Windows Analysis Report
MSIAfterburnerInstaller465.exe

Overview

General Information

Sample name: MSIAfterburnerInstaller465.exe
Analysis ID: 1544726
MD5: b198b5b47aa6293222a21e6b4ced3bac
SHA1: 2aaacac5c0ee029a425c01c5923626416d40e0e8
SHA256: b0e64d98d3b45bad13b5518b4cb0751246b2f84d41f5804753b168f5803bce3e
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found potential dummy code loops (likely to delay analysis)
Uses Windows timers to delay execution
Abnormal high CPU Usage
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Detected potential crypto function
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Potential time zone aware malware
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)

Classification

Source: MSIAfterburnerInstaller465.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/MSIAfterburnerSetup;Component/Images/btn_close_over.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/MSIAfterburnerSetup;Component/Images/btn_close_over.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/MSIAfterburnerSetup;Component/Images/ic_info_over_light.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://defaultcontainer/MSIAfterburnerSetup;Component/Images/ic_info_over_light.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/Images/btn_close_over.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/Images/btn_close_over.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/Images/ic_info_over_light.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/Images/ic_info_over_light.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/images/btn_close_over.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/images/btn_close_over.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/images/ic_info_over_light.png
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.00000000066B5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://foo/bar/images/ic_info_over_light.pngd
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4564151440.0000000006511000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://br.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://br.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://cn.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://cn.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://de.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://de.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://es.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://es.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://fr.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://fr.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://it.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://it.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://jp.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://jp.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://kr.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://kr.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://pl.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://pl.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://ru.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://ru.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://tr.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://tr.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://tw.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://tw.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.msi.com/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.msi.com/page/privacy-policy
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.msi.com/page/website-terms-of-use
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/br/pt/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/br/pt/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/cn/zh/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/cn/zh/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/de/de/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/de/de/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/es/es/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/es/es/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/fr/fr/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/fr/fr/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/it/it/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/it/it/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/jp/ja/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/jp/ja/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/kr/ko/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/kr/ko/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/tw/zh/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/tw/zh/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/us/en/legal/license-services-agreement/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/privacy-notices/
Source: MSIAfterburnerInstaller465.exe String found in binary or memory: https://www.nortonlifelock.com/us/en/privacy/privacy-notices/polish/
Abnormal high CPU Usage
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process Stats: CPU usage > 49%
Detected potential crypto function
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_048360B0 0_2_048360B0
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_04837208 0_2_04837208
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_04834D20 0_2_04834D20
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_0483BFC0 0_2_0483BFC0
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_0483FABA 0_2_0483FABA
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_04834DAA 0_2_04834DAA
Sample file is different than original file name gathered from version info
Source: MSIAfterburnerInstaller465.exe, 00000000.00000002.4561496641.000000000484E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs MSIAfterburnerInstaller465.exe
Source: classification engine Classification label: mal48.evad.winEXE@1/0@0/0
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Mutant created: NULL
Source: MSIAfterburnerInstaller465.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: MSIAfterburnerInstaller465.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: msvcp140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: d3d9.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: d3d10warp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: wtsapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: winsta.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: dataexchange.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: d3d11.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: dcomp.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: dxgi.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: twinapi.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: resourcepolicyclient.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: dxcore.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: msctfui.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: uiautomationcore.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Section loaded: d3dcompiler_47.dll Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: MSIAfterburnerInstaller465.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: MSIAfterburnerInstaller465.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: MSIAfterburnerInstaller465.exe Static file information: File size 59236352 > 1048576
Source: MSIAfterburnerInstaller465.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3824a00
Source: MSIAfterburnerInstaller465.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: MSIAfterburnerInstaller465.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Binary contains a suspicious time stamp
Source: MSIAfterburnerInstaller465.exe Static PE information: 0x8B4D8C54 [Fri Jan 22 22:40:20 2044 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_04833532 pushad ; iretd 0_2_04833541
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_0483356B pushfd ; iretd 0_2_04833571
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_048336D2 push ebx; iretd 0_2_048336DA
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_048310C5 pushfd ; iretd 0_2_048310C9
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_04833A0A push esp; retf 0_2_04833A19
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Code function: 0_2_04833A33 push esp; retf 0_2_04833A19
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Uses Windows timers to delay execution
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe User Timer Set: Timeout: 1ms Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe User Timer Set: Timeout: 1ms Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe User Timer Set: Timeout: 1ms Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe User Timer Set: Timeout: 1ms Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Memory allocated: 4830000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Memory allocated: 6510000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Memory allocated: 8510000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Memory allocated: 8BA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Memory allocated: CBA0000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Window / User API: threadDelayed 3411 Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Window / User API: threadDelayed 6431 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe TID: 5968 Thread sleep time: -28592453314249787s >= -30000s Jump to behavior
Potential time zone aware malware
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe System information queried: CurrentTimeZoneInformation Jump to behavior
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: MSIAfterburnerInstaller465.exe Binary or memory string: "}qemu+

Anti Debugging
barindex
Found potential dummy code loops (likely to delay analysis)
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Process Stats: CPU usage > 42% for more than 60s
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Memory allocated: page read and write | page guard Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Queries volume information: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\MSIAfterburnerInstaller465.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1544726 Sample: MSIAfterburnerInstaller465.exe Startdate: 29/10/2024 Architecture: WINDOWS Score: 48 4 MSIAfterburnerInstaller465.exe 2 2->4         started        signatures3 7 Uses Windows timers to delay execution 4->7 9 Found potential dummy code loops (likely to delay analysis) 4->9
⊘No contacted IP infos