URL:

http://116.67.62.73/NoActiveX/bin/MAWS_NARA_Setup.exe

Full analysis: https://app.any.run/tasks/5c6887f7-6f1f-4d9a-80cb-aa880e49b235
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 01, 2020, 16:59:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

8CE2D97027D926877BF0E9E4372B9CC2

SHA1:

CCE7EA8DC0FC00CDEF6D600196C08FD08C13C289

SHA256:

285CE3C91492DDA2613B80545B7328EBACE4FBF158C8802CF401CBD8A2ECEB12

SSDEEP:

3:N1KsTLT4TXLaqzy6r+kWA:CssOqOA+TA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MAWS_NARA_Setup[1].exe (PID: 1976)
      • MAWS_NARA_Setup[1].exe (PID: 3712)
      • vcredist_x86.exe (PID: 3824)
      • install.exe (PID: 3560)
      • Setup_ePageSafer.exe (PID: 3076)
      • IMGSF50Start_x86.exe (PID: 2328)
      • MaRPackCheck.exe (PID: 3804)
      • markany_ImageSafer.exe (PID: 252)
      • IMGSF50Svc.exe (PID: 2576)
      • Inst_MaEPSBroker.exe (PID: 1536)
      • BrokerCRIMGR.exe (PID: 2428)
      • certutil.exe (PID: 1316)
      • MaEPSBroker.exe (PID: 2196)
      • IMGSF50Svc.exe (PID: 1412)
      • IMGSF50Svc.exe (PID: 1400)
      • CRIMgr_lite.exe (PID: 2076)
      • MaCBFltInstall.exe (PID: 1248)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 2372)
      • MaRPackCheck.exe (PID: 3804)

    • Downloads executable files from IP

      • iexplore.exe (PID: 2372)

    • Loads dropped or rewritten executable

      • markany_ImageSafer.exe (PID: 252)
      • MAWS_NARA_Setup[1].exe (PID: 3712)
      • install.exe (PID: 3560)
      • Setup_ePageSafer.exe (PID: 3076)
      • conhost.exe (PID: 1732)
      • certutil.exe (PID: 1316)
      • IMGSF50Start_x86.exe (PID: 2328)
      • Inst_MaEPSBroker.exe (PID: 1536)
      • RegSvr32.exe (PID: 1848)
      • explorer.exe (PID: 352)

    • Changes settings of System certificates

      • regedit.exe (PID: 2260)

    • Changes the autorun value in the registry

      • Inst_MaEPSBroker.exe (PID: 1536)

    • Changes internet zones settings

      • CRIMgr_lite.exe (PID: 2076)

    • Registers / Runs the DLL via REGSVR32.EXE

      • MAWS_NARA_Setup[1].exe (PID: 3712)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2372)
      • iexplore.exe (PID: 2732)
      • MAWS_NARA_Setup[1].exe (PID: 3712)
      • Setup_ePageSafer.exe (PID: 3076)
      • markany_ImageSafer.exe (PID: 252)
      • MaRPackCheck.exe (PID: 3804)
      • vcredist_x86.exe (PID: 3824)
      • msiexec.exe (PID: 1780)
      • Inst_MaEPSBroker.exe (PID: 1536)
      • MaCBFltInstall.exe (PID: 1248)

    • Starts Internet Explorer

      • explorer.exe (PID: 352)

    • Creates files in the Windows directory

      • MAWS_NARA_Setup[1].exe (PID: 3712)
      • markany_ImageSafer.exe (PID: 252)
      • msiexec.exe (PID: 1780)
      • Inst_MaEPSBroker.exe (PID: 1536)
      • Setup_ePageSafer.exe (PID: 3076)
      • MaCBFltInstall.exe (PID: 1248)

    • Creates COM task schedule object

      • MAWS_NARA_Setup[1].exe (PID: 3712)
      • Inst_MaEPSBroker.exe (PID: 1536)
      • Setup_ePageSafer.exe (PID: 3076)

    • Removes files from Windows directory

      • msiexec.exe (PID: 1780)
      • markany_ImageSafer.exe (PID: 252)
      • Setup_ePageSafer.exe (PID: 3076)
      • MAWS_NARA_Setup[1].exe (PID: 3712)

    • Executed as Windows Service

      • IMGSF50Svc.exe (PID: 1400)

    • Starts CMD.EXE for commands execution

      • Inst_MaEPSBroker.exe (PID: 1536)

    • Creates files in the user directory

      • certutil.exe (PID: 1316)
      • BrokerCRIMGR.exe (PID: 2428)

    • Creates a software uninstall entry

      • Inst_MaEPSBroker.exe (PID: 1536)
      • Setup_ePageSafer.exe (PID: 3076)
      • MAWS_NARA_Setup[1].exe (PID: 3712)

    • Creates files in the program directory

      • Inst_MaEPSBroker.exe (PID: 1536)
      • Setup_ePageSafer.exe (PID: 3076)

    • Creates files in the driver directory

      • MaCBFltInstall.exe (PID: 1248)
      • MAWS_NARA_Setup[1].exe (PID: 3712)

    • Creates or modifies windows services

      • MaCBFltInstall.exe (PID: 1248)

    • Modifies the open verb of a shell class

      • CRIMgr_lite.exe (PID: 2076)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2732)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2372)

