Malware analysis Setup (1).exe Malicious activity | ANY.RUN

Add for printing

File name:	Setup (1).exe
Full analysis:	https://app.any.run/tasks/8a04832f-024a-4b53-9e87-d6483fb0a085
Verdict:	Malicious activity
Threats:	Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	August 06, 2024, 10:21:38
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	adware adaware stealer
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	6AA26713B6FC04BD996EDC4A348F34F1
SHA1:	31550ADDD14FF8D7E030471DB7B635B585D54C45
SHA256:	188D6A347B29CA8B46732DA54AAC8AE93017F30279AA0FBF34E7A1A19C26C7A4
SSDEEP:	24576:g6VnvKTGAqFnBge5g5DJAEHHi+aedECyTiwRd8BK94X:g6VnvKSAqFnBge5g5DJAEHHi+aedECyE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - Setup (1).exe (PID: 6324)
  - WebCompanion-Installer.exe (PID: 6348)
- Steals credentials from Web Browsers
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- ADAWARE has been detected (SURICATA)
  - WebCompanion.exe (PID: 5084)
- Changes the autorun value in the registry
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Actions looks like stealing of personal data
  - WebCompanion.exe (PID: 2424)
  - WebCompanion.exe (PID: 5084)
SUSPICIOUS
- Executable content was dropped or overwritten
  - Setup (1).exe (PID: 6324)
  - WebCompanion-Installer.exe (PID: 6348)
- Searches for installed software
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Process drops legitimate windows executable
  - WebCompanion-Installer.exe (PID: 6348)
- Reads security settings of Internet Explorer
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Drops 7-zip archiver for unpacking
  - WebCompanion-Installer.exe (PID: 6348)
- The process drops C-runtime libraries
  - WebCompanion-Installer.exe (PID: 6348)
- The process creates files with name similar to system file names
  - WebCompanion-Installer.exe (PID: 6348)
- Starts CMD.EXE for commands execution
  - WebCompanion-Installer.exe (PID: 6348)
- Reads the date of Windows installation
  - WebCompanion-Installer.exe (PID: 6348)
- Changes internet zones settings
  - WebCompanion-Installer.exe (PID: 6348)
- Suspicious use of NETSH.EXE
  - cmd.exe (PID: 6320)
- Checks Windows Trust Settings
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Creates a software uninstall entry
  - WebCompanion-Installer.exe (PID: 6348)
- Access to an unwanted program domain was detected
  - WebCompanion.exe (PID: 5084)
- The process checks if it is being run in the virtual environment
  - WebCompanion.exe (PID: 2424)
INFO
- Checks supported languages
  - Setup (1).exe (PID: 6324)
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Creates files or folders in the user directory
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Disables trace logs
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Reads Environment values
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Create files in a temporary directory
  - Setup (1).exe (PID: 6324)
  - WebCompanion-Installer.exe (PID: 6348)
- Checks proxy server information
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Reads the machine GUID from the registry
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Reads the software policy settings
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Reads the computer name
  - WebCompanion-Installer.exe (PID: 6348)
  - WebCompanion.exe (PID: 5084)
  - WebCompanion.exe (PID: 2424)
- Process checks computer location settings
  - WebCompanion-Installer.exe (PID: 6348)
- Creates files in the program directory
  - WebCompanion.exe (PID: 5084)
- Application launched itself
  - chrome.exe (PID: 6852)
- The process uses the downloaded file
  - chrome.exe (PID: 7432)
  - chrome.exe (PID: 7648)
  - chrome.exe (PID: 7440)
  - chrome.exe (PID: 8072)
  - chrome.exe (PID: 7968)
  - chrome.exe (PID: 7852)
  - chrome.exe (PID: 7552)
  - chrome.exe (PID: 7248)
- Executable content was dropped or overwritten
  - chrome.exe (PID: 2464)
- Drops the executable file immediately after the start
  - chrome.exe (PID: 2464)
- Reads Microsoft Office registry keys
  - chrome.exe (PID: 6852)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	InstallShield setup (33)
.exe	\|	Win32 Executable MS Visual C++ (generic) (23.9)
.exe	\|	Win64 Executable (generic) (21.2)
.scr	\|	Windows screen saver (10)
.dll	\|	Win32 Dynamic Link Library (generic) (5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2011:04:18 18:54:06+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	104448
InitializedDataSize:	60416
UninitializedDataSize:	-
EntryPoint:	0x148d4
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	13.900.0.1080
ProductVersionNumber:	13.900.0.1080
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
FileVersion:	13.900.0.1080
ProductVersion:	13.900.0.1080
CompanyName:	Lavasoft
FileDescription:	Web Companion Installer
InternalName:	Installer.exe
LegalCopyright:	c Lavasoft Limited. All Rights Reserved.
OriginalFileName:	Installer.exe
ProductName:	Web Companion Installer

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

185

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

300

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5376 --field-trial-handle=2000,i,4774892850489509214,16579661806618198373,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

1164

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5748 --field-trial-handle=2000,i,4774892850489509214,16579661806618198373,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

1292

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5748 --field-trial-handle=2000,i,4774892850489509214,16579661806618198373,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

2128

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=2000,i,4774892850489509214,16579661806618198373,262144 --variations-seed-version /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

2424

"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall

C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

WebCompanion-Installer.exe

User:

admin

Company:

Lavasoft

Integrity Level:

MEDIUM

Description:

Web Companion

Version:

13.900.0.1080

Modules

Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

2464

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5828 --field-trial-handle=2000,i,4774892850489509214,16579661806618198373,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

4280

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

5084

"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=

C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

WebCompanion-Installer.exe

User:

admin

Company:

Lavasoft

Integrity Level:

MEDIUM

Description:

Web Companion

Exit code:

Version:

13.900.0.1080

Modules

Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

5464

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5740 --field-trial-handle=2000,i,4774892850489509214,16579661806618198373,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

6252

netsh http add urlacl url=http://+:9007/ user=Everyone

C:\Windows\SysWOW64\netsh.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Network Command Shell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

Add for printing

Total events

50 294

Read events

50 107

Write events

179

Delete events

Modification events


(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Lavasoft\Web Companion
Operation:	write	Name:	MachineId
Value: ad1f12af-3f36-3c28-b351-2ce4355f42c2
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(6348) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0

Add for printing

Executable files

Suspicious files

293

Text files

121

Unknown types

229

Dropped files

PID	Process	Filename		Type
6324	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zS4B89D33E\de-DE\WebCompanion-Installer.resources.dll		executable
		MD5:A564D6AE745D289B599A010E570E609E	SHA256:E20A9695E1322491C57C8A0E61839E5AEEBA40F43AAB400C29F19531D18FA037
6324	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zS4B89D33E\WebCompanion-Installer.exe.config		xml
		MD5:E3D3AA100B93504676414B9268DFBAD4	SHA256:EA7747D876307B0022F055C311C4F8F8112FDDE380E0848FD35508C00EDF8E7A
6324	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zS4B89D33E\fr-CA\WebCompanion-Installer.resources.dll		executable
		MD5:07759138B75C31E8E62E2DCB9E5B4121	SHA256:460E0EA0F891B4A7D8FCF4D7C1DAF4034B1A8C01F35C55B87C4DE4D34F7E1119
6324	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zS4B89D33E\es-ES\WebCompanion-Installer.resources.dll		executable
		MD5:A22C9231A5562DCA9F0BC186BDA3348D	SHA256:AF899C47BDE2A325F3F9F22772F4E305F6B50EAF040670DE508226FEFBED649B
6348	WebCompanion-Installer.exe	C:\Users\admin\AppData\Local\Temp\WebCompanion.zip		compressed
		MD5:C0A2AAF917E6BC1D951EC481213D4138	SHA256:2F87DCD36A114502A3C80ECF8A8C5F5EF60475951F9C142A1A68BDEC6CAA3E23
6324	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zS4B89D33E\ICSharpCode.SharpZipLib.dll		executable
		MD5:0CFE19791546A96C6699657A94604596	SHA256:56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
6348	WebCompanion-Installer.exe	C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\BCUSDK.dll		executable
		MD5:79AAF194177DC418CFB4D94AF29CDD2A	SHA256:6327ED564E521BB91791EEE54D7C18699BE1DE77DB2B9D6DCDD6FB7077CACB39
6324	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zS4B89D33E\ja-JP\WebCompanion-Installer.resources.dll		executable
		MD5:442654050F5E5EBFB286C75A6AD10485	SHA256:B85CC7BA82B58AFD8FA00DFCCD820B5B34BC14A942EBDAB5380FCE8F7257C0AE
6324	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zS4B89D33E\pt-BR\WebCompanion-Installer.resources.dll		executable
		MD5:01CCD85F0676258B5E4A223832E3258C	SHA256:C482D074CFDA0B6921A6750F0CCC1279BA6FCFB9D2037CA6EAAF704D8DAF811F
6324	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zS4B89D33E\ru-RU\WebCompanion-Installer.resources.dll		executable
		MD5:F2876EC061D1CC88E44104ED97FC36F8	SHA256:6071DAA27880FE3F6B9FB704890250CA655CAFE832A1B9A4E59F0CFFFB042E04

