| File name: | SR9900_SFX_207.exe |
| Full analysis: | https://app.any.run/tasks/d44190a7-d2c7-48aa-9c1b-9b688d22d18c |
| Verdict: | Malicious activity |
| Analysis date: | November 12, 2024, 18:25:55 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections |
| MD5: | 9CA4EF0A54999B63D6B4306CDD6F3C15 |
| SHA1: | 65BA6BB1341DFEF27A260D67805B1E556240A568 |
| SHA256: | E3F57D5EBC882A0A0CA96F9BA244FE97FB1A02A3297335451B9C5091332FE359 |
| SSDEEP: | 3072:w7CT6SF4J3gnQB6GFYp6kS3IKX2/mztVw4BzuS:wmf2xgnMpFYp6kS3b4atVDBzuS |
MALICIOUS
No malicious indicators.SUSPICIOUS
Reads security settings of Internet Explorer
- SR9900_SFX_207.exe (PID: 6688)
Executable content was dropped or overwritten
- drvinst.exe (PID: 5596)
- install.exe (PID: 5084)
- SR9900_SFX_207.exe (PID: 6688)
Drops a system driver (possible attempt to evade defenses)
- drvinst.exe (PID: 5596)
- SR9900_SFX_207.exe (PID: 6688)
- install.exe (PID: 5084)
Creates files in the driver directory
- drvinst.exe (PID: 5596)
Checks Windows Trust Settings
- drvinst.exe (PID: 5596)
INFO
Reads the computer name
- SR9900_SFX_207.exe (PID: 6688)
- install.exe (PID: 5084)
- drvinst.exe (PID: 5596)
Checks supported languages
- SR9900_SFX_207.exe (PID: 6688)
- drvinst.exe (PID: 5596)
- install.exe (PID: 5084)
- Setup.exe (PID: 6644)
Create files in a temporary directory
- install.exe (PID: 5084)
- SR9900_SFX_207.exe (PID: 6688)
Process checks computer location settings
- SR9900_SFX_207.exe (PID: 6688)
Reads the machine GUID from the registry
- drvinst.exe (PID: 5596)
The process uses the downloaded file
- SR9900_SFX_207.exe (PID: 6688)
Reads the software policy settings
- drvinst.exe (PID: 5596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Generic Win/DOS Executable (50) |
|---|---|---|
| .exe | | | DOS Executable Generic (49.9) |
EXIF
EXE
| Subsystem: | Windows GUI |
|---|---|
| SubsystemVersion: | 4 |
| ImageVersion: | - |
| OSVersion: | 4 |
| EntryPoint: | 0x11def |
| UninitializedDataSize: | - |
| InitializedDataSize: | 20480 |
| CodeSize: | 70656 |
| LinkerVersion: | 8 |
| PEType: | PE32 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| TimeStamp: | 2010:06:27 07:06:38+00:00 |
| MachineType: | Intel 386 or later, and compatibles |
Total processes
138
Monitored processes
6
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4076 | "C:\Users\admin\AppData\Local\Temp\SR9900_SFX_207.exe" | C:\Users\admin\AppData\Local\Temp\SR9900_SFX_207.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 6688 | "C:\Users\admin\AppData\Local\Temp\SR9900_SFX_207.exe" | C:\Users\admin\AppData\Local\Temp\SR9900_SFX_207.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 6644 | "C:\Users\admin\AppData\Local\Temp\SR9900_SFX\Setup.exe" | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\Setup.exe | — | SR9900_SFX_207.exe | |||||||||||
User: admin Company: CoreChip Semiconductor, Inc Integrity Level: HIGH Description: Install Program for CoreChip USB Ethernet Exit code: 0 Version: 5.00 built by: WinDDK Modules
| |||||||||||||||
| 1112 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5084 | ".\install.exe" | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x64\install.exe | Setup.exe | ||||||||||||
User: admin Company: CoreChip Semiconductor, Inc Integrity Level: HIGH Description: Install Program for CoreChip USB Ethernet Exit code: 0 Version: 5.00 built by: WinDDK Modules
| |||||||||||||||
| 5596 | DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{9e7d95aa-049b-4645-9f8d-6a728453bade}\SR9900.inf" "9" "409007f0f" "00000000000001E8" "WinSta0\Default" "00000000000001F0" "208" "C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x64" | C:\Windows\System32\drvinst.exe | svchost.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
