download:

/

Full analysis: https://app.any.run/tasks/6af004bd-7641-402d-8f1a-2339a65fb48d
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: April 28, 2024, 20:35:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1198DAAA23F0AF650C7CD4555FBEF9E8

SHA1:

783F86460785027A41A84E41B42A05B4D4A1A462

SHA256:

25C846183E10BD2A146325EFFECDDBABF0F390717FD11D597012A033E6DAF600

SSDEEP:

98304:pQR6VdJ09uqigD3RAMF6LgaZze6wXCawiMVQwP3F1PwuQqkZObuyX+QuZUREMsLb:A1+GiB+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)
      • setup-.exe (PID: 1440)

    • Actions looks like stealing of personal data

      • setup-.exe (PID: 1440)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)
      • setup-.exe (PID: 1440)

    • Checks Windows Trust Settings

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)
      • setup-.exe (PID: 1440)

    • Reads security settings of Internet Explorer

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)
      • setup-.exe (PID: 1440)

    • Process drops legitimate windows executable

      • setup-.exe (PID: 1440)

    • The process creates files with name similar to system file names

      • setup-.exe (PID: 1440)

    • The process drops C-runtime libraries

      • setup-.exe (PID: 1440)

    • Executable content was dropped or overwritten

      • setup-.exe (PID: 1440)
      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)

    • Reads the Windows owner or organization settings

      • setup-.exe (PID: 1440)

    • Reads settings of System Certificates

      • setup-.exe (PID: 1440)
      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)

    • Searches for installed software

      • setup-.exe (PID: 1440)

    • Access to an unwanted program domain was detected

      • setup-.exe (PID: 1440)

    • Adds/modifies Windows certificates

      • setup-.exe (PID: 1440)

  • INFO

    • Reads the computer name

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)
      • wmpnscfg.exe (PID: 1112)
      • setup-.exe (PID: 1440)

    • Checks proxy server information

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)

    • Checks supported languages

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)
      • setup-.exe (PID: 1440)
      • wmpnscfg.exe (PID: 1112)

    • Reads the software policy settings

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)
      • setup-.exe (PID: 1440)

    • Reads the machine GUID from the registry

      • setup-.exe (PID: 1440)
      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)

    • Creates files or folders in the user directory

      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)
      • setup-.exe (PID: 1440)

    • Create files in a temporary directory

      • setup-.exe (PID: 1440)
      • 6af004bd-7641-402d-8f1a-2339a65fb48d.exe (PID: 4080)

    • Reads Environment values

      • setup-.exe (PID: 1440)

    • Reads product name

      • setup-.exe (PID: 1440)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:24 20:04:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4347392
InitializedDataSize: 5656576
UninitializedDataSize: -
EntryPoint: 0x396dbb
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Download Manager
FileVersion: 1
InternalName: Download Manager
LegalCopyright: Download Manager
OriginalFileName: Download Manager
ProductName: Download Manager
ProductVersion: 1
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 6af004bd-7641-402d-8f1a-2339a65fb48d.exe setup-.exe wmpnscfg.exe no specs 6af004bd-7641-402d-8f1a-2339a65fb48d.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1112"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1440C:\Users\admin\AppData\Local\setup-.exe hhwnd=131368 hreturntoinstaller hextras=id:99a019eebb67725-US-errorC:\Users\admin\AppData\Local\setup-.exe
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
User:
admin
Company:
DT001
Integrity Level:
HIGH
Description:
Software Installation
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\setup-.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3968"C:\Users\admin\AppData\Local\Temp\6af004bd-7641-402d-8f1a-2339a65fb48d.exe" C:\Users\admin\AppData\Local\Temp\6af004bd-7641-402d-8f1a-2339a65fb48d.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download Manager
Exit code:
3221226540
Version:
1
Modules
Images
c:\users\admin\appdata\local\temp\6af004bd-7641-402d-8f1a-2339a65fb48d.exe
c:\windows\system32\ntdll.dll
4080"C:\Users\admin\AppData\Local\Temp\6af004bd-7641-402d-8f1a-2339a65fb48d.exe" C:\Users\admin\AppData\Local\Temp\6af004bd-7641-402d-8f1a-2339a65fb48d.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Download Manager
Version:
1
Modules
Images
c:\users\admin\appdata\local\temp\6af004bd-7641-402d-8f1a-2339a65fb48d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
18 424
Read events
18 288
Write events
119
Delete events
17

Modification events

(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4080) 6af004bd-7641-402d-8f1a-2339a65fb48d.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
23
Suspicious files
14
Text files
17
Unknown types
5

Dropped files

PID
Process
Filename
Type
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:FF31C5143948490616F600ED8115121B
SHA256:8C33C8198C6B1069D1422072DAE07AFDB3F61CF2D1A5E1E84B0DA40E049A08A2
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:3280FDB51633FEF17283030F7FCA1A0B
SHA256:E1FD13C5E3FFDD9585D5A975165B4E4536EC79E9069DFC23AABD836406CC3990
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:D4FF6FA4C39990BE75198D23C3F8A1E1
SHA256:44648BAC9452F65041CDCCCAC1F9DEF558C6F136958C6D44DEF0CBA50433F02A
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\700B9980BA1F8C3D19B9578F56B7386F_345749F8109B3F0DBE7840DC04B120E5binary
MD5:E02654B6B6B5EE224CAAC14C8CA3801D
SHA256:C812B90AC9A649E86FA3AB69E648F66047B1F1A71044747DB4B1A6B3B3E84536
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\service[1].htmtext
MD5:CB5E100E5A9A3E7F6D1FD97512215282
SHA256:CA00FCCFB408989EDDC401062C4D1219A6ACEB6B9B55412357F1790862E8F178
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\700B9980BA1F8C3D19B9578F56B7386F_345749F8109B3F0DBE7840DC04B120E5binary
MD5:27AAD3DC72C280A764D8A13455FD8F21
SHA256:1835CCD5FECBA51B5F287A352F1D701BCBEC87418683A7CBE5886332031692C7
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:F6EBA5B4DA2A6729CE49739376F04E87
SHA256:B5D2109699D2E485BF989AA7595AB2877B6D59FA781364B9B2A6B64652A3A2E1
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\Local\setup-.exeexecutable
MD5:29D3A70CEC060614E1691E64162A6C1E
SHA256:CC70B093A19610E9752794D757AEC9EF07CA862EA9267EC6F9CC92B2AA882C72
40806af004bd-7641-402d-8f1a-2339a65fb48d.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:037AE8164352CA91E80AD33054D1906D
SHA256:07C018EB07002663D5248DAA8A65EAF587955E3DB45735E7E3AC9CB13D7D664E
1440setup-.exeC:\Users\admin\AppData\Local\Temp\ec05d89197b949eb6957b79472e8723d\vcruntime140.dllexecutable
MD5:1A84957B6E681FCA057160CD04E26B27
SHA256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
22
DNS requests
14
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
GET
200
2.19.105.18:80
http://x1.c.lencr.org/
unknown
—
—
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
—
—
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?cfe0a7f8e7962138
unknown
—
—
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/s/gts1d4/c60NpY15aYI/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEQDIkRwUzpFoGQr1j0t77Yt6
unknown
—
—
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8a7a0a8b0d4837c1
unknown
—
—
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/s/gts1d4/w2JVwme7rvU/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEELAll3IHWDiEuOptsbe6aY%3D
unknown
—
—
unknown
1440
setup-.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ec59eab99bb5f968
unknown
—
—
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
GET
200
2.19.105.18:80
http://x2.c.lencr.org/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
4080
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
172.217.16.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1440
setup-.exe
104.16.149.130:443
flow.lavasoft.com
CLOUDFLARENET
—
unknown
1440
setup-.exe
104.16.213.94:443
sos.adaware.com
CLOUDFLARENET
—
unknown
1440
setup-.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown

DNS requests

Domain
IP
Reputation
www.dlsft.com
  • 35.190.60.70
unknown
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.pki.goog
  • 172.217.16.195
whitelisted
www.google.com
  • 142.250.185.100
whitelisted
flow.lavasoft.com
  • 104.16.149.130
  • 104.16.148.130
whitelisted
sos.adaware.com
  • 104.16.213.94
  • 104.16.212.94
whitelisted
dlsft.com
  • 35.190.60.70
unknown
filedm.com
  • 188.114.97.3
  • 188.114.96.3
malicious
x1.c.lencr.org
  • 2.19.105.18
whitelisted
x2.c.lencr.org
  • 2.19.105.18
whitelisted

Threats

Found threats are available for the paid subscriptions
4 ETPRO signatures available at the full report
Process
Message
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
at initializeDynamicVariables (this://app/main.html(329))
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
at getFileInfo.@285@39 (this://app/main.html(307))
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
6af004bd-7641-402d-8f1a-2339a65fb48d.exe
Error: (undefined) has no property - value