File name:

Windows11InstallationAssistant.exe

Full analysis: https://app.any.run/tasks/cf1fff3c-6ae3-45d3-b4f0-d5a99fce13b1
Verdict: Malicious activity
Analysis date: July 04, 2024, 14:23:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9EFE0C8B7F96C1A7D5BDD52BF07D009D

SHA1:

DC6FF2F1C0AF472CDC81B05F876C10420A6BBB78

SHA256:

03A9B3163071ECB41E20B95EB664C3165B9FCABA89F5E5433484D65E8CFA0380

SSDEEP:

98304:n030XyVX3sxtrIrnIWUR7fF800ka1s84oz45DLDugsyQsCzkJ5Hjbm1NtF9AXu4/:OIrlAm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Windows11InstallationAssistant.exe (PID: 5600)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • Windows11InstallationAssistant.exe (PID: 5600)
      • Windows11InstallationAssistant.exe (PID: 3868)

    • Process drops legitimate windows executable

      • Windows11InstallationAssistant.exe (PID: 5600)

    • Executable content was dropped or overwritten

      • Windows11InstallationAssistant.exe (PID: 5600)

    • Creates a software uninstall entry

      • Windows11InstallationAssistant.exe (PID: 5600)

    • Reads security settings of Internet Explorer

      • Windows11InstallationAssistant.exe (PID: 5600)
      • Windows10UpgraderApp.exe (PID: 4600)

    • Reads the date of Windows installation

      • Windows11InstallationAssistant.exe (PID: 5600)

    • Reads Internet Explorer settings

      • Windows10UpgraderApp.exe (PID: 4600)

    • Reads Microsoft Outlook installation path

      • Windows10UpgraderApp.exe (PID: 4600)

  • INFO

    • Checks supported languages

      • Windows11InstallationAssistant.exe (PID: 5600)
      • Windows10UpgraderApp.exe (PID: 4600)

    • Create files in a temporary directory

      • Windows11InstallationAssistant.exe (PID: 5600)
      • Windows10UpgraderApp.exe (PID: 4600)

    • Creates files in the program directory

      • Windows11InstallationAssistant.exe (PID: 5600)
      • Windows10UpgraderApp.exe (PID: 4600)

    • Reads the computer name

      • Windows11InstallationAssistant.exe (PID: 5600)
      • Windows10UpgraderApp.exe (PID: 4600)

    • Process checks computer location settings

      • Windows11InstallationAssistant.exe (PID: 5600)

    • Creates files or folders in the user directory

      • Windows10UpgraderApp.exe (PID: 4600)

    • Checks proxy server information

      • slui.exe (PID: 6896)
      • Windows10UpgraderApp.exe (PID: 4600)

    • Reads Environment values

      • Windows10UpgraderApp.exe (PID: 4600)

    • Reads CPU info

      • Windows10UpgraderApp.exe (PID: 4600)

    • Reads the software policy settings

      • slui.exe (PID: 6644)
      • slui.exe (PID: 6896)

    • Process checks Internet Explorer phishing filters

      • Windows10UpgraderApp.exe (PID: 4600)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1987:09:21 04:41:02+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.2
CodeSize: 473600
InitializedDataSize: 295424
UninitializedDataSize: -
EntryPoint: 0x71a80
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 10
Subsystem: Windows GUI
FileVersionNumber: 1.4.19041.3630
ProductVersionNumber: 1.4.19041.3630
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Bulgarian
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: WindowsInstallationAssistant
InternalName: WindowsInstallationAssistant.exe
LegalCopyright: © Microsoft Corporation. Всички права запазени.
OriginalFileName: WindowsInstallationAssistant.exe
ProductName: Помощник за инсталиране на Windows
FileVersion: 1.4.19041.3630
ProductVersion: 1.4.19041.3630
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start windows11installationassistant.exe windows10upgraderapp.exe no specs sppextcomobj.exe no specs slui.exe slui.exe ucpdmgr.exe no specs conhost.exe no specs windows11installationassistant.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3868"C:\Users\admin\AppData\Local\Temp\Windows11InstallationAssistant.exe" C:\Users\admin\AppData\Local\Temp\Windows11InstallationAssistant.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WindowsInstallationAssistant
Exit code:
3221226540
Version:
1.4.19041.3630
Modules
Images
c:\users\admin\appdata\local\temp\windows11installationassistant.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4600"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe" /SkipSelfUpdate /SunValleyC:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe—Windows11InstallationAssistant.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Installation Assistant
Version:
1.4.19041.3630
Modules
Images
c:\program files (x86)\windowsinstallationassistant\windows10upgraderapp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5600"C:\Users\admin\AppData\Local\Temp\Windows11InstallationAssistant.exe" C:\Users\admin\AppData\Local\Temp\Windows11InstallationAssistant.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WindowsInstallationAssistant
Exit code:
0
Version:
1.4.19041.3630
Modules
Images
c:\users\admin\appdata\local\temp\windows11installationassistant.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6376"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6612C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6644"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6896C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 354
Read events
3 318
Write events
36
Delete events
0

Modification events

(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{115DF11E-4B4C-4EA9-9A79-00DB0C7EF02D}
Operation:writeName:Publisher
Value:
Microsoft Corporation
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{115DF11E-4B4C-4EA9-9A79-00DB0C7EF02D}
Operation:writeName:DisplayName
Value:
Windows 11 Installation Assistant
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{115DF11E-4B4C-4EA9-9A79-00DB0C7EF02D}
Operation:writeName:DisplayIcon
Value:
"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe"
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{115DF11E-4B4C-4EA9-9A79-00DB0C7EF02D}
Operation:writeName:DisplayVersion
Value:
1.4.19041.3630
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{115DF11E-4B4C-4EA9-9A79-00DB0C7EF02D}
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\WindowsInstallationAssistant\Windows10UpgraderApp.exe" /SunValley /ForceUninstall
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{115DF11E-4B4C-4EA9-9A79-00DB0C7EF02D}
Operation:writeName:EstimatedSize
Value:
5120
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5600) Windows11InstallationAssistant.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
16
Suspicious files
0
Text files
114
Unknown types
9

Dropped files

PID
Process
Filename
Type
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\Windows10UpgraderApp.exeexecutable
MD5:A0E338A33DA0FDB1BD4810AAEC246E13
SHA256:E4B69EB58DA23E8A9006097EBA6097F5C593A4A3583B7869C192B91A7F14081C
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\GetCurrentDeploy.dllexecutable
MD5:AF0A8960F2202935937485937B0A81D0
SHA256:155BA8CB59DC33FDB212039DA49302DF29F2AC90F850CD76D3DADBA60FAB9B8F
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\appraiserxp.dllexecutable
MD5:9AE24DDFEBB001B9CF15004176E90D89
SHA256:82F490F1594FE9545AF87A7D90F3905FBC0023A273D2DF87780023218839313E
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\WinDlp.dllexecutable
MD5:1C8871E3758FCFA21AD841A0D4FFFAB5
SHA256:746F5C2A2D83E706629CAE91BA1E382A78B41564F9F171A761A1562CB41B25C8
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\ESDHelper.dllexecutable
MD5:7D8A87E327AC9E68BB87654321FB3F68
SHA256:42662DA4DB110B27741341B79FA2DE07B4E4F7923D8DFDB2B3341127A2A9FA40
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\downloader.dllexecutable
MD5:9E1B5963AC0C44BAD9F119097EE0BFC8
SHA256:1B5CF5D28E4B20ED7D12E0F0ACF3DE6C19CD5694BB228266854D8981E528E4A8
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\resources\ux\default.csstext
MD5:7F5FCAC447CC2150AC90020F8DC8C98B
SHA256:453D8CA4F52FB8FD40D5B4596596911B9FB0794BB89FBF9B60DC27AF3EAA2850
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\GetCurrentOOBE.dllexecutable
MD5:4F6925976716C50B74797957214C096A
SHA256:9D6DE6273289C1F937CF4813C82426984A736BA19676F578DFACBE6B8799DCF4
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\resources\ux\logo.pngimage
MD5:AFEED45DF4D74D93C260A86E71E09102
SHA256:F5FB1E3A7BCA4E2778903E8299C63AB34894E810A174B0143B79183C0FA5072F
5600Windows11InstallationAssistant.exeC:\Users\admin\AppData\Local\Temp\WXUECA9.tmp\resources\ux\pass.pngimage
MD5:5A7499645619886BFE949250E1807415
SHA256:DB27BAD6E59128D58031706C83210AE780A9261E01AF6FDE6323BD30F7A97B12
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
83
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
unknown
3944
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
7116
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
7116
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
2916
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
4084
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2072
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4448
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4656
SearchApp.exe
2.16.110.123:443
www.bing.com
Akamai International B.V.
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3944
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3944
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1060
svchost.exe
2.18.97.227:443
go.microsoft.com
Akamai International B.V.
FR
unknown
3040
OfficeClickToRun.exe
52.111.243.29:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.16.110.123
  • 2.16.110.170
  • 2.16.110.176
  • 2.16.110.121
  • 2.16.110.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.68
  • 20.190.159.0
whitelisted
go.microsoft.com
  • 2.18.97.227
  • 184.28.89.167
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.103.199
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Windows11InstallationAssistant.exe