File name:

Setup_Bosch_Passthru_v2.30.1(1).exe

Full analysis: https://app.any.run/tasks/ae9b1e24-2531-4da7-90ba-f4d890158927
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 03, 2024, 10:29:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

64237AF2942282A3AE7F33E5CD4654A8

SHA1:

BB29C3F36DE1004EF0620E88466C2E68F33CD445

SHA256:

053BDC202B63581662BA8F4DA24AD9F78FFF7E8780FFB343E8B4F54A8C4AB15F

SSDEEP:

98304:a0oxUyuU1eYluOc+Wp5D84wRqOMxVw0lvQsslBWavIGbdVKjgkWBmYjuuCDY2FgK:Wt1HHfc47GOw6QSMzfx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • RbSer32Setup.tmp (PID: 2640)
      • msiexec.exe (PID: 2752)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)

    • Create files in the Startup directory

      • msiexec.exe (PID: 2752)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • RbSer32Setup.tmp (PID: 2640)
      • MigrationSetup.tmp (PID: 2440)
      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 2752)
      • KTSNG-Setup.tmp (PID: 664)

    • Reads the Internet Settings

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • RbSer32Setup.tmp (PID: 2640)
      • msiexec.exe (PID: 3112)

    • Starts SC.EXE for service management

      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 3112)

    • Drops a system driver (possible attempt to evade defenses)

      • RbSer32Setup.tmp (PID: 2640)

    • The process executes VB scripts

      • DDCSetup.tmp (PID: 452)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 2484)
      • cscript.exe (PID: 2436)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 2484)
      • cscript.exe (PID: 2436)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 3112)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • msiexec.exe (PID: 3112)
      • KTSNG-Setup.tmp (PID: 664)
      • DDCSetup.tmp (PID: 452)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3112)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)

    • Uses powercfg.exe to modify the power settings

      • KTSNG-Setup.tmp (PID: 664)

  • INFO

    • Create files in a temporary directory

      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 2036)
      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 532)
      • MigrationSetup.exe (PID: 2336)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • Setup_Bosch_Passthru_v2.30.1_dat.exe (PID: 1740)
      • RbSer32Setup.exe (PID: 2628)
      • RbSer32Setup.tmp (PID: 2640)
      • MigrationSetup.tmp (PID: 2440)
      • DDCSetup.exe (PID: 2592)
      • DDCSetup.tmp (PID: 452)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 3112)
      • msiexec.exe (PID: 2752)
      • DPInst-x32.exe (PID: 1496)
      • KTSNG-Setup.exe (PID: 2560)
      • KTSNG-Setup.tmp (PID: 664)

    • Checks supported languages

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 1404)
      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 2036)
      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 532)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • MigrationSetup.exe (PID: 2336)
      • MigrationSetup.tmp (PID: 2440)
      • Setup_Bosch_Passthru_v2.30.1_dat.exe (PID: 1740)
      • RBSer32.exe (PID: 2644)
      • RbSer32Setup.tmp (PID: 2640)
      • RbSer32Setup.exe (PID: 2628)
      • DDCSetup.exe (PID: 2592)
      • UsbPwrCtrl.exe (PID: 2404)
      • RBSer32.exe (PID: 2692)
      • DDCSetup.tmp (PID: 452)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 2752)
      • msiexec.exe (PID: 3112)
      • msiexec.exe (PID: 2072)
      • DPInst-x32.exe (PID: 1496)
      • drvinst.exe (PID: 3744)
      • drvinst.exe (PID: 3888)
      • vci-ident.exe (PID: 1656)
      • KTSNG-Setup.tmp (PID: 664)
      • RbStartProg.exe (PID: 3248)
      • PtUpdateCheck.exe (PID: 3252)
      • RBsys.exe (PID: 3264)
      • RBSer32.exe (PID: 3244)
      • RbStartProg.exe (PID: 3168)
      • KTSNG-Setup.exe (PID: 2560)

    • Drops the executable file immediately after the start

      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 2036)
      • Setup_Bosch_Passthru_v2.30.1(1).exe (PID: 532)
      • MigrationSetup.exe (PID: 2336)
      • Setup_Bosch_Passthru_v2.30.1_dat.exe (PID: 1740)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • RbSer32Setup.exe (PID: 2628)
      • MigrationSetup.tmp (PID: 2440)
      • DDCSetup.exe (PID: 2592)
      • RbSer32Setup.tmp (PID: 2640)
      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 3112)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 2752)
      • KTSNG-Setup.exe (PID: 2560)
      • KTSNG-Setup.tmp (PID: 664)

    • Reads the computer name

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 1404)
      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • RbSer32Setup.tmp (PID: 2640)
      • MigrationSetup.tmp (PID: 2440)
      • DDCSetup.tmp (PID: 452)
      • UsbPwrCtrl.exe (PID: 2404)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 2752)
      • msiexec.exe (PID: 3112)
      • msiexec.exe (PID: 2072)
      • drvinst.exe (PID: 3888)
      • DPInst-x32.exe (PID: 1496)
      • drvinst.exe (PID: 3744)
      • vci-ident.exe (PID: 1656)
      • KTSNG-Setup.tmp (PID: 664)
      • RBsys.exe (PID: 3264)
      • RBSer32.exe (PID: 3244)

    • Creates files in the program directory

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • RbSer32Setup.tmp (PID: 2640)
      • MigrationSetup.tmp (PID: 2440)
      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 2944)
      • vci-ident.exe (PID: 1656)
      • KTSNG-Setup.tmp (PID: 664)
      • RBsys.exe (PID: 3264)

    • Checks proxy server information

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)

    • Reads the machine GUID from the registry

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • GVCI-Platform-Setup.exe (PID: 3020)
      • msiexec.exe (PID: 2752)
      • msiexec.exe (PID: 3112)
      • msiexec.exe (PID: 2072)
      • DPInst-x32.exe (PID: 1496)
      • drvinst.exe (PID: 3888)
      • drvinst.exe (PID: 3744)

    • Drops 7-zip archiver for unpacking

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)
      • KTSNG-Setup.tmp (PID: 664)

    • Process requests binary or script from the Internet

      • Setup_Bosch_Passthru_v2.30.1(1).tmp (PID: 316)

    • Process drops legitimate windows executable

      • RbSer32Setup.tmp (PID: 2640)
      • MigrationSetup.tmp (PID: 2440)
      • DDCSetup.tmp (PID: 452)
      • msiexec.exe (PID: 3112)
      • KTSNG-Setup.tmp (PID: 664)

    • The process drops C-runtime libraries

      • RbSer32Setup.tmp (PID: 2640)

    • Executes as Windows Service

      • UsbPwrCtrl.exe (PID: 2404)
      • vci-ident.exe (PID: 1656)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 2484)
      • cscript.exe (PID: 2436)

    • Reads Environment values

      • msiexec.exe (PID: 3112)

    • Application launched itself

      • msiexec.exe (PID: 2752)

    • Manual execution by a user

      • RBsys.exe (PID: 3264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (45.2)
.dll | Win32 Dynamic Link Library (generic) (20.9)
.exe | Win32 Executable (generic) (14.3)
.exe | Win16/32 Executable Delphi generic (6.6)
.exe | Generic Win/DOS Executable (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:14 15:27:46+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 66560
InitializedDataSize: 53760
UninitializedDataSize: -
EntryPoint: 0x1181c
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.30.1.0
ProductVersionNumber: 2.30.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Robert Bosch GmbH
FileDescription: Bosch Pass-Thru v2 Setup
FileVersion: 2.30.1
LegalCopyright: Copyright 2020 by Robert Bosch GmbH
ProductName: Bosch Pass-Thru v2 (KTS5a Series)
ProductVersion: 2.30.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
63
Malicious processes
8
Suspicious processes
6

Behavior graph

Click at the process to see the details
start setup_bosch_passthru_v2.30.1(1).exe no specs setup_bosch_passthru_v2.30.1(1).tmp no specs setup_bosch_passthru_v2.30.1(1).exe setup_bosch_passthru_v2.30.1(1).tmp setup_bosch_passthru_v2.30.1_dat.exe no specs migrationsetup.exe no specs migrationsetup.tmp no specs rbser32.exe no specs rbser32setup.exe no specs rbser32setup.tmp no specs rbser32.exe no specs ddcsetup.exe no specs ddcsetup.tmp no specs cscript.exe no specs sc.exe no specs sc.exe no specs usbpwrctrl.exe no specs cscript.exe no specs cscript.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs gvci-platform-setup.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs msiexec.exe no specs dpinst-x32.exe no specs drvinst.exe no specs drvinst.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs sc.exe no specs sc.exe no specs vci-ident.exe no specs ktsng-setup.exe no specs ktsng-setup.tmp no specs powercfg.exe no specs powercfg.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs rbstartprog.exe no specs rbstartprog.exe no specs ptupdatecheck.exe no specs rbsys.exe no specs rbser32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Users\admin\AppData\Local\Temp\is-DDKEB.tmp\Setup_Bosch_Passthru_v2.30.1(1).tmp" /SL5="$501AC,5816348,121344,C:\Users\admin\AppData\Local\Temp\Setup_Bosch_Passthru_v2.30.1(1).exe" /SPAWNWND=$501B2 /NOTIFYWND=$301AA C:\Users\admin\AppData\Local\Temp\is-DDKEB.tmp\Setup_Bosch_Passthru_v2.30.1(1).tmp
Setup_Bosch_Passthru_v2.30.1(1).exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-ddkeb.tmp\setup_bosch_passthru_v2.30.1(1).tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
452"C:\Users\admin\AppData\Local\Temp\is-JQRR2.tmp\DDCSetup.tmp" /SL5="$501D2,10111846,119296,C:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\DDCSetup.exe" /SP- /VERYSILENT /NORESTART /SUPPRESSMSGBOXES /Skip_BT_Setup /LANG=en /LOG="C:\Program Files\Bosch\Passthru_v2\DDCSetup.tmp"C:\Users\admin\AppData\Local\Temp\is-JQRR2.tmp\DDCSetup.tmp—DDCSetup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jqrr2.tmp\ddcsetup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
532"C:\Users\admin\AppData\Local\Temp\Setup_Bosch_Passthru_v2.30.1(1).exe" /SPAWNWND=$501B2 /NOTIFYWND=$301AA C:\Users\admin\AppData\Local\Temp\Setup_Bosch_Passthru_v2.30.1(1).exe
Setup_Bosch_Passthru_v2.30.1(1).tmp
User:
admin
Company:
Robert Bosch GmbH
Integrity Level:
HIGH
Description:
Bosch Pass-Thru v2 Setup
Exit code:
0
Version:
2.30.1
Modules
Images
c:\users\admin\appdata\local\temp\setup_bosch_passthru_v2.30.1(1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
552"powercfg" /SETACVALUEINDEX SCHEME_CURRENT 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0C:\Windows\System32\powercfg.exe—KTSNG-Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
664"C:\Users\admin\AppData\Local\Temp\is-TKA4N.tmp\KTSNG-Setup.tmp" /SL5="$801D4,2042288,119296,C:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\KTSNG-Setup.exe" /VERYSILENT /LOG="C:\Program Files\Bosch\Passthru_v2\KTSNG-Setup.tmp"C:\Users\admin\AppData\Local\Temp\is-TKA4N.tmp\KTSNG-Setup.tmp—KTSNG-Setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-tka4n.tmp\ktsng-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
712netsh advfirewall firewall add rule dir=out action=allow enable=yes profile=any remoteip=any program="C:\Program Files\Bosch\VTX-VCI\VCI Software (KTS)\VCI Identification Service\vci-ident.exe" name="VCI Identification Service (KTS)"C:\Windows\System32\netsh.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
948"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Bosch_DDC" program="C:\Program Files\Bosch\Diagnostics\RBSystem\RBsys.exe" dir=out action=allow profile=anyC:\Windows\System32\netsh.exe—DDCSetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
996"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Bosch_ModuleConfiguratin_RemoteIp"C:\Windows\System32\netsh.exe—KTSNG-Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1192"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name="Bosch_esitronic2.0"C:\Windows\System32\netsh.exe—KTSNG-Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1232"C:\Windows\system32\cscript.exe" C:\Users\admin\AppData\Local\Temp\is-5IO5M.tmp\IsBTHActive.vbsC:\Windows\System32\cscript.exe—DDCSetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
1
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
25 119
Read events
23 782
Write events
1 289
Delete events
48

Modification events

(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(316) Setup_Bosch_Passthru_v2.30.1(1).tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2440) MigrationSetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:Sequence
Value:
1
(PID) Process:(2440) MigrationSetup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0001
Operation:delete valueName:SessionHash
Value:
05685D85CF83226FE5982C5ADCF236CBBCB111CD0D89A71B5ACFE53C9C9ABBB3
Executable files
345
Suspicious files
314
Text files
147
Unknown types
0

Dropped files

PID
Process
Filename
Type
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\Setup_Bosch_Passthru_v2.30.1_dat.exe —
MD5:—
SHA256:—
1740Setup_Bosch_Passthru_v2.30.1_dat.exeC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\GVCI-Platform-Setup.exe —
MD5:—
SHA256:—
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Program Files\Bosch\Passthru_v2\uninstall\is-3E91F.tmp —
MD5:—
SHA256:—
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Program Files\Bosch\Passthru_v2\uninstall\GVCI-Platform-Setup.exe —
MD5:—
SHA256:—
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Program Files\Bosch\Passthru_v2\uninstall\is-MCJ1Q.tmpexecutable
MD5:61C1F5EBAF564463AA2928B06894722C
SHA256:5D99D8B14C960DDF2B5F4D1580628EFC31F121A9B2F5B607DB0EB4CCC1F91506
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\idp.dllexecutable
MD5:9A83F220BF8CA569E3CFA654539A47A4
SHA256:B1C4C9B2DD6A40974FA8789B218B52D967F5CCD1B47E95B4F6BDA4B6CE864D0D
2036Setup_Bosch_Passthru_v2.30.1(1).exeC:\Users\admin\AppData\Local\Temp\is-6LA2T.tmp\Setup_Bosch_Passthru_v2.30.1(1).tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
1740Setup_Bosch_Passthru_v2.30.1_dat.exeC:\Users\admin\AppData\Local\Temp\is-ORUPA.tmp\DDCSetup.exeexecutable
MD5:55DF673AE4F2A6E04B037B3E64FBD228
SHA256:50DD0D4B5240F6438CEBDA54FE1040F9DBC7A895700F6015FB736372F954E999
532Setup_Bosch_Passthru_v2.30.1(1).exeC:\Users\admin\AppData\Local\Temp\is-DDKEB.tmp\Setup_Bosch_Passthru_v2.30.1(1).tmpexecutable
MD5:34ACC2BDB45A9C436181426828C4CB49
SHA256:9C81817ACD4982632D8C7F1DF3898FCA1477577738184265D735F49FC5480F07
316Setup_Bosch_Passthru_v2.30.1(1).tmpC:\Program Files\Bosch\Passthru_v2\uninstall\KTSNG-Setup.exeexecutable
MD5:1BBD36C2AF207F4413FCDE2B197D0103
SHA256:FC582EE781B0BC42B838244F2EDC00D18E2E64A5BC6E14CD536B973F27DEFBF1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
HEAD
200
13.107.246.45:80
http://download.esitronic.de/KTSdownload/kts-setups/Setup_Bosch_Passthru_v2.30.1_dat.exe
unknown
—
—
unknown
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
GET
—
13.107.246.45:80
http://download.esitronic.de/KTSdownload/kts-setups/Setup_Bosch_Passthru_v2.30.1_dat.exe
unknown
—
—
unknown
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
GET
200
13.107.246.45:80
http://download.esitronic.de/KTSdownload/kts-setups/Setup_Bosch_Passthru_v2.30.1_dat.exe
unknown
executable
103 Mb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
13.107.246.45:80
download.esitronic.de
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
download.esitronic.de
  • 13.107.246.45
  • 13.107.213.45
unknown

Threats

PID
Process
Class
Message
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
316
Setup_Bosch_Passthru_v2.30.1(1).tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup_Bosch_Passthru_v2.30.1(1).exe