| File name: | setup_x86.exe |
| Full analysis: | https://app.any.run/tasks/bd30620d-7c3c-41a7-a10f-0b45d5143de1 |
| Verdict: | Malicious activity |
| Analysis date: | May 20, 2024, 10:42:33 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | D41F8844A99091CC13FBD552B976F6E2 |
| SHA1: | F010439B05AA2F82CD24E35FEA6FF0009ADD1C2C |
| SHA256: | 1DC1C69CFB49A69475CB72B9A927BEF0D770A439189394EAB8EADD4480B4494E |
| SSDEEP: | 6144:9gmqYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY+JZzZ8NVerj:OZ8NVerXzhurXrHZwqpt1cV |
MALICIOUS
Drops the executable file immediately after the start
- setup_x86.exe (PID: 3968)
- vlc-plus-3.0.20-win32.exe (PID: 1056)
- inst-updater.exe (PID: 1592)
- vlc-3.0.20-win32.exe (PID: 1816)
Changes the autorun value in the registry
- inst-updater.exe (PID: 1592)
Uses Task Scheduler to autorun other applications
- ns36AA.tmp (PID: 1284)
SUSPICIOUS
Reads the Internet Settings
- setup_x86.exe (PID: 3968)
- vlc-plus-3.0.20-win32.exe (PID: 1056)
Executable content was dropped or overwritten
- setup_x86.exe (PID: 3968)
- vlc-plus-3.0.20-win32.exe (PID: 1056)
- inst-updater.exe (PID: 1592)
- vlc-3.0.20-win32.exe (PID: 1816)
The process creates files with name similar to system file names
- setup_x86.exe (PID: 3968)
- vlc-3.0.20-win32.exe (PID: 1816)
Malware-specific behavior (creating "System.dll" in Temp)
- setup_x86.exe (PID: 3968)
- vlc-3.0.20-win32.exe (PID: 1816)
Reads security settings of Internet Explorer
- setup_x86.exe (PID: 3968)
Checks Windows Trust Settings
- setup_x86.exe (PID: 3968)
Starts application with an unusual extension
- inst-updater.exe (PID: 1592)
Reads settings of System Certificates
- setup_x86.exe (PID: 3968)
Searches for installed software
- vlc-3.0.20-win32.exe (PID: 1816)
Creates a software uninstall entry
- inst-updater.exe (PID: 1592)
INFO
Create files in a temporary directory
- setup_x86.exe (PID: 3968)
- vlc-plus-3.0.20-win32.exe (PID: 1056)
- inst-updater.exe (PID: 1592)
- vlc-3.0.20-win32.exe (PID: 1816)
Checks supported languages
- setup_x86.exe (PID: 3968)
- wmpnscfg.exe (PID: 4004)
- inst-updater.exe (PID: 1592)
- ns36AA.tmp (PID: 1284)
- vlc-plus-3.0.20-win32.exe (PID: 1056)
- vlc-3.0.20-win32.exe (PID: 1816)
Reads the computer name
- setup_x86.exe (PID: 3968)
- wmpnscfg.exe (PID: 4004)
- inst-updater.exe (PID: 1592)
- vlc-plus-3.0.20-win32.exe (PID: 1056)
- vlc-3.0.20-win32.exe (PID: 1816)
Checks proxy server information
- setup_x86.exe (PID: 3968)
Manual execution by a user
- wmpnscfg.exe (PID: 4004)
- msedge.exe (PID: 2556)
Creates files or folders in the user directory
- setup_x86.exe (PID: 3968)
- inst-updater.exe (PID: 1592)
Reads the machine GUID from the registry
- setup_x86.exe (PID: 3968)
- inst-updater.exe (PID: 1592)
Reads the software policy settings
- setup_x86.exe (PID: 3968)
Application launched itself
- msedge.exe (PID: 1932)
- msedge.exe (PID: 2556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2016:12:11 21:50:45+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 24576 |
| InitializedDataSize: | 118784 |
| UninitializedDataSize: | 1024 |
| EntryPoint: | 0x32bf |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
67
Monitored processes
31
Malicious processes
4
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1056 | "C:\Users\admin\AppData\Local\VLC Plus Player Downloader\vlc-plus-3.0.20-win32.exe" | C:\Users\admin\AppData\Local\VLC Plus Player Downloader\vlc-plus-3.0.20-win32.exe | setup_x86.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1248 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3568 --field-trial-handle=1288,i,12979045587340025431,7335686338688766483,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1284 | "C:\Users\admin\AppData\Local\Temp\nsg365B.tmp\ns36AA.tmp" "schtasks.exe" /create /tn "VLC Plus Player Updater" /tr "'C:\Users\admin\AppData\Local\VLC Plus Player Updater\Updater.exe'" /rl HIGHEST /sc onlogon /f | C:\Users\admin\AppData\Local\Temp\nsg365B.tmp\ns36AA.tmp | inst-updater.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1408 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1316 --field-trial-handle=1288,i,12979045587340025431,7335686338688766483,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1552 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6e52f598,0x6e52f5a8,0x6e52f5b4 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1592 | "C:\Users\admin\AppData\Local\Temp\VLC Plus Player\inst-updater.exe" /S | C:\Users\admin\AppData\Local\Temp\VLC Plus Player\inst-updater.exe | vlc-plus-3.0.20-win32.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 1816 | "C:\Users\admin\AppData\Local\Temp\VLC Plus Player\vlc-3.0.20-win32.exe" | C:\Users\admin\AppData\Local\Temp\VLC Plus Player\vlc-3.0.20-win32.exe | vlc-plus-3.0.20-win32.exe | ||||||||||||
User: admin Integrity Level: HIGH Modules
| |||||||||||||||
| 1932 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.vlc.de/ok/?id=_updater. | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | vlc-plus-3.0.20-win32.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2024 | "C:\Users\admin\AppData\Local\VLC Plus Player Downloader\vlc-plus-3.0.20-win32.exe" | C:\Users\admin\AppData\Local\VLC Plus Player Downloader\vlc-plus-3.0.20-win32.exe | — | setup_x86.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 2060 | "schtasks.exe" /create /tn "VLC Plus Player Updater" /tr "'C:\Users\admin\AppData\Local\VLC Plus Player Updater\Updater.exe'" /rl HIGHEST /sc onlogon /f | C:\Windows\System32\schtasks.exe | — | ns36AA.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Manages scheduled tasks Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
22 089
Read events
21 993
Write events
83
Delete events
13
Modification events
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyServer |
Value: | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyOverride |
Value: | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoConfigURL |
Value: | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoDetect |
Value: | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3968) setup_x86.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
Executable files
10
Suspicious files
63
Text files
34
Unknown types
5
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3968 | setup_x86.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\vlc-plus-3.0.20-win32[1].exe | — | |
MD5:— | SHA256:— | |||
| 3968 | setup_x86.exe | C:\Users\admin\AppData\Local\VLC Plus Player Downloader\vlc-plus-3.0.20-win32.exe | — | |
MD5:— | SHA256:— | |||
| 1056 | vlc-plus-3.0.20-win32.exe | C:\Users\admin\AppData\Local\Temp\VLC Plus Player\vlc-3.0.20-win32.exe | — | |
MD5:— | SHA256:— | |||
| 3968 | setup_x86.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:4BED8C9DECB09316F43620AB92126C1D | SHA256:0ECA7333A8FB476C032EE7FDDFDECD56CBD66540B541E668C5606BA5456557A5 | |||
| 3968 | setup_x86.exe | C:\Users\admin\AppData\Local\VLC Plus Player Downloader\setup_x86.txt | text | |
MD5:6FE800C6809034D0C6A1CD7F9C70CD26 | SHA256:F92159C1E9D3FA2B149CADD3EA2E3891083CDC82690506575EDA1F6F725EDF8A | |||
| 3968 | setup_x86.exe | C:\Users\admin\AppData\Local\Temp\nsx3DA9.tmp\nsisdl.dll | executable | |
MD5:41F557E065B405F94D0ECE8B5727233B | SHA256:9DE492995D2180635AA3194B88CE6DD94E0C2B001AF5952A73D4A84FBC32B6AB | |||
| 3968 | setup_x86.exe | C:\Users\admin\AppData\Local\Temp\nsx3DA9.tmp\System.dll | executable | |
MD5:3F176D1EE13B0D7D6BD92E1C7A0B9BAE | SHA256:FA4AB1D6F79FD677433A31ADA7806373A789D34328DA46CCB0449BBF347BD73E | |||
| 1592 | inst-updater.exe | C:\Users\admin\AppData\Local\Temp\nsg365B.tmp\nsExec.dll | executable | |
MD5:B4579BC396ACE8CAFD9E825FF63FE244 | SHA256:01E72332362345C415A7EDCB366D6A1B52BE9AC6E946FB9DA49785C140BA1A4B | |||
| 1932 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State | — | |
MD5:— | SHA256:— | |||
| 3968 | setup_x86.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07DB822C3548410165E7DFA39F71BDE_FE625968969B6977AA67380F44484ABD | der | |
MD5:F7483E2D5545A1E7E54BF69DCF7752FD | SHA256:92201658DA26A54B9D8E18441199F4336917A84EC184124930764C6A4A3AE7CD | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
26
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3968 | setup_x86.exe | GET | 304 | 95.101.54.128:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?85d1e00274ad22f4 | unknown | — | — | unknown |
3968 | setup_x86.exe | GET | 200 | 87.230.43.108:80 | http://www.vlc.de/install/setup_x86.txt | unknown | — | — | unknown |
3968 | setup_x86.exe | GET | 200 | 95.101.111.168:80 | http://dvcasha2.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNcCPjJ499lHmfPUvPsRjzr1YchwQU5TGtvzoRlvSDvFA81LeQm5Du3iUCEB%2BLNUl5VKkVjFCfJqJ03PM%3D | unknown | — | — | unknown |
3968 | setup_x86.exe | GET | 200 | 95.101.111.144:80 | http://subca.ocsp-certum.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTYOkzrrCGQj08njZXbUQQpkoUmuQQUCHbNywf%2FJPbFze27kLzihDdGdfcCECbd0itGycRNWmlNOYB%2Bcq0%3D | unknown | — | — | unknown |
1088 | svchost.exe | GET | 304 | 2.19.126.137:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e523dd86aac30a8d | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
3968 | setup_x86.exe | 87.230.43.108:80 | www.vlc.de | Host Europe GmbH | DE | unknown |
3968 | setup_x86.exe | 87.230.43.108:443 | www.vlc.de | Host Europe GmbH | DE | unknown |
3968 | setup_x86.exe | 95.101.54.128:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
3968 | setup_x86.exe | 95.101.111.144:80 | subca.ocsp-certum.com | TELXIUS TELXIUS Cable | NL | unknown |
3968 | setup_x86.exe | 95.101.111.168:80 | subca.ocsp-certum.com | TELXIUS TELXIUS Cable | NL | unknown |
1088 | svchost.exe | 2.19.126.137:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
2612 | msedge.exe | 87.230.43.108:443 | www.vlc.de | Host Europe GmbH | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.vlc.de |
| unknown |
download.vlc.de |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
subca.ocsp-certum.com |
| whitelisted |
dvcasha2.ocsp-certum.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
www.counter.info |
| unknown |
www.bing.com |
| whitelisted |
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com |
| whitelisted |
Threats
2 ETPRO signatures available at the full report