3 437
Read events
3 436
Write events
1
Delete events
0
Modification events
| (PID) Process: | (5084) install.exe | Key: | HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus |
| Operation: | write | Name: | setupapi.dev.log |
Value: 4096 | |||
Executable files
9
Suspicious files
13
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5084 | install.exe | C:\Users\admin\AppData\Local\Temp\{9e7d95aa-049b-4645-9f8d-6a728453bade}\SR9900.inf | binary | |
MD5:D40539AD5FFCCEC987296161F181DDD8 | SHA256:E53424F6E9B18CBC34507374F8B9A1C6E645F5438FB8941A893CA679DD137FD4 | |||
| 5084 | install.exe | C:\Users\admin\AppData\Local\Temp\{9e7d95aa-049b-4645-9f8d-6a728453bade}\SR9900.cat | binary | |
MD5:231EE844B0B1B1724BEAA62CCC17A0A4 | SHA256:61E70F6DB768C46417637B9E8F8EBCD6E062930941AA549D4E9A5277B2D30335 | |||
| 5084 | install.exe | C:\Users\admin\AppData\Local\Temp\{9e7d95aa-049b-4645-9f8d-6a728453bade}\SR9900.sys | executable | |
MD5:8301A1E797FF9270CECBF4A09F630805 | SHA256:6E9F6A1B29A25A61DF0FFA4350115BA7A1428B04415536273F9FE04EE6EACA8E | |||
| 5596 | drvinst.exe | C:\Windows\System32\DriverStore\Temp\{a9264f18-05d7-6e41-968c-14a59684a0aa}\SR9900.inf | binary | |
MD5:D40539AD5FFCCEC987296161F181DDD8 | SHA256:E53424F6E9B18CBC34507374F8B9A1C6E645F5438FB8941A893CA679DD137FD4 | |||
| 5084 | install.exe | C:\Users\admin\AppData\Local\Temp\{9e7d95aa-049b-4645-9f8d-6a728453bade}\SETBCE1.tmp | binary | |
MD5:D40539AD5FFCCEC987296161F181DDD8 | SHA256:E53424F6E9B18CBC34507374F8B9A1C6E645F5438FB8941A893CA679DD137FD4 | |||
| 5596 | drvinst.exe | C:\Windows\System32\DriverStore\Temp\{a9264f18-05d7-6e41-968c-14a59684a0aa}\SR9900.cat | cat | |
MD5:231EE844B0B1B1724BEAA62CCC17A0A4 | SHA256:61E70F6DB768C46417637B9E8F8EBCD6E062930941AA549D4E9A5277B2D30335 | |||
| 6688 | SR9900_SFX_207.exe | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x86\sr9900.cat | binary | |
MD5:B788E43E51573EC6652EEF1382B9945F | SHA256:2C4A0B87B05493445DC524D8F97149C6CEFAAB5D3C32668C17C85DDD06BB5EA2 | |||
| 5084 | install.exe | C:\Users\admin\AppData\Local\Temp\{9e7d95aa-049b-4645-9f8d-6a728453bade}\SETBCE2.tmp | executable | |
MD5:8301A1E797FF9270CECBF4A09F630805 | SHA256:6E9F6A1B29A25A61DF0FFA4350115BA7A1428B04415536273F9FE04EE6EACA8E | |||
| 6688 | SR9900_SFX_207.exe | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x64\sr9900.cat | binary | |
MD5:231EE844B0B1B1724BEAA62CCC17A0A4 | SHA256:61E70F6DB768C46417637B9E8F8EBCD6E062930941AA549D4E9A5277B2D30335 | |||
| 6688 | SR9900_SFX_207.exe | C:\Users\admin\AppData\Local\Temp\SR9900_SFX\drivers\x86\SR9900.sys | executable | |
MD5:00B1239D9EB8FCE07E79792B8475E9DD | SHA256:56D1CC06763FB6FFDC6AEA534942AAA184E4F6168D57B549D3D5F451FCB4010D | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
41
DNS requests
21
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.48.23.147:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4312 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4312 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
3740 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
624 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6944 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5488 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.48.23.147:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4360 | SearchApp.exe | 104.126.37.128:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
624 | svchost.exe | 20.190.159.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |