File name:

updater.exe

Full analysis: https://app.any.run/tasks/1094670c-75fd-49b6-8e23-0f88120dc7d6
Verdict: Malicious activity
Analysis date: November 19, 2023, 12:27:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

8589B564A5ED7920BE4B1B08F3D6D8ED

SHA1:

6F73743F61238A9746BA9E6EF3B5BF495F22F4A3

SHA256:

E380482FC3D8C4FE11073F9734238D60AB66385E3261231358F7D02082B235CD

SSDEEP:

196608:h1pjCaBTtz/IeWcOpVTlMv/KBcKuo2dTu+kvHM2Z3KQXe2:h1pjCaVtz/VWvpxlAilDWT1qPh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • updater.exe (PID: 2228)
      • gupdater.exe (PID: 2612)
      • mupdater.exe (PID: 2904)
      • fgqgjrcfhjsu.exe (PID: 2820)

    • Adds extension to the Windows Defender exclusion list

      • mupdater.exe (PID: 2904)
      • fgqgjrcfhjsu.exe (PID: 2820)

    • Application was injected by another process

      • lsass.exe (PID: 500)
      • lsm.exe (PID: 508)
      • services.exe (PID: 484)
      • svchost.exe (PID: 692)
      • svchost.exe (PID: 608)
      • winlogon.exe (PID: 448)
      • svchost.exe (PID: 780)
      • svchost.exe (PID: 852)
      • svchost.exe (PID: 824)
      • spoolsv.exe (PID: 1028)
      • IMEDICTUPDATE.EXE (PID: 1244)
      • svchost.exe (PID: 1708)
      • dllhost.exe (PID: 2688)
      • svchost.exe (PID: 1184)
      • svchost.exe (PID: 1656)
      • wmpnetwk.exe (PID: 1104)
      • dllhost.exe (PID: 952)
      • conhost.exe (PID: 2040)
      • dwm.exe (PID: 1884)
      • explorer.exe (PID: 1944)
      • TrustedInstaller.exe (PID: 2684)
      • conhost.exe (PID: 584)
      • svchost.exe (PID: 884)
      • svchost.exe (PID: 1056)
      • svchost.exe (PID: 324)
      • svchost.exe (PID: 1956)
      • dllhost.exe (PID: 2052)
      • conhost.exe (PID: 2284)
      • conhost.exe (PID: 3068)
      • conhost.exe (PID: 2268)
      • conhost.exe (PID: 1660)
      • WmiPrvSE.exe (PID: 2656)
      • conhost.exe (PID: 2388)
      • conhost.exe (PID: 2852)
      • conhost.exe (PID: 712)

    • Runs injected code in another process

      • dialer.exe (PID: 2972)
      • dialer.exe (PID: 2764)

    • Creates a writable file the system directory

      • TrustedInstaller.exe (PID: 2684)
      • powershell.exe (PID: 1788)

  • SUSPICIOUS

    • Searches for installed software

      • svchost.exe (PID: 824)

    • Base64-obfuscated command line is found

      • updater.exe (PID: 2228)

    • Starts POWERSHELL.EXE for commands execution

      • updater.exe (PID: 2228)
      • mupdater.exe (PID: 2904)
      • fgqgjrcfhjsu.exe (PID: 2820)

    • Process drops legitimate windows executable

      • updater.exe (PID: 2228)
      • gupdater.exe (PID: 2612)

    • BASE64 encoded PowerShell command has been detected

      • updater.exe (PID: 2228)

    • Reads the Internet Settings

      • updater.exe (PID: 2228)
      • powershell.exe (PID: 3008)

    • The process drops C-runtime libraries

      • gupdater.exe (PID: 2612)

    • Application launched itself

      • gupdater.exe (PID: 2612)

    • Loads Python modules

      • gupdater.exe (PID: 568)

    • Adds/modifies Windows certificates

      • updater.exe (PID: 2228)
      • services.exe (PID: 484)

    • Script adds exclusion path to Windows Defender

      • mupdater.exe (PID: 2904)
      • fgqgjrcfhjsu.exe (PID: 2820)

    • Script adds exclusion extension to Windows Defender

      • mupdater.exe (PID: 2904)
      • fgqgjrcfhjsu.exe (PID: 2820)

    • Starts CMD.EXE for commands execution

      • mupdater.exe (PID: 2904)
      • fgqgjrcfhjsu.exe (PID: 2820)

    • Starts SC.EXE for service management

      • mupdater.exe (PID: 2904)
      • fgqgjrcfhjsu.exe (PID: 2820)

    • Executes as Windows Service

      • fgqgjrcfhjsu.exe (PID: 2820)

    • Unusual connection from system programs

      • powershell.exe (PID: 1788)

    • Connects to unusual port

      • dialer.exe (PID: 1844)

    • Drops a system driver (possible attempt to evade defenses)

      • fgqgjrcfhjsu.exe (PID: 2820)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 1788)

    • Checks Windows Trust Settings

      • TrustedInstaller.exe (PID: 2684)

  • INFO

    • Checks supported languages

      • updater.exe (PID: 2228)
      • mupdater.exe (PID: 2904)
      • gupdater.exe (PID: 2612)
      • gupdater.exe (PID: 568)
      • TrustedInstaller.exe (PID: 2684)
      • fgqgjrcfhjsu.exe (PID: 2820)

    • Reads the computer name

      • updater.exe (PID: 2228)
      • gupdater.exe (PID: 2612)
      • TrustedInstaller.exe (PID: 2684)

    • Create files in a temporary directory

      • updater.exe (PID: 2228)
      • gupdater.exe (PID: 2612)

    • Reads the machine GUID from the registry

      • TrustedInstaller.exe (PID: 2684)

    • Creates files in the program directory

      • mupdater.exe (PID: 2904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (61.6)
.dll | Win32 Dynamic Link Library (generic) (14.6)
.exe | Win32 Executable (generic) (10)
.exe | Win16/32 Executable Delphi generic (4.6)
.exe | Generic Win/DOS Executable (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 2048
InitializedDataSize: 12895232
UninitializedDataSize: -
EntryPoint: 0x14d1
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 114.0.5735.135
ProductVersionNumber: 114.0.5735.135
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Google Chrome
FileTitle: -
FileDescription: Google Chrome
FileVersion: 114,0,5735,135
LegalCopyright: Copyright 2023 Google LLC. All rights reserved.
LegalTrademark: -
ProductName: Google LLC
ProductVersion: 114,0,5735,135
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
88
Monitored processes
68
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject inject inject inject inject inject inject inject inject inject inject inject inject inject updater.exe powershell.exe no specs mupdater.exe no specs gupdater.exe no specs gupdater.exe no specs powershell.exe no specs cmd.exe no specs sc.exe no specs wusa.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs dialer.exe no specs sc.exe no specs sc.exe no specs dllhost.exe dllhost.exe conhost.exe sc.exe no specs cmd.exe no specs sc.exe no specs conhost.exe fgqgjrcfhjsu.exe no specs choice.exe no specs powershell.exe conhost.exe sc.exe no specs cmd.exe no specs conhost.exe conhost.exe wusa.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs conhost.exe sc.exe no specs dialer.exe no specs dialer.exe no specs svchost.exe winlogon.exe services.exe lsass.exe lsm.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe spoolsv.exe svchost.exe wmpnetwk.exe svchost.exe imedictupdate.exe svchost.exe svchost.exe dwm.exe explorer.exe svchost.exe dllhost.exe conhost.exe dialer.exe conhost.exe trustedinstaller.exe conhost.exe wmiprvse.exe updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
324C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
392C:\Windows\system32\sc.exe stop wuauservC:\Windows\System32\sc.exe—fgqgjrcfhjsu.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
448winlogon.exeC:\Windows\System32\winlogon.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Logon Application
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\winlogon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winsta.dll
484C:\Windows\system32\services.exeC:\Windows\System32\services.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Services and Controller app
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptbase.dll
500C:\Windows\system32\lsass.exeC:\Windows\System32\lsass.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Security Authority Process
Exit code:
0
Version:
6.1.7601.23915 (win7sp1_ldr.170913-0600)
Modules
Images
c:\windows\system32\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspisrv.dll
c:\windows\system32\lsasrv.dll
c:\windows\system32\sechost.dll
c:\windows\system32\sspicli.dll
508C:\Windows\system32\lsm.exeC:\Windows\System32\lsm.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Session Manager Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\lsm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sysntfy.dll
c:\windows\system32\wmsgapi.dll
c:\windows\system32\cryptbase.dll
568"C:\Users\admin\AppData\Local\Temp\gupdater.exe" C:\Users\admin\AppData\Local\Temp\gupdater.exe—gupdater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Security Center Elevated UI App
Exit code:
0
Version:
10.0.19041.1949 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\gupdater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll
584\??\C:\Windows\system32\conhost.exe "-694631943173716261876801617518926192292658369110195015681694301531490977172"C:\Windows\System32\conhost.exe
csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
608C:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpnpmgr.dll
c:\windows\system32\spinf.dll
c:\windows\system32\user32.dll
692C:\Windows\system32\svchost.exe -k RPCSSC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\rpcepmap.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\secur32.dll
Total events
43 844
Read events
43 735
Write events
109
Delete events
0

