URL:

http://d.updater.3u.com/3utools/download/3uTools_v2.38_Setup.exe

Full analysis: https://app.any.run/tasks/de6cc320-36c8-4678-8cf0-1cbbab4188bd
Verdict: Malicious activity
Analysis date: February 10, 2020, 14:21:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

32683153D366041D7C3B4B0CBE5CAF65

SHA1:

82D290DDF42F3DAC658979198FDF5D413955A8D7

SHA256:

0DA5B53FBDF7C6406F75027F5C8F18D439963C8333622AD763C5DD9CF6424BBA

SSDEEP:

3:N1KaLABQQtbJN8LWDKJ9jlA:CaLkQk8ikjlA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • HeicViewer.exe (PID: 1156)
      • 7z.exe (PID: 3368)
      • 3uTools.exe (PID: 3972)

    • Application was dropped or rewritten from another process

      • 3uTools.exe (PID: 3972)
      • HeicViewer.exe (PID: 1156)
      • 7z.exe (PID: 3368)

    • Detects Cygwin installation

      • 3uTools_v2.38_Setup.exe (PID: 2764)

    • Changes settings of System certificates

      • msiexec.exe (PID: 1712)

  • SUSPICIOUS

    • Creates files in the program directory

      • 3uTools.exe (PID: 3972)
      • 3uTools_v2.38_Setup.exe (PID: 2764)

    • Modifies the open verb of a shell class

      • HeicViewer.exe (PID: 1156)
      • 3uTools.exe (PID: 3972)

    • Starts SC.EXE for service management

      • 3uTools.exe (PID: 3972)

    • Executable content was dropped or overwritten

      • 7z.exe (PID: 3368)
      • 3uTools_v2.38_Setup.exe (PID: 2764)
      • msiexec.exe (PID: 1712)

    • Creates a software uninstall entry

      • 3uTools_v2.38_Setup.exe (PID: 2764)

    • Adds / modifies Windows certificates

      • msiexec.exe (PID: 1712)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3620)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3620)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3620)
      • iexplore.exe (PID: 2776)

    • Application launched itself

      • iexplore.exe (PID: 3620)
      • msiexec.exe (PID: 1712)

    • Reads settings of System Certificates

      • msiexec.exe (PID: 1712)
      • iexplore.exe (PID: 3620)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3536)

    • Creates files in the user directory

      • iexplore.exe (PID: 3620)

    • Dropped object may contain Bitcoin addresses

      • 3uTools_v2.38_Setup.exe (PID: 2764)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3620)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
55
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start iexplore.exe iexplore.exe 3utools_v2.38_setup.exe no specs 3utools_v2.38_setup.exe 3utools.exe heicviewer.exe no specs sc.exe no specs sc.exe no specs 7z.exe msiexec.exe msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
308sc start DsmSvcC:\Windows\system32\sc.exe—3uTools.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1156HeicViewer.exe /regC:\Program Files\3uTools\HeicViewer.exe—3uTools.exe
User:
admin
Integrity Level:
HIGH
Description:
HEIC查看器
Exit code:
0
Modules
Images
c:\program files\3utools\heicviewer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\3utools\qt5core.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1712C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2084"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\3uTools_v2.38_Setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\3uTools_v2.38_Setup.exe—iexplore.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\3utools_v2.38_setup.exe
c:\systemroot\system32\ntdll.dll
2764"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\3uTools_v2.38_Setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\3uTools_v2.38_Setup.exe
iexplore.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\3utools_v2.38_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2776"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3620 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2920sc start DeviceInstallC:\Windows\system32\sc.exe—3uTools.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3368"C:\Program Files\3uTools\files\patchtools\7z-32\7z.exe" x "C:\3uTools\Other\iTunes(12.10.4.2).exe" -aoa -o"C:\Users\admin\AppData\Local\Temp\3uTools\iTunes(12.10.4.2)"C:\Program Files\3uTools\files\patchtools\7z-32\7z.exe
3uTools.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Console
Exit code:
0
Version:
9.30 alpha
Modules
Images
c:\program files\3utools\files\patchtools\7z-32\7z.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3536C:\Windows\system32\MsiExec.exe -Embedding 5EAD85DF819F430EE21BF1CF1276BADCC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3620"C:\Program Files\Internet Explorer\iexplore.exe" http://d.updater.3u.com/3utools/download/3uTools_v2.38_Setup.exeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
11 058
Read events
1 954
Write events
6 702
Delete events
2 402

Modification events

(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
2282777678
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30793757
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3620) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
205
Suspicious files
137
Text files
238
Unknown types
37

Dropped files

PID
Process
Filename
Type
2776iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\3uTools_v2.38_Setup[1].exe —
MD5:—
SHA256:—
2776iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\3uTools_v2.38_Setup.exe.7fkn8kj.partial —
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFC26C507743DFAF15.TMP —
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\3uTools_v2.38_Setup.exe.7fkn8kj.partial:Zone.Identifier —
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\3uTools_v2.38_Setup.exe —
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Temp\CabC298.tmp —
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Temp\TarC299.tmp —
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verC2B9.tmp —
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\BSTVR2RZ.txt —
MD5:—
SHA256:—
3620iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\W6Z0KQNJ.txt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
194
TCP/UDP connections
45
DNS requests
18
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3972
3uTools.exe
GET
302
163.171.132.119:80
http://url.3u.com/vIJJbqaa
US
—
—
suspicious
3972
3uTools.exe
GET
302
163.171.132.119:80
http://url.3u.com/Z3QJvuaa?pc_vs=2.38.010
US
—
—
suspicious
3972
3uTools.exe
GET
302
163.171.132.119:80
http://url.3u.com/ZZRf2eaa
US
—
—
suspicious
3972
3uTools.exe
GET
302
163.171.132.119:80
http://url.3u.com/7Rn6Jvaa
US
—
—
suspicious
3972
3uTools.exe
GET
302
163.171.132.119:80
http://url.3u.com/bMJjMraa?pc_vs=2.38.010
US
—
—
suspicious
3972
3uTools.exe
GET
302
163.171.132.119:80
http://url.3u.com/FnUFn2aa
US
—
—
suspicious
3972
3uTools.exe
GET
302
163.171.132.119:80
http://url.3u.com/update?v=2.38.010
US
—
—
suspicious
3972
3uTools.exe
GET
200
163.171.132.115:80
http://d.updater.3u.com/3utools/3utools/Config_2.38.010.xml
US
xml
142 Kb
malicious
3972
3uTools.exe
GET
200
163.171.132.115:80
http://d.updater.3u.com/3utools/configs/jbipa_all/jb20200202ub.xml
US
xml
24.9 Kb
malicious
3620
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3620
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3620
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
3620
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3972
3uTools.exe
163.171.132.119:80
url.3u.com
—
US
malicious
3972
3uTools.exe
163.171.132.115:80
d.updater.3u.com
—
US
malicious
3972
3uTools.exe
17.253.55.208:80
updates-http.cdn-apple.com
Apple Inc.
US
suspicious
2776
iexplore.exe
163.171.132.18:80
d.updater.3u.com
—
US
malicious

DNS requests

Domain
IP
Reputation
d.updater.3u.com
  • 163.171.132.18
  • 163.171.132.115
malicious
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
url.3u.com
  • 163.171.132.119
suspicious
ios.pclog.3u.com
  • 163.171.132.119
malicious
www.3u.com
  • 163.171.132.119
malicious
updates-http.cdn-apple.com
  • 17.253.55.208
  • 17.253.57.210
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2776
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
3972
3uTools.exe
Potentially Bad Traffic
ET INFO Double User-Agent (User-Agent User-Agent)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://d.updater.3u.com/3utools/download/3uTools_v2.38_Setup.exe