analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

MultibarInstaller(Ticno).exe

Full analysis: https://app.any.run/tasks/d571837b-1289-4a47-8770-25829cab3e52
Verdict: Malicious activity
Analysis date: August 13, 2019, 20:45:17
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

1BAB1804AFF2DCCAEB8AC68C0F56E576

SHA1:

34E30C2D5E55620FDC4B9DB919EE935CECADFDFE

SHA256:

E88B58409362DF6BE6A80330BF2407DF9085F3A3AD87667B713C8A1AF95E5920

SSDEEP:

196608:5yBY/ctAVlnMBYAoh5mj7T3A5dPtupWHA6t8rVkT35:5imEklMJj7TQ5dFup4Ab235

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • MultibarInstaller(Ticno).exe (PID: 3308)
      • MultibarInstaller(Ticno).exe (PID: 3704)
      • multibar.exe (PID: 2984)
      • multibar_main.exe (PID: 3160)
      • TicnoWeather.exe (PID: 3816)

    • Application was dropped or rewritten from another process

      • helpscreen.exe (PID: 3144)
      • multibar_main.exe (PID: 3160)
      • multibar.exe (PID: 2984)
      • TicnoWeather.exe (PID: 3816)

    • Changes the autorun value in the registry

      • MultibarInstaller(Ticno).exe (PID: 3704)

  • SUSPICIOUS

    • Application launched itself

      • MultibarInstaller(Ticno).exe (PID: 3308)

    • Executable content was dropped or overwritten

      • MultibarInstaller(Ticno).exe (PID: 3308)
      • MultibarInstaller(Ticno).exe (PID: 3704)
      • multibar.exe (PID: 2984)

    • Creates COM task schedule object

      • MultibarInstaller(Ticno).exe (PID: 3704)

    • Creates a software uninstall entry

      • MultibarInstaller(Ticno).exe (PID: 3704)

    • Creates files in the user directory

      • TicnoWeather.exe (PID: 3816)
      • multibar_main.exe (PID: 3160)
      • MultibarInstaller(Ticno).exe (PID: 3704)

    • Creates files in the program directory

      • MultibarInstaller(Ticno).exe (PID: 3704)

  • INFO

    • Reads settings of System Certificates

      • multibar_main.exe (PID: 3160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

ProductName: Ticno Multibar
LegalTrademarks: -
LegalCopyright: Copyright © 2009 - Media Labs
FileVersion: 0.9.9.5
FileDescription: Multibar Installer
CompanyName: Media Labs Ltd.
Comments: -
CharacterSet: Windows, Cyrillic
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.9.9.5
FileVersionNumber: 0.9.9.5
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x323c
UninitializedDataSize: 1024
InitializedDataSize: 119808
CodeSize: 23552
LinkerVersion: 6
PEType: PE32
TimeStamp: 2009:12:05 23:50:46+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Dec-2009 22:50:46
Detected languages:
  • English - United States
Comments: -
CompanyName: Media Labs Ltd.
FileDescription: Multibar Installer
FileVersion: 0.9.9.5
LegalCopyright: Copyright © 2009 - Media Labs
LegalTrademarks: -
ProductName: Ticno Multibar

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-Dec-2009 22:50:46
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005A5A
0x00005C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.4177
.rdata
0x00007000
0x00001190
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.18163
.data
0x00009000
0x0001AF98
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.70903
.ndata
0x00024000
0x00009000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0002D000
0x00014E48
0x00015000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.55036

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.22437
947
UNKNOWN
English - United States
RT_MANIFEST
2
5.54365
9640
UNKNOWN
English - United States
RT_ICON
3
5.79578
4264
UNKNOWN
English - United States
RT_ICON
4
5.4345
1128
UNKNOWN
English - United States
RT_ICON
103
2.65982
62
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
6
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start multibarinstaller(ticno).exe multibarinstaller(ticno).exe multibar.exe helpscreen.exe multibar_main.exe ticnoweather.exe

Process information

PID
CMD
Path
Indicators
Parent process
3308"C:\Users\admin\AppData\Local\Temp\MultibarInstaller(Ticno).exe" C:\Users\admin\AppData\Local\Temp\MultibarInstaller(Ticno).exe
explorer.exe
User:
admin
Company:
Media Labs Ltd.
Integrity Level:
MEDIUM
Description:
Multibar Installer
Exit code:
0
Version:
0.9.9.5
3704"C:\Users\admin\AppData\Local\Temp\MultibarInstaller(Ticno).exe" /UAC:C01B2 /NCRC C:\Users\admin\AppData\Local\Temp\MultibarInstaller(Ticno).exe
MultibarInstaller(Ticno).exe
User:
admin
Company:
Media Labs Ltd.
Integrity Level:
HIGH
Description:
Multibar Installer
Exit code:
0
Version:
0.9.9.5
2984"C:\Program Files\Ticno\Multibar\multibar.exe" /NEWC:\Program Files\Ticno\Multibar\multibar.exe
MultibarInstaller(Ticno).exe
User:
admin
Integrity Level:
MEDIUM
3144"C:\PROGRA~1\Ticno\Multibar\helpscreen.exe" C:\PROGRA~1\Ticno\Multibar\helpscreen.exe
multibar.exe
User:
admin
Integrity Level:
MEDIUM
3160"C:\PROGRA~1\Ticno\Multibar\multibar_main.exe" 1245590C:\PROGRA~1\Ticno\Multibar\multibar_main.exe
multibar.exe
User:
admin
Integrity Level:
MEDIUM
3816"C:\Users\admin\AppData\Local\Ticno\Multibar\plugins\weather\TicnoWeather.exe"C:\Users\admin\AppData\Local\Ticno\Multibar\plugins\weather\TicnoWeather.exe
multibar_main.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Ticno Weather
Version:
1, 0, 0, 22
Total events
1 315
Read events
932
Write events
0
Delete events
0

Modification events

No data
Executable files
38
Suspicious files
12
Text files
995
Unknown types
4

Dropped files

PID
Process
Filename
Type
3704MultibarInstaller(Ticno).exeC:\Users\admin\AppData\Local\Temp\multibar_un\KillProcDLL.dll —
MD5:—
SHA256:—
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\appdata\backgrounds\Carbon\preview.pngimage
MD5:29EAEEB2CA1164D47CC3AFE4C22E9163
SHA256:8B3C3C01E05CBA60CE9ADFAFA7C83616F3AFF41E219505644041427E12A0F6F0
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\appdata\backgrounds\Clouds\preview.pngimage
MD5:0F1AB2C8F58B121D29E5A1923935D746
SHA256:0022F50D5CD7AEDB5BD1199BB60F40242C5F8BEA1F571196D6806D19CF565743
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\hook2.dllexecutable
MD5:AABBF106ADF2993F96F5BB4B4EC4F4C8
SHA256:D6D60004720ECF35D5DD4E54F5379216962E41D1949A2832FE01E6F488FBA9CA
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\appdata\backgrounds\Net\preview.pngimage
MD5:1FA9D1D2362D402B36DA26CF3D6B919E
SHA256:0633150C71ECFE63284D298691431002F27C7FE171ABBEDCECF48DEE182B82FC
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\multibar.exeexecutable
MD5:38887F7A6D2C1CB6A685CC69CA43C583
SHA256:229B4A62916A5AC366C97B099E0AF9DEB6B72CB26F583D3BE9C7A5D9D6FF18AE
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\appdata\backgrounds\space\layer33.pngimage
MD5:16B7B090D4FF5F60EFB4240ECBFCB24E
SHA256:8F30524EBE2CC9B9E14A3348309C20A5CF2D9C6D0E235AB4FC29685568FC2E4D
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\appdata\backgrounds\space\layer3.pngimage
MD5:3BF353778A91BD9B8D1482C5E2B49383
SHA256:FBEC28E601CA9EDB96E8EE19ACBF43F814BB8E55DB78DAB34354AFF142E3EB1D
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\appdata\backgrounds\Chrome\preview.pngimage
MD5:63AC3CB50DB8639532C60D6E4F9A91B9
SHA256:0FDA7045803E8BBA511D18EAE512CE0262DC20D7CB6891D91ABFDEBA255E40B2
3704MultibarInstaller(Ticno).exeC:\Program Files\Ticno\Multibar\appdata\backgrounds\data.xmlxml
MD5:78A3F367F9FF2F8BD82B9A7DA72145D2
SHA256:E7B0581E7746370E0614BCA96094673A3F8AF69BFB269E5F353043465095E74A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
15
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3816
TicnoWeather.exe
GET
301
169.61.169.124:80
http://xoap.weather.com/weather/local/RSXX0063?cc=*&dayf=5&link=xoap&prod=xoap&par=1086136045&key=93b3405b5760a9e0
US
html
268 b
unknown
3160
multibar_main.exe
GET
200
198.54.112.216:80
http://1451.scenbe.com/match-1451/17009/85949149/1565729148/mf_a8cefbed-51d7-4102-a215-23c513a502b8/YXBpeDA3LWdhbWlhci5jb20=/feed
US
html
414 b
malicious
3160
multibar_main.exe
GET
200
151.106.5.164:80
http://gamiar.com/xml/online_ru.xml
US
html
483 b
suspicious
3816
TicnoWeather.exe
GET
—
169.61.169.124:80
http://xoap.weather.com/weather/local/RSXX0063?cc=*&dayf=5&link=xoap&prod=xoap&par=1086136045&key=93b3405b5760a9e0
US
—
—
unknown
3816
TicnoWeather.exe
GET
301
169.61.169.124:80
http://xoap.weather.com/search/search?where=%2C%20
US
html
267 b
unknown
3816
TicnoWeather.exe
GET
301
169.61.169.124:80
http://xoap.weather.com/weather/local/RSXX0063?cc=*&dayf=5&link=xoap&prod=xoap&par=1086136045&key=93b3405b5760a9e0
US
html
268 b
unknown
3816
TicnoWeather.exe
GET
301
169.61.169.124:80
http://xoap.weather.com/weather/local/RSXX0063?cc=*&dayf=5&link=xoap&prod=xoap&par=1086136045&key=93b3405b5760a9e0
US
html
268 b
unknown
3816
TicnoWeather.exe
GET
301
169.61.169.124:80
http://xoap.weather.com/weather/local/RSXX0063?cc=*&dayf=5&link=xoap&prod=xoap&par=1086136045&key=93b3405b5760a9e0
US
html
268 b
unknown
3160
multibar_main.exe
GET
301
91.227.52.156:80
http://telepay.wmtransfer.com/
RU
html
178 b
suspicious
3816
TicnoWeather.exe
GET
301
169.61.169.124:80
http://xoap.weather.com/weather/local/RSXX0063?cc=*&dayf=5&link=xoap&prod=xoap&par=1086136045&key=93b3405b5760a9e0
US
html
268 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3160
multibar_main.exe
151.106.5.164:80
gamiar.com
—
US
suspicious
3160
multibar_main.exe
91.227.52.156:80
telepay.wmtransfer.com
CJSC Computing Forces
RU
suspicious
3816
TicnoWeather.exe
169.61.169.124:80
xoap.weather.com
—
US
unknown
3816
TicnoWeather.exe
104.73.135.98:443
weather.com
Akamai International B.V.
NL
whitelisted
3160
multibar_main.exe
198.54.112.216:80
1451.scenbe.com
Namecheap, Inc.
US
malicious
3160
multibar_main.exe
91.227.52.156:443
telepay.wmtransfer.com
CJSC Computing Forces
RU
suspicious
3816
TicnoWeather.exe
2.18.235.36:80
wxdata.weather.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
stat.ticno.com
  • —
unknown
release.pivim.com
  • —
unknown
data.ticno.com
  • —
unknown
telepay.wmtransfer.com
  • 91.227.52.156
  • 91.200.28.156
suspicious
gamiar.com
  • 151.106.5.164
suspicious
xoap.weather.com
  • 169.61.169.124
unknown
wxdata.weather.com
  • 2.18.235.36
unknown
install.ticno.com
  • —
unknown
1451.scenbe.com
  • 198.54.112.216
malicious
weather.com
  • 104.73.135.98
suspicious

Threats

PID
Process
Class
Message
3160
multibar_main.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
3160
multibar_main.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
Process
Message
multibar.exe
Os Version 6.148
helpscreen.exe
C:\PROGRA~1\Ticno\Multibar\images
helpscreen.exe
C:\PROGRA~1\Ticno\Multibar\images
multibar.exe
Multibar Version:
multibar.exe
0.9.9.5
multibar.exe
Os Version 6.148
multibar_main.exe
Os Version 6.148
multibar_main.exe
LoadData<
multibar_main.exe
WEATHER_PLUGIN_DLL: DLL Loaded
multibar_main.exe
WEATHER_PLUGIN_DLL: OnCreate
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MultibarInstaller(Ticno).exe