File name:

Epic Pen Setup.exe

Full analysis: https://app.any.run/tasks/0405cffd-878b-4423-981c-cd414c8c4213
Verdict: Malicious activity
Analysis date: May 08, 2024, 20:41:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

3C229B3B884DE76A8DBD82DA50531C87

SHA1:

183A0C15B82AD6BA008A0B94142212A6823E1273

SHA256:

21DA567C78A61CA9FD00D6A3BE3198BCE1D3F608E5F21B06B6497BF9C0066044

SSDEEP:

6144:8F0LAQxGC80sg7sQb/5273IP8+6prDZtf:TXxGCzsg73923IPr6prDZtf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Epic Pen Setup.exe (PID: 3976)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Epic Pen Setup.exe (PID: 3976)

    • Reads settings of System Certificates

      • Epic Pen Setup.exe (PID: 3976)

  • INFO

    • Checks supported languages

      • Epic Pen Setup.exe (PID: 3976)
      • wmpnscfg.exe (PID: 1020)

    • Reads the computer name

      • Epic Pen Setup.exe (PID: 3976)
      • wmpnscfg.exe (PID: 1020)

    • Reads the machine GUID from the registry

      • Epic Pen Setup.exe (PID: 3976)

    • Reads Environment values

      • Epic Pen Setup.exe (PID: 3976)

    • Reads the software policy settings

      • Epic Pen Setup.exe (PID: 3976)

    • Create files in a temporary directory

      • Epic Pen Setup.exe (PID: 3976)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2051:09:14 20:44:17+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 75264
InitializedDataSize: 159232
UninitializedDataSize: -
EntryPoint: 0x145d2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 3.12.74.0
ProductVersionNumber: 3.12.74.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: "Tank Studios Limited"
FileDescription: "Epic Pen Installer"
FileVersion: 3.12.74.0
InternalName: EpicPenWebInstaller.exe
LegalCopyright: "©2024 Tank Studios Limited"
LegalTrademarks: -
OriginalFileName: EpicPenWebInstaller.exe
ProductVersion: 3.12.74.0
AssemblyVersion: 3.12.74.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start epic pen setup.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1020"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3976"C:\Users\admin\AppData\Local\Temp\Epic Pen Setup.exe" C:\Users\admin\AppData\Local\Temp\Epic Pen Setup.exe
explorer.exe
User:
admin
Company:
"Tank Studios Limited"
Integrity Level:
MEDIUM
Description:
"Epic Pen Installer"
Version:
3.12.74.0
Modules
Images
c:\users\admin\appdata\local\temp\epic pen setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
6 345
Read events
6 318
Write events
27
Delete events
0

Modification events

(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Epic Pen Setup.exe
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3976) Epic Pen Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Epic Pen Setup_RASMANCS
Operation:writeName:FileTracingMask
Value:
Executable files
0
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3976Epic Pen Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:949EF1A8F5D7ABB1AE336BE0BD61CDB7
SHA256:66B74C7F5FA9DC8F68DE65C2B41A9C00C14190491F216C64C460EBF3672DF901
3976Epic Pen Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:29F65BA8E88C063813CC50A4EA544E93
SHA256:1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
3976Epic Pen Setup.exeC:\Users\admin\AppData\Local\Temp\Cab4354.tmpcompressed
MD5:29F65BA8E88C063813CC50A4EA544E93
SHA256:1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
3976Epic Pen Setup.exeC:\Users\admin\AppData\Local\Temp\Tar4355.tmpbinary
MD5:435A9AC180383F9FA094131B173A2F7B
SHA256:67DC37ED50B8E63272B49A254A6039EE225974F1D767BB83EB1FD80E759A7C34
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3976
Epic Pen Setup.exe
GET
200
23.50.131.216:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?cc1fd6eba5c377fe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3976
Epic Pen Setup.exe
13.107.213.45:443
distribution.epicpen.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3976
Epic Pen Setup.exe
172.67.193.120:443
distribution.epicpencdn.com
CLOUDFLARENET
US
unknown
3976
Epic Pen Setup.exe
23.50.131.216:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
distribution.epicpen.com
  • 13.107.213.45
  • 13.107.246.45
unknown
distribution.epicpencdn.com
  • 172.67.193.120
  • 104.21.73.244
unknown
ctldl.windowsupdate.com
  • 23.50.131.216
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Epic Pen Setup.exe