analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MeditateInstaller.exe

Full analysis: https://app.any.run/tasks/d8cd2c72-6ab5-4ea6-9e31-05c5733c6b7d
Verdict: Malicious activity
Analysis date: March 30, 2020, 17:15:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0BD341F8379FC0100FCAC22B99BAC4E9

SHA1:

21E93C30360DCEDB99F78CD683D2021E3496FF7E

SHA256:

E6CBE549FDBEDFB44AA5BED4BAF2FF0C5A8D9119E7FC76AD7380A7DA4AC5AA7E

SSDEEP:

3072:BZx9Ga6Mz7qdyjyIBuszX9rJiicuaQeuxtgmu9Ger9N+lIVTnBjKqI74co2CIjS3:LcyjJRyQAmujBN+kTnXco2CIj28rul

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • RaInstallerSolutionrov.exe (PID: 1852)
      • notepad++.exe (PID: 3516)

    • Changes settings of System certificates

      • MeditateInstaller.exe (PID: 2944)

  • SUSPICIOUS

    • Application launched itself

      • MeditateInstaller.exe (PID: 1740)
      • cmd.exe (PID: 1232)

    • Reads Internet Cache Settings

      • MeditateInstaller.exe (PID: 2944)

    • Creates files in the user directory

      • MeditateInstaller.exe (PID: 1740)
      • MeditateInstaller.exe (PID: 2944)
      • RaInstallerSolutionrov.exe (PID: 1852)
      • notepad++.exe (PID: 3516)

    • Creates files in the program directory

      • MeditateInstaller.exe (PID: 1740)
      • MeditateInstaller.exe (PID: 2944)

    • Starts CMD.EXE for self-deleting

      • MeditateInstaller.exe (PID: 2944)
      • cmd.exe (PID: 1232)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 3456)
      • MeditateInstaller.exe (PID: 2944)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 1232)

    • Executable content was dropped or overwritten

      • MeditateInstaller.exe (PID: 2944)
      • RaInstallerSolutionrov.exe (PID: 1852)

    • Creates a software uninstall entry

      • RaInstallerSolutionrov.exe (PID: 1852)

    • Adds / modifies Windows certificates

      • MeditateInstaller.exe (PID: 2944)

  • INFO

    • Reads settings of System Certificates

      • MeditateInstaller.exe (PID: 2944)

    • Manual execution by user

      • notepad++.exe (PID: 3516)
      • WINWORD.EXE (PID: 2788)
      • taskmgr.exe (PID: 2884)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2788)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductVersion: 3.1.6.30
ProductName: RaInstallerSolution
OriginalFileName: RaInstallerSolution.exe
LegalCopyright: Copyright 2019
InternalName: RaInstallerSolution.exe
FileVersion: 3.1.6.30
FileDescription: Ra Installer Solution
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0017
ProductVersionNumber: 3.1.6.30
FileVersionNumber: 3.1.6.30
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x13df0
UninitializedDataSize: -
InitializedDataSize: 112128
CodeSize: 219648
LinkerVersion: 9
PEType: PE32
TimeStamp: 2020:03:27 15:48:51+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Mar-2020 14:48:51
Detected languages:
  • English - United States
FileDescription: Ra Installer Solution
FileVersion: 3.1.6.30
InternalName: RaInstallerSolution.exe
LegalCopyright: Copyright 2019
OriginalFilename: RaInstallerSolution.exe
ProductName: RaInstallerSolution
ProductVersion: 3.1.6.30

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 27-Mar-2020 14:48:51
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00035825
0x00035A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64748
.rdata
0x00037000
0x00007EBA
0x00008000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.53907
.data
0x0003F000
0x00003A6C
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.9636
.rsrc
0x00043000
0x0000EEFC
0x0000F000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.52486
.reloc
0x00052000
0x00002B28
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.50385

