| File name: | keygen[pc-ret].exe |
| Full analysis: | https://app.any.run/tasks/8e040387-38c8-4ff9-b354-93b916eee1aa |
| Verdict: | Malicious activity |
| Analysis date: | March 26, 2024, 10:17:04 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | E72838ECCDA2EAE29E96B0C572D783C3 |
| SHA1: | 60F0944ECBD21CF590445C12BA89A2AE48F27A6A |
| SHA256: | F824FDC666630CCB179D9086B79783E3EDE76E4392A5EDFDD20D93B7259AE061 |
| SSDEEP: | 98304:xq8ZZvWghDdk3XLaScTBLWJ0EjpLIUM5jsMQANKBieb8LzJHkOcJO/D0uOWOtg15:NJt |
MALICIOUS
Drops the executable file immediately after the start
- keygen[pc-ret].exe (PID: 3936)
Actions looks like stealing of personal data
- keygen[pc-ret].exe (PID: 3936)
SUSPICIOUS
Reads the Internet Settings
- keygen[pc-ret].exe (PID: 3936)
Mutex name with non-standard characters
- keygen[pc-ret].exe (PID: 3936)
Reads security settings of Internet Explorer
- keygen[pc-ret].exe (PID: 3936)
INFO
Reads the computer name
- keygen[pc-ret].exe (PID: 3936)
Checks supported languages
- keygen[pc-ret].exe (PID: 3936)
- keygen[pc-ret].exe (PID: 2648)
Create files in a temporary directory
- keygen[pc-ret].exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Borland Delphi 6 (93.8) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (2.3) |
| .exe | | | Win32 Executable (generic) (1.6) |
| .exe | | | Win16/32 Executable Delphi generic (0.7) |
| .exe | | | Generic Win/DOS Executable (0.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 1992:06:19 22:22:17+00:00 |
| ImageFileCharacteristics: | Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 29696 |
| InitializedDataSize: | 10752 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x80e4 |
| OSVersion: | 4 |
| ImageVersion: | - |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
38
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2648 | "C:\Users\admin\AppData\Local\Temp\3582-490\keygen[pc-ret].exe" | C:\Users\admin\AppData\Local\Temp\3582-490\keygen[pc-ret].exe | — | keygen[pc-ret].exe | |||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 3936 | "C:\Users\admin\AppData\Local\Temp\keygen[pc-ret].exe" | C:\Users\admin\AppData\Local\Temp\keygen[pc-ret].exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
2 386
Read events
2 378
Write events
8
Delete events
0
Modification events
| (PID) Process: | (3936) keygen[pc-ret].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3936) keygen[pc-ret].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3936) keygen[pc-ret].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3936) keygen[pc-ret].exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
43
Suspicious files
0
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3936 | keygen[pc-ret].exe | C:\Users\admin\AppData\Local\Temp\3582-490\keygen[pc-ret].exe | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\ose.exe | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-003D-0000-0000-0000000FF1CE}-C\setup.exe | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-006E-0407-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-006E-0407-0000-0000000FF1CE}-C\dwtrig20.exe | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-006E-040C-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-006E-040C-0000-0000000FF1CE}-C\dwtrig20.exe | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-006E-0410-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-006E-0410-0000-0000000FF1CE}-C\dwtrig20.exe | executable | |
MD5:— | SHA256:— | |||
| 3936 | keygen[pc-ret].exe | C:\MSOCache\All Users\{90140000-006E-0411-0000-0000000FF1CE}-C\DW20.EXE | executable | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |