Malware analysis Setup (1).exe Malicious activity | ANY.RUN

Add for printing

File name:	Setup (1).exe
Full analysis:	https://app.any.run/tasks/e97fd210-ae3d-4031-aef1-3a50f1c530e8
Verdict:	Malicious activity
Threats:	Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. Malware Trends Tracker >>>
Analysis date:	August 06, 2024, 12:13:43
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	adware adaware stealer
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	6AA26713B6FC04BD996EDC4A348F34F1
SHA1:	31550ADDD14FF8D7E030471DB7B635B585D54C45
SHA256:	188D6A347B29CA8B46732DA54AAC8AE93017F30279AA0FBF34E7A1A19C26C7A4
SSDEEP:	24576:g6VnvKTGAqFnBge5g5DJAEHHi+aedECyTiwRd8BK94X:g6VnvKSAqFnBge5g5DJAEHHi+aedECyE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - Setup (1).exe (PID: 6284)
  - WebCompanion-Installer.exe (PID: 6308)
- Steals credentials from Web Browsers
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- Changes the autorun value in the registry
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- ADAWARE has been detected (SURICATA)
  - WebCompanion.exe (PID: 2228)
- Actions looks like stealing of personal data
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
SUSPICIOUS
- Executable content was dropped or overwritten
  - Setup (1).exe (PID: 6284)
  - WebCompanion-Installer.exe (PID: 6308)
- Searches for installed software
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 5900)
  - WebCompanion.exe (PID: 2228)
- Reads security settings of Internet Explorer
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- Process drops legitimate windows executable
  - WebCompanion-Installer.exe (PID: 6308)
- The process drops C-runtime libraries
  - WebCompanion-Installer.exe (PID: 6308)
- Drops 7-zip archiver for unpacking
  - WebCompanion-Installer.exe (PID: 6308)
- Changes internet zones settings
  - WebCompanion-Installer.exe (PID: 6308)
- Reads the date of Windows installation
  - WebCompanion-Installer.exe (PID: 6308)
- Creates a software uninstall entry
  - WebCompanion-Installer.exe (PID: 6308)
- Starts CMD.EXE for commands execution
  - WebCompanion-Installer.exe (PID: 6308)
- Suspicious use of NETSH.EXE
  - cmd.exe (PID: 3864)
- Checks Windows Trust Settings
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- The process creates files with name similar to system file names
  - WebCompanion-Installer.exe (PID: 6308)
- Access to an unwanted program domain was detected
  - WebCompanion.exe (PID: 2228)
- The process checks if it is being run in the virtual environment
  - WebCompanion.exe (PID: 5900)
INFO
- Create files in a temporary directory
  - Setup (1).exe (PID: 6284)
  - WebCompanion-Installer.exe (PID: 6308)
- Checks supported languages
  - Setup (1).exe (PID: 6284)
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
  - TextInputHost.exe (PID: 7604)
- Reads the computer name
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
  - TextInputHost.exe (PID: 7604)
- Reads the machine GUID from the registry
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- Reads Environment values
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- Creates files or folders in the user directory
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- Disables trace logs
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 5900)
  - WebCompanion.exe (PID: 2228)
- Checks proxy server information
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- Reads the software policy settings
  - WebCompanion-Installer.exe (PID: 6308)
  - WebCompanion.exe (PID: 2228)
  - WebCompanion.exe (PID: 5900)
- Creates files in the program directory
  - WebCompanion.exe (PID: 2228)
- Process checks computer location settings
  - WebCompanion-Installer.exe (PID: 6308)
- The process uses the downloaded file
  - chrome.exe (PID: 7704)
  - chrome.exe (PID: 7264)
  - chrome.exe (PID: 7764)
  - chrome.exe (PID: 7912)
  - chrome.exe (PID: 8016)
  - chrome.exe (PID: 8184)
  - chrome.exe (PID: 3904)
  - chrome.exe (PID: 7276)
- Application launched itself
  - chrome.exe (PID: 5300)
- Reads Microsoft Office registry keys
  - chrome.exe (PID: 5300)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	InstallShield setup (33)
.exe	\|	Win32 Executable MS Visual C++ (generic) (23.9)
.exe	\|	Win64 Executable (generic) (21.2)
.scr	\|	Windows screen saver (10)
.dll	\|	Win32 Dynamic Link Library (generic) (5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2011:04:18 18:54:06+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	104448
InitializedDataSize:	60416
UninitializedDataSize:	-
EntryPoint:	0x148d4
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	13.900.0.1080
ProductVersionNumber:	13.900.0.1080
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
FileVersion:	13.900.0.1080
ProductVersion:	13.900.0.1080
CompanyName:	Lavasoft
FileDescription:	Web Companion Installer
InternalName:	Installer.exe
LegalCopyright:	c Lavasoft Limited. All Rights Reserved.
OriginalFileName:	Installer.exe
ProductName:	Web Companion Installer

