Malware analysis Luxify 4.exe Malicious activity | ANY.RUN

Add for printing

File name:	Luxify 4.exe
Full analysis:	https://app.any.run/tasks/2fce5266-b6d7-4ce8-974d-577d64f2cd7c
Verdict:	Malicious activity
Analysis date:	March 10, 2024, 01:14:45
OS:	Ubuntu 22.04.2
MIME:	application/x-dosexec
File info:	PE32+ executable (console) x86-64, for MS Windows
MD5:	CEF5723E032181CF5DB529D07B4B8C29
SHA1:	9FB57E5C965CAD75749BF36AE3FE025C21CC3B19
SHA256:	F2151473E537BF9B93E5C7D4003115652C55F2EE77347908D017851BFC49DEE2
SSDEEP:	196608:oh6aK+cm0p8vf9v5XvzBnXHfblFvbN6JTWbDNC/+MFQNIP4XR9XRpr2SRqoCq:d+Dqi5fzx/T2q0k84B9XT2foz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Checks DMI information (probably VM detection)
  - systemd-hostnamed (PID: 9318)
- Reads /proc/mounts (likely used to find writable filesystems)
  - firefox (PID: 9355)
- Checks the user who created the process
  - cron (PID: 10207)
- Executes commands using command-line interpreter
  - cron (PID: 10207)
INFO
No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic Win/DOS Executable (50)
.exe	\|	DOS Executable Generic (49.9)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	0000:00:00 00:00:00
ImageFileCharacteristics:	Executable
PEType:	PE32+
LinkerVersion:	2.18
CodeSize:	6593024
InitializedDataSize:	7880192
UninitializedDataSize:	-
EntryPoint:	0x18f0147
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows command line

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

417

Monitored processes

192

Malicious processes

0

Suspicious processes

0

Behavior graph

Click at the process to see the details

Process information

PID	CMD	Path	Indicators	Parent process
9298	/bin/sh -c "DISPLAY=:0 sudo -iu user nautilus \"/tmp/Luxify 4\.exe\" "	/bin/sh	—	any-guest-agent
User: user Integrity Level: UNKNOWN Exit code: 9750
9299	sudo -iu user nautilus "/tmp/Luxify 4\.exe"	/usr/bin/sudo	—	sh
User: user Integrity Level: UNKNOWN Exit code: 9750
9300	nautilus "/tmp/Luxify 4\.exe"	/usr/bin/nautilus	—	sudo
User: user Integrity Level: UNKNOWN Exit code: 9750
9301	/usr/bin/locale-check C.UTF-8	/usr/bin/locale-check	—	nautilus
User: user Integrity Level: UNKNOWN Exit code: 0
9318	/lib/systemd/systemd-hostnamed	/lib/systemd/systemd-hostnamed	—	systemd
User: root Integrity Level: UNKNOWN Exit code: 9697
9325	nautilus "/tmp/Luxify 4\.exe"	/usr/bin/nautilus	—	nautilus
User: user Integrity Level: UNKNOWN Exit code: 496
9326	file-roller "/tmp/Luxify 4\.exe"	/usr/bin/file-roller	—	nautilus
User: user Integrity Level: UNKNOWN Exit code: 496
9341	/usr/lib/p7zip/7z l -slt -bd -y -- "/tmp/Luxify 4\.exe"	/usr/lib/p7zip/7z	—	file-roller
User: user Integrity Level: UNKNOWN Exit code: 496
9342	/usr/lib/p7zip/7z x -bd -bb1 -y -o/home/user/.cache/.fr-5cQ7vm -- "/tmp/Luxify 4\.exe" .data	/usr/lib/p7zip/7z	—	file-roller
User: user Integrity Level: UNKNOWN Exit code: 1
9355	/snap/firefox/3358/usr/lib/firefox/firefox	/snap/firefox/3358/usr/lib/firefox/firefox	—	gnome-shell
User: user Integrity Level: UNKNOWN Exit code: 0

Add for printing

Executable files

0

Suspicious files

0

Text files

0

Unknown types

0

Dropped files

PID	Process	Filename		Type
9300	nautilus	/home/user/.local/share/nautilus/tags/meta.db-wal		—
		MD5:—	SHA256:—
9300	nautilus	/home/user/.local/share/nautilus/tags/meta.db-shm		—
		MD5:—	SHA256:—
9300	nautilus	/home/user/.local/share/nautilus/tags/.meta.isrunning		—
		MD5:—	SHA256:—
9300	nautilus	/home/user/.local/share/recently-used.xbel.1VGEK2		—
		MD5:—	SHA256:—
9326	file-roller	/dconf/user		—
		MD5:—	SHA256:—
9342	7z	/home/user/.cache/.fr-5cQ7vm/.data		—
		MD5:—	SHA256:—
9355	firefox	/tmp/snap-private-tmp/snap.firefox/tmp/firefox/.parentlock		—
		MD5:—	SHA256:—
9355	firefox	/home/user/snap/firefox/common/.cache/mozilla/firefox/roxl94gw.default/.startup-incomplete		—
		MD5:—	SHA256:—
9355	firefox	/home/user/snap/firefox/common/.mozilla/firefox/roxl94gw.default/sessionCheckpoints.json.tmp		—
		MD5:—	SHA256:—
9355	firefox	/home/user/snap/firefox/common/.mozilla/firefox/roxl94gw.default/content-prefs.sqlite-journal		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

59

TCP/UDP connections

158

DNS requests

244

Threats

1

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	34.107.221.82:80	http://detectportal.firefox.com/canonical.html	unknown	text	90 b	unknown
—	—	POST	—	23.45.119.217:80	http://r3.o.lencr.org/	unknown	—	—	unknown
—	—	GET	200	34.107.221.82:80	http://detectportal.firefox.com/success.txt?ipv4	unknown	text	8 b	unknown
—	—	POST	200	23.45.119.217:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	23.45.119.217:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	23.45.119.217:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	23.45.119.217:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	23.45.119.217:80	http://r3.o.lencr.org/	unknown	binary	503 b	unknown
—	—	POST	200	142.250.186.99:80	http://ocsp.pki.goog/gts1c3	unknown	binary	471 b	unknown
—	—	POST	—	142.250.186.99:80	http://ocsp.pki.goog/gts1c3	unknown	—	—	unknown

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	224.0.0.251:5353	—	—	—	unknown
—	—	34.107.221.82:80	detectportal.firefox.com	GOOGLE	US	unknown
—	—	142.250.186.138:443	safebrowsing.googleapis.com	—	—	unknown
—	—	34.117.188.166:443	spocs.getpocket.com	—	—	unknown
—	—	34.117.237.239:443	contile.services.mozilla.com	GOOGLE-CLOUD-PLATFORM	US	unknown
—	—	34.107.243.93:443	push.services.mozilla.com	—	—	unknown
—	—	23.45.119.217:80	r3.o.lencr.org	Akamai International B.V.	US	unknown
—	—	34.120.115.102:443	contile-images.services.mozilla.com	GOOGLE-CLOUD-PLATFORM	US	unknown
—	—	34.160.144.191:443	content-signature-2.cdn.mozilla.net	GOOGLE	US	unknown
—	—	34.149.100.209:443	firefox.settings.services.mozilla.com	GOOGLE	US	unknown

DNS requests

Domain	IP	Reputation
187.100.168.192.in-addr.arpa	—	unknown
connectivity-check.ubuntu.com	2620:2d:4000:1::2b 2620:2d:4000:1::96 2620:2d:4002:1::196 2620:2d:4002:1::198 2001:67c:1562::23 2001:67c:1562::24 2620:2d:4000:1::23 2620:2d:4000:1::22 2620:2d:4000:1::97 2620:2d:4000:1::2a 2620:2d:4000:1::98 2620:2d:4002:1::197 185.125.190.48 185.125.190.96 91.189.91.49 91.189.91.48 91.189.91.97 185.125.190.49 91.189.91.98 91.189.91.96 185.125.190.98 185.125.190.97 185.125.190.17 185.125.190.18	unknown
detectportal.firefox.com	34.107.221.82 2600:1901:0:38d7::	whitelisted
example.org	93.184.216.34 2606:2800:220:1:248:1893:25c8:1946	whitelisted
ipv4only.arpa	192.0.0.171 192.0.0.170	whitelisted
contile.services.mozilla.com	34.117.237.239	whitelisted
spocs.getpocket.com	34.117.188.166	shared
prod.ads.prod.webservices.mozgcp.net	—	unknown
r3.o.lencr.org	23.45.119.217 23.45.119.214 2a01:4a0:1338:28::c38a:ff12 2a01:4a0:1338:28::c38a:ff18 95.101.54.131 2.16.202.121 2a02:26f0:780::210:ca79 2a02:26f0:780::5f65:3683	shared
www.youtube.com	142.250.186.174 172.217.16.142 142.250.186.46 142.250.186.78 216.58.212.174 142.250.181.238 142.250.185.78 142.250.186.110 142.250.185.206 172.217.18.14 142.250.185.174 142.250.184.206 142.250.186.142 142.250.185.110 172.217.16.206 142.250.185.238 2a00:1450:4001:80e::200e 2a00:1450:4001:80f::200e 2a00:1450:4001:811::200e 2a00:1450:4001:812::200e	whitelisted

Threats

PID	Process	Class	Message
—	—	Not Suspicious Traffic	INFO [ANY.RUN] Global content delivery network (unpkg .com)

Add for printing

No debug info

General Info

Luxify 4.exe

CEF5723E032181CF5DB529D07B4B8C29

9FB57E5C965CAD75749BF36AE3FE025C21CC3B19

F2151473E537BF9B93E5C7D4003115652C55F2EE77347908D017851BFC49DEE2

196608:oh6aK+cm0p8vf9v5XvzBnXHfblFvbN6JTWbDNC/+MFQNIP4XR9XRpr2SRqoCq:d+Dqi5fzx/T2q0k84B9XT2foz

Software environment set and analysis options

Launch configuration

Software preset

Behavior activities

MALICIOUS

SUSPICIOUS

Checks DMI information (probably VM detection)

Reads /proc/mounts (likely used to find writable filesystems)

Checks the user who created the process

Executes commands using command-line interpreter

INFO

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Information

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings