File name:

veyon-4.8.2.0-win64-setup.exe

Full analysis: https://app.any.run/tasks/02562566-f4a4-414d-a2f9-9cb7839500d4
Verdict: Malicious activity
Analysis date: April 04, 2025, 07:28:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive, 7 sections
MD5:

E2BCBA976B9C23CEA7563148A4E73429

SHA1:

59D11FB19EF9B5CAE50F778CC21988A7B7BB038C

SHA256:

0B8B354E5AB9FBD4EBFC24B489019D25665FA1938EB1518E0462600A755A0EFC

SSDEEP:

98304:tE7QU3C9EbBsjjXwvS7KHrvdNQL3Qe0ez28uKQS1Fmf/o01axX07CjLachPbCaWz:9IpvVbYGnfBoKj8kyPfzEsbe2aQ56l

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
    • Executable content was dropped or overwritten

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • install-interception.exe (PID: 6480)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
    • There is functionality for taking screenshot (YARA)

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-service.exe (PID: 8120)
      • veyon-server.exe (PID: 7768)
    • Executes as Windows Service

      • veyon-service.exe (PID: 8120)
      • veyon-service.exe (PID: 7628)
    • Creates a software uninstall entry

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
    • Creates or modifies Windows services

      • install-interception.exe (PID: 6480)
    • Creates files in the driver directory

      • install-interception.exe (PID: 6480)
    • Drops a system driver (possible attempt to evade defenses)

      • install-interception.exe (PID: 6480)
  • INFO

    • Reads the computer name

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-wcli.exe (PID: 7928)
      • veyon-wcli.exe (PID: 8004)
      • veyon-wcli.exe (PID: 8044)
      • veyon-wcli.exe (PID: 8084)
      • veyon-service.exe (PID: 8120)
      • veyon-server.exe (PID: 6620)
      • veyon-worker.exe (PID: 7292)
      • veyon-configurator.exe (PID: 5156)
      • veyon-service.exe (PID: 7628)
      • veyon-server.exe (PID: 7768)
      • veyon-worker.exe (PID: 5576)
    • Checks supported languages

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-wcli.exe (PID: 7928)
      • veyon-wcli.exe (PID: 8004)
      • veyon-wcli.exe (PID: 8044)
      • veyon-wcli.exe (PID: 8084)
      • veyon-server.exe (PID: 6620)
      • veyon-worker.exe (PID: 7292)
      • veyon-configurator.exe (PID: 5156)
      • veyon-service.exe (PID: 8120)
      • veyon-worker.exe (PID: 5576)
      • install-interception.exe (PID: 6480)
      • veyon-server.exe (PID: 7768)
      • veyon-service.exe (PID: 7628)
    • The sample compiled with english language support

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • install-interception.exe (PID: 6480)
    • Create files in a temporary directory

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-wcli.exe (PID: 7928)
      • veyon-worker.exe (PID: 7292)
      • veyon-configurator.exe (PID: 5156)
    • Creates files in the program directory

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-configurator.exe (PID: 5156)
    • Reads the machine GUID from the registry

      • veyon-wcli.exe (PID: 7928)
      • veyon-wcli.exe (PID: 8004)
      • veyon-wcli.exe (PID: 8044)
      • veyon-wcli.exe (PID: 8084)
      • veyon-service.exe (PID: 8120)
      • veyon-server.exe (PID: 6620)
      • veyon-worker.exe (PID: 7292)
      • veyon-configurator.exe (PID: 5156)
      • veyon-service.exe (PID: 7628)
      • veyon-server.exe (PID: 7768)
      • veyon-worker.exe (PID: 5576)
    • Checks proxy server information

