| File name: | goodbyedpi-0.2.3rc1-2.zip |
| Full analysis: | https://app.any.run/tasks/650fa30d-6bab-4d52-b045-bfd253cc5f33 |
| Verdict: | Malicious activity |
| Analysis date: | August 12, 2024, 13:56:26 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=store |
| MD5: | 41938D1256F900CDACA626A152BA5E95 |
| SHA1: | DBAFC9A75213D46B19E8FD7A330B87BFD8C0B562 |
| SHA256: | E3FF0DE76A44978EBD02B890F66BE6F3F4320C99F8B443DE1877D4E16A4A5443 |
| SSDEEP: | 49152:0AJn6dfL7XeDJmJS57XeLoMd1ZeGdZtQdrK/DFam2pkAUZq+KrqhOe+6wADOE7LU:VN6dfL7uDJp57u0UZN8BKbUTKNts6wA6 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Drops a system driver (possible attempt to evade defenses)
- WinRAR.exe (PID: 6456)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6456)
Manual execution by a user
- cmd.exe (PID: 6604)
- firefox.exe (PID: 5504)
Reads the machine GUID from the registry
- goodbyedpi.exe (PID: 6820)
Reads the computer name
- goodbyedpi.exe (PID: 6820)
- TextInputHost.exe (PID: 4540)
Checks supported languages
- goodbyedpi.exe (PID: 6820)
- TextInputHost.exe (PID: 4540)
Application launched itself
- firefox.exe (PID: 5504)
- firefox.exe (PID: 2208)
Reads Microsoft Office registry keys
- firefox.exe (PID: 2208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2024:08:01 09:33:12 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | goodbyedpi-0.2.3rc1/ |
Total processes
152
Monitored processes
25
Malicious processes
0
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4 | System | [System Process] | |||||||||||||
User: SYSTEM Integrity Level: SYSTEM | |||||||||||||||
| 1528 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4520 -childID 2 -isForBrowser -prefsHandle 4512 -prefMapHandle 4508 -prefsLen 36263 -prefMapSize 244343 -jsInitHandle 1464 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b5967bc-4dc0-44a7-9fcf-cc454c033a9d} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" 24f8a883bd0 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 2208 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 3844 | goodbyedpi.exe -9 --dns-addr 77.88.8.8 --dns-port 1253 --dnsv6-addr 2a02:6b8::feed:0ff --dnsv6-port 1253 --blacklist ..\russia-blacklist.txt --blacklist ..\russia-youtube.txt | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\x86_64\goodbyedpi.exe | — | cmd.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 4064 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2276 -parentBuildID 20240213221259 -prefsHandle 2268 -prefMapHandle 2264 -prefsLen 30537 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba3faf43-39bc-4455-902a-7810d34dc0fb} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" 24ff697f510 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 4540 | "C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Version: 123.26505.0.0 Modules
| |||||||||||||||
| 5028 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2952 -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2940 -prefsLen 30953 -prefMapSize 244343 -jsInitHandle 1464 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00feb314-796e-406f-9246-206b495a137c} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" 24f8902e690 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 5504 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | explorer.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 0 Version: 123.0 Modules
| |||||||||||||||
| 5512 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240213221259 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 30537 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {810d67ae-0354-4ec9-b6ff-7ee178ae8403} 2208 "\\.\pipe\gecko-crash-server-pipe.2208" 24ffebe5410 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Exit code: 1 Version: 123.0 Modules
| |||||||||||||||
| 6420 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
22 897
Read events
22 844
Write events
52
Delete events
1
Modification events
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2.zip | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E |
| Operation: | write | Name: | @C:\WINDOWS\System32\acppage.dll,-6003 |
Value: Windows Command Script | |||
| (PID) Process: | (6456) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2 | |||
Executable files
7
Suspicious files
177
Text files
30
Unknown types
230
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\x86\goodbyedpi.exe | executable | |
MD5:92A6C37A997FBA11F9E26995925CBEE6 | SHA256:DA0884D6B282FF934C0D7392A50EFCA03C65943B6E2B6254E14E81420F0EBB5F | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\licenses\LICENSE-uthash.txt | text | |
MD5:5CC1F1E4C71F19F580458586756C02B4 | SHA256:D3C6556E48104C31E3E0C62238C749C2A09CA79EE87DA50B9CD29C6C9027D57D | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\x86\WinDivert64.sys | executable | |
MD5:6A33620DE63BCCAF5E5314EE49CD58FB | SHA256:E69B5BA3F0CD6CFB2983E442636E7F0B342B61B15264B0328317D4559C82CF50 | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\x86\WinDivert.dll | executable | |
MD5:1CB0EFD60883B5637B31BF46C34AE199 | SHA256:625FFDD95BFABFF32D0E8A95BEABCD303C01C8BBA73B90402D4E84D6E15DD8E5 | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\x86\WinDivert32.sys | executable | |
MD5:CD477EE96FF05CACDA8AC3C0E9316D7A | SHA256:29CA5CEB59C9C6993A349E82B1FD46078E6F8A302764153AB84FA22E382FCDCA | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\licenses\LICENSE-getline.txt | text | |
MD5:3A7EDEBC3612BCEA2306F73B92342A44 | SHA256:EC5F8E03FCCB3842CC62AD79EA5F6F6058988E2721A3E6566E8FB72786D485C4 | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\service_remove.cmd | text | |
MD5:295C774295B7FAB9F7E3100BF3A482DA | SHA256:D6F19938699E88198ACE9206E417E1289F211E187CFED163D31172F97CB91D55 | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\x86_64\goodbyedpi.exe | executable | |
MD5:FD680538C2A80DC54C63AE39C3563FBD | SHA256:FA9A32AE6EB24E2290941EA60F80E914168E1F84E900293BFFD4393FB9A8FAE2 | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\2_any_country.cmd | text | |
MD5:72103C58F2ED536EBC07E19FD00FA2F0 | SHA256:17A3D7B8B1E1340F67D3687CE9162199C0A25025941D23954880808403487D07 | |||
| 6456 | WinRAR.exe | C:\Users\admin\Downloads\goodbyedpi-0.2.3rc1-2\1_russia_blacklist.cmd | text | |
MD5:76763259E528CD27E998FB4C665C2B78 | SHA256:69C8B67FAFBCA446CE5302E97F9947191ECB84D2A51EAE61D4955DC3E2147DA0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
188
DNS requests
9
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5336 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
2212 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6996 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
4 | System | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
4 | System | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
2208 | firefox.exe | POST | 200 | 88.221.132.66:80 | http://r10.o.lencr.org/ | unknown | — | — | unknown |
2208 | firefox.exe | POST | 200 | 88.221.132.66:80 | http://r10.o.lencr.org/ | unknown | — | — | unknown |
6960 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
2208 | firefox.exe | POST | 200 | 88.221.132.66:80 | http://r10.o.lencr.org/ | unknown | — | — | unknown |
2208 | firefox.exe | POST | 200 | 88.221.132.66:80 | http://r11.o.lencr.org/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2248 | RUXIMICS.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4160 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4160 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5336 | SearchApp.exe | 104.126.37.178:443 | www.bing.com | Akamai International B.V. | DE | unknown |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2212 | svchost.exe | 40.126.31.73:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
th.bing.com |
| whitelisted |
fd.api.iris.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |