URL:

https://github.com/nefarius/ScpToolkit/releases/download/v1.6.238.16010/ScpToolkit_Setup.exe

Full analysis: https://app.any.run/tasks/fb460cc1-7b15-4efc-9371-269089075065
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 31, 2020, 22:33:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

05F1041E02C76D924545991B62138D77

SHA1:

0C49213851CDB78A9110A1923DF459379B47B530

SHA256:

0F969830CF461E5488AA466B3B3A9B2F668F854ECCDD1A455790CBA16F851741

SSDEEP:

3:N8tEd7m8WtGbRAM2hrkCmmdWqt0AMgRQaA:2uQN0pOrsqWqt0pgRlA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ScpToolkit_Setup.exe (PID: 304)
      • vcredist_x86.exe (PID: 2688)
      • vcredist_x86.exe (PID: 3728)
      • Setup.exe (PID: 4072)
      • ScpToolkit_Setup.exe (PID: 2608)
      • ScpUpdater.exe (PID: 3340)
      • ScpTrayApp.exe (PID: 2488)
      • ScpSettings.exe (PID: 3316)
      • ScpDriverInstaller.exe (PID: 604)
      • ScpDriverInstaller.exe (PID: 3884)
      • ScpService.exe (PID: 608)

    • Loads the Task Scheduler DLL interface

      • ScpToolkit_Setup.exe (PID: 304)

    • Changes the autorun value in the registry

      • ScpToolkit_Setup.exe (PID: 304)

    • Downloads executable files from the Internet

      • ScpToolkit_Setup.exe (PID: 304)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 4072)
      • ScpTrayApp.exe (PID: 2488)
      • mscorsvw.exe (PID: 2192)
      • mscorsvw.exe (PID: 2760)
      • mscorsvw.exe (PID: 3780)
      • mscorsvw.exe (PID: 3692)
      • mscorsvw.exe (PID: 1712)
      • mscorsvw.exe (PID: 2640)
      • mscorsvw.exe (PID: 3892)
      • mscorsvw.exe (PID: 2392)
      • mscorsvw.exe (PID: 3852)
      • mscorsvw.exe (PID: 2888)
      • mscorsvw.exe (PID: 3708)
      • mscorsvw.exe (PID: 2724)
      • mscorsvw.exe (PID: 536)
      • mscorsvw.exe (PID: 3160)
      • mscorsvw.exe (PID: 3800)
      • mscorsvw.exe (PID: 3860)
      • mscorsvw.exe (PID: 3332)
      • mscorsvw.exe (PID: 3732)
      • mscorsvw.exe (PID: 3480)
      • mscorsvw.exe (PID: 3464)
      • ScpSettings.exe (PID: 3316)
      • ScpDriverInstaller.exe (PID: 604)
      • ScpService.exe (PID: 608)

    • Loads the Task Scheduler COM API

      • MsiExec.exe (PID: 3488)
      • ngen.exe (PID: 1888)

    • Writes to a start menu file

      • msiexec.exe (PID: 912)

    • Changes settings of System certificates

      • Setup.exe (PID: 4072)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • ScpToolkit_Setup.exe (PID: 304)

    • Executable content was dropped or overwritten

      • ScpToolkit_Setup.exe (PID: 304)
      • vcredist_x86.exe (PID: 2688)
      • iexplore.exe (PID: 3180)
      • msiexec.exe (PID: 2976)
      • msiexec.exe (PID: 912)
      • mscorsvw.exe (PID: 2192)
      • mscorsvw.exe (PID: 3780)
      • mscorsvw.exe (PID: 3892)
      • mscorsvw.exe (PID: 1712)
      • mscorsvw.exe (PID: 2640)
      • mscorsvw.exe (PID: 3692)
      • mscorsvw.exe (PID: 2392)
      • mscorsvw.exe (PID: 2724)
      • mscorsvw.exe (PID: 3852)
      • mscorsvw.exe (PID: 2888)
      • mscorsvw.exe (PID: 3708)
      • mscorsvw.exe (PID: 536)
      • mscorsvw.exe (PID: 3160)
      • mscorsvw.exe (PID: 3800)
      • mscorsvw.exe (PID: 3860)
      • mscorsvw.exe (PID: 3480)
      • mscorsvw.exe (PID: 3732)
      • mscorsvw.exe (PID: 3332)
      • mscorsvw.exe (PID: 3464)
      • ScpDriverInstaller.exe (PID: 604)
      • DrvInst.exe (PID: 1232)
      • DrvInst.exe (PID: 3524)
      • DrvInst.exe (PID: 3808)

    • Removes files from Windows directory

      • ScpToolkit_Setup.exe (PID: 304)
      • mscorsvw.exe (PID: 2192)
      • mscorsvw.exe (PID: 3892)
      • mscorsvw.exe (PID: 3692)
      • mscorsvw.exe (PID: 1712)
      • mscorsvw.exe (PID: 2640)
      • mscorsvw.exe (PID: 3780)
      • mscorsvw.exe (PID: 2724)
      • mscorsvw.exe (PID: 3852)
      • mscorsvw.exe (PID: 2888)
      • mscorsvw.exe (PID: 2392)
      • mscorsvw.exe (PID: 3708)
      • mscorsvw.exe (PID: 536)
      • mscorsvw.exe (PID: 3800)
      • mscorsvw.exe (PID: 3860)
      • mscorsvw.exe (PID: 3480)
      • mscorsvw.exe (PID: 3732)
      • mscorsvw.exe (PID: 3332)
      • mscorsvw.exe (PID: 3464)
      • DrvInst.exe (PID: 1232)
      • DrvInst.exe (PID: 3808)
      • DrvInst.exe (PID: 3524)
      • mscorsvw.exe (PID: 3160)

    • Reads Environment values

      • ScpToolkit_Setup.exe (PID: 304)
      • ScpToolkit_Setup.exe (PID: 2608)
      • MsiExec.exe (PID: 4012)

    • Creates files in the user directory

      • ScpToolkit_Setup.exe (PID: 304)
      • powershell.exe (PID: 2544)

    • Creates files in the Windows directory

      • ScpToolkit_Setup.exe (PID: 304)
      • msiexec.exe (PID: 2976)
      • ngen.exe (PID: 1888)
      • mscorsvw.exe (PID: 2192)
      • mscorsvw.exe (PID: 3780)
      • mscorsvw.exe (PID: 3692)
      • mscorsvw.exe (PID: 1712)
      • mscorsvw.exe (PID: 2640)
      • mscorsvw.exe (PID: 3892)
      • mscorsvw.exe (PID: 2724)
      • mscorsvw.exe (PID: 2888)
      • mscorsvw.exe (PID: 2392)
      • mscorsvw.exe (PID: 3852)
      • mscorsvw.exe (PID: 3708)
      • mscorsvw.exe (PID: 536)
      • mscorsvw.exe (PID: 3160)
      • mscorsvw.exe (PID: 3800)
      • mscorsvw.exe (PID: 3860)
      • mscorsvw.exe (PID: 3332)
      • mscorsvw.exe (PID: 3732)
      • mscorsvw.exe (PID: 3480)
      • mscorsvw.exe (PID: 3464)
      • ScpDriverInstaller.exe (PID: 604)
      • DrvInst.exe (PID: 1232)
      • DrvInst.exe (PID: 3808)
      • DrvInst.exe (PID: 3524)

    • Reads internet explorer settings

      • ScpToolkit_Setup.exe (PID: 304)

    • Executed as Windows Service

      • vssvc.exe (PID: 3148)
      • ScpService.exe (PID: 608)

    • Application launched itself

      • ScpToolkit_Setup.exe (PID: 304)
      • cmd.exe (PID: 2132)
      • cmd.exe (PID: 3136)

    • Executes PowerShell scripts

      • MsiExec.exe (PID: 4012)

    • Starts CMD.EXE for commands execution

      • ScpToolkit_Setup.exe (PID: 304)
      • cmd.exe (PID: 3136)
      • cmd.exe (PID: 2132)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3136)
      • cmd.exe (PID: 2132)

    • Adds / modifies Windows certificates

      • Setup.exe (PID: 4072)

    • Executed via COM

      • DrvInst.exe (PID: 3524)
      • DrvInst.exe (PID: 1232)
      • DrvInst.exe (PID: 3808)

    • Creates files in the program directory

      • ScpDriverInstaller.exe (PID: 604)
      • ScpService.exe (PID: 608)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 3524)
      • DrvInst.exe (PID: 1232)
      • DrvInst.exe (PID: 3808)

    • Uses RUNDLL32.EXE to load library

      • DrvInst.exe (PID: 3524)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3180)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3180)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3180)
      • iexplore.exe (PID: 2756)

    • Creates files in the user directory

      • iexplore.exe (PID: 2756)
      • iexplore.exe (PID: 3180)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2976)
      • msiexec.exe (PID: 912)

    • Reads settings of System Certificates

      • Setup.exe (PID: 4072)
      • iexplore.exe (PID: 3180)
      • iexplore.exe (PID: 2756)
      • DrvInst.exe (PID: 3524)
      • ScpDriverInstaller.exe (PID: 604)

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 2976)
      • MsiExec.exe (PID: 1156)
      • MsiExec.exe (PID: 3488)
      • MsiExec.exe (PID: 4012)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3180)
      • DrvInst.exe (PID: 3524)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3180)
      • DrvInst.exe (PID: 3524)

    • Application launched itself

      • msiexec.exe (PID: 912)

    • Searches for installed software

      • msiexec.exe (PID: 912)
      • DrvInst.exe (PID: 3524)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3148)

    • Creates files in the program directory

      • msiexec.exe (PID: 912)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 912)

    • Manual execution by user

      • ScpSettings.exe (PID: 3316)
      • ScpDriverInstaller.exe (PID: 3884)
      • ScpDriverInstaller.exe (PID: 604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
109
Monitored processes
55
Malicious processes
32
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe scptoolkit_setup.exe vcredist_x86.exe no specs vcredist_x86.exe setup.exe msiexec.exe msiexec.exe msiexec.exe no specs scptoolkit_setup.exe vssvc.exe no specs msiexec.exe no specs msiexec.exe no specs scpupdater.exe no specs ngen.exe no specs scptrayapp.exe no specs powershell.exe no specs mscorsvw.exe no specs mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe cmd.exe no specs cmd.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs mscorsvw.exe mscorsvw.exe mscorsvw.exe mscorsvw.exe scpsettings.exe scpdriverinstaller.exe no specs scpdriverinstaller.exe drvinst.exe rundll32.exe no specs drvinst.exe drvinst.exe scpservice.exe

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ScpToolkit_Setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ScpToolkit_Setup.exe
iexplore.exe
User:
admin
Company:
Nefarius Software Solutions
Integrity Level:
MEDIUM
Description:
ScpToolkit Setup
Exit code:
0
Version:
1.6.238.16010
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\scptoolkit_setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
536C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 20c -NGENProcess 174 -Pipe 22c -Comment "NGen Worker Process"C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
mscorsvw.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
.NET Runtime Optimization Service
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
540C:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\admin\AppData\Local\Temp\EXE5697.tmp.bat" "C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
604"C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpDriverInstaller.exe" C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpDriverInstaller.exe
explorer.exe
User:
admin
Company:
Scarlet.Crush Productions
Integrity Level:
HIGH
Description:
ScpDriverInstaller
Exit code:
0
Version:
1.6.238.16010
Modules
Images
c:\program files\nefarius software solutions\scptoolkit\scpdriverinstaller.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
608"C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe"C:\Program Files\Nefarius Software Solutions\ScpToolkit\ScpService.exe
services.exe
User:
SYSTEM
Company:
Scarlet.Crush Productions
Integrity Level:
SYSTEM
Description:
ScpService
Exit code:
0
Version:
1.6.238.16010
Modules
Images
c:\program files\nefarius software solutions\scptoolkit\scpservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
912C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
940rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{2aa4e5c5-68f4-2b10-b96c-3042b0ccee0c} Global\{2257d216-32d5-7536-cec9-0e4780130223} C:\Windows\System32\DriverStore\Temp\{7febc28c-75d9-4251-b85a-9858eb8c1e24}\ScpVBus.inf C:\Windows\System32\DriverStore\Temp\{7febc28c-75d9-4251-b85a-9858eb8c1e24}\ScpVBus.catC:\Windows\system32\rundll32.exe—DrvInst.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1156C:\Windows\system32\MsiExec.exe -Embedding 86C92724564E5FAD5347720F8CE9D05E CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1232DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem4.inf" "scpvbus.inf:SCProductions.NTx86:ScpVBus_Install:1.0.0.103:root\scpvbus" "6b5cfab93" "00000324" "000005E0" "000005E4"C:\Windows\system32\DrvInst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1412ATTRIB -r "C:\Users\admin\AppData\Local\Temp\EXE5697.tmp.bat" C:\Windows\system32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 168
Read events
2 736
Write events
2 378
Delete events
54

Modification events

(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
2252592556
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30791814
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3180) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
158
Suspicious files
50
Text files
365
Unknown types
69

Dropped files

PID
Process
Filename
Type
2756iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab6F7B.tmp —
MD5:—
SHA256:—
2756iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar6F7C.tmp —
MD5:—
SHA256:—
2756iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\00D79U7S.txt —
MD5:—
SHA256:—
2756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\ScpToolkit_Setup[1].exe —
MD5:—
SHA256:—
2756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ScpToolkit_Setup.exe.qcw5v5x.partial —
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF12D0EB7FD55C6C79.TMP —
MD5:—
SHA256:—
3180iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\ScpToolkit_Setup.exe.qcw5v5x.partial:Zone.Identifier —
MD5:—
SHA256:—
304ScpToolkit_Setup.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\BSTVR2RZ.txt —
MD5:—
SHA256:—
304ScpToolkit_Setup.exeC:\Users\admin\AppData\Local\Temp\tinB5CB.tmp.part —
MD5:—
SHA256:—
304ScpToolkit_Setup.exeC:\Users\admin\AppData\Local\Temp\tinB5CB.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
17
DNS requests
12
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2756
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
2756
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAGC%2BAmOouYmuRo7J4Qfua8%3D
US
der
1.47 Kb
whitelisted
2756
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAGC%2BAmOouYmuRo7J4Qfua8%3D
US
der
1.47 Kb
whitelisted
2756
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuqL92L3tjkN67RNFF%2FEdvT6NEzAQUwBKyKHRoRmfpcCV0GgBFWwZ9XEQCEAgt9o7pxpMVvr9yB5s4EP0%3D
US
der
471 b
whitelisted
3180
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2756
iexplore.exe
GET
200
93.184.220.29:80
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
564 b
whitelisted
2756
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAoGMEJ%2FW7ztaVc5ZZO2RR8%3D
US
der
471 b
whitelisted
304
ScpToolkit_Setup.exe
GET
200
2.18.233.19:80
http://download.microsoft.com/download/1/6/5/165255E7-1014-4D0A-B094-B6A430A6BFFC/vcredist_x86.exe
unknown
executable
8.57 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3180
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2756
iexplore.exe
140.82.118.3:443
github.com
—
US
malicious
2756
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
304
ScpToolkit_Setup.exe
172.217.23.164:80
www.google.com
Google Inc.
US
whitelisted
2756
iexplore.exe
52.216.237.195:443
github-production-release-asset-2e65be.s3.amazonaws.com
Amazon.com, Inc.
US
unknown
3180
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
304
ScpToolkit_Setup.exe
151.101.0.133:443
raw.githubusercontent.com
Fastly
US
malicious
304
ScpToolkit_Setup.exe
2.18.233.19:80
download.microsoft.com
Akamai International B.V.
—
whitelisted
3180
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.118.3
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
github-production-release-asset-2e65be.s3.amazonaws.com
  • 52.216.237.195
shared
crl4.digicert.com
  • 93.184.220.29
whitelisted
www.google.com
  • 172.217.23.164
malicious
raw.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
shared
download.microsoft.com
  • 2.18.233.19
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
sqm.microsoft.com
  • —
unknown

Threats

PID
Process
Class
Message
304
ScpToolkit_Setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2 ETPRO signatures available at the full report
Process
Message
Setup.exe
The operation completed successfully.
Setup.exe
The operation completed successfully.
ScpService.exe
irrKlang sound library version 1.5.0
ScpService.exe
Loaded plugin: ikpflac.dll
ScpService.exe
Loaded plugin: ikpmp3.dll
ScpService.exe
Using DirectSound8 driver
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/nefarius/ScpToolkit/releases/download/v1.6.238.16010/ScpToolkit_Setup.exe