      • slui.exe (PID: 7608)
    • Reads the software policy settings

      • slui.exe (PID: 7608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:10 19:17:03+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.35
CodeSize: 38400
InitializedDataSize: 54272
UninitializedDataSize: 131072
EntryPoint: 0x46d4
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.8.2.0
ProductVersionNumber: 4.8.2.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Veyon Solutions
FileDescription: Veyon Installer
FileVersion: 4.8.2.0
LegalCopyright: 2004-2023 Veyon Solutions / Tobias Junghans
ProductName: Veyon
ProductVersion: 4.8.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
17
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start veyon-4.8.2.0-win64-setup.exe veyon-wcli.exe no specs veyon-wcli.exe no specs veyon-wcli.exe no specs veyon-wcli.exe no specs veyon-service.exe no specs veyon-server.exe no specs veyon-worker.exe no specs veyon-configurator.exe no specs slui.exe veyon-service.exe no specs install-interception.exe conhost.exe no specs veyon-server.exe no specs veyon-worker.exe no specs rundll32.exe no specs veyon-4.8.2.0-win64-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5156"C:\Program Files\Veyon\veyon-configurator.exe"C:\Program Files\Veyon\veyon-configurator.exeveyon-4.8.2.0-win64-setup.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
HIGH
Description:
Veyon Configurator
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-configurator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libssp-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeinstall-interception.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5576"C:\Program Files\Veyon\veyon-worker.exe" {8e997d84-ebb9-430f-8f72-d45d9821963d}C:\Program Files\Veyon\veyon-worker.exeveyon-server.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
MEDIUM
Description:
Veyon
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-worker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libssp-0.dll
c:\program files\veyon\libstdc++-6.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\program files\veyon\qt6gui.dll
6480"C:\Program Files\Veyon\interception\install-interception.exe" /installC:\Program Files\Veyon\interception\install-interception.exe
veyon-service.exe
User:
SYSTEM
Company:
Francisco Lopes
Integrity Level:
SYSTEM
Description:
Interception command line installation tool
Exit code:
0
Version:
1.00 built by: WinDDK
Modules
Images
c:\program files\veyon\interception\install-interception.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6620"C:\Program Files\Veyon\veyon-server.exe" C:\Program Files\Veyon\veyon-server.exeveyon-service.exe
User:
SYSTEM
Company:
Veyon Solutions
Integrity Level:
SYSTEM
Description:
Veyon Server
Exit code:
0
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libssp-0.dll
c:\program files\veyon\libstdc++-6.dll
c:\program files\veyon\qt6core.dll
c:\program files\veyon\qt6gui.dll
c:\windows\system32\advapi32.dll
7292"C:\Program Files\Veyon\veyon-worker.exe" {8e997d84-ebb9-430f-8f72-d45d9821963d}C:\Program Files\Veyon\veyon-worker.exeveyon-server.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
MEDIUM
Description:
Veyon
Exit code:
0
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-worker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libssp-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\veyon\libstdc++-6.dll
7336"C:\Users\admin\AppData\Local\Temp\veyon-4.8.2.0-win64-setup.exe" C:\Users\admin\AppData\Local\Temp\veyon-4.8.2.0-win64-setup.exeexplorer.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
MEDIUM
Description:
Veyon Installer
Exit code:
3221226540
Version:
4.8.2.0
Modules
Images
c:\users\admin\appdata\local\temp\veyon-4.8.2.0-win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7428"C:\Users\admin\AppData\Local\Temp\veyon-4.8.2.0-win64-setup.exe" C:\Users\admin\AppData\Local\Temp\veyon-4.8.2.0-win64-setup.exe
explorer.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
HIGH
Description:
Veyon Installer
Exit code:
0
Version:
4.8.2.0
Modules
Images
c:\users\admin\appdata\local\temp\veyon-4.8.2.0-win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7608C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7628"C:\Program Files\Veyon\veyon-service.exe"C:\Program Files\Veyon\veyon-service.exeservices.exe
User:
SYSTEM
Company:
Veyon Solutions
Integrity Level:
SYSTEM
Description:
Veyon Service
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libstdc++-6.dll
c:\program files\veyon\qt6core.dll
c:\program files\veyon\libssp-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
Total events
9 384
Read events
9 279
Write events
96
Delete events
9

Modification events

(PID) Process:(7928) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:EventMessageFile
Value:
C:\Program Files\Veyon\veyon-wcli.exe
(PID) Process:(7928) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:TypesSupported
Value:
31
(PID) Process:(8004) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:SoftwareSASGeneration
Value:
1
(PID) Process:(8044) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:EventMessageFile
Value:
C:\Program Files\Veyon\veyon-wcli.exe
(PID) Process:(8044) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:TypesSupported
Value:
31
(PID) Process:(8044) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:SoftwareSASGeneration
Value:
1
(PID) Process:(7428) veyon-4.8.2.0-win64-setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
Operation:writeName:ForceGuest
Value:
0
(PID) Process:(8084) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:EventMessageFile
Value:
C:\Program Files\Veyon\veyon-wcli.exe
(PID) Process:(8084) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:TypesSupported
Value:
31
(PID) Process:(8120) veyon-service.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Service
Operation:writeName:EventMessageFile
Value:
C:\Program Files\Veyon\veyon-service.exe
Executable files
66
Suspicious files
77
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7428veyon-4.8.2.0-win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsoC008.tmp\modern-header.bmpbinary
MD5:CA505EE1B37AE9EA906064497276B9D4
SHA256:479E358E48AEAD66F293DA8556FD3E66D6B14BF94A8C1B5C778D6C8ED4B616B1
7428veyon-4.8.2.0-win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsoC008.tmp\modern-wizard.bmpbinary
MD5:A8D81A837E19534E2663FB02A1355BEA
SHA256:2BAD887CD8FA8206FED401C3B1CDEE18AC9A65CFC9F982A95577791226836660
7428veyon-4.8.2.0-win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsoC008.tmp\UserInfo.dllexecutable
MD5:31285BAB04EBB2E7184E1622130110CE
SHA256:85F435E4E4AC4D917FA178610014C990BD48D366BD54CB897EAB10B035CD9D1D
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6Widgets.dllexecutable
MD5:A1B8D75B1A9850526BF86F49A7371102
SHA256:C23B7E5AB0EACDBAC4AF9B2F2F9FAB54560729620027668849683100EBEE4CF3
7428veyon-4.8.2.0-win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsoC008.tmp\System.dllexecutable
MD5:342087BBFDA77D9E4D3C5319E4E6F912
SHA256:AE4A96380BADBBE822DB9299613606328F559EBFD08FDF387535C1639A031478
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\veyon-service.exeexecutable
MD5:3AD654073FAE8AA457D8B5C8FBCD8926
SHA256:7410D6CB6EB2F2C526F23AF40989FDA57966D205F88E9E2CB397834DB64952F0
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\veyon-cli.exeexecutable
MD5:2B84BAC072A16B9C2EF6A3A8DC370D8C
SHA256:CE85AC41AEB7E2169F2DB231E16C139FD8A09D04DB227822B7DF68925BB61B50
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\veyon-wcli.exeexecutable
MD5:F12373F3E114399F24533B2B1A875458
SHA256:F222608EC7EECA36B4DA868B16055F851D0E30BB0A08E7EDF3ADF1302B5ED668
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\veyon-worker.exeexecutable
MD5:ECFD12BACE4D5252FB2D517F65E258BB
SHA256:8CDCB9BBAD87217D6381BF5A3EC668FAACF3AC06F8274EBC5236E40C8C068A27
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6Core5Compat.dllexecutable
MD5:FF6FDCDBB6BC87A293D275234F634067
SHA256:20992F2DEBCEA9A7855D2B296C4762F88D3A75A206A5052C8FE941C8AA68AD1E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
38
DNS requests
20
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
20.10.31.115:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5552
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5552
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7232
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 20.10.31.115
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.128
  • 40.126.31.3
  • 20.190.159.64
  • 40.126.31.131
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2a01:111:f100:9001::1761:914d
whitelisted
15.164.165.52.in-addr.arpa
unknown
d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

No threats detected
No debug info