| File name: | ccsetup536.exe |
| Full analysis: | https://app.any.run/tasks/bef51961-f3c7-44c7-9603-771212db41a2 |
| Verdict: | Malicious activity |
| Analysis date: | March 08, 2018, 11:06:59 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 4BEE8E02687AEF9C23179B7CF4954220 |
| SHA1: | 48972CF8A6FC0F282498B44E62AB2829448565D1 |
| SHA256: | 03D8B1EAFDDB81140AFE512122C20D048863BA861F976F97D28697F9E44A9E5B |
| SSDEEP: | 196608:9AQMh7na4sIoQ95pNuUgO4JbUodxpvBXxt87YmOF:9adLToQ95zuU3IppXJ |
MALICIOUS
Actions looks like stealing of personal data
- ccsetup536.exe (PID: 2324)
Loads the Task Scheduler COM API
- CCleaner.exe (PID: 2952)
- CCUpdate.exe (PID: 3268)
Application loaded dropped or rewritten executable
- ccsetup536.exe (PID: 2324)
Changes internet zones settings
- iexplore.exe (PID: 3436)
SUSPICIOUS
Low-level read access rights to disk partition
- ccsetup536.exe (PID: 2324)
- CCleaner.exe (PID: 3308)
- CCUpdate.exe (PID: 3268)
Creates files in the program directory
- ccsetup536.exe (PID: 2324)
- CCUpdate.exe (PID: 3268)
Creates a software uninstall entry
- ccsetup536.exe (PID: 2324)
Reads internet explorer settings
- CCleaner.exe (PID: 3308)
- ccsetup536.exe (PID: 2324)
- iexplore.exe (PID: 2972)
Searches for installed software
- ccsetup536.exe (PID: 2324)
Modifies the open verb of a shell class
- ccsetup536.exe (PID: 2324)
Creates files in the user directory
- CCleaner.exe (PID: 3308)
- ccsetup536.exe (PID: 2324)
- iexplore.exe (PID: 2972)
Starts Internet Explorer
- FlashPlayerApp.exe (PID: 2484)
- iexplore.exe (PID: 3436)
Writes to a desktop.ini file (may be used to cloak folders)
- iexplore.exe (PID: 3436)
Modifies files in the system directory
- ccsetup536.exe (PID: 2324)
Reads Internet Cache Settings
- ccsetup536.exe (PID: 2324)
- iexplore.exe (PID: 2972)
Starts application with an unusual extension
- ccsetup536.exe (PID: 2324)
INFO
Dropped object may contain URL's
- ccsetup536.exe (PID: 2324)
Loads rich edit control libraries
- ccsetup536.exe (PID: 2324)
Reads settings of System Certificates
- iexplore.exe (PID: 2972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2015:12:29 22:34:49+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 29696 |
| InitializedDataSize: | 48128 |
| UninitializedDataSize: | 16896 |
| EntryPoint: | 0x3a1c |
| OSVersion: | 5 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 5.36.0.6278 |
| ProductVersionNumber: | 5.36.0.6278 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| CompanyName: | Piriform Ltd |
| FileDescription: | CCleaner Installer |
| FileVersion: | 5.36.0.6278 |
| LegalCopyright: | Copyright © 2005-2017 Piriform Ltd |
| ProductName: | CCleaner |
Summary
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 29-Dec-2015 21:34:49 |
| Detected languages: |
|
| CompanyName: | Piriform Ltd |
| FileDescription: | CCleaner Installer |
| FileVersion: | 5.36.0.6278 |
| LegalCopyright: | Copyright © 2005-2017 Piriform Ltd |
| ProductName: | CCleaner |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000D8 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 5 |
| Time date stamp: | 29-Dec-2015 21:34:49 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00007250 | 0x00007400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.46491 |
.rdata | 0x00009000 | 0x00002B38 | 0x00002C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.41939 |
.data | 0x0000C000 | 0x00067EDC | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 1.89689 |
.ndata | 0x00074000 | 0x00371000 | 0x00000000 | IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rsrc | 0x003E5000 | 0x00008D38 | 0x00008E00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.96172 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.27868 | 1212 | Latin 1 / Western European | English - United States | RT_MANIFEST |
2 | 5.62687 | 4264 | Latin 1 / Western European | English - United States | RT_ICON |
3 | 4.7389 | 2216 | Latin 1 / Western European | English - United States | RT_ICON |
4 | 3.91559 | 1384 | Latin 1 / Western European | English - United States | RT_ICON |
5 | 5.97397 | 1128 | Latin 1 / Western European | English - United States | RT_ICON |
6 | 3.89369 | 744 | Latin 1 / Western European | English - United States | RT_ICON |
103 | 2.72033 | 90 | Latin 1 / Western European | English - United States | RT_GROUP_ICON |
105 | 2.704 | 688 | Latin 1 / Western European | English - United States | RT_DIALOG |
106 | 2.92897 | 344 | Latin 1 / Western European | English - United States | RT_DIALOG |
107 | 2.52183 | 160 | Latin 1 / Western European | English - United States | RT_DIALOG |
Imports
ADVAPI32.dll |
COMCTL32.dll |
GDI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
ole32.dll |
Total processes
51
Monitored processes
13
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 684 | ping -n 1 -w 1000 www.piriform.com | C:\Windows\system32\ping.exe | — | ns5E90.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: TCP/IP Ping Command Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2324 | "C:\Users\admin\AppData\Local\Temp\ccsetup536.exe" | C:\Users\admin\AppData\Local\Temp\ccsetup536.exe | explorer.exe | ||||||||||||
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner Installer Exit code: 0 Version: 5.36.0.6278 Modules
| |||||||||||||||
| 2484 | "C:\Windows\system32\FlashPlayerApp.exe" | C:\Windows\system32\FlashPlayerApp.exe | — | rundll32.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe Flash Player Control Panel Applet Exit code: 0 Version: 26,0,0,137 Modules
| |||||||||||||||
| 2952 | "C:\Program Files\CCleaner\CCleaner.exe" /createSkipUAC 5.35.6210 | C:\Program Files\CCleaner\CCleaner.exe | — | ccsetup536.exe | |||||||||||
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner Exit code: 0 Version: 5, 36, 00, 6278 Modules
| |||||||||||||||
| 2972 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3436 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3228 | "C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\ns9C75.tmp" ping -n 1 -w 5000 www.piriform.com | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\ns9C75.tmp | — | ccsetup536.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 1 Modules
| |||||||||||||||
| 3268 | "C:\Program Files\CCleaner\CCUpdate.exe" /reg | C:\Program Files\CCleaner\CCUpdate.exe | — | ccsetup536.exe | |||||||||||
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner emergency updater Exit code: 0 Version: 5, 36, 0, 0 Modules
| |||||||||||||||
| 3308 | "C:\Program Files\CCleaner\CCleaner.exe" | C:\Program Files\CCleaner\CCleaner.exe | — | ccsetup536.exe | |||||||||||
User: admin Company: Piriform Ltd Integrity Level: HIGH Description: CCleaner Exit code: 0 Version: 5, 36, 00, 6278 Modules
| |||||||||||||||
| 3324 | "C:\Users\admin\AppData\Local\Temp\ccsetup536.exe" | C:\Users\admin\AppData\Local\Temp\ccsetup536.exe | — | explorer.exe | |||||||||||
User: admin Company: Piriform Ltd Integrity Level: MEDIUM Description: CCleaner Installer Exit code: 3221226540 Version: 5.36.0.6278 Modules
| |||||||||||||||
| 3436 | "C:\Program Files\Internet Explorer\iexplore.exe" -nohome | C:\Program Files\Internet Explorer\iexplore.exe | — | FlashPlayerApp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 051
Read events
857
Write events
188
Delete events
6
Modification events
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Toolbar |
| Operation: | write | Name: | test |
Value: test | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Toolbar |
| Operation: | delete value | Name: | test |
Value: test | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Toolbar |
| Operation: | delete key | Name: | |
Value: | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012018030820180309 |
| Operation: | write | Name: | CachePath |
Value: %USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012018030820180309 | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012018030820180309 |
| Operation: | write | Name: | CachePrefix |
Value: :2018030820180309: | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012018030820180309 |
| Operation: | write | Name: | CacheLimit |
Value: 8192 | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012018030820180309 |
| Operation: | write | Name: | CacheOptions |
Value: 11 | |||
| (PID) Process: | (2324) ccsetup536.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012018030820180309 |
| Operation: | write | Name: | CacheRepair |
Value: 0 | |||
Executable files
9
Suspicious files
0
Text files
39
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\g\gcombo\ComboOffer_1033.html | html | |
MD5:016F10E3840423FD75A776923AA3E57D | SHA256:C89B3683C75B641526524E2397D9BEB24F5BBD0D813D60CEB2B5B8896AE17659 | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\UserInfo.dll | executable | |
MD5:C1F778A6D65178D34BDE4206161A98E0 | SHA256:9CAF7A78F750713180CF64D18967A2B803B5580E636E59279DCAAF18BA0DAA87 | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\System.dll | executable | |
MD5:41A3C964232EDD2D7D5EDEA53E8245CD | SHA256:8B65FEC615C7B371C23F8F7F344B12DC5085E40A556F96DB318ED757494D62D5 | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\g\gcombo\ComboOffer_1030.html | html | |
MD5:74FB5C6592947C542FD036FE1D332AAF | SHA256:63B9E98CBD2CA35590318A0307145A5BC541CAC4E06EF93D6C0095E5692E5172 | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\g\gcombo\ComboOffer_1026.html | html | |
MD5:31F4AFA1E87F0243C43B0203B89D50B1 | SHA256:34C5182D004DF6016042423E040A79F597E9286F5F75F38C0A821FC06494C702 | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\g\gcombo\ComboOffer_1031.html | html | |
MD5:7BFEF739A458A6C54378FC4EEAB2E30D | SHA256:4786ECF1484B6D5463D31B57EA4B6314906C2F81ADC99B7145B5770140921868 | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\g\gcombo\ComboOffer_1032.html | html | |
MD5:B304784FF5CB5F21C84838FAB5FC9DCD | SHA256:E0F89A65F2DC26B278B4DAF1F3E75AC2DE25C49852EA9E3EF55DB32E9D889E4A | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\g\gtapi_signed.dll | executable | |
MD5:61BC40D1FAD9E0FAA9A07219B90BA0E4 | SHA256:89E157A4F61D7D18180CB7F901C0095DA3B7A5CC5A9FD58D710099E5F0EE505A | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\g\gcombo\ComboOffer_1027.html | html | |
MD5:D23B9D2A41FB327025C45B392B8415A5 | SHA256:36B5327492D4A1097A87C6F52EA89D90AB5245799A700E189C48FD41E2EA7179 | |||
| 2324 | ccsetup536.exe | C:\Users\admin\AppData\Local\Temp\nsm54AC.tmp\g\gcapi_dll.dll | executable | |
MD5:2973AF8515EFFD0A3BFC7A43B03B3FCC | SHA256:D0E4581210A22135CE5DEB47D9DF4D636A94B3813E0649AAB84822C9F08AF2A0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
33
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 5.62.38.42:80 | http://ip-info.ff.avast.com/v2/info | NL | text | 364 b | whitelisted |
— | — | GET | 200 | 192.147.130.63:80 | http://get.adobe.com/flashplayer/about/ | US | html | 27.4 Kb | whitelisted |
— | — | GET | 200 | 2.16.186.17:80 | http://ccleaner.tools.avcdn.net/tools/ccleaner/update/patches.ini | unknown | ini | 96 b | whitelisted |
— | — | GET | 200 | 151.101.0.64:80 | http://service.piriform.com/installcheck.aspx?p=1&v=5.36.6278&vx=5.35.6210&l=1033&b=1&o=6.1W3&g=14&i=1&a=0&e=0&n=ccsetup536.exe&id=003&mk=X6Q8-PNKK-2F2B-AUCU-BBXE-Q7EE-6KMM-WAUY-KN2W&mx=97B7721C4994E2556FF6A439510F665D508A73235A43827BE00F60C395A258E2&gu=251c0000-e015-4d85-8000-22a73ddd7a28 | US | text | 4 b | whitelisted |
— | — | GET | 200 | 2.16.186.10:80 | http://emupdate.avcdn.net/files/emupdate/pong.txt | unknown | text | 3 b | whitelisted |
— | — | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
— | — | GET | 200 | 2.16.186.17:80 | http://ccleaner.tools.avcdn.net/tools/ccleaner/update/updates.xml | unknown | xml | 393 b | whitelisted |
— | — | GET | 304 | 8.253.145.105:80 | http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab | US | — | — | whitelisted |
— | — | GET | 301 | 151.101.0.64:80 | http://www.piriform.com/auto?a=0&p=cc&v=5.36.6278&l=1033&lk=&mk=X6Q8-PNKK-2F2B-AUCU-BBXE-Q7EE-6KMM-WAUY-KN2W&o=6.1W3&au=1&mx=97B7721C4994E2556FF6A439510F665D508A73235A43827BE00F60C395A258E2&gu=251c0000-e015-4d85-8000-22a73ddd7a28 | US | — | — | whitelisted |
— | — | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAH9o%2BtuynXIiEOLckvPvJE%3D | US | der | 471 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 172.217.21.238:80 | — | Google Inc. | US | whitelisted |
— | — | 151.101.0.64:443 | www.piriform.com | Fastly | US | whitelisted |
— | — | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
— | — | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
— | — | 104.111.216.15:443 | wwwimages2.adobe.com | Akamai International B.V. | NL | whitelisted |
— | — | 8.253.145.105:80 | www.download.windowsupdate.com | Level 3 Communications, Inc. | US | suspicious |
— | — | 192.147.130.63:80 | get.adobe.com | Adobe Systems Inc. | US | whitelisted |
— | — | 151.101.0.64:80 | www.piriform.com | Fastly | US | whitelisted |
— | — | 5.62.38.42:80 | ip-info.ff.avast.com | AVAST Software s.r.o. | NL | unknown |
— | — | 2.16.186.17:80 | ccleaner.tools.avcdn.net | Akamai International B.V. | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.piriform.com |
| whitelisted |
service.piriform.com |
| whitelisted |
ip-info.ff.avast.com |
| whitelisted |
emupdate.avcdn.net |
| whitelisted |
ccleaner.tools.avcdn.net |
| whitelisted |
www.ccleaner.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.adobe.com |
| whitelisted |
www.download.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |