File name:

app.exe

Full analysis: https://app.any.run/tasks/93b50d82-9325-4723-8551-ea394eacf302
Verdict: Malicious activity
Analysis date: December 15, 2024, 02:15:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

57ECE16B37DBDAC6E714CA391AEABB13

SHA1:

5E82C0A3BD381DBD60C2D8EC5BABECFC9A0F1091

SHA256:

2B1508BA0570C9842E4128FEB9C8EE35C2E99AC8A76B37E0A221C883BE48E91E

SSDEEP:

98304:VnI8ZRtCk4weIL+PxMJKlyyaiCBGxLdJcGK8fHwH9rgcOgzreD1ggOFyxXX0yZ+g:N3GKpp/txKxT8BikI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ISBEW64.exe (PID: 1296)

  • SUSPICIOUS

    • Starts another process probably with elevated privileges via RUNAS.EXE

      • runas.exe (PID: 2456)

    • Executable content was dropped or overwritten

      • app.exe (PID: 5604)
      • netcfg.exe (PID: 1200)
      • drvinst.exe (PID: 1540)

    • Reads the Windows owner or organization settings

      • app.exe (PID: 5604)

    • Searches for installed software

      • dllhost.exe (PID: 396)
      • app.exe (PID: 5604)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4556)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 2744)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 2744)
      • netcfg.exe (PID: 1200)
      • drvinst.exe (PID: 1540)

    • Creates a software uninstall entry

      • app.exe (PID: 5604)

    • Starts a Microsoft application from unusual location

      • ocupdater.exe (PID: 4500)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 1540)

  • INFO

    • Manual execution by a user

      • app.exe (PID: 5748)
      • app.exe (PID: 5604)

    • The sample compiled with english language support

      • runas.exe (PID: 2456)
      • app.exe (PID: 5604)
      • msiexec.exe (PID: 2744)

    • Reads the computer name

      • msiexec.exe (PID: 2744)
      • app.exe (PID: 5604)
      • ISBEW64.exe (PID: 1296)
      • drvinst.exe (PID: 1540)

    • Checks supported languages

      • app.exe (PID: 5604)
      • msiexec.exe (PID: 2744)
      • ISBEW64.exe (PID: 1296)
      • drvinst.exe (PID: 1540)

    • Create files in a temporary directory

      • app.exe (PID: 5604)

    • Manages system restore points

      • SrTasks.exe (PID: 648)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2744)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2744)

    • Reads the software policy settings

      • drvinst.exe (PID: 1540)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 1540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (54.3)
.exe | Win64 Executable (generic) (34.8)
.exe | Win32 Executable (generic) (5.6)
.exe | Generic Win/DOS Executable (2.5)
.exe | DOS Executable Generic (2.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:09:22 04:58:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 563200
InitializedDataSize: 423424
UninitializedDataSize: -
EntryPoint: 0x6984b
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 16.0.0.400
ProductVersionNumber: 16.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: star
FileDescription: Setup Launcher
FileVersion: 5.8
InternalName: Setup
LegalCopyright: Copyright (C) 2009 Acresso Software Inc. and/or InstallShield Co. Inc. All Rights Reserved.
OriginalFileName: Setup.exe
ProductName: OConnect
ProductVersion: 5.8
InternalBuildNumber: 92881
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
19
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start runas.exe no specs conhost.exe no specs rundll32.exe no specs app.exe no specs app.exe msiexec.exe isbew64.exe no specs SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs ocupdater.exe no specs netcfg.exe conhost.exe no specs drvinst.exe

