Analysis
- max time kernel
79s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/06/2024, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
anyrecover-for-win_setup.exe
Resource
win7-20240220-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
anyrecover-for-win_setup.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target anyrecover-for-win_setup.exe
- Size 3.1MB
- Sample240618-nhbd7s1elf
- SHA256 651907c1b631bdd79f8aa3f097bd23156d168a1e2c489c41238ddfd1f5434ba7
- MD5 fc21b78d8012dcfc1d94185ed5083dff
- SHA1 23458457bd546befb18162bed4a408b7d72a2a18
- SHA512 5861c71289e155f2cff57f28a160ef8de217bc2388b5f64c851b7045e7b59640e6f98e3090949ffb5a6859d02abc0804eb3ebbbcce412b45573dce8b8075408b
- SSDEEP 49152:JY9Vgae/6GLuni6Ud7jHdh3oc4A/naB/YPqv7d/nWcRVROqMIM:JUmae/6GLuNaj9h3oc4Ay/Z/E
- MD5 SHA1 SHA512 SSDEEP
Score
4/10
Malware Config
Signatures
- Drops file in Program Files directory 45 IoCs
description ioc Process File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\French\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\German\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Italian\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\English\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\French\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\German\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Arabic\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Portuguese\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Thai\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\language.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\ChineseTW\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\French\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\German\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Japanese\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Korean\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Dutch\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Spanish\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Thai\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\English\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Japanese\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Korean\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Spanish\text.ini anyrecover-for-win_setup.exe File opened for modification C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\Log\imyfone_down.log anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Swedish\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\productInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Chinese\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\ChineseTW\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Italian\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Portuguese\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Swedish\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Thai\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Dutch\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\English\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Korean\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Arabic\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Dutch\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Swedish\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Arabic\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Chinese\text.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Chinese\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Italian\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Japanese\UrlInfo.ini anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Portuguese\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Spanish\install_tips.png anyrecover-for-win_setup.exe File created C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\ChineseTW\UrlInfo.ini anyrecover-for-win_setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3244 anyrecover-for-win_setup.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\imyfone_down\anyrecover-for-win_setup\language\Arabic\install_tips.png
- Size 2KB
- SHA256 78afdaf35fa6173b08621270842b5d8d899b966ffdfa986a9e98f372afd4f419
- MD5 28fbf016e49eed024ebc37a11e1f883a
- SHA1 032ee9a583d9482cea6cb617925a8ad0be9b175f
- SHA512 fe250df9f481f5b5e9993834059f707bc51af1f4334fae3e1f0034b802dd25aac4aec1a27478c65e72b4fc353ff49e555bb92d9a51ccd14605c02293baa40cb0
- MD5 SHA1 SHA512
