Windows Analysis Report
http://download.lenovo.com/pccbbs/desktop/u1ra101us17.exe

Overview

General Information

Sample URL:	http://download.lenovo.com/pccbbs/desktop/u1ra101us17.exe
Analysis ID:	1432074
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Drops executables to the windows directory (C:\Windows) and starts them

Creates files inside the system directory

Deletes files inside the Windows folder

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Sigma detected: File Download From Browser Process Via Inline URL

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.8:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49721 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112

Source: global traffic	DNS traffic detected: DNS query: download.lenovo.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.8:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49721 version: TLS 1.2

Creates files inside the system directory

Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst
Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst\is-5AHOE.tmp
Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\is-BBEMV.tmp
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp\_isetup
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp

Deletes files inside the Windows folder

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

File deleted: C:\Windows\is-BBEMV.tmp

Source: classification engine

Classification label: sus23.evad.win@24/12@8/89

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\a37fe17a-04a3-4a31-9e10-b8ef14f0235f.tmp

Source: C:\Users\user\Downloads\u1ra101us17.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Downloads\u1ra101us17.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Downloads\u1ra101us17.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://download.lenovo.com/pccbbs/desktop/u1ra101us17.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4932 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4932 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\u1ra101us17.exe "C:\Users\user\Downloads\u1ra101us17.exe"
Source: C:\Users\user\Downloads\u1ra101us17.exe	Process created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp "C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp" /SL5="$80240,3550847,180224,C:\Users\user\Downloads\u1ra101us17.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\u1ra101us17.exe "C:\Users\user\Downloads\u1ra101us17.exe"
Source: C:\Users\user\Downloads\u1ra101us17.exe	Process created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp "C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp" /SL5="$80240,3550847,180224,C:\Users\user\Downloads\u1ra101us17.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\u1ra101us17.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\u1ra101us17.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\u1ra101us17.exe	Section loaded: apphelp.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: version.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: uxtheme.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: kernel.appcore.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wtsapi32.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: winsta.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: textinputframework.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: coreuicomponents.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: coremessaging.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: ntmarta.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: coremessaging.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wintypes.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wintypes.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wintypes.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: windows.storage.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wldp.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: profapi.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: shfolder.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: rstrtmgr.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: ncrypt.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: ntasn1.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: textshaping.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: msftedit.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: windows.globalization.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: bcp47langs.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: bcp47mrm.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: globinputhost.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: windows.ui.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: windowmanagementapi.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: inputhost.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: twinapi.appcore.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: twinapi.appcore.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: propsys.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: dwmapi.dll

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Window found: window name: TMainForm

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Downloads\u1ra101us17.exe

Executable created and started: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\a37fe17a-04a3-4a31-9e10-b8ef14f0235f.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 690274.crdownload	Jump to dropped file
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp			Jump to dropped file
Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp			Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\Downloads\u1ra101us17.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Found dropped PE file which has not been started or loaded

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Dropped PE file which has not been started: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp

Jump to dropped file

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.189.142	unknown	United States	15169	GOOGLEUS	false
23.45.182.85	unknown	United States	20940	AKAMAI-ASN1EU	false
192.178.50.67	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
192.178.50.68	www.google.com	United States	15169	GOOGLEUS	false
173.194.211.84	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
184.84.136.138	unknown	United States	16625	AKAMAI-ASUS	false
23.43.44.216	unknown	United States	18734	OperbesSAdeCVMX	false
172.217.3.67	unknown	United States	15169	GOOGLEUS	false
142.250.217.238	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17

Contacted Domains

Name	IP	Active
www.google.com	192.178.50.68	true
download.lenovo.com	unknown	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	29F65BA8E88C063813CC50A4EA544E93	05A7040D5C127E68C25D81CC51271FFB8BEF3568	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	C39790BDFF39FFDA7DC57AEDB5C44C24	2D8335FE579300FE70B4AA8726445CF1D7EF1F7E	391A25FCEBDD66B910F674C1D9BA28FBFFF1DB0364BB1EBF25DBD0CD27041B8D
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 08:38:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	4770D8B0943E3B8038AA21A24A490C04	9BFDD97044502E425ABC223CEAA85FCC9071020D	BAE2438E48E73A4EDE7EF249FD2613D9D5AC304BD44F27CE67736A4865C6CC13
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 08:38:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	802B24D5F759A7A67505F6B1A0E3A245	49C8662DBF69C89DE440E9DECC7D37B56F92BE6D	EA3FA04FED304102FDC0F19203403721FEBD2106E9BEAC5A19F50A763449EA17
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:54:41 2023, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	45A001C48BC5DF86AC91131526CA1C09	250A5F375A12D154A0F58E5D9CFFA28EF55502C6	12293507DCA6B231DACBB477EA8F7295E93DFCAFAFC2B793D360C3F98968B5FC
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 08:38:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	27A6F5636E0F7E2EAB227EF9FFC45377	0121A8CD1679913F6C4E03D9DB6C1CA9DFFF713F	15CCBF6149AA573E689DFB180D77D034AAE40E22CD2C2BDEC01DC9AE1967677C
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 08:38:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	171DFC2C36740B3DEC7C0E93E73259CF	7BD3E51F4DD366D29F6E17549609F2BF09AFFDC4	6DC01DD87A6FECE87A8BE0BF8D3BD9FBE75E1C5EED0EC14DD1D010484E5399EB
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 26 08:38:36 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide	525939551DB70E9E52F04526A4B90541	327D474767C2CC1AE0CCB560C943EFA0F9FB5BED	4DA21D34916004307B8020482D7FD77ACB4E77CB6BF280BAB3F21D912A0CC06D
C:\Users\user\Downloads\Unconfirmed 690274.crdownload	PE32 executable (GUI) Intel 80386, for MS Windows	E372109B2BD3B0F50EF462D53E9989BA	94D80DFE20689B9C47B32E4C25875731AF4BD20B	81CB774D3527ACAB6003E200FEF2E285BE7E6042693969FC25E38EDB71A562EC
C:\Users\user\Downloads\a37fe17a-04a3-4a31-9e10-b8ef14f0235f.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	BBEC9F6E3AF3DDEBEBF992B4D88FE564	8812736E10C3F9BF283B24A54212D489ADD17D41	96B1767D6EA0ECAFBE1BBA6C59C59B5D31BCD19F0A383B46D47F7D469B47AF3B
C:\Users\user\Downloads\u1ra101us17.exe (copy)	PE32 executable (GUI) Intel 80386, for MS Windows	E372109B2BD3B0F50EF462D53E9989BA	94D80DFE20689B9C47B32E4C25875731AF4BD20B	81CB774D3527ACAB6003E200FEF2E285BE7E6042693969FC25E38EDB71A562EC
C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp	PE32+ executable (console) x86-64, for MS Windows	E4211D6D009757C078A9FAC7FF4F03D4	019CD56BA687D39D12D4B13991C9A42EA6BA03DA	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	PE32 executable (GUI) Intel 80386, for MS Windows	DA27AEF67635F21FF5723FCD2DB5D2F9	ACD0929D0A8E19F1EE315C5ACE271969BFF3D597	C5167284574EEFE9780BB5606B1FC6E8D7E836A2BE2C873976E0E29DA3903ADA

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.8:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49721 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 20.114.59.183
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112
Source: unknown	TCP traffic detected without corresponding DNS query: 23.193.120.112

Source: global traffic	DNS traffic detected: DNS query: download.lenovo.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.193.120.112:443 -> 192.168.2.17:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.29.8:443 -> 192.168.2.17:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.5.88:443 -> 192.168.2.17:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.114.59.183:443 -> 192.168.2.17:49721 version: TLS 1.2

Creates files inside the system directory

Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst
Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst\is-5AHOE.tmp
Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\is-BBEMV.tmp
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp\_isetup
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp

Deletes files inside the Windows folder

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

File deleted: C:\Windows\is-BBEMV.tmp

Source: classification engine

Classification label: sus23.evad.win@24/12@8/89

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\a37fe17a-04a3-4a31-9e10-b8ef14f0235f.tmp

Source: C:\Users\user\Downloads\u1ra101us17.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\user\Downloads\u1ra101us17.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Downloads\u1ra101us17.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://download.lenovo.com/pccbbs/desktop/u1ra101us17.exe
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5340 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4932 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4932 --field-trial-handle=1984,i,16616354626430115823,17598558010190862369,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\u1ra101us17.exe "C:\Users\user\Downloads\u1ra101us17.exe"
Source: C:\Users\user\Downloads\u1ra101us17.exe	Process created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp "C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp" /SL5="$80240,3550847,180224,C:\Users\user\Downloads\u1ra101us17.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\Downloads\u1ra101us17.exe "C:\Users\user\Downloads\u1ra101us17.exe"
Source: C:\Users\user\Downloads\u1ra101us17.exe	Process created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp "C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp" /SL5="$80240,3550847,180224,C:\Users\user\Downloads\u1ra101us17.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\Downloads\u1ra101us17.exe	Section loaded: version.dll
Source: C:\Users\user\Downloads\u1ra101us17.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Downloads\u1ra101us17.exe	Section loaded: apphelp.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: version.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: uxtheme.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: kernel.appcore.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wtsapi32.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: winsta.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: textinputframework.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: coreuicomponents.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: coremessaging.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: ntmarta.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: coremessaging.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wintypes.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wintypes.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wintypes.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: windows.storage.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: wldp.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: profapi.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: shfolder.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: rstrtmgr.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: ncrypt.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: ntasn1.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: textshaping.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: msftedit.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: windows.globalization.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: bcp47langs.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: bcp47mrm.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: globinputhost.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: windows.ui.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: windowmanagementapi.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: inputhost.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: twinapi.appcore.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: twinapi.appcore.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: propsys.dll
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Section loaded: dwmapi.dll

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Window found: window name: TMainForm

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

File opened: C:\Windows\SysWOW64\MSFTEDIT.DLL

Source: Window Recorder

Window detected: More than 3 window changes detected

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Downloads\u1ra101us17.exe

Executable created and started: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Drops PE files

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\a37fe17a-04a3-4a31-9e10-b8ef14f0235f.tmp	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\Downloads\Unconfirmed 690274.crdownload	Jump to dropped file
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	File created: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp			Jump to dropped file
Source: C:\Users\user\Downloads\u1ra101us17.exe	File created: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp			Jump to dropped file

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Users\user\Downloads\u1ra101us17.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Found dropped PE file which has not been started or loaded

Source: C:\Windows\TempInst\is-5AHOE.tmp\u1ra101us17.tmp

Dropped PE file which has not been started: C:\Windows\TempInst\is-2L981.tmp\_isetup\_setup64.tmp

Jump to dropped file

ID:	1432074
Product:	CloudBasic
Start time:	11:38:08
Start date:	26.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://download.lenovo.com/pccbbs/desktop/u1ra101us17.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report http://download.lenovo.com/pccbbs/desktop/u1ra101us17.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report
http://download.lenovo.com/pccbbs/desktop/u1ra101us17.exe