File name:

hwi_764.exe

Full analysis: https://app.any.run/tasks/50db6a16-7d4c-43e9-956c-0c7f9d9b9a43
Verdict: Malicious activity
Analysis date: October 18, 2023, 21:48:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0702F46419FD200AC2BB499D501B7001

SHA1:

E74B1FA64324817C28A34DAD05DE03D9DE477CAF

SHA256:

15B6A49ABBCD040B8BD67FF1E7CF98E4C3F48DBF9973FD555BA247B3F30DA287

SSDEEP:

98304:chN0zuSU+HKouVEU1I+tv9S0jlaT2lRKtUXHJZLqIKfUHg9V5tJY2zM2hpJnzkiS:ZbjsdbBGdEiUSG312f5u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • hwi_764.exe (PID: 556)
      • hwi_764.exe (PID: 3824)
      • hwi_764.tmp (PID: 1632)
      • HWiNFO32.EXE (PID: 3472)

    • Loads dropped or rewritten executable

      • hwi_764.tmp (PID: 1632)

    • Application was dropped or rewritten from another process

      • HWiNFO32.EXE (PID: 3740)
      • HWiNFO32.EXE (PID: 3472)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • hwi_764.tmp (PID: 1632)

    • Reads the Windows owner or organization settings

      • hwi_764.tmp (PID: 1632)

    • Reads the Internet Settings

      • hwi_764.tmp (PID: 3708)
      • HWiNFO32.EXE (PID: 3472)

    • Drops a system driver (possible attempt to evade defenses)

      • HWiNFO32.EXE (PID: 3472)

    • Reads settings of System Certificates

      • HWiNFO32.EXE (PID: 3472)

    • Checks Windows Trust Settings

      • HWiNFO32.EXE (PID: 3472)

    • Reads security settings of Internet Explorer

      • HWiNFO32.EXE (PID: 3472)

  • INFO

    • Checks supported languages

      • hwi_764.exe (PID: 3824)
      • hwi_764.exe (PID: 556)
      • hwi_764.tmp (PID: 3708)
      • hwi_764.tmp (PID: 1632)
      • HWiNFO32.EXE (PID: 3472)

    • Create files in a temporary directory

      • hwi_764.exe (PID: 556)
      • hwi_764.exe (PID: 3824)
      • hwi_764.tmp (PID: 1632)
      • HWiNFO32.EXE (PID: 3472)

    • Reads the computer name

      • hwi_764.tmp (PID: 3708)
      • hwi_764.tmp (PID: 1632)
      • HWiNFO32.EXE (PID: 3472)

    • Application was dropped or rewritten from another process

      • hwi_764.tmp (PID: 3708)
      • hwi_764.tmp (PID: 1632)

    • Creates files in the program directory

      • hwi_764.tmp (PID: 1632)
      • HWiNFO32.EXE (PID: 3472)

    • Reads the machine GUID from the registry

      • HWiNFO32.EXE (PID: 3472)

    • Reads CPU info

      • HWiNFO32.EXE (PID: 3472)

    • Checks proxy server information

      • HWiNFO32.EXE (PID: 3472)

    • Creates files or folders in the user directory

      • HWiNFO32.EXE (PID: 3472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.9)
.exe | UPX compressed Win32 Executable (16.7)
.exe | Win32 Executable Delphi generic (8.7)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 84480
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Martin Malik, REALiX s.r.o.
FileDescription:
FileVersion:
LegalCopyright: Copyright ©1999-2023 Martin Malik, REALiX s.r.o.
ProductName:
ProductVersion: 7.64
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
6
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start hwi_764.exe no specs hwi_764.tmp no specs hwi_764.exe hwi_764.tmp no specs hwinfo32.exe no specs hwinfo32.exe

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Users\admin\AppData\Local\Temp\hwi_764.exe" C:\Users\admin\AppData\Local\Temp\hwi_764.exe—explorer.exe
User:
admin
Company:
Martin Malik, REALiX s.r.o.
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\hwi_764.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1632"C:\Users\admin\AppData\Local\Temp\is-KAGG9.tmp\hwi_764.tmp" /SL5="$150220,11831683,123392,C:\Users\admin\AppData\Local\Temp\hwi_764.exe" /SPAWNWND=$4036C /NOTIFYWND=$602F8 C:\Users\admin\AppData\Local\Temp\is-KAGG9.tmp\hwi_764.tmp—hwi_764.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-kagg9.tmp\hwi_764.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3472"C:\Program Files\HWiNFO32\HWiNFO32.EXE" C:\Program Files\HWiNFO32\HWiNFO32.EXE
hwi_764.tmp
User:
admin
Company:
REALiX s.r.o.
Integrity Level:
HIGH
Description:
HWiNFO32
Exit code:
0
Version:
7.64-5240
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\hwinfo32\hwinfo32.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
3708"C:\Users\admin\AppData\Local\Temp\is-F1NES.tmp\hwi_764.tmp" /SL5="$602F8,11831683,123392,C:\Users\admin\AppData\Local\Temp\hwi_764.exe" C:\Users\admin\AppData\Local\Temp\is-F1NES.tmp\hwi_764.tmp—hwi_764.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-f1nes.tmp\hwi_764.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\usp10.dll
3740"C:\Program Files\HWiNFO32\HWiNFO32.EXE" C:\Program Files\HWiNFO32\HWiNFO32.EXE—hwi_764.tmp
User:
admin
Company:
REALiX s.r.o.
Integrity Level:
MEDIUM
Description:
HWiNFO32
Exit code:
3221226540
Version:
7.64-5240
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\hwinfo32\hwinfo32.exe
3824"C:\Users\admin\AppData\Local\Temp\hwi_764.exe" /SPAWNWND=$4036C /NOTIFYWND=$602F8 C:\Users\admin\AppData\Local\Temp\hwi_764.exe
hwi_764.tmp
User:
admin
Company:
Martin Malik, REALiX s.r.o.
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\hwi_764.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
6 815
Read events
6 726
Write events
46
Delete events
43

Modification events

(PID) Process:(3708) hwi_764.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3708) hwi_764.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3708) hwi_764.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3708) hwi_764.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3472) HWiNFO32.EXEKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3472) HWiNFO32.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3472) HWiNFO32.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000056010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3472) HWiNFO32.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3472) HWiNFO32.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3472) HWiNFO32.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
10
Suspicious files
8
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
556hwi_764.exeC:\Users\admin\AppData\Local\Temp\is-F1NES.tmp\hwi_764.tmpexecutable
MD5:751D4F1D0F96F1DF71F778391555E52B
SHA256:249A43F4202A145F53CB034C6AD9AB91A2F783621B4B172B89660F91A9285D1F
3824hwi_764.exeC:\Users\admin\AppData\Local\Temp\is-KAGG9.tmp\hwi_764.tmpexecutable
MD5:751D4F1D0F96F1DF71F778391555E52B
SHA256:249A43F4202A145F53CB034C6AD9AB91A2F783621B4B172B89660F91A9285D1F
1632hwi_764.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\HWiNFO32\HWiNFO32.lnkbinary
MD5:C933DCF68B4D98E8004640C70E4F8D38
SHA256:7376997E9FA057396552923EC05355232906EA0C7998BF480652FCB07828DCA2
1632hwi_764.tmpC:\Program Files\HWiNFO32\is-6LHM4.tmpexecutable
MD5:AC788D19BF96CA1108756D82355115E9
SHA256:6B9CB8DC1574446ABB7ECF02ADF62529A0F1DA46C38725BDE5794600CE7ACF89
1632hwi_764.tmpC:\Users\admin\AppData\Local\Temp\is-2KSJS.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
1632hwi_764.tmpC:\Program Files\HWiNFO32\unins000.datbinary
MD5:C0B07DBBEE70948B46EEAFB1D4D9C0A4
SHA256:8DBD0C8A95129128F96A14B8144F1B916D73F945F4B2E6F0C894E650EC15524D
3472HWiNFO32.EXEC:\Program Files\HWiNFO32\HWiNFO32.INItext
MD5:31EA0D720B02F5BE9A0A8C843FA525B6
SHA256:2B52116A161DB87EAD7FBA5329E113610A39EC5183D713A9D9A7222FE657C949
3472HWiNFO32.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1632hwi_764.tmpC:\Program Files\HWiNFO32\HWiNFO32.EXEexecutable
MD5:BA4545C2F4CE942A50445CF422A0F5DB
SHA256:B9E12BD6952186D303A79896C937FE8A58A4619092C6B1FC470E048F1D7A4FBA
3472HWiNFO32.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:0FFD2B2381A60512310D1BF0AB0B1BE6
SHA256:592A1F29EF72CD9B7591C3AFEB88E2365472D20B11CF028AD6E937D6379D6857
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
6
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3472
HWiNFO32.EXE
GET
200
8.248.147.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4cecca3696452d98
unknown
compressed
4.66 Kb
unknown
3472
HWiNFO32.EXE
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3472
HWiNFO32.EXE
GET
200
142.250.184.227:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3472
HWiNFO32.EXE
172.67.205.235:443
www.hwinfo.com
CLOUDFLARENET
US
unknown
3472
HWiNFO32.EXE
8.248.147.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
3472
HWiNFO32.EXE
142.250.184.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.hwinfo.com
  • 172.67.205.235
  • 104.21.22.164
whitelisted
ctldl.windowsupdate.com
  • 8.248.147.254
  • 8.248.117.254
  • 8.248.115.254
  • 8.248.119.254
  • 67.26.81.254
whitelisted
ocsp.pki.goog
  • 142.250.184.227
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hwi_764.exe