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.24655
881
Latin 1 / Western European
English - United States
RT_MANIFEST
107
2.01924
20
Latin 1 / Western European
English - United States
RT_GROUP_ICON
129
3.21032
258
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
KERNEL32.dll
OLEAUT32.dll
PSAPI.DLL
SHELL32.dll
SHLWAPI.dll
USER32.dll
WININET.dll
WTSAPI32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
12
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start meditateinstaller.exe no specs meditateinstaller.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs cmd.exe no specs rainstallersolutionrov.exe cmd.exe no specs notepad++.exe winword.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1740"C:\Users\admin\AppData\Local\Temp\MeditateInstaller.exe" C:\Users\admin\AppData\Local\Temp\MeditateInstaller.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Ra Installer Solution
Exit code:
0
Version:
3.1.6.30
2944"C:\Users\admin\AppData\Local\Temp\MeditateInstaller.exe" -uacC:\Users\admin\AppData\Local\Temp\MeditateInstaller.exe
MeditateInstaller.exe
User:
admin
Integrity Level:
HIGH
Description:
Ra Installer Solution
Exit code:
0
Version:
3.1.6.30
3456C:\Windows\system32\cmd.exe /d /c cmd /d /c cmd /d /c IF EXIST "C:\Program Files\RaInstallerrsbSolution\RaInstallerSolutionrov.exe" (start "" "C:\Program Files\RaInstallerrsbSolution\RaInstallerSolutionrov.exe" 8660438912910417)C:\Windows\system32\cmd.exe—MeditateInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1232C:\Windows\system32\cmd.exe /d /c timeout 5 & cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\MeditateInstaller.exe"C:\Windows\system32\cmd.exe—MeditateInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3608cmd /d /c cmd /d /c IF EXIST "C:\Program Files\RaInstallerrsbSolution\RaInstallerSolutionrov.exe" (start "" "C:\Program Files\RaInstallerrsbSolution\RaInstallerSolutionrov.exe" 8660438912910417)C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3824timeout 5 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1632cmd /d /c IF EXIST "C:\Program Files\RaInstallerrsbSolution\RaInstallerSolutionrov.exe" (start "" "C:\Program Files\RaInstallerrsbSolution\RaInstallerSolutionrov.exe" 8660438912910417)C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1852"C:\Program Files\RaInstallerrsbSolution\RaInstallerSolutionrov.exe" 8660438912910417C:\Program Files\RaInstallerrsbSolution\RaInstallerSolutionrov.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.8.0.0
2652cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\MeditateInstaller.exe"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3516"C:\Users\admin\AppData\Roaming\Notepad++\notepad++.exe" C:\Users\admin\AppData\Roaming\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.8
Total events
3 214
Read events
1 671
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
4
Text files
20
Unknown types
8

Dropped files

PID
Process
Filename
Type
2944MeditateInstaller.exeC:\Users\admin\AppData\Local\Temp\Cab8F77.tmp —
MD5:—
SHA256:—
2944MeditateInstaller.exeC:\Users\admin\AppData\Local\Temp\Tar8F78.tmp —
MD5:—
SHA256:—
2944MeditateInstaller.exeC:\Users\admin\AppData\Roaming\folder\Changelogneztext
MD5:F08EE8B693EAA0D6AE7BCF5920080EC7
SHA256:D1A28A4A8BA0119B9B18EBDC002F693D4C11579C7190E3A23C0BC6EAF33BEC51
2944MeditateInstaller.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\WMQ5CWM6executable
MD5:3D0BED6E637AD841876C900734D868AD
SHA256:EE9020226ACD5D9E7598C94B036C7E7379433428012DFD38C0CFA51BD7E0EAF4
2944MeditateInstaller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C1B3CC7FF1466C71640A202F8258105B_320C6094CD382ED04102F667B857065Bbinary
MD5:8194E6400E03B60D89BD2DF36402BE4C
SHA256:9C9DE632B8716929EDBB17E710121254F74AADDC479EA50802ED5620FFD5D580
1740MeditateInstaller.exeC:\Users\admin\AppData\Roaming\folder\Changelogxrotext
MD5:F08EE8B693EAA0D6AE7BCF5920080EC7
SHA256:D1A28A4A8BA0119B9B18EBDC002F693D4C11579C7190E3A23C0BC6EAF33BEC51
2944MeditateInstaller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1der
MD5:907131A56BA168672FD6DCA3988E2A2B
SHA256:7A4D281C2E93B883F2A05E43F75A91BCA5F83FB3F1FE3AC84FDA45D6146BAB05
2944MeditateInstaller.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1binary
MD5:0475163F01FC25ECEBA09FDF36CBE843
SHA256:726E3859C7E45B7A3D2C16969CD237158F9211209D6B9400E8AE5A8091BAB68C
2944MeditateInstaller.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\MNLX2XUF.txttext
MD5:9241AD868DE0F66DA568BAAD189CAC25
SHA256:497B6C08B8036F89A3C05219EDF225FC0FAB23F57CDBCCC99A4EB45C76E8F38C
1740MeditateInstaller.exeC:\ProgramData\folder\Changelogxrotext
MD5:F08EE8B693EAA0D6AE7BCF5920080EC7
SHA256:D1A28A4A8BA0119B9B18EBDC002F693D4C11579C7190E3A23C0BC6EAF33BEC51
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2944
MeditateInstaller.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2Fz5hY5qj0aEmX0H4s05bY%3D
US
der
1.47 Kb
whitelisted
2944
MeditateInstaller.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQrBBNpPfHTPX6Jy6BVzyBPnBWMnQQUPnQtH89FdQR%2BP8Cihz5MQ4NRE8YCEA4Q8WP71KRa1%2Bn9nuQqJAI%3D
US
der
279 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2944
MeditateInstaller.exe
104.26.2.41:443
softwaresahead.com
Cloudflare Inc
US
unknown
2944
MeditateInstaller.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
softwaresahead.com
  • 104.26.2.41
  • 104.26.3.41
suspicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Users\admin\AppData\Roaming\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Users\admin\AppData\Roaming\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: error while getting certificate informations
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MeditateInstaller.exe