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(884) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3896776584-4254864009-862391680-1000
Operation:writeName:RefCount
Value:
5
(PID) Process:(884) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3896776584-4254864009-862391680-1000
Operation:writeName:RefCount
Value:
6
(PID) Process:(2228) updater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2228) updater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2228) updater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2228) updater.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1296) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1296) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E81D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E090000000100000016000000301406082B0601050507030206082B060105050703010B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
(PID) Process:(1296) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
0F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F6362000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C60B000000010000001A0000004900530052004700200052006F006F0074002000580031000000090000000100000016000000301406082B0601050507030206082B0601050507030114000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E1D000000010000001000000073B6876195F5D18E048510422AEF04E3030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E820000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
Executable files
22
Suspicious files
15
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2612gupdater.exeC:\Users\admin\AppData\Local\Temp\_MEI26122\VCRUNTIME140.dllexecutable
MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
SHA256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
884svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcfbinary
MD5:7683CAFFE80861814773CB12554C21B6
SHA256:A04402F82CCA7EFF4C054655578CDC925653074DAE8D813715870C70B6BCF8B1
2612gupdater.exeC:\Users\admin\AppData\Local\Temp\_MEI26122\_bz2.pydexecutable
MD5:2D461B41F6E9A305DDE68E9C59E4110A
SHA256:ABBE3933A34A9653A757244E8E55B0D7D3A108527A3E9E8A7F2013B5F2A9EFF4
2228updater.exeC:\Users\admin\AppData\Local\Temp\gupdater.exeexecutable
MD5:426E59AC373C95971B451FE03331DDA0
SHA256:A4E45A46A84F80384EC2F8671836DC39FF4DB291DCB3E721357E943124D14D7B
2612gupdater.exeC:\Users\admin\AppData\Local\Temp\_MEI26122\_decimal.pydexecutable
MD5:A8952538E090E2FF0EFB0BA3C890CD04
SHA256:C4E8740C5DBBD2741FC4124908DA4B65FA9C3E17D9C9BF3F634710202E0C7009
2612gupdater.exeC:\Users\admin\AppData\Local\Temp\_MEI26122\_lzma.pydexecutable
MD5:3798175FD77EDED46A8AF6B03C5E5F6D
SHA256:3C9D5A9433B22538FC64141CD3784800C567C18E4379003329CF69A1D59B2A41
2612gupdater.exeC:\Users\admin\AppData\Local\Temp\_MEI26122\_ctypes.pydexecutable
MD5:1ADFE4D0F4D68C9C539489B89717984D
SHA256:64E8FD952CCF5B8ADCA80CE8C7BC6C96EC7DF381789256FE8D326F111F02E95C
2612gupdater.exeC:\Users\admin\AppData\Local\Temp\_MEI26122\_socket.pydexecutable
MD5:BCC3E26A18D59D76FD6CF7CD64E9E14D
SHA256:4E19F29266A3D6C127E5E8DE01D2C9B68BC55075DD3D6AABE22CF0DE4B946A98
2612gupdater.exeC:\Users\admin\AppData\Local\Temp\_MEI26122\_queue.pydexecutable
MD5:DECDABACA104520549B0F66C136A9DC1
SHA256:9D4880F7D0129B1DE95BECD8EA8BBBF0C044D63E87764D18F9EC00D382E43F84
2612gupdater.exeC:\Users\admin\AppData\Local\Temp\_MEI26122\_hashlib.pydexecutable
MD5:F10D896ED25751EAD72D8B03E404EA36
SHA256:3660B985CA47CA1BBA07DB01458B3153E4E692EE57A8B23CE22F1A5CA18707C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
13
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1788
powershell.exe
GET
200
8.241.11.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?aaf63d5367c1b31c
unknown
compressed
4.66 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1788
powershell.exe
8.241.11.126:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
1844
dialer.exe
162.19.139.184:12222
xmr.2miners.com
OVH SAS
FR
unknown
1844
dialer.exe
104.20.68.143:443
pastebin.com
CLOUDFLARENET
—
unknown
1844
dialer.exe
66.29.148.6:443
online.badbull.pro
NAMECHEAP-NET
US
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 8.241.11.126
  • 8.241.123.126
  • 67.27.157.126
  • 8.241.122.126
  • 8.248.131.254
whitelisted
xmr.2miners.com
  • 162.19.139.184
unknown
pastebin.com
  • 104.20.68.143
  • 104.20.67.143
  • 172.67.34.170
shared
online.badbull.pro
  • 66.29.148.6
unknown

Threats

PID
Process
Class
Message
324
svchost.exe
Crypto Currency Mining Activity Detected
ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
updater.exe