Malware analysis DraftableCompare.exe Malicious activity

Add for printing

File name:	DraftableCompare.exe
Full analysis:	https://app.any.run/tasks/81b9bdf6-306f-4a2a-bc47-ff4ca984e758
Verdict:	Malicious activity
Analysis date:	May 14, 2019, 23:28:39
OS:	Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	4DD1BBDC08B9C120AF5CC34A592CF917
SHA1:	F575F63888977250399F9513E82D8C11288B7223
SHA256:	E1283A9491E435D6ACFE54871E6BE8B036B713A14E2A1C244D908F0B6E4DDB12
SSDEEP:	12288:bDPdsil5fCMggBIiMVO26kk+FGzeMb01JQntLOCVkoSrUf:bD1s2ts96kTMemVuc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 8.0.7601.17514 undefined
Adobe Acrobat Reader DC MUI (15.023.20070)
Adobe Flash Player 26 ActiveX (26.0.0.131)
Adobe Flash Player 26 NPAPI (26.0.0.131)
Adobe Flash Player 26 PPAPI (26.0.0.131)
Adobe Refresh Manager (1.8.0)
CCleaner (5.35)
FileZilla Client 3.36.0 (3.36.0)
Google Chrome (73.0.3683.75)
Google Update Helper (1.3.33.23)
Java 8 Update 92 (8.0.920.14)
Java Auto Updater (2.8.92.14)
Microsoft .NET Framework 4.6.1 (4.6.01055)
Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Professional 2010 (14.0.6029.1000)
Microsoft Office Proof (English) 2010 (14.0.6029.1000)
Microsoft Office Proof (French) 2010 (14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
Microsoft Office Single Image 2010 (14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
Notepad++ (32-bit x86) (7.5.1)
Opera 12.15 (12.15.1748)
Skype version 8.29 (8.29)
VLC media player (2.2.6)
WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

Client LanguagePack Package
Client Refresh LanguagePack Package
CodecPack Basic Package
Foundation Package
IE Troubleshooters Package
InternetExplorer Optional Package
KB2534111
KB2999226
KB976902
LocalPack AU Package
LocalPack CA Package
LocalPack GB Package
LocalPack US Package
LocalPack ZA Package
ProfessionalEdition
UltimateEdition

Add for printing

MALICIOUS
- Loads dropped or rewritten executable
  - Draftable.CompareTool.exe (PID: 3420)
  - dfsvc.exe (PID: 3644)
  - Draftable.CompareTool.exe (PID: 2576)
  - Draftable.CompareTool.exe (PID: 2776)
  - Draftable.CompareTool.exe (PID: 2380)
- Application was dropped or rewritten from another process
  - Draftable.CompareTool.exe (PID: 3420)
  - Draftable.CompareTool.exe (PID: 2576)
  - Draftable.CompareTool.exe (PID: 2380)
  - Draftable.CompareTool.exe (PID: 2776)
- Changes settings of System certificates
  - dfsvc.exe (PID: 3644)
SUSPICIOUS
- Creates files in the user directory
  - dfsvc.exe (PID: 3644)
- Reads Internet Cache Settings
  - Draftable.CompareTool.exe (PID: 2576)
  - dfsvc.exe (PID: 3644)
- Reads internet explorer settings
  - Draftable.CompareTool.exe (PID: 2576)
  - dfsvc.exe (PID: 3644)
- Reads Environment values
  - Draftable.CompareTool.exe (PID: 2576)
  - dfsvc.exe (PID: 3644)
- Creates a software uninstall entry
  - dfsvc.exe (PID: 3644)
- Executable content was dropped or overwritten
  - dfsvc.exe (PID: 3644)
INFO
- Reads settings of System Certificates
  - Draftable.CompareTool.exe (PID: 2576)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win32 Executable (generic) (52.9)
.exe	\|	Generic Win/DOS Executable (23.5)
.exe	\|	DOS Executable Generic (23.5)

