We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
2 January 2025, 10:25
Analysis environment:
Windows 10 Pro, build 19045, x64
FM-AIO-2.5.0.0.exe
MD5:
259686D48920B69F239B615C506C5CE0
SHA1:
3E992A4642E1D412AF875573689D9888F7D4F5E4
SHA256:
E299A47AD46062CD9C93EDA4B4FCA56124AD6FFAC2CE3F855506EEE94588D1A0
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis FM-AIO-2.5.0.0.exe (MD5: 259686D48920B69F239B615C506C5CE0) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Changes the autorun value in the registry
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
SUSPICIOUS
Reads security settings of Internet Explorer
FM-AIO-2.5.0.0.exe (PID: 4592)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
FM-AIO-2.5.0.0.exe (PID: 6596)
Executable content was dropped or overwritten
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7664)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
FM-AIO-2.5.0.0.exe (PID: 6596)
Process drops legitimate windows executable
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7664)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
msiexec.exe (PID: 7208)
FM-AIO-2.5.0.0.exe (PID: 6596)
Starts a Microsoft application from unusual location
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
Searches for installed software
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
Starts itself from another location
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
Creates a software uninstall entry
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
Checks Windows Trust Settings
msiexec.exe (PID: 7208)
Reads the Windows owner or organization settings
msiexec.exe (PID: 7208)
The process creates files with name similar to system file names
msiexec.exe (PID: 7208)
The process drops C-runtime libraries
msiexec.exe (PID: 7208)
INFO
Sends debugging messages
FM-AIO-2.5.0.0.exe (PID: 4592)
Checks supported languages
FM-AIO-2.5.0.0.exe (PID: 4592)
identity_helper.exe (PID: 6224)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7664)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
msiexec.exe (PID: 7208)
msiexec.exe (PID: 7232)
msiexec.exe (PID: 7404)
msiexec.exe (PID: 7520)
msiexec.exe (PID: 536)
identity_helper.exe (PID: 7956)
FM-AIO-2.5.0.0.exe (PID: 6596)
FM-AIO-2.5.0.0.exe (PID: 8148)
Reads the computer name
FM-AIO-2.5.0.0.exe (PID: 4592)
identity_helper.exe (PID: 6224)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
msiexec.exe (PID: 7208)
msiexec.exe (PID: 7232)
msiexec.exe (PID: 7404)
msiexec.exe (PID: 7520)
msiexec.exe (PID: 536)
FM-AIO-2.5.0.0.exe (PID: 6596)
FM-AIO-2.5.0.0.exe (PID: 8148)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
Manual execution by a user
msedge.exe (PID: 6168)
FM-AIO-2.5.0.0.exe (PID: 6596)
FM-AIO-2.5.0.0.exe (PID: 3260)
FM-AIO-2.5.0.0.exe (PID: 6276)
FM-AIO-2.5.0.0.exe (PID: 8148)
Application launched itself
msedge.exe (PID: 4984)
msedge.exe (PID: 6168)
msedge.exe (PID: 7624)
Executable content was dropped or overwritten
msedge.exe (PID: 6168)
msiexec.exe (PID: 7208)
Reads Environment values
identity_helper.exe (PID: 6224)
The process uses the downloaded file
msedge.exe (PID: 7568)
msedge.exe (PID: 6168)
The sample compiled with english language support
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7664)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
msiexec.exe (PID: 7208)
Create files in a temporary directory
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
FM-AIO-2.5.0.0.exe (PID: 6596)
Process checks computer location settings
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7688)
FM-AIO-2.5.0.0.exe (PID: 6596)
Reads the machine GUID from the registry
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
msiexec.exe (PID: 7208)
Creates files in the program directory
windowsdesktop-runtime-8.0.11-win-x64.exe (PID: 7960)
FM-AIO-2.5.0.0.exe (PID: 6596)
Reads the software policy settings
msiexec.exe (PID: 7208)
FM-AIO-2.5.0.0.exe (PID: 6596)
Creates a software uninstall entry
msiexec.exe (PID: 7208)
Checks proxy server information
FM-AIO-2.5.0.0.exe (PID: 8148)
Threats
No threats detected