URL:

https://download.cdn.viber.com/desktop/windows/ViberSetup.exe

Full analysis: https://app.any.run/tasks/2fee5961-e03b-4c3d-99e5-47b1e71a668b
Verdict: Malicious activity
Analysis date: March 10, 2024, 16:17:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

6527E2DE4447AF13B8E47BAE24C10727

SHA1:

85000708389B92AB9C78D45DFDA3EC9665304EE6

SHA256:

058CC7CA604060639D6E12DFAFBBE5289D0BB40FB4887A3A0E9484749AA31189

SSDEEP:

3:N8SElMLAg8W1VKSMq6lA:2SKMLj82f6lA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ViberSetup.exe (PID: 2420)
      • ViberSetup.exe (PID: 2672)

    • Changes the autorun value in the registry

      • ViberSetup.exe (PID: 2672)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • ViberSetup.exe (PID: 2672)

    • The process creates files with name similar to system file names

      • ViberSetup.exe (PID: 2672)

    • Executable content was dropped or overwritten

      • ViberSetup.exe (PID: 2420)
      • ViberSetup.exe (PID: 2672)

    • Searches for installed software

      • ViberSetup.exe (PID: 2672)

    • Creates a software uninstall entry

      • ViberSetup.exe (PID: 2672)

    • Reads the Internet Settings

      • ViberSetup.exe (PID: 2672)

  • INFO

    • Reads the computer name

      • ViberSetup.exe (PID: 2672)

    • Checks supported languages

      • ViberSetup.exe (PID: 2672)
      • ViberSetup.exe (PID: 2420)

    • Reads the machine GUID from the registry

      • ViberSetup.exe (PID: 2672)

    • Application launched itself

      • iexplore.exe (PID: 3700)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3700)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2044)

    • Create files in a temporary directory

      • ViberSetup.exe (PID: 2672)
      • ViberSetup.exe (PID: 2420)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2044)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3700)

    • Reads Environment values

      • ViberSetup.exe (PID: 2672)

    • Creates files in the program directory

      • ViberSetup.exe (PID: 2672)

    • Creates files or folders in the user directory

      • ViberSetup.exe (PID: 2672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe vibersetup.exe vibersetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
3700"C:\Program Files\Internet Explorer\iexplore.exe" "https://download.cdn.viber.com/desktop/windows/ViberSetup.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2044"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3700 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2420"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ViberSetup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ViberSetup.exe
iexplore.exe
User:
admin
Company:
2010-2024 Viber Media S.a.r.l
Integrity Level:
MEDIUM
Description:
Viber
Exit code:
0
Version:
22.2.0.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\vibersetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2672"C:\Users\admin\AppData\Local\Temp\{71CA8D1C-B95D-4B1C-8BC0-AF59EB758397}\.cr\ViberSetup.exe" -burn.clean.room="C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ViberSetup.exe" -burn.filehandle.attached=152 -burn.filehandle.self=160 C:\Users\admin\AppData\Local\Temp\{71CA8D1C-B95D-4B1C-8BC0-AF59EB758397}\.cr\ViberSetup.exe
ViberSetup.exe
User:
admin
Company:
2010-2024 Viber Media S.a.r.l
Integrity Level:
MEDIUM
Description:
Viber
Exit code:
0
Version:
22.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{71ca8d1c-b95d-4b1c-8bc0-af59eb758397}\.cr\vibersetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
26 220
Read events
26 063
Write events
125
Delete events
32

Modification events

(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31093510
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31093510
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
133
Suspicious files
21
Text files
46
Unknown types
7

Dropped files

PID
Process
Filename
Type
2044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:D5BEC898862ED5158F9BAF7CE8E91FA6
SHA256:EDC1986A71610798CD0D4752FD3DB34FEE7AE73E61C042E7A4473B1AF5060DA4
2044iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ViberSetup[1].exeexecutable
MD5:3678F8E12BAFD1C7CAC566DBB14BE5B9
SHA256:175D0E9AD4861FC8333F65BCC07C8070BAF8D7DAA7A0AD97542826A2EF624C22
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
3700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177binary
MD5:BA0C76F6C8F44CA4F93B09DB0F512404
SHA256:B6AEF1F155079AD62ABEC3CA6958F1405AEC14A07E2CB164EF3404D695F75663
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver6FAD.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
2044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:6C08E717BB6640A59AFF6022CF27C9AD
SHA256:30D7CF046537C3041076BC4E82B14D8173C7D9155E560DFEBA5CBEF201E253FF
3700iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\5HOMSU9G.txttext
MD5:6A6F4EB4C5ADBC65B0285E0199F7CDAE
SHA256:BEF08930C40A6DC47F1083371D34227428DA6223BC2D533CFF5D5CEBD8530E83
3700iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\B4IJF2UR.txttext
MD5:7116D7937415E3450581AA3FA9F02D41
SHA256:32B2096E328FA521D7BC2B7B40E1F3B577F2ADAD0D3927E192059A7898D15FF6
3700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:E2D28A038C9261C0989096853D6B4908
SHA256:7DF8CEC15CC865F3AE956A434A48979283B4F7646F4B74EAF1E2AABD6B47A742
2044iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:21DE229DBB59E3F1E49C5BBAB5701A2F
SHA256:4FF00880925249E1D294D334C6608ABA346A847482550F70C605A07D30C01D71
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2044
iexplore.exe
GET
200
108.138.2.173:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
—
2044
iexplore.exe
GET
304
2.18.121.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
—
2044
iexplore.exe
GET
304
2.18.121.71:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
—
2044
iexplore.exe
GET
200
18.245.39.64:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
unknown
binary
1.37 Kb
—
3700
iexplore.exe
GET
304
2.18.121.71:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
—
2044
iexplore.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
—
3700
iexplore.exe
GET
304
2.18.121.71:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b23edf5cfbe16fd7
unknown
—
—
—
1080
svchost.exe
GET
200
2.18.121.71:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1b8fee253118cbef
unknown
compressed
67.5 Kb
—
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA177el9ggmWelJjG4vdGL0%3D
unknown
binary
471 b
—
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
2044
iexplore.exe
18.66.122.96:443
download.cdn.viber.com
AMAZON-02
US
unknown
2044
iexplore.exe
2.18.121.71:80
ctldl.windowsupdate.com
AKAMAI-AS
FR
unknown
2044
iexplore.exe
2.18.121.202:80
ctldl.windowsupdate.com
AKAMAI-AS
FR
unknown
2044
iexplore.exe
108.138.2.173:80
o.ss2.us
AMAZON-02
US
unknown
2044
iexplore.exe
18.245.39.64:80
ocsp.rootg2.amazontrust.com
—
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3700
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
unknown

DNS requests

Domain
IP
Reputation
download.cdn.viber.com
  • 18.66.122.96
  • 18.66.122.59
  • 18.66.122.76
  • 18.66.122.119
unknown
ctldl.windowsupdate.com
  • 2.18.121.202
  • 2.18.121.71
unknown
o.ss2.us
  • 108.138.2.173
  • 108.138.2.107
  • 108.138.2.10
  • 108.138.2.195
unknown
ocsp.rootg2.amazontrust.com
  • 18.245.39.64
unknown
ocsp.rootca1.amazontrust.com
  • 18.245.39.64
unknown
iecvlist.microsoft.com
  • 152.199.19.161
unknown
r20swj13mr.microsoft.com
  • 152.199.19.161
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
ieonline.microsoft.com
  • 204.79.197.200
unknown
go.microsoft.com
  • 2.22.37.133
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.cdn.viber.com/desktop/windows/ViberSetup.exe