File name:

TeraCopy.3.21.Pro.keygen.exe

Full analysis: https://app.any.run/tasks/78337794-7914-4278-9877-b54901234f9c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: July 10, 2020, 10:31:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
stealer
evasion
copper
fareit
pony
adware
innotools
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

02BF1160E776270691FF519E2F11D91B

SHA1:

05C33135ADFCFB050C065FF100A5C3981A38EFC8

SHA256:

DF2067E684991F1425AE39D8EA8C5435B69D633CBDB3B5347F2F7603C2D0F7E9

SSDEEP:

196608:Ou7iWYZqeMI7OzMUDw6WZAkg4ftMzb0EMNaI5ePjeIiVSdsSXX1V8ZVM3TFPvZ7L:DGWHepMMcwHQ40tMNaI5erejVSzlV8Mn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Application was dropped or rewritten from another process

      • keygen-step-3.exe (PID: 3944)
      • keygen-step-1.exe (PID: 4012)
      • keygen-pr.exe (PID: 3856)
      • keygen-step-4.exe (PID: 648)
      • key.exe (PID: 2364)
      • key.exe (PID: 308)
      • id6.exe (PID: 1732)
      • hjjgaa.exe (PID: 2472)
      • gcttt.exe (PID: 1740)
      • Setup.exe (PID: 3912)
      • jfiag_gg.exe (PID: 2372)
      • gcttt.exe (PID: 2256)
      • jfiag_gg.exe (PID: 2388)
      • Setup.exe (PID: 2148)
      • jfiag_gg.exe (PID: 2080)
      • jfiag_gg.exe (PID: 2644)
      • Installer.exe (PID: 4088)
      • Installer.exe (PID: 2516)
      • hjjgaa.exe (PID: 4076)
      • ProZipper.exe (PID: 348)
      • Install.exe (PID: 3188)
      • Lysuvoboxe.exe (PID: 1868)
      • Nytasurufa.exe (PID: 2068)
      • ProZipper.exe (PID: 3852)
      • Kukyxoraezho.exe (PID: 3164)
      • Install.exe (PID: 3948)
    • Stealing of credential data

      • id6.exe (PID: 1732)
    • Actions looks like stealing of personal data

      • id6.exe (PID: 1732)
      • keygen-step-4.exe (PID: 648)
      • key.exe (PID: 2364)
    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3436)
      • cmd.exe (PID: 2896)
    • Connects to CnC server

      • keygen-step-3.exe (PID: 3944)
      • id6.exe (PID: 1732)
      • key.exe (PID: 2364)
      • hjjgaa.exe (PID: 2472)
      • gcttt.exe (PID: 2256)
      • Lysuvoboxe.exe (PID: 1868)
    • Downloads executable files from the Internet

      • keygen-step-1.exe (PID: 4012)
      • Installer.tmp (PID: 4064)
    • Loads dropped or rewritten executable

      • keygen-step-1.exe (PID: 4012)
      • WerFault.exe (PID: 3484)
      • ProZipper.exe (PID: 3852)
    • Changes the autorun value in the registry

      • hjjgaa.exe (PID: 2472)
      • gcttt.exe (PID: 2256)
      • prozipperRed.exe (PID: 2568)
    • COPPER was detected

      • Setup.exe (PID: 2148)
    • Detected Pony/Fareit Trojan

      • key.exe (PID: 2364)
    • PONY was detected

      • key.exe (PID: 2364)
    • Changes settings of System certificates

      • prozipperRed.exe (PID: 2568)
      • hjjgaa.exe (PID: 2472)
      • gcttt.exe (PID: 2256)
    • INNOTOOLS was detected

      • Installer.tmp (PID: 4064)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • TeraCopy.3.21.Pro.keygen.exe (PID: 2428)
      • keygen-step-4.exe (PID: 648)
      • keygen-pr.exe (PID: 3856)
      • keygen-step-1.exe (PID: 4012)
      • hjjgaa.exe (PID: 2472)
      • gcttt.exe (PID: 2256)
      • Installer.exe (PID: 4088)
      • Installer.tmp (PID: 4064)
      • Installer.exe (PID: 2516)
      • prozipperRed.exe (PID: 2568)
      • ProZipper.exe (PID: 348)
      • ProZipper.tmp (PID: 3860)
      • Install.exe (PID: 3188)
      • Install.exe (PID: 3948)
    • Reads the cookies of Google Chrome

      • keygen-step-3.exe (PID: 3944)
      • id6.exe (PID: 1732)
      • jfiag_gg.exe (PID: 2372)
      • jfiag_gg.exe (PID: 2388)
    • Creates files in the user directory

      • id6.exe (PID: 1732)
      • key.exe (PID: 2364)
    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 3944)
      • Setup.exe (PID: 2148)
    • Application launched itself

      • key.exe (PID: 2364)
      • hjjgaa.exe (PID: 4076)
      • gcttt.exe (PID: 1740)
    • Reads the Windows organization settings

      • key.exe (PID: 308)
      • Install.tmp (PID: 2508)
    • Creates files in the program directory

      • keygen-step-1.exe (PID: 4012)
    • Reads the cookies of Mozilla Firefox

      • id6.exe (PID: 1732)
    • Starts CMD.EXE for commands execution

      • keygen-step-3.exe (PID: 3944)
      • Setup.exe (PID: 2148)
      • TeraCopy.3.21.Pro.keygen.exe (PID: 2428)
    • Reads Internet Cache Settings

      • id6.exe (PID: 1732)
      • key.exe (PID: 2364)
      • Installer.tmp (PID: 4064)
    • Reads Environment values

      • key.exe (PID: 308)
    • Reads Windows owner or organization settings

      • key.exe (PID: 308)
      • Install.tmp (PID: 2508)
    • Reads Windows Product ID

      • key.exe (PID: 308)
    • Checks for external IP

      • hjjgaa.exe (PID: 2472)
      • gcttt.exe (PID: 2256)
    • Low-level read access rights to disk partition

      • Setup.exe (PID: 2148)
    • Loads DLL from Mozilla Firefox

      • key.exe (PID: 2364)
    • Searches for installed software

      • key.exe (PID: 2364)
      • key.exe (PID: 308)
    • Adds / modifies Windows certificates

      • prozipperRed.exe (PID: 2568)
      • gcttt.exe (PID: 2256)
      • hjjgaa.exe (PID: 2472)
    • Starts Internet Explorer

      • ProZipper.tmp (PID: 3860)
      • Nytasurufa.exe (PID: 2068)
    • Creates files in the Windows directory

      • prozipperRed.exe (PID: 2568)
  • INFO

    • Reads Microsoft Office registry keys

      • key.exe (PID: 308)
    • Reads settings of System Certificates

      • gcttt.exe (PID: 2256)
      • hjjgaa.exe (PID: 2472)
      • prozipperRed.exe (PID: 2568)
      • iexplore.exe (PID: 3912)
    • Application was dropped or rewritten from another process

      • Installer.tmp (PID: 2500)
      • Installer.tmp (PID: 4064)
      • prozipperRed.exe (PID: 2568)
      • ProZipper.tmp (PID: 3860)
      • Install.tmp (PID: 3272)
      • Install.tmp (PID: 2508)
    • Loads dropped or rewritten executable

      • Installer.tmp (PID: 4064)
      • ProZipper.tmp (PID: 3860)
    • Creates files in the program directory

      • prozipperRed.exe (PID: 2568)
      • ProZipper.tmp (PID: 3860)
    • Creates a software uninstall entry

      • ProZipper.tmp (PID: 3860)
    • Application launched itself

      • iexplore.exe (PID: 3468)
    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3912)
      • iexplore.exe (PID: 3468)
      • iexplore.exe (PID: 2524)
    • Changes internet zones settings

      • iexplore.exe (PID: 3468)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3912)
    • Changes settings of System certificates

      • iexplore.exe (PID: 3912)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2524)
      • iexplore.exe (PID: 3912)
    • Creates files in the user directory

      • iexplore.exe (PID: 2524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:03:26 11:02:47+01:00
PEType: PE32
LinkerVersion: 14
CodeSize: 198144
InitializedDataSize: 254464
UninitializedDataSize: -
EntryPoint: 0x1e1f9
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 26-Mar-2020 10:02:47
Detected languages:
  • English - United States
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 26-Mar-2020 10:02:47
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00030581
0x00030600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.70021
.rdata
0x00032000
0x0000A332
0x0000A400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.23888
.data
0x0003D000
0x000238B0
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.83994
.gfids
0x00061000
0x000000E8
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.12166
.rsrc
0x00062000
0x0000DFD0
0x0000E000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.63693
.reloc
0x00070000
0x0000210C
0x00002200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.61039

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.25329
1875
UNKNOWN
English - United States
RT_MANIFEST
2
5.10026
2216
UNKNOWN
English - United States
RT_ICON
3
5.25868
3752
UNKNOWN
English - United States
RT_ICON
4
5.02609
1128
UNKNOWN
English - United States
RT_ICON
5
5.18109
4264
UNKNOWN
English - United States
RT_ICON
6
5.04307
9640
UNKNOWN
English - United States
RT_ICON
7
3.1586
482
UNKNOWN
English - United States
RT_STRING
8
3.11685
460
UNKNOWN
English - United States
RT_STRING
9
3.11236
440
UNKNOWN
English - United States
RT_STRING
10
2.99727
326
UNKNOWN
English - United States
RT_STRING

Imports

KERNEL32.dll
USER32.dll (delay-loaded)
gdiplus.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
96
Monitored processes
44
Malicious processes
18
Suspicious processes
7

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start teracopy.3.21.pro.keygen.exe cmd.exe no specs keygen-pr.exe keygen-step-1.exe keygen-step-3.exe keygen-step-4.exe #PONY key.exe id6.exe cmd.exe no specs key.exe no specs ping.exe no specs hjjgaa.exe no specs hjjgaa.exe gcttt.exe no specs jfiag_gg.exe no specs gcttt.exe setup.exe no specs jfiag_gg.exe no specs #COPPER setup.exe jfiag_gg.exe no specs jfiag_gg.exe no specs cmd.exe no specs installer.exe ping.exe no specs installer.tmp no specs werfault.exe no specs installer.exe #INNOTOOLS installer.tmp prozipperred.exe prozipper.exe prozipper.tmp kukyxoraezho.exe iexplore.exe prozipper.exe no specs nytasurufa.exe iexplore.exe lysuvoboxe.exe iexplore.exe no specs install.exe iexplore.exe install.tmp no specs install.exe install.tmp no specs searzar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
308C:\Users\admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.datC:\Users\admin\AppData\Local\Temp\RarSFX1\key.exekey.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\key.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
348"C:\Program Files\MSBuild\TEHNXJQRPW\ProZipper.exe" /VERYSILENTC:\Program Files\MSBuild\TEHNXJQRPW\ProZipper.exe
prozipperRed.exe
User:
admin
Company:
ProZipper
Integrity Level:
HIGH
Description:
ProZipper Setup
Exit code:
0
Version:
Modules
Images
c:\program files\msbuild\tehnxjqrpw\prozipper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
648keygen-step-4.exe C:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\keygen-step-4.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1732"C:\Users\admin\AppData\Local\Temp\RarSFX2\id6.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\id6.exe
keygen-step-4.exe
User:
admin
Company:
TODO: <公司名>
Integrity Level:
MEDIUM
Description:
ddvc
Exit code:
4294967295
Version:
1.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\id6.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
1740"C:\Users\admin\AppData\Local\Temp\RarSFX2\gcttt.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\gcttt.exekeygen-step-4.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\gcttt.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1868"C:\Users\admin\AppData\Local\Temp\74-99e02-d8e-8cdad-810c39f5efbb7\Lysuvoboxe.exe" /noatC:\Users\admin\AppData\Local\Temp\74-99e02-d8e-8cdad-810c39f5efbb7\Lysuvoboxe.exe
prozipperRed.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
windows updater
Exit code:
0
Version:
4.4.3.2
Modules
Images
c:\users\admin\appdata\local\temp\74-99e02-d8e-8cdad-810c39f5efbb7\lysuvoboxe.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2068"C:\Users\admin\AppData\Local\Temp\fb-ac970-666-667ad-6ddec2bbb4d2f\Nytasurufa.exe" /staticC:\Users\admin\AppData\Local\Temp\fb-ac970-666-667ad-6ddec2bbb4d2f\Nytasurufa.exe
prozipperRed.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
7.6.5.7
Modules
Images
c:\users\admin\appdata\local\temp\fb-ac970-666-667ad-6ddec2bbb4d2f\nytasurufa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2080C:\Users\admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\admin\AppData\Local\Temp\fjgha23_fa.txtC:\Users\admin\AppData\Local\Temp\jfiag_gg.exehjjgaa.exe
User:
admin
Company:
NirSoft
Integrity Level:
HIGH
Description:
EdgeCookiesView
Exit code:
0
Version:
1.17
Modules
Images
c:\users\admin\appdata\local\temp\jfiag_gg.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2100"C:\Program Files\Internet Explorer\iexplore.exe" http://www.onclickbright.com/jump/next.php?r=2096223&sub1=360C:\Program Files\Internet Explorer\iexplore.exeNytasurufa.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2144ping 127.0.0.1 -n 3 C:\Windows\system32\PING.EXEcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
Total events
7 689
Read events
5 307
Write events
2 378
Delete events
4

Modification events

(PID) Process:(2428) TeraCopy.3.21.Pro.keygen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2428) TeraCopy.3.21.Pro.keygen.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3856) keygen-pr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3856) keygen-pr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(4012) keygen-step-1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\keygen-step-1_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4012) keygen-step-1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\keygen-step-1_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4012) keygen-step-1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\keygen-step-1_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(4012) keygen-step-1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\keygen-step-1_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(4012) keygen-step-1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\keygen-step-1_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4012) keygen-step-1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\keygen-step-1_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
38
Suspicious files
16
Text files
21
Unknown types
10

Dropped files

PID
Process
Filename
Type
2428TeraCopy.3.21.Pro.keygen.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeexecutable
MD5:
SHA256:
2428TeraCopy.3.21.Pro.keygen.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen.battext
MD5:
SHA256:
1732id6.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm
MD5:
SHA256:
648keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\hjjgaa.exeexecutable
MD5:
SHA256:
2428TeraCopy.3.21.Pro.keygen.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exeexecutable
MD5:
SHA256:
648keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\gcttt.exeexecutable
MD5:
SHA256:
648keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\BTRSetp.exeexecutable
MD5:
SHA256:
648keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\lunch.battext
MD5:
SHA256:
3856keygen-pr.exeC:\Users\admin\AppData\Local\Temp\RarSFX1\JOzWR.datbinary
MD5:12476321A502E943933E60CFB4429970
SHA256:14A0FBD7EAB461E49EE161AC3BD9AD8055086DBE56848DBABA9EC2034B3DEA29
648keygen-step-4.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\Setup.exeexecutable
MD5:7AB5B2D562BB5D83473B29B150E4D9B8
SHA256:E02D619B4633C398B4BAC92654A38DF2F2D580676A6A315CF60CAE1F4BD68A71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
54
DNS requests
33
Threats
41

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4012
keygen-step-1.exe
GET
200
185.154.13.74:80
http://gothw.club/jshp1.exe
NL
executable
533 Kb
suspicious
1732
id6.exe
POST
200
194.54.83.254:80
http://freekzvideo.cloud/business/receive
UA
malicious
2472
hjjgaa.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
287 b
malicious
2256
gcttt.exe
GET
200
192.157.193.137:80
http://j8hghe3uyf.2ihsfa.com/api/fbtime
US
text
52 b
malicious
2364
key.exe
POST
104.27.167.134:80
http://www.oldhorse.info/
US
malicious
4064
Installer.tmp
GET
200
52.219.75.76:80
http://prozipper.s3.eu-central-1.amazonaws.com/prozipperRed.exe
DE
executable
285 Kb
shared
2068
Nytasurufa.exe
GET
200
216.58.208.36:80
http://www.google.com/
US
html
47.0 Kb
malicious
2256
gcttt.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
287 b
malicious
2472
hjjgaa.exe
GET
200
192.157.193.137:80
http://j8hghe3uyf.2ihsfa.com/api/fbtime
US
text
52 b
malicious
2364
key.exe
POST
104.27.167.134:80
http://www.oldhorse.info/
US
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1732
id6.exe
194.54.83.254:80
freekzvideo.cloud
Omnilance Ltd
UA
malicious
2472
hjjgaa.exe
208.95.112.1:80
ip-api.com
IBURST
malicious
208.95.112.1:80
ip-api.com
IBURST
malicious
2472
hjjgaa.exe
31.13.92.36:443
www.facebook.com
Facebook, Inc.
IE
whitelisted
2256
gcttt.exe
31.13.92.36:443
www.facebook.com
Facebook, Inc.
IE
whitelisted
2148
Setup.exe
149.248.9.104:80
986a89d3131d29cb.xyz
1651884 Ontario Inc.
CA
malicious
2364
key.exe
172.67.192.106:80
oldhorse.info
US
malicious
3944
keygen-step-3.exe
45.32.114.117:80
www.wfasdwedfs.com
Choopa, LLC
SG
malicious
4064
Installer.tmp
52.219.75.76:80
prozipper.s3.eu-central-1.amazonaws.com
DE
shared
2364
key.exe
104.27.167.134:80
oldhorse.info
Cloudflare Inc
US
malicious

DNS requests

Domain
IP
Reputation
www.wfasdwedfs.com
  • 45.32.114.117
malicious
gothw.club
  • 185.154.13.74
suspicious
freekzvideo.cloud
  • 194.54.83.254
malicious
ip-api.com
  • 208.95.112.1
malicious
www.facebook.com
  • 31.13.92.36
whitelisted
986a89d3131d29cb.xyz
  • 149.248.9.104
malicious
oldhorse.info
  • 172.67.192.106
  • 104.27.166.134
  • 104.27.167.134
malicious
j8hghe3uyf.2ihsfa.com
  • 192.157.193.137
malicious
www.oldhorse.info
  • 104.27.167.134
  • 172.67.192.106
  • 104.27.166.134
malicious
prozipper.s3.eu-central-1.amazonaws.com
  • 52.219.75.76
shared

Threats

PID
Process
Class
Message
4012
keygen-step-1.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
1040
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
4012
keygen-step-1.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4012
keygen-step-1.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1732
id6.exe
A Network Trojan was detected
ET TROJAN Suspicious User-Agent (WindowsNT) With No Separating Space
1732
id6.exe
Potentially Bad Traffic
ET INFO HTTP Request to Suspicious *.cloud Domain
2472
hjjgaa.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
2472
hjjgaa.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
2256
gcttt.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
2256
gcttt.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
17 ETPRO signatures available at the full report
Process
Message
id6.exe
006
id6.exe
http://freekzvideo.cloud/business/receive