File name: | MSTeamsSetup_c_l_.exe |
Full analysis: | https://app.any.run/tasks/290fd63e-998e-4008-a144-3183b18b183b |
Verdict: | Malicious activity |
Analysis date: | August 12, 2022, 17:41:39 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 092BFF0405AB418FE22C565E231BE2BA |
SHA1: | 8AEF2B7D83B3D5AE55B24F25AB6621BB2DEA9287 |
SHA256: | 156CAFA6DA98A57E481AAB74EF748726BD4DCE2912536FB59E65D9A57A3AE7A7 |
SSDEEP: | 24576:4NYuPOTryV7OXRiYZgJw2K9KS74fVyhfP0dhyaz/PxSbQOUP8oSf37Z3/UyD:MOX6743ZvFKS74Nwfahyazx0LZ3jD |
.exe | | | Win32 Executable (generic) (52.9) |
---|---|---|
.exe | | | Generic Win/DOS Executable (23.5) |
.exe | | | DOS Executable Generic (23.5) |
MachineType: | Intel 386 or later, and compatibles |
---|---|
TimeStamp: | 2022:04:20 00:24:16+02:00 |
PEType: | PE32 |
LinkerVersion: | 14.16 |
CodeSize: | 215040 |
InitializedDataSize: | 1187840 |
UninitializedDataSize: | - |
EntryPoint: | 0x14510 |
OSVersion: | 6 |
ImageVersion: | - |
SubsystemVersion: | 6 |
Subsystem: | Windows GUI |
FileVersionNumber: | 1.4.4.0 |
ProductVersionNumber: | 1.4.4.0 |
FileFlagsMask: | 0x003f |
FileFlags: | (none) |
FileOS: | Windows NT 32-bit |
ObjectFileType: | Executable application |
FileSubtype: | - |
LanguageCode: | English (U.S.) |
CharacterSet: | Unicode |
FileDescription: | Installer for Squirrel-based applications |
FileVersion: | 1.4.4.0 |
InternalName: | Setup.exe |
LegalCopyright: | Copyright (C) 2014 |
OriginalFileName: | Setup.exe |
ProductName: | Squirrel-based application |
ProductVersion: | 1.4.4.0 |
SquirrelAwareVersion: | 1 |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3524 | "C:\Users\admin\AppData\Local\Temp\MSTeamsSetup_c_l_.exe" | C:\Users\admin\AppData\Local\Temp\MSTeamsSetup_c_l_.exe | Explorer.EXE | |
User: admin Integrity Level: MEDIUM Description: Installer for Squirrel-based applications Version: 1.4.4.0 | ||||
996 | "C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=MSTeamsSetup_c_l_.exe --bootstrapperMode | C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe | MSTeamsSetup_c_l_.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Teams Exit code: 4294967295 Version: 3.1.2.0 |
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASAPI32 |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASAPI32 |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASAPI32 |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASAPI32 |
Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASAPI32 |
Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASAPI32 |
Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASMANCS |
Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASMANCS |
Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASMANCS |
Operation: | write | Name: | FileTracingMask |
Value: | |||
(PID) Process: | (996) Update.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Update_RASMANCS |
Operation: | write | Name: | ConsoleTracingMask |
Value: |
PID | Process | Filename | Type | |
---|---|---|---|---|
996 | Update.exe | C:\Users\admin\AppData\Local\SquirrelTemp\SquirrelSetup.log | text | |
MD5:D4DE6247E5E59677088D3304934A92B6 | SHA256:B59418D73A9319D5B02ABDAE9A1725FE9B2762D8BBF509B9142C2882B54031AF | |||
3524 | MSTeamsSetup_c_l_.exe | C:\Users\admin\AppData\Local\SquirrelTemp\background.gif | image | |
MD5:FF1F29DCA0451246C3CA6CB7B023434F | SHA256:753D7D351E427246E2B6CC86C45E21F952939E306C3EB2FDB1BD7D67842C64B8 | |||
3524 | MSTeamsSetup_c_l_.exe | C:\Users\admin\AppData\Local\SquirrelTemp\downloading.gif | image | |
MD5:3488A1749B859E969C01BA981036FAB6 | SHA256:C3FA333FDBCE95D504AEE31912993DC17AB31324428F557AC774F7E98B049B99 | |||
3524 | MSTeamsSetup_c_l_.exe | C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe | executable | |
MD5:55D2BE3EA0DC1DCAEEFDDD7ED12C05E9 | SHA256:5CACCD37E4DF62DCF709605DE3F79664DE7190534B56CD69BCC96BDF0F939437 | |||
3524 | MSTeamsSetup_c_l_.exe | C:\Users\admin\AppData\Local\SquirrelTemp\endpoint.json | binary | |
MD5:677CAB9A8B50AD026CFA7625A35DD2D7 | SHA256:07890DDA20815E1E57DCA9553F5DFCFF1B85F4A4369685D4991599E2618978F0 |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
996 | Update.exe | 104.208.16.88:443 | mobile.pipe.aria.microsoft.com | Microsoft Corporation | US | suspicious |
Domain | IP | Reputation |
---|---|---|
mobile.pipe.aria.microsoft.com |
| whitelisted |
Process | Message |
---|---|
Update.exe | Update.exe Information: 0 : |
Update.exe | Starting TelemetryManager constructor
|
Update.exe | Update.exe Information: 0 : |
Update.exe | TelemetryManagerImpl creation started
|
Update.exe | Update.exe Information: 0 : |
Update.exe | Performance counters are disabled. Skipping creation of counters category.
|
Update.exe | Update.exe Information: 0 : |
Update.exe | RecordBatcherTask with ID 4 started.
|
Update.exe | Update.exe Information: 0 : |
Update.exe | DataPackageSender with UserAgent name: AST-exe-C#, version: 3.1.2.0, [Ast_Default_Source]
|