.exe
GET
400
185.26.182.112:80
http://sitecheck2.opera.com/?host=www.cjwdev.com&hdn=05mLfJNc6XRzsqaL0iwXXg==
unknown
html
150 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3172
opera.exe
185.26.182.112:80
sitecheck2.opera.com
Opera Software AS
—
malicious
3172
opera.exe
185.26.182.93:443
sitecheck2.opera.com
Opera Software AS
—
whitelisted
—
—
93.184.220.29:80
crl4.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3172
opera.exe
94.136.40.103:80
www.cjwdev.com
Host Europe GmbH
GB
malicious

DNS requests

Domain
IP
Reputation
www.cjwdev.com
  • 94.136.40.103
malicious
sitecheck2.opera.com
  • 185.26.182.112
  • 185.26.182.93
  • 185.26.182.94
  • 185.26.182.111
whitelisted
certs.opera.com
  • 185.26.182.93
  • 185.26.182.94
whitelisted
crl4.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://www.cjwdev.com/Software/GetLocalAdminsGUI/GetLocalAdminsGUI.zip