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

169

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1432

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2076 --field-trial-handle=1944,i,12316349216868089731,8975233734406500793,262144 --variations-seed-version /prefetch:3

C:\Program Files\Google\Chrome\Application\chrome.exe

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

1644

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

1984

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3312 --field-trial-handle=1944,i,12316349216868089731,8975233734406500793,262144 --variations-seed-version /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

2228

"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=

C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

WebCompanion-Installer.exe

User:

admin

Company:

Lavasoft

Integrity Level:

MEDIUM

Description:

Web Companion

Exit code:

Version:

13.900.0.1080

Modules

Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

3864

"C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone

C:\Windows\SysWOW64\cmd.exe

—

WebCompanion-Installer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll

3904

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5480 --field-trial-handle=1944,i,12316349216868089731,8975233734406500793,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

5104

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2344 --field-trial-handle=1944,i,12316349216868089731,8975233734406500793,262144 --variations-seed-version /prefetch:8

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

5300

"C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN240701&campaign=18022583703&

C:\Program Files\Google\Chrome\Application\chrome.exe

WebCompanion-Installer.exe

User:

admin

Company:

Google LLC

Integrity Level:

MEDIUM

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

5796

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3148 --field-trial-handle=1944,i,12316349216868089731,8975233734406500793,262144 --variations-seed-version /prefetch:1

C:\Program Files\Google\Chrome\Application\chrome.exe

—

chrome.exe

User:

admin

Company:

Google LLC

Integrity Level:

LOW

Description:

Google Chrome

Exit code:

Version:

122.0.6261.70

Modules

Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll

5900

"C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall

C:\Users\admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe

WebCompanion-Installer.exe

User:

admin

Company:

Lavasoft

Integrity Level:

MEDIUM

Description:

Web Companion

Version:

13.900.0.1080

Modules

Images
c:\users\admin\appdata\roaming\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

Add for printing

Total events

46 921

Read events

46 741

Write events

175

Delete events

Modification events


(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Lavasoft\Web Companion
Operation:	write	Name:	MachineId
Value: ad1f12af-3f36-3c28-b351-2ce4355f42c2
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(6308) WebCompanion-Installer.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\WebCompanion-Installer_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0

Add for printing

Executable files

Suspicious files

184

Text files

102

Unknown types

Dropped files

PID	Process	Filename		Type
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\ICSharpCode.SharpZipLib.dll		executable
		MD5:0CFE19791546A96C6699657A94604596	SHA256:56FDFD148F0D60805B2873A5A49739909001D11789B75DAB2B0EA8E55BC60913
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\Newtonsoft.Json.dll		executable
		MD5:461C476F474A5F13D2EA9344AE6F70F6	SHA256:4F0EC6439B24652F16DF066F4A38B64518B5A874080EDA63DE45968545830F67
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\ja-JP\WebCompanion-Installer.resources.dll		executable
		MD5:442654050F5E5EBFB286C75A6AD10485	SHA256:B85CC7BA82B58AFD8FA00DFCCD820B5B34BC14A942EBDAB5380FCE8F7257C0AE
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\fr-CA\WebCompanion-Installer.resources.dll		executable
		MD5:07759138B75C31E8E62E2DCB9E5B4121	SHA256:460E0EA0F891B4A7D8FCF4D7C1DAF4034B1A8C01F35C55B87C4DE4D34F7E1119
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\de-DE\WebCompanion-Installer.resources.dll		executable
		MD5:A564D6AE745D289B599A010E570E609E	SHA256:E20A9695E1322491C57C8A0E61839E5AEEBA40F43AAB400C29F19531D18FA037
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\pt-BR\WebCompanion-Installer.resources.dll		executable
		MD5:01CCD85F0676258B5E4A223832E3258C	SHA256:C482D074CFDA0B6921A6750F0CCC1279BA6FCFB9D2037CA6EAAF704D8DAF811F
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\en-US\WebCompanion-Installer.resources.dll		executable
		MD5:88498F281D2BC857F09C3A0EFFE97A35	SHA256:2FBD9C10CEC246D5E6EE2F41635F283C3064773724253BAE598BFAEA735B702D
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\WebCompanion-Installer.exe		executable
		MD5:A27F9713DB1688D03D2082BFA1827803	SHA256:2F86EB0D3902A11DA1F534D9734DABAE37D33E2C57B03F968198A1CFC2E652A9
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\it-IT\WebCompanion-Installer.resources.dll		executable
		MD5:320A49D5E8C225BF7D8C8FC8F0FBA1FE	SHA256:53F48BF5DEB5FB756EB61D5EE78BB72EF4509ADB396EB40BEF9671ECAA8D9819
6284	Setup (1).exe	C:\Users\admin\AppData\Local\Temp\7zSC8871E2E\es-ES\WebCompanion-Installer.resources.dll		executable
		MD5:A22C9231A5562DCA9F0BC186BDA3348D	SHA256:AF899C47BDE2A325F3F9F22772F4E305F6B50EAF040670DE508226FEFBED649B

