| File name: | goodbyedpi-0.2.3rc1-2.zip |
| Full analysis: | https://app.any.run/tasks/c1fca42d-7b2e-4c11-bce9-08c98c70970d |
| Verdict: | Malicious activity |
| Analysis date: | August 10, 2024, 12:49:52 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v2.0 to extract, compression method=store |
| MD5: | 41938D1256F900CDACA626A152BA5E95 |
| SHA1: | DBAFC9A75213D46B19E8FD7A330B87BFD8C0B562 |
| SHA256: | E3FF0DE76A44978EBD02B890F66BE6F3F4320C99F8B443DE1877D4E16A4A5443 |
| SSDEEP: | 49152:0AJn6dfL7XeDJmJS57XeLoMd1ZeGdZtQdrK/DFam2pkAUZq+KrqhOe+6wADOE7LU:VN6dfL7uDJp57u0UZN8BKbUTKNts6wA6 |
MALICIOUS
No malicious indicators.SUSPICIOUS
Drops the executable file immediately after the start
- WinRAR.exe (PID: 6340)
Drops a system driver (possible attempt to evade defenses)
- WinRAR.exe (PID: 6340)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 6340)
Reads the machine GUID from the registry
- goodbyedpi.exe (PID: 6988)
Reads the computer name
- goodbyedpi.exe (PID: 6988)
- TextInputHost.exe (PID: 3980)
Checks supported languages
- goodbyedpi.exe (PID: 6988)
- TextInputHost.exe (PID: 3980)
Manual execution by a user
- cmd.exe (PID: 6840)
- firefox.exe (PID: 6972)
Application launched itself
- firefox.exe (PID: 1536)
- firefox.exe (PID: 6972)
Reads Microsoft Office registry keys
- firefox.exe (PID: 1536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 20 |
|---|---|
| ZipBitFlag: | - |
| ZipCompression: | None |
| ZipModifyDate: | 2024:08:01 09:33:12 |
| ZipCRC: | 0x00000000 |
| ZipCompressedSize: | - |
| ZipUncompressedSize: | - |
| ZipFileName: | goodbyedpi-0.2.3rc1/ |
Total processes
156
Monitored processes
25
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 4 | System | [System Process] | |||||||||||||
User: SYSTEM Integrity Level: SYSTEM | |||||||||||||||
| 1044 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2980 -childID 1 -isForBrowser -prefsHandle 2972 -prefMapHandle 2968 -prefsLen 30953 -prefMapSize 244343 -jsInitHandle 1472 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78e00bfc-cf7a-4531-8479-e19e078cc943} 1536 "\\.\pipe\gecko-crash-server-pipe.1536" 2b5a7f56150 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 1536 | "C:\Program Files\Mozilla Firefox\firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | firefox.exe | ||||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 2204 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4388 -childID 2 -isForBrowser -prefsHandle 4380 -prefMapHandle 4368 -prefsLen 36263 -prefMapSize 244343 -jsInitHandle 1472 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f448f395-598f-4236-8790-d1210bb24857} 1536 "\\.\pipe\gecko-crash-server-pipe.1536" 2b5a982ca10 tab | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 3980 | "C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mca | C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Version: 123.26505.0.0 Modules
| |||||||||||||||
| 6228 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2304 -parentBuildID 20240213221259 -prefsHandle 2296 -prefMapHandle 2288 -prefsLen 30537 -prefMapSize 244343 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d89f24bd-7b9b-4cf0-b7f0-e669636996ad} 1536 "\\.\pipe\gecko-crash-server-pipe.1536" 2b595c7fb10 socket | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 6340 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\goodbyedpi-0.2.3rc1-2.zip | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Version: 5.91.0 Modules
| |||||||||||||||
| 6584 | "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1912 -parentBuildID 20240213221259 -prefsHandle 1852 -prefMapHandle 1832 -prefsLen 30537 -prefMapSize 244343 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4164760e-ea8a-4486-8421-a5836d4fffb4} 1536 "\\.\pipe\gecko-crash-server-pipe.1536" 2b5a26e7e10 gpu | C:\Program Files\Mozilla Firefox\firefox.exe | — | firefox.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: LOW Description: Firefox Version: 123.0 Modules
| |||||||||||||||
| 6736 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6840 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\goodbyedpi-0.2.3rc1\1_russia_blacklist_dnsredir.cmd" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
23 600
Read events
23 560
Write events
39
Delete events
1
Modification events
| (PID) Process: | (6340) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (6340) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (6340) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
| (PID) Process: | (6340) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\goodbyedpi-0.2.3rc1-2.zip | |||
| (PID) Process: | (6340) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (6340) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (6340) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (6340) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (6840) cmd.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (6840) cmd.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
Executable files
7
Suspicious files
187
Text files
24
Unknown types
191
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\x86\WinDivert64.sys | executable | |
MD5:6A33620DE63BCCAF5E5314EE49CD58FB | SHA256:E69B5BA3F0CD6CFB2983E442636E7F0B342B61B15264B0328317D4559C82CF50 | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\x86_64\goodbyedpi.exe | executable | |
MD5:FD680538C2A80DC54C63AE39C3563FBD | SHA256:FA9A32AE6EB24E2290941EA60F80E914168E1F84E900293BFFD4393FB9A8FAE2 | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\licenses\LICENSE-getline.txt | text | |
MD5:3A7EDEBC3612BCEA2306F73B92342A44 | SHA256:EC5F8E03FCCB3842CC62AD79EA5F6F6058988E2721A3E6566E8FB72786D485C4 | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\licenses\LICENSE-goodbyedpi.txt | text | |
MD5:C4082B6C254C9FB71136710391D9728B | SHA256:E03BA41D7FAB20700769FE4118BAB50D800CB74F990353A05D2F5FFF1C228363 | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\x86_64\WinDivert.dll | executable | |
MD5:88E1C19B978436258F7C938013408A8A | SHA256:6110BFA44667405179C3E15E12AF1B62037E447ED59B054B19042032995E6C7E | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\1_russia_blacklist_dnsredir.cmd | text | |
MD5:06018C5958CDDD1D0CF3135762AEB2EB | SHA256:472D9BD4F0366BB9478B6CD61302F12BF6CFFBED038508A67087250BF610E355 | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\0_russia_update_blacklist_file.cmd | text | |
MD5:A6AF4B081A4CBCD448759306B2366EAC | SHA256:D9D7C57C7DEDB3A4E6566DDD7623758F53986A2C34E0CD3784B84F7F881A01C4 | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\x86_64\WinDivert64.sys | executable | |
MD5:6A33620DE63BCCAF5E5314EE49CD58FB | SHA256:E69B5BA3F0CD6CFB2983E442636E7F0B342B61B15264B0328317D4559C82CF50 | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\russia-blacklist.txt | text | |
MD5:10428C8013F3A63E4D85C7E8C12D1288 | SHA256:A0EDD9B4D4D99B31B62F73AD4D0819408B0F38A4178893D5279A9BC6736B0668 | |||
| 6340 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa6340.1332\goodbyedpi-0.2.3rc1\x86\WinDivert32.sys | executable | |
MD5:CD477EE96FF05CACDA8AC3C0E9316D7A | SHA256:29CA5CEB59C9C6993A349E82B1FD46078E6F8A302764153AB84FA22E382FCDCA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
193
DNS requests
3
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4 | System | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4 | System | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
4 | System | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
6248 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
4 | System | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
1536 | firefox.exe | POST | 200 | 88.221.132.88:80 | http://r11.o.lencr.org/ | unknown | — | — | unknown |
1536 | firefox.exe | POST | 200 | 88.221.132.66:80 | http://r10.o.lencr.org/ | unknown | — | — | unknown |
1536 | firefox.exe | POST | 200 | 88.221.132.66:80 | http://r10.o.lencr.org/ | unknown | — | — | unknown |
1536 | firefox.exe | POST | 200 | 88.221.132.66:80 | http://r10.o.lencr.org/ | unknown | — | — | unknown |
1536 | firefox.exe | POST | 200 | 88.221.132.88:80 | http://r11.o.lencr.org/ | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3888 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3268 | RUXIMICS.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
2120 | MoUsoCoreWorker.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4708 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4708 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 77.88.8.8:1253 | — | — | — | unknown |
5336 | SearchApp.exe | 80.239.150.35:443 | — | Telia Company AB | DE | unknown |
5336 | SearchApp.exe | 192.229.221.95:80 | — | EDGECAST | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |
4 | System | Potentially Bad Traffic | ET INFO Non Standard Port DNS Query to google .com (udp) |