| File name: | Bandicam v4.3.3.1498 (2-click run).exe.7z |
| Full analysis: | https://app.any.run/tasks/91ddbd05-33ad-4880-a578-098db34f488d |
| Verdict: | Malicious activity |
| Analysis date: | September 19, 2020, 07:33:53 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | 1678EEDEA98928D62F0D27A62AE0EC92 |
| SHA1: | 711030AFF8AA1EBB1EEABE310F45671C6A925ED4 |
| SHA256: | F5A5DC0867CFF84632F7DEC445AE8C97756720EE5AED86A18EE28E5CDCE0BF98 |
| SSDEEP: | 393216:0FOhXyQMzaYLwEZ2C0dqUibYeggCD+2WxPRPxy:NXyQcaIMC0dqUiUBzIxPRPI |
MALICIOUS
Application was dropped or rewritten from another process
- Bandicam v4.3.3.1498 (2-click run).exe (PID: 3908)
- Bandicam v4.3.3.1498 (2-click run).exe (PID: 656)
- irsetup.exe (PID: 3688)
- BandicamPortable.exe (PID: 1844)
- bdcam.exe (PID: 3980)
- bdcam.exe (PID: 3256)
- bdcam.exe (PID: 3520)
Loads dropped or rewritten executable
- irsetup.exe (PID: 3688)
- bdcam.exe (PID: 3980)
- explorer.exe (PID: 352)
- BandicamPortable.exe (PID: 1844)
- bdcam.exe (PID: 3520)
Loads the Task Scheduler COM API
- bdcam.exe (PID: 3520)
SUSPICIOUS
Creates files in the user directory
- irsetup.exe (PID: 3688)
Executable content was dropped or overwritten
- Bandicam v4.3.3.1498 (2-click run).exe (PID: 656)
- irsetup.exe (PID: 3688)
- BandicamPortable.exe (PID: 1844)
Starts Internet Explorer
- irsetup.exe (PID: 3688)
Creates a software uninstall entry
- irsetup.exe (PID: 3688)
Changes IE settings (feature browser emulation)
- BandicamPortable.exe (PID: 1844)
Creates files in the program directory
- irsetup.exe (PID: 3688)
Uses RUNDLL32.EXE to load library
- bdcam.exe (PID: 3980)
Reads Internet Cache Settings
- bdcam.exe (PID: 3520)
INFO
Manual execution by user
- Bandicam v4.3.3.1498 (2-click run).exe (PID: 3908)
- Bandicam v4.3.3.1498 (2-click run).exe (PID: 656)
Application launched itself
- iexplore.exe (PID: 1980)
Reads Internet Cache Settings
- iexplore.exe (PID: 1980)
- iexplore.exe (PID: 2448)
Changes internet zones settings
- iexplore.exe (PID: 1980)
Dropped object may contain Bitcoin addresses
- irsetup.exe (PID: 3688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
Total processes
53
Monitored processes
12
Malicious processes
4
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 352 | C:\Windows\Explorer.EXE | C:\Windows\explorer.exe | — | — | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 656 | "C:\Users\admin\Desktop\Bandicam v4.3.3.1498 (2-click run).exe" C:\Users\admin\Desktop\parisunderstanding.jpg | C:\Users\admin\Desktop\Bandicam v4.3.3.1498 (2-click run).exe | explorer.exe | ||||||||||||
User: admin Company: Friends in War Integrity Level: HIGH Description: Copy Maker Exit code: 0 Version: 4.0.0.0 Modules
| |||||||||||||||
| 1832 | "C:\Windows\system32\rundll32.exe" "C:\2-click run\Bandicam\v4.3.3.1498\App\Bandicam\bdcamvk32.dll",RegDll | C:\Windows\system32\rundll32.exe | — | bdcam.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1844 | "C:\2-click run\Bandicam\v4.3.3.1498\BandicamPortable.exe" | C:\2-click run\Bandicam\v4.3.3.1498\BandicamPortable.exe | irsetup.exe | ||||||||||||
User: admin Company: CheshireCat Integrity Level: HIGH Description: Bandicam Portable Exit code: 2 Version: 4.3.0.0 Modules
| |||||||||||||||
| 1980 | "C:\Program Files\Internet Explorer\iexplore.exe" http://www.friendsinwar.com/thank_you_use_prog.php?name=Bandicam | C:\Program Files\Internet Explorer\iexplore.exe | — | irsetup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 1 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2448 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:1980 CREDAT:275457 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Internet Explorer Exit code: 0 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2840 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Bandicam v4.3.3.1498 (2-click run).exe.7z" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.60.0 Modules
| |||||||||||||||
| 3256 | "C:\Users\admin\AppData\Local\Temp\Bandicam.tmp\bdcam.exe" | C:\Users\admin\AppData\Local\Temp\Bandicam.tmp\bdcam.exe | — | BandicamPortable.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3520 | "C:\2-click run\Bandicam\v4.3.3.1498\App\Bandicam\bdcam.exe" 0 0 | C:\2-click run\Bandicam\v4.3.3.1498\App\Bandicam\bdcam.exe | — | BandicamPortable.exe | |||||||||||
User: admin Company: Bandicam Company Integrity Level: HIGH Description: Bandicam - bdcam.exe Exit code: 2 Version: 4.3.3.1498 Modules
| |||||||||||||||
| 3688 | "C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" C:\Users\admin\Desktop\parisunderstanding.jpg __IRAOFF:2101506 "__IRAFN:C:\Users\admin\Desktop\Bandicam v4.3.3.1498 (2-click run).exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000" | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe | Bandicam v4.3.3.1498 (2-click run).exe | ||||||||||||
User: admin Company: Indigo Rose Corporation Integrity Level: HIGH Description: Setup Application Exit code: 0 Version: 9.5.0.0 Modules
| |||||||||||||||
Total events
7 332
Read events
5 998
Write events
1 309
Delete events
25
Modification events
| (PID) Process: | (352) explorer.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\Bandicam v4.3.3.1498 (2-click run).exe.7z | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2840) WinRAR.exe | Key: | HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (352) explorer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.7z\OpenWithList |
| Operation: | write | Name: | a |
Value: WinRAR.exe | |||
Executable files
26
Suspicious files
5
Text files
77
Unknown types
9
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2840 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa2840.19563\Bandicam v4.3.3.1498 (2-click run).exe | — | |
MD5:— | SHA256:— | |||
| 3688 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat | — | |
MD5:— | SHA256:— | |||
| 3688 | irsetup.exe | C:\2-click run\Bandicam\v4.3.3.1498\Uninstall\uni4388.tmp | — | |
MD5:— | SHA256:— | |||
| 656 | Bandicam v4.3.3.1498 (2-click run).exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll | executable | |
MD5:C3F5F4A1FB69B5889F0BBB313CF6017F | SHA256:769416FA7EDF38E91A55F4F7163914EE4AAD9C8C890ED641C300B73157ACAC45 | |||
| 3688 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG5.JPG | image | |
MD5:3EC199A621019550F29DB8AD57BD24EE | SHA256:9A470C873590A5D05D68AB127E43BC698D5580AB760C768E2EF27964CB3BBAE2 | |||
| 3688 | irsetup.exe | C:\2-click run\Bandicam\v4.3.3.1498\Uninstall\uninstall.xml | xml | |
MD5:E3DE823BEB81BDB008249B25D82AD4E9 | SHA256:586D9BD3646630518483006CB7248B9905FC2C9D8AAABAD8FA347689CDAAB5A9 | |||
| 3688 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG4.JPG | image | |
MD5:3EC199A621019550F29DB8AD57BD24EE | SHA256:9A470C873590A5D05D68AB127E43BC698D5580AB760C768E2EF27964CB3BBAE2 | |||
| 3688 | irsetup.exe | C:\2-click run\Bandicam\v4.3.3.1498\uninstall.exe | executable | |
MD5:9BDCF813D65265255B820BC7A704DA3C | SHA256:B15D67B4A57184E5202DF3C25E20DC0B7F853F4D527D148B337138900989824A | |||
| 3688 | irsetup.exe | C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\WinCatalogPortable_103.ico | image | |
MD5:780A4D02C2AC62937E8BE73909A4FE8B | SHA256:C6415563C9F186B257F27E7FDD5B2A3C01F0DD3121F6009AC34D11E11B002A30 | |||
| 3688 | irsetup.exe | C:\2-click run\Bandicam\v4.3.3.1498\App\readme.txt | text | |
MD5:3B066CD6FBF545179AF644EE32AFDC0C | SHA256:87DD88B4169BAA6B4E620BCBBA707B4DD852F65C9627AE9F10B3463729FD9B7F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2448 | iexplore.exe | 83.149.102.154:80 | www.friendsinwar.com | LeaseWeb Netherlands B.V. | NL | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.friendsinwar.com |
| suspicious |