File name:

veyon-4.8.2.0-win64-setup.exe

Full analysis: https://app.any.run/tasks/02562566-f4a4-414d-a2f9-9cb7839500d4
Verdict: Malicious activity
Analysis date: April 04, 2025, 07:28:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive, 7 sections
MD5:

E2BCBA976B9C23CEA7563148A4E73429

SHA1:

59D11FB19EF9B5CAE50F778CC21988A7B7BB038C

SHA256:

0B8B354E5AB9FBD4EBFC24B489019D25665FA1938EB1518E0462600A755A0EFC

SSDEEP:

98304:tE7QU3C9EbBsjjXwvS7KHrvdNQL3Qe0ez28uKQS1Fmf/o01axX07CjLachPbCaWz:9IpvVbYGnfBoKj8kyPfzEsbe2aQ56l

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-service.exe (PID: 8120)
      • veyon-server.exe (PID: 7768)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
    • The process creates files with name similar to system file names

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
    • Executable content was dropped or overwritten

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • install-interception.exe (PID: 6480)
    • Executes as Windows Service

      • veyon-service.exe (PID: 8120)
      • veyon-service.exe (PID: 7628)
    • Creates a software uninstall entry

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
    • Drops a system driver (possible attempt to evade defenses)

      • install-interception.exe (PID: 6480)
    • Creates or modifies Windows services

      • install-interception.exe (PID: 6480)
    • Creates files in the driver directory

      • install-interception.exe (PID: 6480)
  • INFO

    • Checks supported languages

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-wcli.exe (PID: 7928)
      • veyon-wcli.exe (PID: 8004)
      • veyon-wcli.exe (PID: 8044)
      • veyon-wcli.exe (PID: 8084)
      • veyon-service.exe (PID: 8120)
      • veyon-server.exe (PID: 6620)
      • veyon-configurator.exe (PID: 5156)
      • veyon-worker.exe (PID: 7292)
      • install-interception.exe (PID: 6480)
      • veyon-worker.exe (PID: 5576)
      • veyon-server.exe (PID: 7768)
      • veyon-service.exe (PID: 7628)
    • The sample compiled with english language support

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • install-interception.exe (PID: 6480)
    • Creates files in the program directory

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-configurator.exe (PID: 5156)
    • Create files in a temporary directory

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-wcli.exe (PID: 7928)
      • veyon-worker.exe (PID: 7292)
      • veyon-configurator.exe (PID: 5156)
    • Reads the computer name

      • veyon-4.8.2.0-win64-setup.exe (PID: 7428)
      • veyon-wcli.exe (PID: 7928)
      • veyon-wcli.exe (PID: 8004)
      • veyon-wcli.exe (PID: 8044)
      • veyon-wcli.exe (PID: 8084)
      • veyon-service.exe (PID: 8120)
      • veyon-server.exe (PID: 6620)
      • veyon-worker.exe (PID: 7292)
      • veyon-configurator.exe (PID: 5156)
      • veyon-service.exe (PID: 7628)
      • veyon-server.exe (PID: 7768)
      • veyon-worker.exe (PID: 5576)
    • Reads the machine GUID from the registry

      • veyon-wcli.exe (PID: 7928)
      • veyon-wcli.exe (PID: 8004)
      • veyon-wcli.exe (PID: 8044)
      • veyon-wcli.exe (PID: 8084)
      • veyon-service.exe (PID: 8120)
      • veyon-server.exe (PID: 6620)
      • veyon-worker.exe (PID: 7292)
      • veyon-service.exe (PID: 7628)
      • veyon-server.exe (PID: 7768)
      • veyon-worker.exe (PID: 5576)
      • veyon-configurator.exe (PID: 5156)
    • Checks proxy server information

      • slui.exe (PID: 7608)
    • Reads the software policy settings

      • slui.exe (PID: 7608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:10 19:17:03+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.35
CodeSize: 38400
InitializedDataSize: 54272
UninitializedDataSize: 131072
EntryPoint: 0x46d4
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.8.2.0
ProductVersionNumber: 4.8.2.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Veyon Solutions
FileDescription: Veyon Installer
FileVersion: 4.8.2.0
LegalCopyright: 2004-2023 Veyon Solutions / Tobias Junghans
ProductName: Veyon
ProductVersion: 4.8.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
17
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start veyon-4.8.2.0-win64-setup.exe veyon-wcli.exe no specs veyon-wcli.exe no specs veyon-wcli.exe no specs veyon-wcli.exe no specs veyon-service.exe no specs veyon-server.exe no specs veyon-worker.exe no specs veyon-configurator.exe no specs slui.exe veyon-service.exe no specs install-interception.exe conhost.exe no specs veyon-server.exe no specs veyon-worker.exe no specs rundll32.exe no specs veyon-4.8.2.0-win64-setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5156"C:\Program Files\Veyon\veyon-configurator.exe"C:\Program Files\Veyon\veyon-configurator.exeveyon-4.8.2.0-win64-setup.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
HIGH
Description:
Veyon Configurator
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-configurator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libssp-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exeinstall-interception.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5576"C:\Program Files\Veyon\veyon-worker.exe" {8e997d84-ebb9-430f-8f72-d45d9821963d}C:\Program Files\Veyon\veyon-worker.exeveyon-server.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
MEDIUM
Description:
Veyon
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-worker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libssp-0.dll
c:\program files\veyon\libstdc++-6.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\program files\veyon\qt6gui.dll
6480"C:\Program Files\Veyon\interception\install-interception.exe" /installC:\Program Files\Veyon\interception\install-interception.exe
veyon-service.exe
User:
SYSTEM
Company:
Francisco Lopes
Integrity Level:
SYSTEM
Description:
Interception command line installation tool
Exit code:
0
Version:
1.00 built by: WinDDK
Modules
Images
c:\program files\veyon\interception\install-interception.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6620"C:\Program Files\Veyon\veyon-server.exe" C:\Program Files\Veyon\veyon-server.exeveyon-service.exe
User:
SYSTEM
Company:
Veyon Solutions
Integrity Level:
SYSTEM
Description:
Veyon Server
Exit code:
0
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libssp-0.dll
c:\program files\veyon\libstdc++-6.dll
c:\program files\veyon\qt6core.dll
c:\program files\veyon\qt6gui.dll
c:\windows\system32\advapi32.dll
7292"C:\Program Files\Veyon\veyon-worker.exe" {8e997d84-ebb9-430f-8f72-d45d9821963d}C:\Program Files\Veyon\veyon-worker.exeveyon-server.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
MEDIUM
Description:
Veyon
Exit code:
0
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-worker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libssp-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\veyon\libstdc++-6.dll
7336"C:\Users\admin\AppData\Local\Temp\veyon-4.8.2.0-win64-setup.exe" C:\Users\admin\AppData\Local\Temp\veyon-4.8.2.0-win64-setup.exeexplorer.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
MEDIUM
Description:
Veyon Installer
Exit code:
3221226540
Version:
4.8.2.0
Modules
Images
c:\users\admin\appdata\local\temp\veyon-4.8.2.0-win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7428"C:\Users\admin\AppData\Local\Temp\veyon-4.8.2.0-win64-setup.exe" C:\Users\admin\AppData\Local\Temp\veyon-4.8.2.0-win64-setup.exe
explorer.exe
User:
admin
Company:
Veyon Solutions
Integrity Level:
HIGH
Description:
Veyon Installer
Exit code:
0
Version:
4.8.2.0
Modules
Images
c:\users\admin\appdata\local\temp\veyon-4.8.2.0-win64-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7608C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7628"C:\Program Files\Veyon\veyon-service.exe"C:\Program Files\Veyon\veyon-service.exeservices.exe
User:
SYSTEM
Company:
Veyon Solutions
Integrity Level:
SYSTEM
Description:
Veyon Service
Version:
4.8.2
Modules
Images
c:\program files\veyon\veyon-service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\program files\veyon\libstdc++-6.dll
c:\program files\veyon\qt6core.dll
c:\program files\veyon\libssp-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
Total events
9 384
Read events
9 279
Write events
96
Delete events
9

Modification events

(PID) Process:(7928) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:EventMessageFile
Value:
C:\Program Files\Veyon\veyon-wcli.exe
(PID) Process:(7928) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:TypesSupported
Value:
31
(PID) Process:(8004) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:SoftwareSASGeneration
Value:
1
(PID) Process:(8044) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:EventMessageFile
Value:
C:\Program Files\Veyon\veyon-wcli.exe
(PID) Process:(8044) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:TypesSupported
Value:
31
(PID) Process:(8044) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:SoftwareSASGeneration
Value:
1
(PID) Process:(7428) veyon-4.8.2.0-win64-setup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa
Operation:writeName:ForceGuest
Value:
0
(PID) Process:(8084) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:EventMessageFile
Value:
C:\Program Files\Veyon\veyon-wcli.exe
(PID) Process:(8084) veyon-wcli.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\CLI
Operation:writeName:TypesSupported
Value:
31
(PID) Process:(8120) veyon-service.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\EventLog\Application\Service
Operation:writeName:EventMessageFile
Value:
C:\Program Files\Veyon\veyon-service.exe
Executable files
66
Suspicious files
77
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\veyon-server.exeexecutable
MD5:A45C863FDC92E11C1D9877B0797B1FA6
SHA256:BF64A896B07D1B5B37A82379D09BC71510968066F4C750C99727B935D00960E4
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6Core.dllexecutable
MD5:B1A5AE934687C91F5A341E958314F093
SHA256:8A9E74CF0617B97B093CFB968B8D85CC7CF6F6BCABE1C7CDE55C81138FA68972
7428veyon-4.8.2.0-win64-setup.exeC:\Users\admin\AppData\Local\Temp\nsoC008.tmp\modern-header.bmpbinary
MD5:CA505EE1B37AE9EA906064497276B9D4
SHA256:479E358E48AEAD66F293DA8556FD3E66D6B14BF94A8C1B5C778D6C8ED4B616B1
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6Concurrent.dllexecutable
MD5:B0F6694C6585A0662DE25FF4CC1303EF
SHA256:7328A4F154A43977CC0D6D2AE7E7DF1FBD24CA024D71C0924C0C354C552F45DB
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\veyon-configurator.exeexecutable
MD5:54106F66783AC51DB58EB28B87EE5F93
SHA256:36108E48A94DAA867B528E2B401183C8A13D851BE0B8EB42D54720E03AC45E07
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6HttpServer.dllexecutable
MD5:FDF926E0D0E616C102AF1EDDDEDCDCC4
SHA256:D9AC0B6C422A369B71D6D25C42D0515B22579BD663650185EC9855BFC6895C0F
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6Widgets.dllexecutable
MD5:A1B8D75B1A9850526BF86F49A7371102
SHA256:C23B7E5AB0EACDBAC4AF9B2F2F9FAB54560729620027668849683100EBEE4CF3
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6Core5Compat.dllexecutable
MD5:FF6FDCDBB6BC87A293D275234F634067
SHA256:20992F2DEBCEA9A7855D2B296C4762F88D3A75A206A5052C8FE941C8AA68AD1E
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6Gui.dllexecutable
MD5:15E528D65FEC191EFEDC44B640DD684F
SHA256:F58A6DCBD0A6ACB0B388C24ABFAA9787BD23B45603953ABE362F340E0496BE3E
7428veyon-4.8.2.0-win64-setup.exeC:\Program Files\Veyon\Qt6Network.dllexecutable
MD5:C97EFE7D252751E328627AB0FB517CA3
SHA256:5509235F6A6ED014D8566709BDAB8B035C6A07FE7CD2BA1D6DEEFEB1988D5AB5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
38
DNS requests
20
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
3216
svchost.exe
20.10.31.115:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5552
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5552
SIHClient.exe
52.165.164.15:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7232
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 20.10.31.115
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.71
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.128
  • 40.126.31.3
  • 20.190.159.64
  • 40.126.31.131
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
  • 2a01:111:f100:9001::1761:914d
whitelisted
15.164.165.52.in-addr.arpa
unknown
d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

No threats detected
No debug info