EXIF

EXE

ProductVersion:	14.0.23107.0
ProductName:	-
OriginalFileName:	setup.exe
LegalCopyright:	© Microsoft Corporation. All rights reserved.
InternalName:	setup.exe
FileVersion:	14.0.23107.0 built by: D14REL
FileDescription:	Setup
CompanyName:	-
CharacterSet:	Unicode
LanguageCode:	English (U.S.)
FileSubtype:	-
ObjectFileType:	Executable application
FileOS:	Win32
FileFlags:	(none)
FileFlagsMask:	0x003f
ProductVersionNumber:	14.0.23107.0
FileVersionNumber:	14.0.23107.0
Subsystem:	Windows GUI
SubsystemVersion:	5.1
ImageVersion:	10
OSVersion:	5.1
EntryPoint:	0x330c2
UninitializedDataSize:	-
InitializedDataSize:	481792
CodeSize:	364544
LinkerVersion:	14
PEType:	PE32
TimeStamp:	2015:07:07 08:26:33+02:00
MachineType:	Intel 386 or later, and compatibles

Summary

Architecture:	IMAGE_FILE_MACHINE_I386
Subsystem:	IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date:	07-Jul-2015 06:26:33
Detected languages:	English - United States
Debug artifacts:	setup.pdb
CompanyName:	-
FileDescription:	Setup
FileVersion:	14.0.23107.0 built by: D14REL
InternalName:	setup.exe
LegalCopyright:	© Microsoft Corporation. All rights reserved.
OriginalFilename:	setup.exe
ProductName:	-
ProductVersion:	14.0.23107.0

DOS Header

Magic number:	MZ
Bytes on last page of file:	0x0090
Pages in file:	0x0003
Relocations:	0x0000
Size of header:	0x0004
Min extra paragraphs:	0x0000
Max extra paragraphs:	0xFFFF
Initial SS value:	0x0000
Initial SP value:	0x00B8
Checksum:	0x0000
Initial IP value:	0x0000
Initial CS value:	0x0000
Overlay number:	0x0000
OEM identifier:	0x0000
OEM information:	0x0000
Address of NE header:	0x00000118

PE Headers

Signature:	PE
Machine:	IMAGE_FILE_MACHINE_I386
Number of sections:	5
Time date stamp:	07-Jul-2015 06:26:33
Pointer to Symbol Table:	0x00000000
Number of symbols:	0
Size of Optional Header:	0x00E0
Characteristics:	IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name	Virtual Address	Virtual Size	Raw Size	Charateristics	Entropy
.text	0x00001000	0x00058E58	0x00059000	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ	6.39733
.data	0x0005A000	0x00003D2C	0x00001800	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE	3.69795
.idata	0x0005E000	0x0000152A	0x00001600	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	5.45654
.rsrc	0x00060000	0x0006EF64	0x0006F000	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ	4.27334
.reloc	0x000CF000	0x00003B4C	0x00003C00	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ	6.60243

Resources

Title	Entropy	Size	Codepage	Language	Type
1	5.22945	1378	Latin 1 / Western European	English - United States	RT_MANIFEST
2	2.59785	3752	Latin 1 / Western European	English - United States	RT_ICON
3	2.61852	2216	Latin 1 / Western European	English - United States	RT_ICON
4	1.63426	1384	Latin 1 / Western European	English - United States	RT_ICON
5	7.87399	7820	Latin 1 / Western European	English - United States	RT_ICON
6	3.07929	16936	Latin 1 / Western European	English - United States	RT_ICON
7	3.33247	9640	Latin 1 / Western European	English - United States	RT_ICON
8	3.65064	4264	Latin 1 / Western European	English - United States	RT_ICON
9	3.99341	1128	Latin 1 / Western European	English - United States	RT_ICON
10	7.07398	1885	Latin 1 / Western European	English - United States	RT_ICON

Imports


ADVAPI32.dll (delay-loaded)
CRYPT32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
Secur32.dll
USER32.dll
WININET.dll
msi.dll
ole32.dll

Exports

Title	Ordinal	Address
_DecodePointerInternal@4	1	0x0001FC22
_EncodePointerInternal@4	2	0x0001FC3D

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
2532	"C:\Users\admin\AppData\Local\Temp\DraftableCompare.exe"	C:\Users\admin\AppData\Local\Temp\DraftableCompare.exe		explorer.exe
User: admin Integrity Level: MEDIUM Description: Setup Exit code: 0 Version: 14.0.23107.0 built by: D14REL
3644	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"	C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe		DraftableCompare.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ClickOnce Version: 4.6.1055.0 built by: NETFXREL2
2576	"C:\Users\admin\AppData\Local\Apps\2.0\EV07YR8O.MBJ\BT4PTWXJ.COZ\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe"	C:\Users\admin\AppData\Local\Apps\2.0\EV07YR8O.MBJ\BT4PTWXJ.COZ\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe		dfsvc.exe
User: admin Company: Draftable Integrity Level: MEDIUM Description: Draftable.CompareTool Version: 1.1.3.2
2008	"rundll32.exe" dfshim.dll,ShOpenVerbShortcut C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Draftable Pty Ltd\Draftable Suite\Draftable Compare.appref-ms\|	C:\Windows\system32\rundll32.exe	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
3420	"C:\Users\admin\AppData\Local\Apps\2.0\EV07YR8O.MBJ\BT4PTWXJ.COZ\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe"	C:\Users\admin\AppData\Local\Apps\2.0\EV07YR8O.MBJ\BT4PTWXJ.COZ\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe		rundll32.exe
User: admin Company: Draftable Integrity Level: MEDIUM Description: Draftable.CompareTool Exit code: 0 Version: 1.1.3.2
2884	"rundll32.exe" dfshim.dll,ShOpenVerbShortcut C:\Users\admin\Desktop\Draftable Compare.appref-ms\|	C:\Windows\system32\rundll32.exe	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2380	"C:\Users\admin\AppData\Local\Apps\2.0\EV07YR8O.MBJ\BT4PTWXJ.COZ\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe"	C:\Users\admin\AppData\Local\Apps\2.0\EV07YR8O.MBJ\BT4PTWXJ.COZ\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe		rundll32.exe
User: admin Company: Draftable Integrity Level: MEDIUM Description: Draftable.CompareTool Exit code: 0 Version: 1.1.3.2
2664	"rundll32.exe" dfshim.dll,ShOpenVerbShortcut C:\Users\admin\Desktop\Draftable Compare.appref-ms\|	C:\Windows\system32\rundll32.exe	—	explorer.exe
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
2776	"C:\Users\admin\AppData\Local\Apps\2.0\EV07YR8O.MBJ\BT4PTWXJ.COZ\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe"	C:\Users\admin\AppData\Local\Apps\2.0\EV07YR8O.MBJ\BT4PTWXJ.COZ\draf..tion_ed18b5d23647a6f3_0001.0001_8bb8ccde17319e2d\Draftable.CompareTool.exe		rundll32.exe
User: admin Company: Draftable Integrity Level: MEDIUM Description: Draftable.CompareTool Version: 1.1.3.2

Add for printing

Total events

1 354

Read events

536

Write events

Delete events

Modification events

No data

Add for printing

Executable files

112

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
3644	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\HXVYH9J2.RNG\404QQPQ4.7GL\Resources\draftable.ico		image
		MD5:02AA92CBB2DE4C732EDEB72A8F7B6B81	SHA256:9732AE5D3775A8380461B3CE2079F2FB2F6FB4C4FFEDEE993F186750C249D462
2532	DraftableCompare.exe	C:\Users\admin\AppData\Local\Temp\VSD4029.tmp\install.log		binary
		MD5:95F029F6B8C00AEAFF181AD5098A103F	SHA256:13FD579F0438C5E72851B5CDE8BBEA098B704D8FE98C7F359BF70A46920E4EFA
3644	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\HXVYH9J2.RNG\404QQPQ4.7GL\Draftable.CompareTool.exe.manifest		xml
		MD5:755770E2A5C75C9271C2AAADD7EB31C2	SHA256:775AFC4E689D524803900FAE20D3D4AB2D0F87833882B93E52343673E186610D
3644	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\HXVYH9J2.RNG\404QQPQ4.7GL\Draftable.CompareTool.exe.config		xml
		MD5:F88174F5AC9E81E96D55D3CED7B98EAC	SHA256:B916AB3F2816A4153B552333E7E72528DD036080BF04F5A8E5FA40540B87089A
3644	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\HXVYH9J2.RNG\404QQPQ4.7GL\x64\netlib40.dll		executable
		MD5:C17A925588D8A56F9AD5766E166C9FEA	SHA256:2D3EA99A938C238D5E92227DDB7F7922F288AB48865600806CAC542DC9EBDAFF
3644	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\HXVYH9J2.RNG\404QQPQ4.7GL\x64\pdfium.dll		executable
		MD5:2A3F9078D6CD6998A865BB10D3AE68D4	SHA256:A44BA72EA56BDFCD3D3AF429D97816159ED13A96BB5CACA7D4D694C8A4DDAFDE
3644	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\HXVYH9J2.RNG\404QQPQ4.7GL\x86\ixclib40.dll		executable
		MD5:B3E29AA23E676A202C8428BF9BCA5051	SHA256:BF03F3950BDEA7D0374593D611FB39447388DBC26FCE3EB50DEB7F011828FB0A
3644	dfsvc.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2989C0A878FE45C610C8177194428257		binary
		MD5:CD1ED5977EFDDD1CBD97B69045A7C98A	SHA256:7E8229A3D297E2F8628237A95E59F69941E210985987EB10EBF2FF489635294E
3644	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\HXVYH9J2.RNG\404QQPQ4.7GL\x86\pxcview.dll		executable
		MD5:0E09AFFECE4077462291C9DD28F835BC	SHA256:FB3D0D3D6690627163F64C97C730F8484F3AA104B86BC97487171003C7A94AA4
3644	dfsvc.exe	C:\Users\admin\AppData\Local\Temp\Deployment\HXVYH9J2.RNG\404QQPQ4.7GL\x64\xccdx40.dll		executable
		MD5:39886F4270E543400FB275F04454364B	SHA256:A1FFB2D409B06D6AD5D73ABE66D150EFFF31AEC3630F1E1E943B552451EE2BC8

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
3644	dfsvc.exe	GET	200	104.18.10.39:80	http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt	US	der	1.30 Kb	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2576	Draftable.CompareTool.exe	52.216.169.43:443	draftable-compare.s3.amazonaws.com	Amazon.com, Inc.	US	shared
3644	dfsvc.exe	104.18.10.39:80	cacerts.digicert.com	Cloudflare Inc	US	shared
2532	DraftableCompare.exe	52.216.234.27:443	draftable-compare.s3.amazonaws.com	Amazon.com, Inc.	US	unknown
3644	dfsvc.exe	52.216.112.179:443	draftable-compare.s3.amazonaws.com	Amazon.com, Inc.	US	shared

DNS requests

Domain	IP	Reputation
draftable-compare.s3.amazonaws.com	52.216.234.27 52.216.112.179 52.216.169.43	shared
cacerts.digicert.com	104.18.10.39 104.18.11.39	whitelisted

Threats

No threats detected

Add for printing

Process	Message
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe	* Status originated: -1073741811 * Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230

General Info

DraftableCompare.exe

4DD1BBDC08B9C120AF5CC34A592CF917

F575F63888977250399F9513E82D8C11288B7223

E1283A9491E435D6ACFE54871E6BE8B036B713A14E2A1C244D908F0B6E4DDB12

12288:bDPdsil5fCMggBIiMVO26kk+FGzeMb01JQntLOCVkoSrUf:bD1s2ts96kTMemVuc

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Loads dropped or rewritten executable

Application was dropped or rewritten from another process

Changes settings of System certificates

SUSPICIOUS

Creates files in the user directory

Reads Internet Cache Settings

Reads internet explorer settings

Reads Environment values

Creates a software uninstall entry

Executable content was dropped or overwritten

INFO

Reads settings of System Certificates

Malware configuration

Static information

TRiD

EXIF

EXE

Summary

DOS Header

PE Headers

Sections

Resources

Imports

Exports

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings