Malware analysis 23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe Malicious activity

Add for printing

File name:	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe
Full analysis:	https://app.any.run/tasks/256a08f0-576e-4b9c-9857-d5f738686c38
Verdict:	Malicious activity
Threats:	Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. Malware Trends Tracker >>>
Analysis date:	September 30, 2024, 14:32:20
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	adware adaware
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	6AA26713B6FC04BD996EDC4A348F34F1
SHA1:	31550ADDD14FF8D7E030471DB7B635B585D54C45
SHA256:	188D6A347B29CA8B46732DA54AAC8AE93017F30279AA0FBF34E7A1A19C26C7A4
SSDEEP:	24576:g6VnvKTGAqFnBge5g5DJAEHHi+aedECyTiwRd8BK94X:g6VnvKSAqFnBge5g5DJAEHHi+aedECyE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- ADAWARE has been detected (SURICATA)
  - WebCompanion.exe (PID: 7036)
SUSPICIOUS
- The process drops C-runtime libraries
  - WebCompanion-Installer.exe (PID: 6328)
- Executable content was dropped or overwritten
  - 23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe (PID: 1608)
  - WebCompanion-Installer.exe (PID: 6328)
- Process drops legitimate windows executable
  - WebCompanion-Installer.exe (PID: 6328)
- Suspicious use of NETSH.EXE
  - cmd.exe (PID: 2208)
- Access to an unwanted program domain was detected
  - WebCompanion.exe (PID: 7036)
- Drops 7-zip archiver for unpacking
  - WebCompanion-Installer.exe (PID: 6328)
- Starts CMD.EXE for commands execution
  - WebCompanion-Installer.exe (PID: 6328)
INFO
- Application launched itself
  - chrome.exe (PID: 6220)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	InstallShield setup (33)
.exe	\|	Win32 Executable MS Visual C++ (generic) (23.9)
.exe	\|	Win64 Executable (generic) (21.2)
.scr	\|	Windows screen saver (10)
.dll	\|	Win32 Dynamic Link Library (generic) (5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2011:04:18 18:54:06+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	104448
InitializedDataSize:	60416
UninitializedDataSize:	-
EntryPoint:	0x148d4
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	13.900.0.1080
ProductVersionNumber:	13.900.0.1080
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
FileVersion:	13.900.0.1080
ProductVersion:	13.900.0.1080
CompanyName:	Lavasoft
FileDescription:	Web Companion Installer
InternalName:	Installer.exe
LegalCopyright:	c Lavasoft Limited. All Rights Reserved.
OriginalFileName:	Installer.exe
ProductName:	Web Companion Installer

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

150

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1504

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3636 --field-trial-handle=1844,i,3031098908083423541,8829024208462743021,262144 --variations-seed-version /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

1608

"C:\Users\admin\Downloads\23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe"

C:\Users\admin\Downloads\23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe

explorer.exe

User:

admin

Company:

Lavasoft

Integrity Level:

MEDIUM

Description:

Web Companion Installer

Exit code:

Version:

13.900.0.1080

Modules

Images
c:\users\admin\downloads\23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll

2208

"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone

C:\Windows\SysWOW64\cmd.exe

—

WebCompanion-Installer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

2616

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2396 --field-trial-handle=1844,i,3031098908083423541,8829024208462743021,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

3728

"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall

C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

WebCompanion-Installer.exe

User:

admin

Company:

Lavasoft

Integrity Level:

MEDIUM

Description:

Web Companion

Version:

13.900.0.1080

Modules

Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

4080

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1828 --field-trial-handle=1844,i,3031098908083423541,8829024208462743021,262144 --variations-seed-version /prefetch:2

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

4084

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1844,i,3031098908083423541,8829024208462743021,262144 --variations-seed-version /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

4492

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1844,i,3031098908083423541,8829024208462743021,262144 --variations-seed-version /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

4668

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=122.0.6261.70 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7fffd3b5dc40,0x7fffd3b5dc4c,0x7fffd3b5dc58

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

5056

"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent

C:\Windows\System32\slui.exe

—

SppExtComObj.Exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

Add for printing

Total events

21 063

Read events

20 998

Write events

Delete events

Modification events


(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Lavasoft\Web Companion
Operation:	write	Name:	MachineId
Value: ad1f12af-3f36-3c28-b351-2ce4355f42c2
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6328) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASMANCS
Operation:	write	Name:	EnableAutoFileTracing
Value: 0

Add for printing

Executable files

Suspicious files

138

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\de-DE\WebCompanion-Installer.resources.dll		executable
		MD5:A564D6AE745D289B599A010E570E609E	SHA256:E20A9695E1322491C57C8A0E61839E5AEEBA40F43AAB400C29F19531D18FA037
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\es-ES\WebCompanion-Installer.resources.dll		executable
		MD5:A22C9231A5562DCA9F0BC186BDA3348D	SHA256:AF899C47BDE2A325F3F9F22772F4E305F6B50EAF040670DE508226FEFBED649B
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\it-IT\WebCompanion-Installer.resources.dll		executable
		MD5:320A49D5E8C225BF7D8C8FC8F0FBA1FE	SHA256:53F48BF5DEB5FB756EB61D5EE78BB72EF4509ADB396EB40BEF9671ECAA8D9819
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\ICSharpCode.SharpZipLib.dll		executable
		MD5:0CFE19791546A96C6699657A94604596	SHA256:56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\WebCompanion-Installer.exe		executable
		MD5:A27F9713DB1688D03D2082BFA1827803	SHA256:2F86EB0D3902A11DA1F534D9734DABAE37D33E2C57B03F968198A1CFC2E652A9
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\ja-JP\WebCompanion-Installer.resources.dll		executable
		MD5:442654050F5E5EBFB286C75A6AD10485	SHA256:B85CC7BA82B58AFD8FA00DFCCD820B5B34BC14A942EBDAB5380FCE8F7257C0AE
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\ru-RU\WebCompanion-Installer.resources.dll		executable
		MD5:F2876EC061D1CC88E44104ED97FC36F8	SHA256:6071DAA27880FE3F6B9FB704890250CA655CAFE832A1B9A4E59F0CFFFB042E04
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\Newtonsoft.Json.dll		executable
		MD5:461C476F474A5F13D2EA9344AE6F70F6	SHA256:4F0EC6439B24652F16DF066F4A38B64518B5A874080EDA63DE45968545830F67
1608	23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe	C:\Users\admin\AppData\Local\Temp\7zS8463246F\pt-BR\WebCompanion-Installer.resources.dll		executable
		MD5:01CCD85F0676258B5E4A223832E3258C	SHA256:C482D074CFDA0B6921A6750F0CCC1279BA6FCFB9D2037CA6EAAF704D8DAF811F
6328	WebCompanion-Installer.exe	C:\Users\admin\AppData\Local\Temp\WebCompanion.zip		compressed
		MD5:C0A2AAF917E6BC1D951EC481213D4138	SHA256:2F87DCD36A114502A3C80ECF8A8C5F5EF60475951F9C142A1A68BDEC6CAA3E23

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2120	MoUsoCoreWorker.exe	GET	200	72.246.169.155:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6328	WebCompanion-Installer.exe	GET	200	104.16.149.130:80	http://geo.lavasoft.com/	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
376	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6328	WebCompanion-Installer.exe	GET	200	104.16.149.130:80	http://geo.lavasoft.com/	unknown	—	—	whitelisted
7036	WebCompanion.exe	GET	200	2.23.198.32:80	http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRp%2BmQDKauE4nIg%2FgknZHuBlLkfKgQUzolPglGqFaKEYsoxI2HSYfv4%2FngCECXQy517DWxwDNrkPSQ6scY%3D	unknown	—	—	whitelisted
7036	WebCompanion.exe	GET	200	2.23.198.32:80	http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D	unknown	—	—	whitelisted
7036	WebCompanion.exe	GET	200	2.23.198.32:80	http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D	unknown	—	—	whitelisted
7036	WebCompanion.exe	GET	200	104.16.149.130:80	http://geo.lavasoft.com/	unknown	—	—	whitelisted
7036	WebCompanion.exe	GET	200	64.18.87.82:80	http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240701_wb	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
5196	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	72.246.169.155:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
—	—	40.126.32.74:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	40.115.3.253:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
5164	svchost.exe	40.126.32.74:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 4.231.128.59 51.124.78.146	whitelisted
www.microsoft.com	72.246.169.155 88.221.169.152	whitelisted
google.com	216.58.206.46	whitelisted
login.live.com	40.126.32.74 40.126.32.72 40.126.32.136 20.190.160.17 40.126.32.140 20.190.160.22 40.126.32.138 40.126.32.133	whitelisted
client.wns.windows.com	40.115.3.253	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
go.microsoft.com	23.213.166.81	whitelisted
geo.lavasoft.com	104.16.149.130 104.16.148.130	whitelisted
featureflags.lavasoft.com	104.16.149.130 104.16.148.130	whitelisted
flwadw.com	104.18.26.149 104.18.27.149	unknown

Threats

PID	Process	Class	Message
7036	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
7036	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
7036	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
7016	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
7016	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
7016	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
7016	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
7036	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion

Add for printing

Process	Message
WebCompanion-Installer.exe	Failed to OpenWcfHost: System.ServiceModel.AddressAccessDeniedException: HTTP could not register URL http://+:9008/webcompanion/. Your process does not have access rights to this namespace (see http://go.microsoft.com/fwlink/?LinkId=70353 for details). ---> System.Net.HttpListenerException: Access is denied at System.Net.HttpListener.AddAllPrefixes() at System.Net.HttpListener.Start() at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() --- End of inner exception stack trace --- at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() at System.ServiceModel.Channels.TransportManager.Open(TransportChannelListener channelListener) at System.ServiceModel.Channels.TransportManagerContainer.Open(SelectTransportManagersCallback selectTransportManagerCallback) at System.ServiceModel.Channels.TransportChannelListener.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.HttpChannelListener`1.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at WebCompanionInstaller.App.OpenInstallerWcfHost()
WebCompanion-Installer.exe	Detecting windows culture
WebCompanion-Installer.exe	Preparing request for featureflag: {"Geo":"DE","Partner":"IN240701","Campaign":"18022583703","InstallDate":"20240930","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
WebCompanion-Installer.exe	Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklist\", \"WhiteList\": \"https://acs.lavasoft.com/api/v2/url/permanentwhitelist\", \"DisplayName\": \"Web Protection\", \"FeatureName\": \"WebProtection\"}","targetId":241}]
WebCompanion-Installer.exe	9/30/2024 2:32:31 PM :-> Start
WebCompanion-Installer.exe	Failed to report progress in SendPostRequest: System.Net.WebException: The remote server returned an error: (400) Bad Request. at System.Net.HttpWebRequest.GetResponse() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanion-Installer.exe	9/30/2024 2:32:32 PM :-> Starting installer 13.900.0.1080 with: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240701 --nonadmin --direct --tych --campaign=18022583703 --version=13.900.0.1080, Run as admin: False
WebCompanion-Installer.exe	SecurityProtocol set toTls, Tls11, Tls12, Tls13
WebCompanion-Installer.exe	Preparing for installing Web Companion
WebCompanion-Installer.exe	9/30/2024 2:32:33 PM :-> Generating Machine and Install Id ...

General Info

23348_52482037_188d6a347b29ca8b46732da54aac8ae93017f30279aa0fbf34e7a1a19c26c7a4_setup.exe

6AA26713B6FC04BD996EDC4A348F34F1

31550ADDD14FF8D7E030471DB7B635B585D54C45

188D6A347B29CA8B46732DA54AAC8AE93017F30279AA0FBF34E7A1A19C26C7A4

24576:g6VnvKTGAqFnBge5g5DJAEHHi+aedECyTiwRd8BK94X:g6VnvKSAqFnBge5g5DJAEHHi+aedECyE

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

ADAWARE has been detected (SURICATA)

SUSPICIOUS

The process drops C-runtime libraries

Executable content was dropped or overwritten

Process drops legitimate windows executable

Suspicious use of NETSH.EXE

Access to an unwanted program domain was detected

Drops 7-zip archiver for unpacking

Starts CMD.EXE for commands execution

INFO

Application launched itself

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings