| File name: | Skype.windows.exe |
| Full analysis: | https://app.any.run/tasks/1f100277-b3c5-4047-8251-d8014f7db445 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | March 07, 2025, 09:06:31 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections |
| MD5: | 454FAFCEDD05F3D8B16191A237435F98 |
| SHA1: | F8E5BA09B14EF149D18A6DABF23D563D82E062D0 |
| SHA256: | 110FA8642FFFBC511CDE6C0932A956D6BAD31EA0F3BE1E3A2354C78BD3324043 |
| SSDEEP: | 98304:Brq3BdwCm3ar+QByDON7b+qPtE9v5U4MXjum7PMOTe17xTuQq2suqL3PwKVXGAW7:dQnPeynB+X2qPYe7DC0qqztO7y0Q |
MALICIOUS
Changes the autorun value in the registry
- vcredist_x86.exe (PID: 6972)
Actions looks like stealing of personal data
- Skype.windows.tmp (PID: 732)
SUSPICIOUS
Executable content was dropped or overwritten
- Skype.windows.exe (PID: 4776)
- Skype.windows.exe (PID: 6728)
- vcredist_x86.exe (PID: 6972)
- TiWorker.exe (PID: 7712)
- Skype.windows.tmp (PID: 732)
Reads security settings of Internet Explorer
- Skype.windows.tmp (PID: 3884)
Reads the Windows owner or organization settings
- Skype.windows.tmp (PID: 732)
Drops 7-zip archiver for unpacking
- Skype.windows.tmp (PID: 732)
The process drops C-runtime libraries
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
Process drops legitimate windows executable
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
- Skype.windows.tmp (PID: 732)
The process verifies whether the antivirus software is installed
- Skype.windows.tmp (PID: 732)
Starts a Microsoft application from unusual location
- vcredist_x86.exe (PID: 6972)
INFO
Checks supported languages
- Skype.windows.exe (PID: 4776)
- Skype.windows.tmp (PID: 3884)
- Skype.windows.exe (PID: 6728)
- Skype.windows.tmp (PID: 732)
- vcredist_x86.exe (PID: 6972)
- msiexec.exe (PID: 5968)
- msiexec.exe (PID: 6744)
Reads the computer name
- Skype.windows.tmp (PID: 3884)
- Skype.windows.exe (PID: 6728)
- Skype.windows.tmp (PID: 732)
- msiexec.exe (PID: 6744)
- msiexec.exe (PID: 5968)
Create files in a temporary directory
- Skype.windows.exe (PID: 4776)
- Skype.windows.exe (PID: 6728)
- Skype.windows.tmp (PID: 732)
- vcredist_x86.exe (PID: 6972)
Process checks computer location settings
- Skype.windows.tmp (PID: 3884)
The sample compiled with english language support
- Skype.windows.tmp (PID: 732)
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
Reads the machine GUID from the registry
- msiexec.exe (PID: 6744)
Creates files or folders in the user directory
- msiexec.exe (PID: 6744)
- Skype.windows.tmp (PID: 732)
Reads the software policy settings
- msiexec.exe (PID: 6744)
Executable content was dropped or overwritten
- msiexec.exe (PID: 6744)
The sample compiled with chinese language support
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
The sample compiled with german language support
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
The sample compiled with spanish language support
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
The sample compiled with Italian language support
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
The sample compiled with french language support
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
Detects InnoSetup installer (YARA)
- Skype.windows.exe (PID: 4776)
- Skype.windows.exe (PID: 6728)
- Skype.windows.tmp (PID: 732)
- Skype.windows.tmp (PID: 3884)
The sample compiled with japanese language support
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
The sample compiled with korean language support
- msiexec.exe (PID: 6744)
- TiWorker.exe (PID: 7712)
Compiled with Borland Delphi (YARA)
- Skype.windows.exe (PID: 6728)
- Skype.windows.exe (PID: 4776)
- Skype.windows.tmp (PID: 3884)
- Skype.windows.tmp (PID: 732)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (53.5) |
|---|---|---|
| .exe | | | InstallShield setup (21) |
| .exe | | | Win32 EXE PECompact compressed (generic) (20.2) |
| .exe | | | Win32 Executable (generic) (2.1) |
| .exe | | | Win16/32 Executable Delphi generic (1) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:06:09 11:07:51+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 685056 |
| InitializedDataSize: | 407040 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa83bc |
| OSVersion: | 6.1 |
| ImageVersion: | - |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | Skype Setup |
| FileVersion: | |
| LegalCopyright: | |
| OriginalFileName: | |
| ProductName: | Skype |
| ProductVersion: | 0.0.0.1 |
Total processes
144
Monitored processes
11
Malicious processes
4
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 536 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 732 | "C:\Users\admin\AppData\Local\Temp\is-0SRR6.tmp\Skype.windows.tmp" /SL5="$802C6,15359391,1093120,C:\Users\admin\AppData\Local\Temp\Skype.windows.exe" /SPAWNWND=$6030C /NOTIFYWND=$80288 | C:\Users\admin\AppData\Local\Temp\is-0SRR6.tmp\Skype.windows.tmp | Skype.windows.exe | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: Setup/Uninstall Version: 51.1052.0.0 Modules
| |||||||||||||||
| 3884 | "C:\Users\admin\AppData\Local\Temp\is-MIU8A.tmp\Skype.windows.tmp" /SL5="$80288,15359391,1093120,C:\Users\admin\AppData\Local\Temp\Skype.windows.exe" | C:\Users\admin\AppData\Local\Temp\is-MIU8A.tmp\Skype.windows.tmp | — | Skype.windows.exe | |||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Setup/Uninstall Version: 51.1052.0.0 Modules
| |||||||||||||||
| 4776 | "C:\Users\admin\AppData\Local\Temp\Skype.windows.exe" | C:\Users\admin\AppData\Local\Temp\Skype.windows.exe | explorer.exe | ||||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Skype Setup Version: Modules
| |||||||||||||||
| 5332 | msiexec.exe /i vcredist.msi /qn | C:\Windows\SysWOW64\msiexec.exe | — | vcredist_x86.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5968 | C:\Windows\syswow64\MsiExec.exe -Embedding E0AD0B79BEEADF9A70D7DC0983B45349 | C:\Windows\SysWOW64\msiexec.exe | — | msiexec.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows® installer Exit code: 0 Version: 5.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6272 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6728 | "C:\Users\admin\AppData\Local\Temp\Skype.windows.exe" /SPAWNWND=$6030C /NOTIFYWND=$80288 | C:\Users\admin\AppData\Local\Temp\Skype.windows.exe | Skype.windows.tmp | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: Skype Setup Version: Modules
| |||||||||||||||
| 6744 | C:\WINDOWS\system32\msiexec.exe /V | C:\Windows\System32\msiexec.exe | services.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows® installer Version: 5.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6972 | "C:\Users\admin\AppData\Local\Temp\is-UD7QK.tmp\vcredist_x86.exe" /q:a /c:"msiexec.exe /i vcredist.msi /qn" | C:\Users\admin\AppData\Local\Temp\is-UD7QK.tmp\vcredist_x86.exe | Skype.windows.tmp | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Win32 Cabinet Self-Extractor Exit code: 0 Version: 6.00.2900.2180 (xpsp_sp2_rtm.040803-2158) Modules
| |||||||||||||||
Total events
7 579
Read events
6 710
Write events
797
Delete events
72
Modification events
| (PID) Process: | (6972) vcredist_x86.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce |
| Operation: | write | Name: | wextract_cleanup0 |
Value: rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\" | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | write | Name: | Owner |
Value: 581A0000AA109F3E408FDB01 | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | write | Name: | SessionHash |
Value: 51095594EACF6792CB115BE865562B65C626B200DDA3F205FE983E8EA58EC828 | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0001 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\77EB05CE46035D115AA4000972A8B18B |
| Operation: | write | Name: | c1c4f01781cc94c4c8fb1542c0981a2a |
Value: 02:\SOFTWARE\Microsoft\DevDiv\VC\Servicing\8.0\SP | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0EF18C3B9B1A1EE8 |
| Operation: | write | Name: | c1c4f01781cc94c4c8fb1542c0981a2a |
Value: | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1FA18F7974E099CD0AF18C3B9B1A1EE8 |
| Operation: | write | Name: | c1c4f01781cc94c4c8fb1542c0981a2a |
Value: >ATL80.dll\Microsoft.VC80.ATL,type="win32",version="8.0.50727.6195",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86" | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED124534C201BC1D0CF18C3B9B1A1EE8 |
| Operation: | write | Name: | c1c4f01781cc94c4c8fb1542c0981a2a |
Value: | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED124534C201BC1D0BF18C3B9B1A1EE8 |
| Operation: | write | Name: | c1c4f01781cc94c4c8fb1542c0981a2a |
Value: | |||
| (PID) Process: | (6744) msiexec.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4006F64980E4BACB0DF18C3B9B1A1EE8 |
| Operation: | write | Name: | c1c4f01781cc94c4c8fb1542c0981a2a |
Value: | |||
Executable files
84
Suspicious files
89
Text files
390
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6744 | msiexec.exe | C:\Windows\Installer\10c5f2.msi | executable | |
MD5:B20BBEB818222B657DF49A9CFE4FED79 | SHA256:91BDD063F6C53126737791C9ECCF0B2F4CF44927831527245BC89A0BE06C0CB4 | |||
| 732 | Skype.windows.tmp | C:\Users\admin\AppData\Local\Temp\is-UD7QK.tmp\_isetup\_setup64.tmp | executable | |
MD5:E4211D6D009757C078A9FAC7FF4F03D4 | SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95 | |||
| 732 | Skype.windows.tmp | C:\Users\admin\AppData\Local\Temp\is-UD7QK.tmp\vcredist_x86.exe | executable | |
MD5:4F1611F2D0AE799507F60C10FF8654C5 | SHA256:8648C5FC29C44B9112FE52F9A33F80E7FC42D10F3B5B42B2121542A13E44ADFD | |||
| 6972 | vcredist_x86.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\vcredist.msi | executable | |
MD5:B20BBEB818222B657DF49A9CFE4FED79 | SHA256:91BDD063F6C53126737791C9ECCF0B2F4CF44927831527245BC89A0BE06C0CB4 | |||
| 732 | Skype.windows.tmp | C:\Users\admin\AppData\Local\Temp\is-UD7QK.tmp\7zpp.dll | executable | |
MD5:81006627DCDF10E10979DA28BCC688A2 | SHA256:E8D94C81108B2B6B1213D077D2E50416DEACEADB02ADAD6F64824A568175A884 | |||
| 732 | Skype.windows.tmp | C:\Users\admin\AppData\Local\Temp\is-UD7QK.tmp\7za.dll | executable | |
MD5:B8BF3BB996FE4DA79678564573FBC559 | SHA256:EB4A51EF8451CC07914A7A65B9C344564A7F966C10B0B220DA056EED84D18A44 | |||
| 732 | Skype.windows.tmp | C:\Users\admin\AppData\Local\Temp\is-UD7QK.tmp\_isetup\_isdecmp.dll | executable | |
MD5:077CB4461A2767383B317EB0C50F5F13 | SHA256:8287D0E287A66EE78537C8D1D98E426562B95C50F569B92CEA9CE36A9FA57E64 | |||
| 6972 | vcredist_x86.exe | C:\Users\admin\AppData\Local\Temp\IXP000.TMP\vcredis1.cab | compressed | |
MD5:CC064D4B81619991DE8131A86AD77681 | SHA256:913EE5A1CAE3E5A1872B3A5EFAAA00C58E4BEB692492B138F76967DA671B0477 | |||
| 6744 | msiexec.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9 | binary | |
MD5:3F27CF905FA4A88F74BCC715839B562E | SHA256:6DC99DCFC1997AAECA38151C8800FF9820D4D7D0BFC0D33EB8613EDDD0233D12 | |||
| 6744 | msiexec.exe | C:\Windows\Installer\MSID2D2.tmp | executable | |
MD5:85221B3BCBA8DBE4B4A46581AA49F760 | SHA256:F6E34A4550E499346F5AB1D245508F16BF765FF24C4988984B89E049CA55737F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
13
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6744 | msiexec.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/CSPCA.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6988 | backgroundTaskHost.exe | GET | 200 | 184.30.131.245:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
7952 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7952 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6744 | msiexec.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
3216 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 20.190.159.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
6988 | backgroundTaskHost.exe | 20.223.36.55:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6988 | backgroundTaskHost.exe | 184.30.131.245:80 | ocsp.digicert.com | AKAMAI-AS | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |