| File name: | SR9900_SFX_207.exe |
| Full analysis: | https://app.any.run/tasks/03716c07-d809-448d-9868-7e91a9d202e5 |
| Verdict: | Malicious activity |
| Analysis date: | January 14, 2025, 13:39:57 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections |
| MD5: | 9CA4EF0A54999B63D6B4306CDD6F3C15 |
| SHA1: | 65BA6BB1341DFEF27A260D67805B1E556240A568 |
| SHA256: | E3F57D5EBC882A0A0CA96F9BA244FE97FB1A02A3297335451B9C5091332FE359 |
| SSDEEP: | 3072:w7CT6SF4J3gnQB6GFYp6kS3IKX2/mztVw4BzuS:wmf2xgnMpFYp6kS3b4atVDBzuS |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executable content was dropped or overwritten
- SR9900_SFX_207.exe (PID: 6596)
- install.exe (PID: 6768)
- drvinst.exe (PID: 6872)
- SR9900_SFX_207.exe (PID: 6192)
- SR9900_SFX_207.exe (PID: 5544)
Drops a system driver (possible attempt to evade defenses)
- SR9900_SFX_207.exe (PID: 6596)
- install.exe (PID: 6768)
- drvinst.exe (PID: 6872)
- SR9900_SFX_207.exe (PID: 6192)
- SR9900_SFX_207.exe (PID: 5544)
Creates files in the driver directory
- drvinst.exe (PID: 6872)
The process executes via Task Scheduler
- PLUGScheduler.exe (PID: 784)
INFO
Create files in a temporary directory
- SR9900_SFX_207.exe (PID: 6596)
- SR9900_SFX_207.exe (PID: 6192)
- SR9900_SFX_207.exe (PID: 5544)
Checks supported languages
- Setup.exe (PID: 6688)
The sample compiled with english language support
- drvinst.exe (PID: 6872)
- SR9900_SFX_207.exe (PID: 6596)
- install.exe (PID: 6768)
- SR9900_SFX_207.exe (PID: 6192)
- SR9900_SFX_207.exe (PID: 5544)
Reads the computer name
- SR9900_SFX_207.exe (PID: 6192)
Manual execution by a user
- SR9900_SFX_207.exe (PID: 6196)
- SR9900_SFX_207.exe (PID: 6192)
- SR9900_SFX_207.exe (PID: 2136)
- SR9900_SFX_207.exe (PID: 5544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2010:06:27 07:06:38+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 8 |
| CodeSize: | 70656 |
| InitializedDataSize: | 20480 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x11def |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
241
Monitored processes
17
Malicious processes
3
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 624 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 784 | "C:\Program Files\RUXIM\PLUGscheduler.exe" | C:\Program Files\RUXIM\PLUGScheduler.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Update LifeCycle Component Scheduler Exit code: 0 Version: 10.0.19041.3623 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2136 | "C:\Users\admin\Desktop\SR9900_SFX_207.exe" | C:\Users\admin\Desktop\SR9900_SFX_207.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 2956 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4244 | "C:\Users\admin\AppData\Local\Temp\SR9900_SFX\Setup.exe" | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\Setup.exe | — | SR9900_SFX_207.exe | |||||||||||
User: admin Company: CoreChip Semiconductor, Inc Integrity Level: HIGH Description: Install Program for CoreChip USB Ethernet Exit code: 0 Version: 5.00 built by: WinDDK Modules
| |||||||||||||||
| 4640 | ".\install.exe" | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x64\install.exe | — | Setup.exe | |||||||||||
User: admin Company: CoreChip Semiconductor, Inc Integrity Level: HIGH Description: Install Program for CoreChip USB Ethernet Exit code: 0 Version: 5.00 built by: WinDDK Modules
| |||||||||||||||
| 4716 | "C:\Users\admin\AppData\Local\Temp\SR9900_SFX\Setup.exe" | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\Setup.exe | — | SR9900_SFX_207.exe | |||||||||||
User: admin Company: CoreChip Semiconductor, Inc Integrity Level: HIGH Description: Install Program for CoreChip USB Ethernet Exit code: 0 Version: 5.00 built by: WinDDK Modules
| |||||||||||||||
| 5544 | "C:\Users\admin\Desktop\SR9900_SFX_207.exe" | C:\Users\admin\Desktop\SR9900_SFX_207.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 5580 | ".\install.exe" | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x64\install.exe | — | Setup.exe | |||||||||||
User: admin Company: CoreChip Semiconductor, Inc Integrity Level: HIGH Description: Install Program for CoreChip USB Ethernet Exit code: 0 Version: 5.00 built by: WinDDK Modules
| |||||||||||||||
| 6192 | "C:\Users\admin\Desktop\SR9900_SFX_207.exe" | C:\Users\admin\Desktop\SR9900_SFX_207.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
Total events
2 044
Read events
2 043
Write events
1
Delete events
0
Modification events
| (PID) Process: | (6768) install.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus |
| Operation: | write | Name: | setupapi.dev.log |
Value: 4096 | |||
Executable files
19
Suspicious files
0
Text files
2
Unknown types
61
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6768 | install.exe | C:\Users\admin\AppData\Local\Temp\{d9db5b09-b88f-0649-88cf-f437efca9940}\SET7562.tmp | cat | |
MD5:231EE844B0B1B1724BEAA62CCC17A0A4 | SHA256:61E70F6DB768C46417637B9E8F8EBCD6E062930941AA549D4E9A5277B2D30335 | |||
| 6596 | SR9900_SFX_207.exe | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\Setup.exe | executable | |
MD5:E4C61F137BF08F7345F254968B20A850 | SHA256:5EB575A8A2FBC2457DA37180A45E1A3F26D9503CE218943A403EB02DA6C86D0E | |||
| 6872 | drvinst.exe | C:\Windows\System32\DriverStore\Temp\{4c954b61-e8fc-4844-b73a-aa709879e5af}\SR9900.cat | cat | |
MD5:231EE844B0B1B1724BEAA62CCC17A0A4 | SHA256:61E70F6DB768C46417637B9E8F8EBCD6E062930941AA549D4E9A5277B2D30335 | |||
| 6596 | SR9900_SFX_207.exe | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x86\SR9900.inf | txt | |
MD5:D40F6C1E165D9A308CB9C3A39B1FCC57 | SHA256:38FCEE6532910D1CEE4460BF6277AC9F3D02EDFFC4E2D0452B9E3F046F7CC5A0 | |||
| 6768 | install.exe | C:\Users\admin\AppData\Local\Temp\{d9db5b09-b88f-0649-88cf-f437efca9940}\SR9900.inf | txt | |
MD5:D40539AD5FFCCEC987296161F181DDD8 | SHA256:E53424F6E9B18CBC34507374F8B9A1C6E645F5438FB8941A893CA679DD137FD4 | |||
| 6596 | SR9900_SFX_207.exe | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x64\SR9900.inf | txt | |
MD5:D40539AD5FFCCEC987296161F181DDD8 | SHA256:E53424F6E9B18CBC34507374F8B9A1C6E645F5438FB8941A893CA679DD137FD4 | |||
| 6596 | SR9900_SFX_207.exe | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x86\install.exe | executable | |
MD5:3A7B764F0C3DDAF0377A9952949C190E | SHA256:3172A69C5F0B31E6EC059B277B317B1A9D5A5111376304C7846FA794F6072109 | |||
| 6768 | install.exe | C:\Users\admin\AppData\Local\Temp\{d9db5b09-b88f-0649-88cf-f437efca9940}\SR9900.cat | cat | |
MD5:231EE844B0B1B1724BEAA62CCC17A0A4 | SHA256:61E70F6DB768C46417637B9E8F8EBCD6E062930941AA549D4E9A5277B2D30335 | |||
| 6768 | install.exe | C:\Users\admin\AppData\Local\Temp\{d9db5b09-b88f-0649-88cf-f437efca9940}\SR9900.sys | executable | |
MD5:8301A1E797FF9270CECBF4A09F630805 | SHA256:6E9F6A1B29A25A61DF0FFA4350115BA7A1428B04415536273F9FE04EE6EACA8E | |||
| 6872 | drvinst.exe | C:\Windows\System32\DriverStore\Temp\{4c954b61-e8fc-4844-b73a-aa709879e5af}\SET767B.tmp | cat | |
MD5:231EE844B0B1B1724BEAA62CCC17A0A4 | SHA256:61E70F6DB768C46417637B9E8F8EBCD6E062930941AA549D4E9A5277B2D30335 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
24
DNS requests
12
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.59:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2040 | svchost.exe | GET | 200 | 2.16.164.59:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3040 | RUXIMICS.exe | GET | 200 | 2.16.164.59:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3040 | RUXIMICS.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2040 | svchost.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.86.251.10:443 | https://r.bing.com/rb/19/cir3,ortl,cc,nc/mIBK4Tj4MH4TuENc-SRjlybWA2M.css?bu=C9kK2AOUBbULmgqECowIbW1tbQ&or=w | unknown | text | 19.8 Kb | whitelisted |
— | — | POST | 204 | 184.86.251.20:443 | https://www.bing.com/threshold/xls.aspx | unknown | — | — | whitelisted |
— | — | POST | 204 | 184.86.251.16:443 | https://www.bing.com/threshold/xls.aspx | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.86.251.20:443 | https://www.bing.com/rb/18/jnc,nj/6hU_LneafI_NFLeDvM367ebFaKQ.js?bu=DyIrb3t-gQF4cnWyAbUBK6UBK7gB&or=w | unknown | s | 21.3 Kb | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2040 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3040 | RUXIMICS.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.16.164.59:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
3040 | RUXIMICS.exe | 2.16.164.59:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
2040 | svchost.exe | 2.16.164.59:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
3040 | RUXIMICS.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
2040 | svchost.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
officeclient.microsoft.com |
| whitelisted |
ecs.office.com |
| whitelisted |
r.bing.com |
| whitelisted |