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6348	WebCompanion-Installer.exe	GET	200	104.16.149.130:80	http://geo.lavasoft.com/	unknown	—	—	whitelisted
6348	WebCompanion-Installer.exe	GET	200	104.16.149.130:80	http://geo.lavasoft.com/	unknown	—	—	whitelisted
2272	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
6920	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5084	WebCompanion.exe	GET	200	2.23.198.32:80	http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D	unknown	—	—	whitelisted
6968	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5084	WebCompanion.exe	GET	200	2.23.198.32:80	http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRp%2BmQDKauE4nIg%2FgknZHuBlLkfKgQUzolPglGqFaKEYsoxI2HSYfv4%2FngCECXQy517DWxwDNrkPSQ6scY%3D	unknown	—	—	whitelisted
5084	WebCompanion.exe	GET	200	64.18.87.82:80	http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240701	unknown	—	—	whitelisted
5084	WebCompanion.exe	GET	200	2.23.198.32:80	http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
2680	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4088	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6348	WebCompanion-Installer.exe	104.16.149.130:80	geo.lavasoft.com	CLOUDFLARENET	—	unknown
6348	WebCompanion-Installer.exe	104.16.148.130:443	geo.lavasoft.com	CLOUDFLARENET	—	unknown
6348	WebCompanion-Installer.exe	104.18.27.149:443	flwadw.com	CLOUDFLARENET	—	shared
4	System	192.168.100.255:137	—	—	—	whitelisted
2680	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 40.127.240.158 51.124.78.146	whitelisted
google.com	142.250.186.174	whitelisted
geo.lavasoft.com	104.16.149.130 104.16.148.130	whitelisted
featureflags.lavasoft.com	104.16.148.130 104.16.149.130	whitelisted
flwadw.com	104.18.27.149 104.18.26.149	unknown
wcdownloadercdn.lavasoft.com	104.16.148.130 104.16.149.130	whitelisted
www.bing.com	2.23.209.156 2.23.209.135 2.23.209.149 2.23.209.143 2.23.209.150 2.23.209.141 2.23.209.155 2.23.209.136 2.23.209.154 95.100.146.11 95.100.146.40 95.100.146.35 95.100.146.32 95.100.146.10 95.100.146.34 95.100.146.16 95.100.146.27 95.100.146.33	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	20.190.159.64 40.126.31.69 20.190.159.4 20.190.159.75 20.190.159.0 20.190.159.2 40.126.31.71 20.190.159.23	whitelisted
client.wns.windows.com	40.113.103.199	whitelisted

Threats

PID	Process	Class	Message
5084	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
5084	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
5084	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
2128	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
2128	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
5084	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion

Add for printing

Process	Message
WebCompanion-Installer.exe	Failed to OpenWcfHost: System.ServiceModel.AddressAccessDeniedException: HTTP could not register URL http://+:9008/webcompanion/. Your process does not have access rights to this namespace (see http://go.microsoft.com/fwlink/?LinkId=70353 for details). ---> System.Net.HttpListenerException: Access is denied at System.Net.HttpListener.AddAllPrefixes() at System.Net.HttpListener.Start() at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() --- End of inner exception stack trace --- at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() at System.ServiceModel.Channels.TransportManager.Open(TransportChannelListener channelListener) at System.ServiceModel.Channels.TransportManagerContainer.Open(SelectTransportManagersCallback selectTransportManagerCallback) at System.ServiceModel.Channels.TransportChannelListener.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.HttpChannelListener`1.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at WebCompanionInstaller.App.OpenInstallerWcfHost()
WebCompanion-Installer.exe	Detecting windows culture
WebCompanion-Installer.exe	Preparing request for featureflag: {"Geo":"RO","Partner":"IN240701","Campaign":"18022583703","InstallDate":"20240806","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
WebCompanion-Installer.exe	Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklist\", \"WhiteList\": \"https://acs.lavasoft.com/api/v2/url/permanentwhitelist\", \"DisplayName\": \"Web Protection\", \"FeatureName\": \"WebProtection\"}","targetId":241}]
WebCompanion-Installer.exe	8/6/2024 10:21:47 AM :-> Start
WebCompanion-Installer.exe	Failed to report progress in SendPostRequest: System.Net.WebException: The remote server returned an error: (400) Bad Request. at System.Net.HttpWebRequest.GetResponse() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanion-Installer.exe	8/6/2024 10:21:48 AM :-> Starting installer 13.900.0.1080 with: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240701 --nonadmin --direct --tych --campaign=18022583703 --version=13.900.0.1080, Run as admin: False
WebCompanion-Installer.exe	SecurityProtocol set toTls, Tls11, Tls12, Tls13
WebCompanion-Installer.exe	Preparing for installing Web Companion
WebCompanion-Installer.exe	8/6/2024 10:21:50 AM :-> Generating Machine and Install Id ...

General Info

Setup (1).exe

6AA26713B6FC04BD996EDC4A348F34F1

31550ADDD14FF8D7E030471DB7B635B585D54C45

188D6A347B29CA8B46732DA54AAC8AE93017F30279AA0FBF34E7A1A19C26C7A4

24576:g6VnvKTGAqFnBge5g5DJAEHHi+aedECyTiwRd8BK94X:g6VnvKSAqFnBge5g5DJAEHHi+aedECyE

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Steals credentials from Web Browsers

ADAWARE has been detected (SURICATA)

Changes the autorun value in the registry

Actions looks like stealing of personal data

SUSPICIOUS

Executable content was dropped or overwritten

Searches for installed software

Process drops legitimate windows executable

Reads security settings of Internet Explorer

Drops 7-zip archiver for unpacking

The process drops C-runtime libraries

The process creates files with name similar to system file names

Starts CMD.EXE for commands execution

Reads the date of Windows installation

Changes internet zones settings

Suspicious use of NETSH.EXE

Checks Windows Trust Settings

Creates a software uninstall entry

Access to an unwanted program domain was detected

The process checks if it is being run in the virtual environment

INFO

Checks supported languages

Creates files or folders in the user directory

Disables trace logs

Reads Environment values

Create files in a temporary directory

Checks proxy server information

Reads the machine GUID from the registry

Reads the software policy settings

Reads the computer name

Process checks computer location settings

Creates files in the program directory

Application launched itself

The process uses the downloaded file

Executable content was dropped or overwritten

Drops the executable file immediately after the start

Reads Microsoft Office registry keys

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules