File name:

aksdiag32_setup.exe

Full analysis: https://app.any.run/tasks/e212ca40-99f1-44fb-abc0-4ce041d44387
Verdict: Malicious activity
Analysis date: July 29, 2024, 19:22:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C1C93353A70B89092A9964962B9A860C

SHA1:

8932C99E03F54914DA99704114E1D45DD935024F

SHA256:

18F6BE3B2AD550598ACFB442BF57550A7F0D812CE35C22756AEEEAA368039606

SSDEEP:

98304:9WkvCxB54ePHuzVXxWEznLZMVHH5Bigyo0mRKFAq3gHygD3sjPJr9aR9z3mKWgxi:oxyavq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • aksdiag32_setup.exe (PID: 4912)
      • GLB259.tmp (PID: 4840)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • aksdiag32_setup.exe (PID: 4912)
      • GLB259.tmp (PID: 4840)

    • Starts application with an unusual extension

      • aksdiag32_setup.exe (PID: 4912)

    • Searches for installed software

      • GLB259.tmp (PID: 4840)

    • Creates a software uninstall entry

      • GLB259.tmp (PID: 4840)

    • The process checks if it is being run in the virtual environment

      • diagnostix.exe (PID: 1544)

  • INFO

    • Create files in a temporary directory

      • aksdiag32_setup.exe (PID: 4912)
      • GLB259.tmp (PID: 4840)

    • Reads the computer name

      • GLB259.tmp (PID: 4840)
      • diagnostix.exe (PID: 1544)

    • Checks supported languages

      • GLB259.tmp (PID: 4840)
      • aksdiag32_setup.exe (PID: 4912)
      • diagnostix.exe (PID: 1544)

    • Creates files in the program directory

      • GLB259.tmp (PID: 4840)
      • diagnostix.exe (PID: 1544)

    • Manual execution by a user

      • diagnostix.exe (PID: 736)
      • diagnostix.exe (PID: 1544)

    • Creates files or folders in the user directory

      • GLB259.tmp (PID: 4840)

    • UPX packer has been detected

      • diagnostix.exe (PID: 1544)

    • Checks proxy server information

      • slui.exe (PID: 1712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1999:04:08 20:24:47+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 512
InitializedDataSize: 2111488
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.10.0.0
ProductVersionNumber: 1.10.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows 16-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Aladdin Knowledge Systems
FileDescription: Aladdin DiagnostiX Setup
FileVersion: 1.1
LegalCopyright: Aladdin Knowledge Systems Ltd. ©婍
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start aksdiag32_setup.exe glb259.tmp slui.exe diagnostix.exe no specs THREAT diagnostix.exe aksdiag32_setup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\Program Files (x86)\Aladdin\DiagnostiX\diagnostix.exe" C:\Program Files (x86)\Aladdin\DiagnostiX\diagnostix.exe—explorer.exe
User:
admin
Company:
Aladdin Knowledge Systems Ltd.
Integrity Level:
MEDIUM
Description:
Aladdin DiagnostiX
Exit code:
3221226540
Version:
1.10
Modules
Images
c:\program files (x86)\aladdin\diagnostix\diagnostix.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1544"C:\Program Files (x86)\Aladdin\DiagnostiX\diagnostix.exe" C:\Program Files (x86)\Aladdin\DiagnostiX\diagnostix.exe
explorer.exe
User:
admin
Company:
Aladdin Knowledge Systems Ltd.
Integrity Level:
HIGH
Description:
Aladdin DiagnostiX
Version:
1.10
Modules
Images
c:\program files (x86)\aladdin\diagnostix\diagnostix.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1712C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4032"C:\Users\admin\AppData\Local\Temp\aksdiag32_setup.exe" C:\Users\admin\AppData\Local\Temp\aksdiag32_setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\aksdiag32_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4840C:\Users\admin\AppData\Local\Temp\GLB259.tmp 4736 C:\Users\admin\AppData\Local\Temp\AKSDIA~1.EXEC:\Users\admin\AppData\Local\Temp\GLB259.tmp
aksdiag32_setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\glb259.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
4912"C:\Users\admin\AppData\Local\Temp\aksdiag32_setup.exe" C:\Users\admin\AppData\Local\Temp\aksdiag32_setup.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\aksdiag32_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
4 676
Read events
4 637
Write events
38
Delete events
1

Modification events

(PID) Process:(4840) GLB259.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aladdin DiagnostiX 1.10
Operation:writeName:DisplayName
Value:
Aladdin DiagnostiX 1.10
(PID) Process:(4840) GLB259.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Aladdin DiagnostiX 1.10
Operation:writeName:UninstallString
Value:
C:\PROGRA~2\Aladdin\DIAGNO~1\UNWISE.EXE C:\PROGRA~2\Aladdin\DIAGNO~1\INSTALL.LOG
(PID) Process:(4840) GLB259.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Aladdin Knowledge Systems\diagnostix\reporting
Operation:writeName:rep1call
Value:
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe /nfo conflicts.nfo /categories +resourcesforcedhardware+resourcesconflicts+resourcesio+componentsnetwork+componentsports+componentsproblemdevices+swenvstartupprograms
(PID) Process:(4840) GLB259.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Aladdin Knowledge Systems\diagnostix\reporting
Operation:writeName:rep1output
Value:
conflicts.nfo
(PID) Process:(4840) GLB259.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aladdin Knowledge Systems\diagnostix\reporting
Operation:writeName:rep1call
Value:
%CommonProgramFiles%\Microsoft Shared\MSInfo\msinfo32.exe /nfo conflicts.nfo /categories +resourcesforcedhardware+resourcesconflicts+resourcesio+componentsnetwork+componentsports+componentsproblemdevices+swenvstartupprograms
(PID) Process:(4840) GLB259.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aladdin Knowledge Systems\diagnostix\reporting
Operation:writeName:rep1output
Value:
conflicts.nfo
(PID) Process:(4840) GLB259.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Aladdin Knowledge Systems\diagnostix\general
Operation:writeName:language
Value:
en
(PID) Process:(4840) GLB259.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Aladdin Knowledge Systems\diagnostix\general
Operation:writeName:update
Value:
1
(PID) Process:(4840) GLB259.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Aladdin Knowledge Systems\diagnostix\general
Operation:writeName:modehl
Value:
1
(PID) Process:(4840) GLB259.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Aladdin Knowledge Systems\diagnostix\general
Operation:writeName:modehs
Value:
1
Executable files
15
Suspicious files
1
Text files
7
Unknown types
10

Dropped files

PID
Process
Filename
Type
4912aksdiag32_setup.exeC:\Users\admin\AppData\Local\Temp\GLB259.tmpexecutable
MD5:D60B36FD1A8ADCFF4376C2C8C45A14B7
SHA256:66D5A47DC12E49F31602AA5186B57FB316BDFF8FE3BD3C6228BD6400B1BC3DB0
4840GLB259.tmpC:\Users\admin\AppData\Local\Temp\GLC2E6.tmpexecutable
MD5:5758CB6E80BEE4CDA2944BAA83C9701C
SHA256:BB302CB17EC1ABF9E78B97CF88CDA4651AB754B073897966B3550BDA6E044964
4840GLB259.tmpC:\Program Files (x86)\Aladdin\DiagnostiX\UNWISE.EXEexecutable
MD5:1DE69F64E93FD216267DF5EF8B5F1067
SHA256:0C4FA4E51F3F902E93BAA5033B1667BD9D270C16EC48C189882DE36ABB7B394F
4840GLB259.tmpC:\Program Files (x86)\Aladdin\DiagnostiX\~GLH0001.TMPexecutable
MD5:1DE69F64E93FD216267DF5EF8B5F1067
SHA256:0C4FA4E51F3F902E93BAA5033B1667BD9D270C16EC48C189882DE36ABB7B394F
4840GLB259.tmpC:\Users\admin\AppData\Local\Temp\GLW52A.tmptext
MD5:ADB7A31B90CE22BE572A0AA1B14A4956
SHA256:E1406F3BE4AA18B697C62E4760CEE0214BF0AD46DB5986961D042DE6F9EC561A
4840GLB259.tmpC:\Users\admin\AppData\Local\Temp\GLFF00.tmpexecutable
MD5:C076A7ECBB81FCAA384D8B2835DA97FF
SHA256:0DC33C87623E0AB1049A3AE27E73AD915B1E4719D15EB229920598D4DCAF46FC
4840GLB259.tmpC:\Program Files (x86)\Aladdin\DiagnostiX\diagnostix.exeexecutable
MD5:A1F81896D8890EF888788B65CE992EDF
SHA256:7BC70616A1588D2A8F6A75B81DD89F0F3082F961E806D014060BCB87E5A449C6
4840GLB259.tmpC:\Program Files (x86)\Aladdin\DiagnostiX\~GLH0003.TMPexecutable
MD5:A1F81896D8890EF888788B65CE992EDF
SHA256:7BC70616A1588D2A8F6A75B81DD89F0F3082F961E806D014060BCB87E5A449C6
4840GLB259.tmpC:\Program Files (x86)\Aladdin\DiagnostiX\temp.000executable
MD5:A1F81896D8890EF888788B65CE992EDF
SHA256:7BC70616A1588D2A8F6A75B81DD89F0F3082F961E806D014060BCB87E5A449C6
4840GLB259.tmpC:\Users\admin\AppData\Local\Temp\GLK315.tmpexecutable
MD5:3DF61E5730883B2D338ADDD7ACBE4BC4
SHA256:2EFE9A54C8EB878711D9B6CD18F276838645AFF52FE69D8A864376CB258EC616
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
51
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6964
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
131.253.33.254:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.23.209.186:443
www.bing.com
Akamai International B.V.
GB
unknown
3656
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6744
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2616
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6588
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.209.186
  • 2.23.209.161
  • 2.23.209.177
  • 2.23.209.182
  • 2.23.209.183
  • 2.23.209.185
  • 2.23.209.160
  • 2.23.209.176
  • 2.23.209.158
  • 104.126.37.163
  • 104.126.37.162
  • 104.126.37.153
  • 104.126.37.170
  • 104.126.37.146
  • 104.126.37.161
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.155
whitelisted
google.com
  • 172.217.16.206
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.42
whitelisted
fp.msedge.net
  • 204.79.197.222
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.20
  • 40.126.32.133
  • 20.190.160.17
  • 40.126.32.74
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
th.bing.com
  • 92.123.104.64
  • 92.123.104.51
  • 92.123.104.47
  • 92.123.104.44
  • 92.123.104.61
  • 92.123.104.65
  • 92.123.104.60
  • 92.123.104.52
  • 92.123.104.59
  • 104.126.37.171
  • 104.126.37.131
  • 104.126.37.170
  • 104.126.37.128
  • 104.126.37.178
  • 104.126.37.177
  • 104.126.37.130
  • 104.126.37.162
  • 104.126.37.163
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
aksdiag32_setup.exe