    • Application launched itself

      • iexplore.exe (PID: 2732)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
25
Malicious processes
11
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe maws_nara_setup[1].exe no specs maws_nara_setup[1].exe setup_epagesafer.exe markany_imagesafer.exe marpackcheck.exe vcredist_x86.exe install.exe no specs msiexec.exe imgsf50svc.exe no specs imgsf50svc.exe no specs imgsf50svc.exe no specs imgsf50start_x86.exe no specs inst_maepsbroker.exe regedit.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs maepsbroker.exe no specs brokercrimgr.exe no specs macbfltinstall.exe crimgr_lite.exe no specs regsvr32.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
252"C:\Users\admin\AppData\Local\Temp\markany_ImageSafer.exe" /qC:\Users\admin\AppData\Local\Temp\markany_ImageSafer.exe
Setup_ePageSafer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\markany_imagesafer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
352C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1248C:\Windows\system32\MaCBFltInstall.exe -i_v4_minifC:\Windows\system32\MaCBFltInstall.exe
Setup_ePageSafer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\macbfltinstall.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1316"C:\Program Files\MarkAny\EPSBroker\cert\certutil.exe" -A -n "C:\Program Files\MarkAny\EPSBroker\cert\maca.crt" -i "C:\Program Files\MarkAny\EPSBroker\cert\maca.crt" -t "TCu,TCu,TCu" -d .C:\Program Files\MarkAny\EPSBroker\cert\certutil.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\markany\epsbroker\cert\certutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\markany\epsbroker\cert\nssutil3.dll
c:\program files\markany\epsbroker\cert\libplc4.dll
c:\program files\markany\epsbroker\cert\libnspr4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1400C:\Windows\IMGSF50Svc.exeC:\Windows\IMGSF50Svc.exe—services.exe
User:
SYSTEM
Company:
MarkAny
Integrity Level:
SYSTEM
Description:
Image SAFER 5.0 Session Managing Service for x86
Exit code:
0
Version:
5, 0, 19, 802
Modules
Images
c:\windows\imgsf50svc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1412C:\Windows\IMGSF50Svc.exe -startC:\Windows\IMGSF50Svc.exe—markany_ImageSafer.exe
User:
admin
Company:
MarkAny
Integrity Level:
HIGH
Description:
Image SAFER 5.0 Session Managing Service for x86
Exit code:
0
Version:
5, 0, 19, 802
Modules
Images
c:\windows\imgsf50svc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1536"C:\Users\admin\AppData\Local\Temp\Inst_MaEPSBroker.exe" /qC:\Users\admin\AppData\Local\Temp\Inst_MaEPSBroker.exe
Setup_ePageSafer.exe
User:
admin
Company:
MarkAny Inc.
Integrity Level:
HIGH
Description:
MarkAny Broker Moudle
Exit code:
0
Version:
2.5.0.34
Modules
Images
c:\users\admin\appdata\local\temp\inst_maepsbroker.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1732\??\C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe—csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1780C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1848RegSvr32 /s C:\Windows\system32\SUPD_Provider.dllC:\Windows\system32\RegSvr32.exe—MAWS_NARA_Setup[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
4
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
2 501
Read events
1 730
Write events
734
Delete events
37

Modification events

(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000092000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{25EF13F5-2CB8-11EA-AB41-5254004A04AF}
Value:
0
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
2
(PID) Process:(2732) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E4070100030001001100000002002201
Executable files
101
Suspicious files
13
Text files
46
Unknown types
7

Dropped files

PID
Process
Filename
Type
2732iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF87B256C33D4F2295.TMP —
MD5:—
SHA256:—
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\favicon[1].ico —
MD5:—
SHA256:—
2732iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\index.datdat
MD5:—
SHA256:—
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012020010120200102\index.datdat
MD5:—
SHA256:—
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012020010120200102\index.datdat
MD5:—
SHA256:—
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\index.datdat
MD5:—
SHA256:—
2732iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{25EF13F6-2CB8-11EA-AB41-5254004A04AF}.datbinary
MD5:—
SHA256:—
2372iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y2VIEBBF\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
2732iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF58224C078E1D4B34.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
2
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2372
iexplore.exe
GET
200
116.67.62.73:80
http://116.67.62.73/NoActiveX/bin/MAWS_NARA_Setup.exe
KR
executable
12.4 Mb
suspicious
3804
MaRPackCheck.exe
GET
200
23.210.248.197:80
http://download.microsoft.com/download/9/7/7/977B481A-7BA6-4E30-AC40-ED51EB2028F2/vcredist_x86.exe
NL
executable
4.28 Mb
whitelisted
2732
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2732
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2372
iexplore.exe
116.67.62.73:80
—
National Computing and information Service
KR
suspicious
3804
MaRPackCheck.exe
23.210.248.197:80
download.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
download.microsoft.com
  • 23.210.248.197
whitelisted

Threats

PID
Process
Class
Message
2372
iexplore.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2372
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2372
iexplore.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
3804
MaRPackCheck.exe
A Network Trojan was detected
ET MALWARE User-Agent (HTTP)
3804
MaRPackCheck.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
Setup_ePageSafer.exe
bRet1 == [0]
Setup_ePageSafer.exe
bRet2 == [0]
Setup_ePageSafer.exe
bRet4 == [0]
Setup_ePageSafer.exe
!bRet5 == [1]
Setup_ePageSafer.exe
bRet3 == [0]
Setup_ePageSafer.exe
pStr == []
Setup_ePageSafer.exe
pStr == []
Setup_ePageSafer.exe
pStr == []
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://116.67.62.73/NoActiveX/bin/MAWS_NARA_Setup.exe