URL:

http://acs.pandasoftware.com/Panda/FREEAV/181305/FREEAV.exe

Full analysis: https://app.any.run/tasks/92e09630-5373-4c24-8186-ccb10d446c9f
Verdict: Malicious activity
Analysis date: May 30, 2018, 18:57:38
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

A3283C59F7C3252993FE87A121EA38EE

SHA1:

89DBB2D226C767FD5B832981B3DD2298DA9A05B8

SHA256:

198D2115F0DCEAB399F540BE638574BB8CDFA693E70B4156C49D17EAD3DB0D70

SSDEEP:

3:N1Kf05FJLghxUknACn:Cs9U3UknAC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes settings of System certificates

      • setup.exe (PID: 1620)

    • Loads dropped or rewritten executable

      • setup.exe (PID: 1620)
      • PSANCU.exe (PID: 2684)
      • Hydra.Sdk.Windows.Service.exe (PID: 3984)
      • csrss.exe (PID: 400)
      • PSANCU.exe (PID: 3976)

    • Application was dropped or rewritten from another process

      • PSANCU.exe (PID: 2684)
      • tracelog.exe (PID: 2952)
      • PSINAN~1.EXE (PID: 900)
      • PSANCU.exe (PID: 3976)
      • Hydra.Sdk.Windows.Service.exe (PID: 3984)

  • SUSPICIOUS

    • Creates files in the program directory

      • setup.exe (PID: 1620)
      • tracelog.exe (PID: 2952)
      • PSINAN~1.EXE (PID: 900)
      • Hydra.Sdk.Windows.Service.exe (PID: 3984)
      • PSANCU.exe (PID: 3976)
      • FREEAV[1].exe (PID: 3056)

    • Adds / modifies Windows certificates

      • setup.exe (PID: 1620)

    • Creates files in the user directory

      • PSANCU.exe (PID: 2684)

    • Reads Internet Cache Settings

      • setup.exe (PID: 1620)

    • Executable content was dropped or overwritten

      • MsiExec.exe (PID: 2828)
      • FREEAV[1].exe (PID: 3056)
      • msiexec.exe (PID: 3932)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 3932)

    • Creates files in the driver directory

      • msiexec.exe (PID: 3932)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 3932)

    • Changes IE settings (feature browser emulation)

      • MsiExec.exe (PID: 2684)

    • Creates COM task schedule object

      • MsiExec.exe (PID: 2684)

    • Creates or modifies windows services

      • Hydra.Sdk.Windows.Service.exe (PID: 3984)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3932)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2884)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2912)

    • Dropped object may contain URL's

      • iexplore.exe (PID: 2912)
      • iexplore.exe (PID: 2884)
      • MsiExec.exe (PID: 2828)
      • FREEAV[1].exe (PID: 3056)
      • msiexec.exe (PID: 3932)

    • Dropped object may contain Bitcoin addresses

      • FREEAV[1].exe (PID: 3056)
      • msiexec.exe (PID: 3932)

    • Application launched itself

      • msiexec.exe (PID: 3932)

    • Creates files in the program directory

      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 2684)
      • msiexec.exe (PID: 3932)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 2684)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3932)

    • Creates or modifies windows services

      • msiexec.exe (PID: 3932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
14
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start iexplore.exe iexplore.exe freeav[1].exe no specs freeav[1].exe setup.exe tracelog.exe no specs psancu.exe no specs msiexec.exe msiexec.exe psinan~1.exe no specs msiexec.exe no specs csrss.exe no specs psancu.exe no specs hydra.sdk.windows.service.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
400%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16C:\Windows\System32\csrss.exe——
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Client Server Runtime Process
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\csrsrv.dll
c:\windows\system32\basesrv.dll
c:\windows\system32\winsrv.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\lpk.dll
900"C:\Users\admin\AppData\Local\Temp\{A7289~1\PSINAN~1.EXE" /LogFile:"C:\ProgramData\Panda Security\PSLogs\PSINanoRun.exe_7242.Log"| /GetSO:"C:\Users\admin\AppData\Local\Temp\{A72890C6-04C4-4B0B-BC93-2F6C70B3F157}\SO.ini"|C:\Users\admin\AppData\Local\Temp\{A7289~1\PSINAN~1.EXE—MsiExec.exe
User:
admin
Company:
Panda Security, S.L.
Integrity Level:
HIGH
Description:
Panda Setup Bootstrap Run Utilities
Exit code:
0
Version:
7.7.5.0
Modules
Images
c:\users\admin\appdata\local\temp\{a7289~1\psinan~1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1568"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LM4BD81N\FREEAV[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LM4BD81N\FREEAV[1].exe—iexplore.exe
User:
admin
Company:
Panda Security, S.L.
Integrity Level:
MEDIUM
Description:
Panda Security SFX
Exit code:
3221226540
Version:
15.14.4.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\lm4bd81n\freeav[1].exe
c:\systemroot\system32\ntdll.dll
1620".\setup.exe" C:\Users\admin\AppData\Local\Temp\7zS0FBF3E14\setup.exe
FREEAV[1].exe
User:
admin
Company:
Panda Security, S.L.
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
7.7.20.0
Modules
Images
c:\users\admin\appdata\local\temp\7zs0fbf3e14\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2684"C:\Users\admin\AppData\Local\Temp\7zS0FBF3E14\Program Files\Panda Security\Panda Cloud Antivirus\PSANCU.exe" /applycustom /wd:"C:\Users\admin\AppData\Local\Temp\7zS0FBF3E14\"C:\Users\admin\AppData\Local\Temp\7zS0FBF3E14\Program Files\Panda Security\Panda Cloud Antivirus\PSANCU.exe—setup.exe
User:
admin
Company:
Panda Security, S.L.
Integrity Level:
HIGH
Description:
Panda Security Application CU
Exit code:
0
Version:
4.0.3.2
Modules
Images
c:\users\admin\appdata\local\temp\7zs0fbf3e14\program files\panda security\panda cloud antivirus\psancu.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2684C:\Windows\system32\MsiExec.exe -Embedding CF86D789DFF3461C624DB2334627F581 M Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\7zs0fbf3e14\program files\panda security\panda cloud antivirus\msvcp100.dll
c:\users\admin\appdata\local\temp\7zs0fbf3e14\program files\panda security\panda cloud antivirus\pskalloc.dll
c:\users\admin\appdata\local\temp\7zs0fbf3e14\program files\panda security\panda cloud antivirus\psnccfgstore.dll
c:\users\admin\appdata\local\temp\7zs0fbf3e14\program files\panda security\panda cloud antivirus\psnxml.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\userenv.dll
c:\windows\system32\cryptsp.dll
c:\users\admin\appdata\local\temp\7zs0fbf3e14\program files\panda security\panda cloud antivirus\psncrypt.dll
c:\users\admin\appdata\local\temp\7zs0fbf3e14\program files\panda security\panda cloud antivirus\psnfiles.dll
2828C:\Windows\system32\MsiExec.exe -Embedding DD226E9624A1BB47B25151F49985B198C:\Windows\system32\MsiExec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2884"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2912"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2884 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2952"C:\Users\admin\AppData\Local\Temp\7zS0FBF3E14\Temp\tracelog.exe" -start "InstAppLog_4600.etl" -rt -guid "C:\Users\admin\AppData\Local\Temp\7zS0FBF3E14\Temp\GUIDs.txt" -f "C:\ProgramData\Panda Security\PSLogs\InstAppLog_4600.etl" -level 5 -flags 255 -UseCPUCycle -gs -seq 5C:\Users\admin\AppData\Local\Temp\7zS0FBF3E14\Temp\tracelog.exe—setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7zs0fbf3e14\temp\tracelog.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
2 070
Read events
915
Write events
1 151
Delete events
4

Modification events

(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000006B000000010000000000000000000000000000000000000000000000400C35B347C7D301000000000000000000000000020000001700000000000000FE80000000000000D45917EAB3ED3D860B000000000000001700000000000000FE80000000000000D45917EAB3ED3D860B000000000000001C00000000000000000000000000000000000000000000000000000000000000170000000000000000000000000000000000FFFFC0A8640B000000000000000002000000C0A801640000000000000000000000000000000000000000000000000C00000C37D0000010A73800D8703600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081F800009000230090002300380023000000000000702C000A00000000000000F8412C00
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{5B502FF3-643B-11E8-B27F-5254004AAD21}
Value:
0
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
5
(PID) Process:(2884) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E207050003001E00120039003600D201
Executable files
477
Suspicious files
229
Text files
122
Unknown types
131

Dropped files

PID
Process
Filename
Type
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2LKO8ICX\favicon[1].ico —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF73C1BC27A4151E85.TMP —
MD5:—
SHA256:—
2912iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WF2FXMJU\FREEAV[1].exe —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LM4BD81N\FREEAV[1].exe —
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{5B502FF4-643B-11E8-B27F-5254004AAD21}.datbinary
MD5:—
SHA256:—
2912iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:—
SHA256:—
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\WF2FXMJU\FREEAV[1].exe:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
2884iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LM4BD81N\FREEAV[1].exe:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
2912iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012018053020180531\index.datdat
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
2
DNS requests
2
Threats
985

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2912
iexplore.exe
GET
—
2.16.186.73:80
http://acs.pandasoftware.com/Panda/FREEAV/181305/FREEAV.exe
unknown
—
—
whitelisted
2884
iexplore.exe
GET
200
13.107.21.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2884
iexplore.exe
13.107.21.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2912
iexplore.exe
2.16.186.73:80
acs.pandasoftware.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
acs.pandasoftware.com
  • 2.16.186.73
  • 2.16.186.51
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 9
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 1
—
—
A Network Trojan was detected
[PT MALWARE] Feodo HTTP header Cookie Check-in
—
—
A Network Trojan was detected
[PT MALWARE] Feodo HTTP header Cookie Check-in
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 3
—
—
A Network Trojan was detected
[PT MALWARE] Feodo HTTP header Cookie Check-in
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 21
—
—
A Network Trojan was detected
[PT MALWARE] Feodo HTTP header Cookie Check-in
—
—
A Network Trojan was detected
ET CNC Feodo Tracker Reported CnC Server group 16
—
—
A Network Trojan was detected
[PT MALWARE] Feodo HTTP header Cookie Check-in
Process
Message
setup.exe
Cancel
setup.exe
Cancel
setup.exe
Cancel
setup.exe
Next
setup.exe
Next
setup.exe
Next
setup.exe
Next
setup.exe
Next
setup.exe
Next
setup.exe
Next
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://acs.pandasoftware.com/Panda/FREEAV/181305/FREEAV.exe