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6308	WebCompanion-Installer.exe	GET	200	104.16.148.130:80	http://geo.lavasoft.com/	unknown	—	—	whitelisted
6308	WebCompanion-Installer.exe	GET	200	104.16.148.130:80	http://geo.lavasoft.com/	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
5092	svchost.exe	GET	304	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
5092	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
6956	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6904	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
2228	WebCompanion.exe	GET	200	104.16.148.130:80	http://geo.lavasoft.com/	unknown	—	—	whitelisted
2228	WebCompanion.exe	GET	200	64.18.87.81:80	http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240701	unknown	—	—	whitelisted
2228	WebCompanion.exe	GET	200	64.18.87.81:80	http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=IN240701_wb	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4064	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1060	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
6308	WebCompanion-Installer.exe	104.16.148.130:80	geo.lavasoft.com	CLOUDFLARENET	—	unknown
6308	WebCompanion-Installer.exe	104.16.148.130:443	geo.lavasoft.com	CLOUDFLARENET	—	unknown
6308	WebCompanion-Installer.exe	104.18.27.149:443	flwadw.com	CLOUDFLARENET	—	shared
4	System	192.168.100.255:137	—	—	—	whitelisted
4064	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 4.231.128.59 40.127.240.158	whitelisted
google.com	142.250.185.206	whitelisted
geo.lavasoft.com	104.16.148.130 104.16.149.130	whitelisted
featureflags.lavasoft.com	104.16.148.130 104.16.149.130	whitelisted
flwadw.com	104.18.27.149 104.18.26.149	unknown
wcdownloadercdn.lavasoft.com	104.16.149.130 104.16.148.130	whitelisted
www.bing.com	95.100.146.11 95.100.146.32 95.100.146.16 95.100.146.8 95.100.146.34 95.100.146.27 95.100.146.33 95.100.146.17 95.100.146.18 95.100.146.25 95.100.146.19 95.100.146.40	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
login.live.com	20.190.160.22 40.126.32.72 40.126.32.68 40.126.32.138 20.190.160.17 40.126.32.134 20.190.160.20 40.126.32.136	whitelisted
client.wns.windows.com	40.113.110.67	whitelisted

Threats

PID	Process	Class	Message
2228	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
2228	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
2228	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion
1432	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
1432	chrome.exe	Not Suspicious Traffic	INFO [ANY.RUN] Google Hosted Libraries (ajax .googleapis .com)
2228	WebCompanion.exe	Possibly Unwanted Program Detected	ADWARE [ANY.RUN] Adaware Web Companion

Add for printing

Process	Message
WebCompanion-Installer.exe	Failed to OpenWcfHost: System.ServiceModel.AddressAccessDeniedException: HTTP could not register URL http://+:9008/webcompanion/. Your process does not have access rights to this namespace (see http://go.microsoft.com/fwlink/?LinkId=70353 for details). ---> System.Net.HttpListenerException: Access is denied at System.Net.HttpListener.AddAllPrefixes() at System.Net.HttpListener.Start() at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() --- End of inner exception stack trace --- at System.ServiceModel.Channels.SharedHttpTransportManager.OnOpen() at System.ServiceModel.Channels.TransportManager.Open(TransportChannelListener channelListener) at System.ServiceModel.Channels.TransportManagerContainer.Open(SelectTransportManagersCallback selectTransportManagerCallback) at System.ServiceModel.Channels.TransportChannelListener.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.HttpChannelListener`1.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.Dispatcher.ChannelDispatcher.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at System.ServiceModel.ServiceHostBase.OnOpen(TimeSpan timeout) at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout) at WebCompanionInstaller.App.OpenInstallerWcfHost()
WebCompanion-Installer.exe	Detecting windows culture
WebCompanion-Installer.exe	Preparing request for featureflag: {"Geo":"DE","Partner":"IN240701","Campaign":"18022583703","InstallDate":"20240806","TriggerType":"install","TriggerEvent":"installer","Version":"13.900.0.1080","featurewp":true,"featureal":true}
WebCompanion-Installer.exe	Getting response from featureflag: [{"sectionCode":"WAC","code":"WAC","configuration":"{\"Icon\": \"https://webcompanion.com/images/favicon.ico\", \"AppName\": \"Web Companion\", \"Settings\": [\"WCAutoUpdate\", \"EnableGranularity\", \"PostRunV2Action\", \"PostRunTimerAction\", \"EnableTelemetryScan\", \"EnableWebProtection\", \"EnableDynamicNotification\"], \"CompanyName\": \"Lavasoft\", \"ConfigVersion\": \"v1\", \"CurrentVersion\": \"9.3.0\", \"IsNewUpdaterService\": true}","targetId":301},{"sectionCode":"WFAI","code":"WCP","configuration":"{\"Version\": \"3.0.2.12\", \"FilePath\": \"https://rt.webcompanion.com/notifications/download/rt/dci/latest/Webprotection.zip\", \"BlackList\": \"https://acs.lavasoft.com/api/v2/url/blacklist\", \"WhiteList\": \"https://acs.lavasoft.com/api/v2/url/permanentwhitelist\", \"DisplayName\": \"Web Protection\", \"FeatureName\": \"WebProtection\"}","targetId":241}]
WebCompanion-Installer.exe	8/6/2024 12:13:55 PM :-> Start
WebCompanion-Installer.exe	Failed to report progress in SendPostRequest: System.Net.WebException: The remote server returned an error: (400) Bad Request. at System.Net.HttpWebRequest.GetResponse() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanion-Installer.exe	8/6/2024 12:13:56 PM :-> Starting installer 13.900.0.1080 with: .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN240701 --nonadmin --direct --tych --campaign=18022583703 --version=13.900.0.1080, Run as admin: False
WebCompanion-Installer.exe	SecurityProtocol set toTls, Tls11, Tls12, Tls13
WebCompanion-Installer.exe	Preparing for installing Web Companion
WebCompanion-Installer.exe	8/6/2024 12:13:57 PM :-> Generating Machine and Install Id ...

General Info

Setup (1).exe

6AA26713B6FC04BD996EDC4A348F34F1

31550ADDD14FF8D7E030471DB7B635B585D54C45

188D6A347B29CA8B46732DA54AAC8AE93017F30279AA0FBF34E7A1A19C26C7A4

24576:g6VnvKTGAqFnBge5g5DJAEHHi+aedECyTiwRd8BK94X:g6VnvKSAqFnBge5g5DJAEHHi+aedECyE

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

Steals credentials from Web Browsers

Changes the autorun value in the registry

ADAWARE has been detected (SURICATA)

Actions looks like stealing of personal data

SUSPICIOUS

Executable content was dropped or overwritten

Searches for installed software

Reads security settings of Internet Explorer

Process drops legitimate windows executable

The process drops C-runtime libraries

Drops 7-zip archiver for unpacking

Changes internet zones settings

Reads the date of Windows installation

Creates a software uninstall entry

Starts CMD.EXE for commands execution

Suspicious use of NETSH.EXE

Checks Windows Trust Settings

The process creates files with name similar to system file names

Access to an unwanted program domain was detected

The process checks if it is being run in the virtual environment

INFO

Create files in a temporary directory

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Reads Environment values

Creates files or folders in the user directory

Disables trace logs

Checks proxy server information

Reads the software policy settings

Creates files in the program directory

Process checks computer location settings

The process uses the downloaded file

Application launched itself

Reads Microsoft Office registry keys

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events