analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

keyexp4.exe

Full analysis: https://app.any.run/tasks/ebdf6a20-4126-46c7-8c30-831d318e3fd9
Verdict: Malicious activity
Analysis date: January 18, 2019, 05:50:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F98D52684DC19A44C41430C816721F51

SHA1:

F78C8EC20045A7669212144367ECBBCD61D7BB18

SHA256:

F2FEFC21ED3117BB7A836A42872241832E2B86F7CCA8176C5EDA7F5C5F21C27C

SSDEEP:

196608:pNw4ppnqXTQs6yweP3xsSQ31W+bW3Gg1rKDDg3sSCLnLvvAfTFiyoamgBAE4V4B1:pK4ppv/ePx5Cf81rS3wSTAAERCw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • GLB8C33.tmp (PID: 2688)

    • Application was dropped or rewritten from another process

      • GLB8C33.tmp (PID: 2688)
      • SetACL.exe (PID: 1912)
      • REGKEY~1.EXE (PID: 3864)
      • SCHEDU~1.EXE (PID: 3748)
      • QkStart.exe (PID: 2632)

    • Writes to a start menu file

      • GLB8C33.tmp (PID: 2688)

    • Loads the Task Scheduler COM API

      • SCHEDU~1.EXE (PID: 3748)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • keyexp4.exe (PID: 2220)
      • GLB8C33.tmp (PID: 2688)

    • Starts application with an unusual extension

      • keyexp4.exe (PID: 2220)

    • Searches for installed software

      • DllHost.exe (PID: 2748)
      • GLB8C33.tmp (PID: 2688)

    • Creates files in the program directory

      • GLB8C33.tmp (PID: 2688)
      • REGKEY~1.EXE (PID: 3864)

    • Creates a software uninstall entry

      • GLB8C33.tmp (PID: 2688)

    • Modifies the open verb of a shell class

      • GLB8C33.tmp (PID: 2688)

    • Uses ICACLS.EXE to modify access control list

      • SetACL.exe (PID: 1912)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • GLB8C33.tmp (PID: 2688)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

LegalCopyright: (c) 2014 Insight Software Solutions, Inc
FileVersion: 4.4.1.1
FileDescription: Keyboard Express 4
CompanyName: Insight Software Solutions, Inc.
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows 16-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1032.4455.0.0
FileVersionNumber: 4.4.1.1
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1000
UninitializedDataSize: -
InitializedDataSize: 16031744
CodeSize: 1024
LinkerVersion: 7.1
PEType: PE32
TimeStamp: 2007:08:16 20:13:16+02:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
16
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start keyexp4.exe no specs keyexp4.exe glb8c33.tmp vssvc.exe no specs SPPSurrogate no specs drvinst.exe no specs setacl.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs icacls.exe no specs regkey~1.exe no specs qkstart.exe no specs schedu~1.exe no specs notepad.exe no specs keyplayer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3596"C:\Users\admin\AppData\Local\Temp\keyexp4.exe" C:\Users\admin\AppData\Local\Temp\keyexp4.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
2220"C:\Users\admin\AppData\Local\Temp\keyexp4.exe" C:\Users\admin\AppData\Local\Temp\keyexp4.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
2688C:\Users\admin\AppData\Local\Temp\GLB8C33.tmp 6144 C:\Users\admin\AppData\Local\Temp\keyexp4.exeC:\Users\admin\AppData\Local\Temp\GLB8C33.tmp
keyexp4.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
3596C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2748C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2728DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot18" "" "" "6792c44eb" "00000000" "00000550" "00000330"C:\Windows\system32\DrvInst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1912"C:\Users\admin\AppData\Local\Temp\SetACL.exe" C:\Users\admin\AppData\Local\Temp\SetACL.exe—GLB8C33.tmp
User:
admin
Integrity Level:
HIGH
Exit code:
0
3620"C:\Windows\System32\icacls.exe" "C:\Users\Public\Documents\Insight Software Solutions" /grant BUILTIN\Users:(OI)(CI)F /T /CC:\Windows\System32\icacls.exe—SetACL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3960"C:\Windows\System32\icacls.exe" "C:\Users\Public\Documents\Insight Software" /grant BUILTIN\Users:(OI)(CI)F /T /CC:\Windows\System32\icacls.exe—SetACL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2608"C:\Windows\System32\icacls.exe" "C:\ProgramData\Insight Software Solutions" /grant BUILTIN\Users:(OI)(CI)F /T /CC:\Windows\System32\icacls.exe—SetACL.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
812
Read events
601
Write events
0
Delete events
0

Modification events

No data
Executable files
22
Suspicious files
4
Text files
67
Unknown types
4

Dropped files

PID
Process
Filename
Type
2748DllHost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2748DllHost.exeC:\System Volume Information\SPP\OnlineMetadataCache\{c3bd63b6-d813-40eb-8c9e-fe15495818b7}_OnDiskSnapshotPropbinary
MD5:A09CA8BA098AF89451DF745F388B25F3
SHA256:F873AC956665D0BC10E042B5793B9C7A06EA1B398258E4ED3BCB7CF0D9E671C1
2688GLB8C33.tmpC:\Users\admin\AppData\Local\Temp\GLW905C.tmptext
MD5:9000799159F8F9632627EEB08FBBF6EA
SHA256:C7C3EC3B09EBFB7D751394DF839DD0442C1956EA3294F637C940EE95B7C8BED1
2728DrvInst.exeC:\Windows\INF\setupapi.ev1binary
MD5:72DCEE5E333A7158E7F35AABA63E8B46
SHA256:387F49A30D21E5C34C593CE793B79D8C834ED7B497AA398B01902BFE1AB92A1D
2220keyexp4.exeC:\Users\admin\AppData\Local\Temp\GLB8C33.tmpexecutable
MD5:D806A80B19B2D3533F54D889EF556939
SHA256:3DC24C7CBD07F7BC6D2DF0CEEE6D74139347E55DFF8A5D888DE7A8E126291C9B
2748DllHost.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:A09CA8BA098AF89451DF745F388B25F3
SHA256:F873AC956665D0BC10E042B5793B9C7A06EA1B398258E4ED3BCB7CF0D9E671C1
2728DrvInst.exeC:\Windows\INF\setupapi.dev.logini
MD5:1E6DBF58A04BC586FA2E398FBC4E54FE
SHA256:EBF093B2C88F0BAA2B45B2C2F06B29B65503BBAF4DC2CC33BE4676BFCDDAD431
2728DrvInst.exeC:\Windows\INF\setupapi.ev3binary
MD5:76DCC60F78B3DFF1AE3627619074F465
SHA256:18541AC1875315C4F9EFF75050C574FAFF83717C029DAE6B366F9C6C3F0C19E0
2688GLB8C33.tmpC:\Users\admin\AppData\Local\Temp\GLK8C63.tmpexecutable
MD5:693653316F18CA508C6EEC2E2FD988DC
SHA256:AEE1EB527D74ADE3DEC0B5D5CAF8E4244A1DAD00C0170A032CEE9036223D3E69
2688GLB8C33.tmpC:\Users\admin\AppData\Local\Temp\~GLH0000.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
keyexp4.exe