Process information

PID
CMD
Path
Indicators
Parent process
396C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
648C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1200C:\WINDOWS\\sysnative\netcfg.exe -l C:\WINDOWS\\syswow64\temp\ndisrd_lwf.inf -c s -i nt_ndisrdC:\Windows\System32\netcfg.exe
app.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WinPE network installer
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netcfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1224\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netcfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296C:\Users\admin\AppData\Local\Temp\{9D8226D1-CACF-4A23-B009-DED32536A977}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6239B91E-958D-4E71-9474-08FC195B6A2E}C:\Users\admin\AppData\Local\Temp\{9D8226D1-CACF-4A23-B009-DED32536A977}\ISBEW64.exe—app.exe
User:
admin
Company:
Acresso Software Inc.
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Version:
16.0.328
Modules
Images
c:\users\admin\appdata\local\temp\{9d8226d1-cacf-4a23-b009-ded32536a977}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1540DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{b35eadc4-f831-1f45-8fe2-253cb6317b8e}\ndisrd_lwf.inf" "9" "41b779883" "00000000000001D0" "WinSta0\Default" "00000000000001E0" "208" "C:\WINDOWS\syswow64\temp"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—runas.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2220\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2456"C:\Windows\System32\runas.exe" /user:administrator C:\Users\admin\app.exeC:\Windows\System32\runas.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Run As Utility
Exit code:
3221225786
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runas.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2744C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
6 415
Read events
6 094
Write events
304
Delete events
17

Modification events

(PID) Process:(5604) app.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000F5911F5E974EDB01E4150000400A0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(396) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000F5911F5E974EDB018C01000084000000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(396) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000065F85F5E974EDB018C01000084000000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(396) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000065F85F5E974EDB018C01000084000000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(396) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000275C625E974EDB018C01000084000000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(396) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
48000000000000009923675E974EDB018C01000084000000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(396) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(396) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000FDCAD45E974EDB018C01000084000000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4556) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009B21E35E974EDB01CC11000044130000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4556) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000009B21E35E974EDB01CC110000F80E0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
26
Suspicious files
43
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
5604app.exeC:\Users\admin\AppData\Local\Temp\_isD672.tmp —
MD5:—
SHA256:—
5604app.exeC:\Users\admin\AppData\Local\Temp\{379D5F4C-DB47-48EC-9757-8833E2634183}\OConnect.msi —
MD5:—
SHA256:—
5604app.exeC:\Users\admin\AppData\Local\Temp\_isD5C3.tmpbinary
MD5:8A471F9ECD2E4B6E542FEFE9BA3C434A
SHA256:8575F54671FEBDA9922F968627CB892852DB9CB26ADD3A04158204444D13AF3A
5604app.exeC:\Users\admin\AppData\Local\Temp\_isD5F4.tmpbinary
MD5:4278EB0F1D8EE6231AEEE812F423ACE0
SHA256:B70C3A70E6BC16A0D92B2E238D9A48053D42A5FA29CD5A0809F8A82FE0233C7D
5604app.exeC:\Users\admin\AppData\Local\Temp\_isDA6A.tmpbinary
MD5:8EC62525335684F653B4D27E3D12E7E9
SHA256:FF331BB2ED4C518B8F9D432F29090355083AACB68C63E1A0F42F0528CCABCE41
5604app.exeC:\Users\admin\AppData\Local\Temp\_isD5C2.tmpbinary
MD5:4278EB0F1D8EE6231AEEE812F423ACE0
SHA256:B70C3A70E6BC16A0D92B2E238D9A48053D42A5FA29CD5A0809F8A82FE0233C7D
396dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
2744msiexec.exeC:\Windows\Installer\143c7b.msi —
MD5:—
SHA256:—
5604app.exeC:\Users\admin\AppData\Local\Temp\{379D5F4C-DB47-48EC-9757-8833E2634183}\Setup.INItext
MD5:BE102B49CFEDC06873FCF3554C6D7CDD
SHA256:E2A66313E4BC607A2F2FEDB338B4FB11B4FF1AF3774BD268BB188A0724E691EA
5604app.exeC:\Users\admin\AppData\Local\Temp\{9D8226D1-CACF-4A23-B009-DED32536A977}\ISBEW64.exeexecutable
MD5:41CB698F967B4D9F2580EA2A21A5A710
SHA256:10205DD8642824F9C81F32E73D8402E892A839B71A13B3816F548F3805FDED8B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
14
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.55.110.211:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.55.110.211:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.55.110.211:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
104.79.89.142:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
23.55.110.211:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.55.110.211:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
104.79.89.142:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
104.79.89.142:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2736
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.179.174
whitelisted
crl.microsoft.com
  • 23.55.110.211
whitelisted
www.microsoft.com
  • 104.79.89.142
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
app.exe