File name:

OInstall_x64.exe

Full analysis: https://app.any.run/tasks/0627e702-b4de-4e50-a771-f4b61576cf02
Verdict: Malicious activity
Analysis date: February 23, 2025, 19:18:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 3 sections
MD5:

02B17720FF567400C8A0E26E17EB696E

SHA1:

3B3040CD70CCC9556DD33792C2A39D94142FAAE6

SHA256:

34C3A9FC542B5BD6C4ADC1FFDDD7C274A8072CE8EB172169DA38848C63F01319

SSDEEP:

98304:t8hXBCKqDKOX1GUowziWVoG65L6aNCdOpV3eOUTAeAl2qMlX+EqaRVx0Ll3YSX/v:tuPA5ERSJaWqr9xMobo5NwCpX18nR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • OInstall_x64.exe (PID: 1684)
      • OInstall_x64.exe (PID: 5200)

    • Uses WMIC.EXE to add exclusions to the Windows Defender

      • cmd.exe (PID: 5548)
      • cmd.exe (PID: 3832)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 936)
      • powershell.exe (PID: 6012)
      • powershell.exe (PID: 5160)

  • SUSPICIOUS

    • Uses REG/REGEDIT.EXE to modify registry

      • OInstall_x64.exe (PID: 1684)

    • Found strings related to reading or modifying Windows Defender settings

      • OInstall_x64.exe (PID: 1684)

    • Starts CMD.EXE for commands execution

      • OInstall_x64.exe (PID: 1684)

    • Executable content was dropped or overwritten

      • OInstall_x64.exe (PID: 1684)
      • files.dat (PID: 4824)

    • The executable file from the user directory is run by the CMD process

      • files.dat (PID: 4824)

    • Drops 7-zip archiver for unpacking

      • OInstall_x64.exe (PID: 1684)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1752)

    • Process drops legitimate windows executable

      • OInstall_x64.exe (PID: 1684)
      • files.dat (PID: 4824)

    • The process drops C-runtime libraries

      • files.dat (PID: 4824)

    • Starts POWERSHELL.EXE for commands execution

      • OInstall_x64.exe (PID: 1684)

    • Probably download files using WebClient

      • OInstall_x64.exe (PID: 1684)

    • Unpacks CAB file

      • expand.exe (PID: 5404)
      • expand.exe (PID: 2412)
      • expand.exe (PID: 6184)

  • INFO

    • Checks supported languages

      • OInstall_x64.exe (PID: 1684)
      • files.dat (PID: 4824)
      • expand.exe (PID: 5404)
      • expand.exe (PID: 6184)
      • expand.exe (PID: 2412)

    • Reads the computer name

      • OInstall_x64.exe (PID: 1684)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1804)
      • WMIC.exe (PID: 4052)

    • Create files in a temporary directory

      • OInstall_x64.exe (PID: 1684)
      • files.dat (PID: 4824)
      • expand.exe (PID: 5404)
      • expand.exe (PID: 2412)
      • expand.exe (PID: 6184)

    • The sample compiled with english language support

      • OInstall_x64.exe (PID: 1684)
      • files.dat (PID: 4824)

    • Reads Environment values

      • OInstall_x64.exe (PID: 1684)

    • Disables trace logs

      • powershell.exe (PID: 936)
      • powershell.exe (PID: 6012)
      • powershell.exe (PID: 5160)

    • Checks proxy server information

      • powershell.exe (PID: 936)
      • powershell.exe (PID: 6012)
      • powershell.exe (PID: 5160)

    • Reads the machine GUID from the registry

      • expand.exe (PID: 5404)
      • expand.exe (PID: 6184)
      • expand.exe (PID: 2412)

    • UPX packer has been detected

      • OInstall_x64.exe (PID: 1684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (87.1)
.exe | Generic Win/DOS Executable (6.4)
.exe | DOS Executable Generic (6.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:01:21 08:53:05+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware
PEType: PE32+
LinkerVersion: 2.5
CodeSize: 15306752
InitializedDataSize: 86016
UninitializedDataSize: 16068608
EntryPoint: 0x1dec100
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.3
ProductVersionNumber: 7.5.0.3
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
ProductName: Office 2013-2021 C2R Install
FileDescription: Office 2013-2021 C2R Install
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
31
Malicious processes
1
Suspicious processes
6

Behavior graph

Click at the process to see the details
start oinstall_x64.exe cmd.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs files.dat powershell.exe conhost.exe no specs expand.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs expand.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs expand.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs oinstall_x64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
936"powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab', 'C:\Users\admin\AppData\Local\Temp\over701498\v32.cab') }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
OInstall_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1684"C:\Users\admin\AppData\Local\Temp\OInstall_x64.exe" C:\Users\admin\AppData\Local\Temp\OInstall_x64.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Office 2013-2021 C2R Install
Modules
Images
c:\users\admin\appdata\local\temp\oinstall_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1752"C:\WINDOWS\System32\cmd.exe" /D /c files.dat -y -pkmsautoC:\Windows\System32\cmd.exe—OInstall_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1752"powershell" -command "& { Get-Content C:\Users\admin\AppData\Local\Temp\over701498\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—OInstall_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1804WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\admin\AppData\Local\Temp\OInstall_x64.exe"C:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
2147749889
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
2412"expand" v32.cab -F:VersionDescriptor.xml C:\Users\admin\AppData\Local\Temp\over610636C:\Windows\System32\expand.exe—OInstall_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
LZ Expansion Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\expand.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
2624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2676\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2992\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 342
Read events
27 341
Write events
1
Delete events
0

Modification events

(PID) Process:(3260) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script Host\Settings
Operation:writeName:Enabled
Value:
1
Executable files
6
Suspicious files
4
Text files
24
Unknown types
0

Dropped files

PID
Process
Filename
Type
936powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hszrqrfs.isw.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1684OInstall_x64.exeC:\Users\admin\AppData\Local\Temp\files\files.datexecutable
MD5:BB5569B15D68C10B7FF2D96B45825120
SHA256:4E3B13B56BEC0E41778E6506430282BBBD75CCAA600FD4B645CE37DD95B44C8E
4824files.datC:\Users\admin\AppData\Local\Temp\files\x64\msvcr100.dllexecutable
MD5:DF3CA8D16BDED6A54977B30E66864D33
SHA256:1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36
4824files.datC:\Users\admin\AppData\Local\Temp\files\x86\msvcr100.dllexecutable
MD5:BF38660A9125935658CFA3E53FDC7D65
SHA256:60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
936powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ymyzfqqd.pdm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1684OInstall_x64.exeC:\Users\admin\AppData\Local\Temp\files\Configure.xmltext
MD5:AC6BE84084E31DBB0E08D188B6C86EC8
SHA256:1879F7DE537C2AA70292C61EBEF9C6477D36E25B2E6A639E318B159E0A22B0FC
936powershell.exeC:\Users\admin\AppData\Local\Temp\over701498\v32.cabcompressed
MD5:AE3E94AAD127329DF50DD00DD91D385D
SHA256:AEADDC4AAB6BF61E7E38F24E6AEFA9EA1B63E6775347C3631BB88BD9E46B79C7
4824files.datC:\Users\admin\AppData\Local\Temp\files\x86\cleanospp.exeexecutable
MD5:98821A7A5737D656633D10A3AFB724BD
SHA256:04BA4487F95290E0B0557B44300C18F637FBAF0872EE96E3111013B8A1539F25
5404expand.exeC:\Users\admin\AppData\Local\Temp\over701498\VersionDescriptor.xmlxml
MD5:8954E1DC8E5A614084642CDA88BEB4BA
SHA256:E55983757C24A166275579074D60119FE61153F527304D97C11714393F83D7FE
1752powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1apuqvo3.g50.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
35
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5004
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5004
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
936
powershell.exe
GET
200
199.232.214.172:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
unknown
—
—
whitelisted
6012
powershell.exe
GET
200
199.232.214.172:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5160
powershell.exe
GET
200
199.232.214.172:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
unknown
—
—
whitelisted
6632
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6632
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5008
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5004
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5780
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5004
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5004
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5004
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
936
powershell.exe
199.232.214.172:80
officecdn.microsoft.com
FASTLY
US
whitelisted
6012
powershell.exe
199.232.214.172:80
officecdn.microsoft.com
FASTLY
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.209.214.100
whitelisted
officecdn.microsoft.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
www.bing.com
  • 184.86.251.12
  • 184.86.251.9
  • 184.86.251.17
  • 184.86.251.7
  • 184.86.251.4
  • 184.86.251.20
  • 184.86.251.19
  • 184.86.251.14
  • 184.86.251.15
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.14
  • 20.190.160.131
  • 20.190.160.67
  • 20.190.160.132
  • 40.126.32.134
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 2.18.97.227
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
OInstall_x64.exe