File name:

Raptor7StudentSetup.exe

Full analysis: https://app.any.run/tasks/972a0fa8-9b8e-4737-bf2d-3e3186bb424b
Verdict: Malicious activity
Analysis date: December 13, 2024, 15:40:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

18D775D15AA7CF705CD4B6133EAD65B5

SHA1:

96DA4C9D30C8AF64D0B9CC6E94E6A1093869103C

SHA256:

36D8E1861DBD3CB74E5431BAE28BB35F15C8E69B606F8942B485AD9BF19079F0

SSDEEP:

98304:RPhCJdBBbfHPhi2VVSOqXg/jmCjAHBSOauNR0zQ9M9qxzBgsprOyHEYCLf3ZK6mT:/gFYjQ4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Raptor7StudentSetup.exe (PID: 6820)

    • Application launched itself

      • Raptor7StudentSetup.exe (PID: 6796)

    • Creates/Modifies COM task schedule object

      • Raptor7StudentSetup.exe (PID: 6820)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6012)

    • Creates a software uninstall entry

      • Raptor7StudentSetup.exe (PID: 6820)

  • INFO

    • Checks supported languages

      • Raptor7StudentSetup.exe (PID: 6796)
      • Raptor7StudentSetup.exe (PID: 6820)
      • Raptor7Student.exe (PID: 880)

    • Reads the computer name

      • Raptor7StudentSetup.exe (PID: 6820)
      • Raptor7Student.exe (PID: 880)

    • The sample compiled with english language support

      • Raptor7StudentSetup.exe (PID: 6796)
      • Raptor7StudentSetup.exe (PID: 6820)

    • Creates files in the program directory

      • Raptor7StudentSetup.exe (PID: 6820)

    • Create files in a temporary directory

      • Raptor7StudentSetup.exe (PID: 6820)

    • Reads the machine GUID from the registry

      • Raptor7StudentSetup.exe (PID: 6820)

    • Manages system restore points

      • SrTasks.exe (PID: 1916)

    • Manual execution by a user

      • Raptor7Student.exe (PID: 880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (33)
.exe | Win32 Executable MS Visual C++ (generic) (23.9)
.exe | Win64 Executable (generic) (21.2)
.scr | Windows screen saver (10)
.dll | Win32 Dynamic Link Library (generic) (5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:11:10 23:16:45+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 67072
InitializedDataSize: 44544
UninitializedDataSize: -
EntryPoint: 0xcc61
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.1.0.429
ProductVersionNumber: 9.1.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: InstallShield Software Corporation
FileDescription: Setup.exe
FileVersion: 9.01.429
InternalName: Setup
OriginalFileName: Setup.exe
LegalCopyright: Copyright (C) 2003 InstallShield Software Corp.
ProductName: InstallShield (R)
ProductVersion: 9.01
OLESelfRegister: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start raptor7studentsetup.exe raptor7studentsetup.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs raptor7student.exe no specs raptor7studentsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
880"C:\Program Files (x86)\Raptor7Student\Raptor7Student.exe" C:\Program Files (x86)\Raptor7Student\Raptor7Student.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\program files (x86)\raptor7student\raptor7student.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1916C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2940C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
5780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6012C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6712"C:\Users\admin\AppData\Local\Temp\Raptor7StudentSetup.exe" C:\Users\admin\AppData\Local\Temp\Raptor7StudentSetup.exe—explorer.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
MEDIUM
Description:
Setup.exe
Exit code:
3221226540
Version:
9.01.429
Modules
Images
c:\users\admin\appdata\local\temp\raptor7studentsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6796"C:\Users\admin\AppData\Local\Temp\Raptor7StudentSetup.exe" C:\Users\admin\AppData\Local\Temp\Raptor7StudentSetup.exe
explorer.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
Setup.exe
Exit code:
0
Version:
9.01.429
Modules
Images
c:\users\admin\appdata\local\temp\raptor7studentsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acspecfc.dll
6820 -deleter C:\Users\admin\AppData\Local\Temp\Raptor7StudentSetup.exe
Raptor7StudentSetup.exe
User:
admin
Company:
InstallShield Software Corporation
Integrity Level:
HIGH
Description:
Setup.exe
Exit code:
0
Version:
9.01.429
Modules
Images
c:\users\admin\appdata\local\temp\raptor7studentsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acspecfc.dll
Total events
2 747
Read events
2 255
Write events
474
Delete events
18

Modification events

(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA7E2068-CB55-11D2-8094-00104B1F9838}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{AA7E2066-CB55-11D2-8094-00104B1F9838}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B13-E59D-11D2-B40B-00A024B9DDDD}\TypeLib
Operation:writeName:Version
Value:
1.0
(PID) Process:(6820) Raptor7StudentSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{8C3C1B16-E59D-11D2-B40B-00A024B9DDDD}\TypeLib
Operation:writeName:Version
Value:
1.0
Executable files
51
Suspicious files
44
Text files
150
Unknown types
1

Dropped files

PID
Process
Filename
Type
6820Raptor7StudentSetup.exeC:\Users\admin\AppData\Local\Temp\ISPackFiles.initext
MD5:AACF8E1D306F0549D91A4A7ABFF22C58
SHA256:BFB8AE43F0E3A2E1D635ECDA919DA2F2584FF6C9E0DA153F67B6B934435DD6D7
6820Raptor7StudentSetup.exeC:\Users\admin\AppData\Local\Temp\bye8001.tmp\Disk1\engine32.cabcompressed
MD5:DE89C44F15D1BFBCCA26778AF838F720
SHA256:FE5DC5947F277B459CB55877439E74E9BB2FB891CB42B72ABC42322A51E8423D
6820Raptor7StudentSetup.exeC:\Users\admin\AppData\Local\Temp\bye8001.tmp\Disk1\layout.binbinary
MD5:389A1A2C036B6A0BB304EF16430BF8E2
SHA256:687E0A59783F815FA271CB82332891A6084A956DC1E6A851DA6A4DB3F1AE581A
6820Raptor7StudentSetup.exeC:\Users\admin\AppData\Local\Temp\bye8001.tmp\Disk1\data1.cabcompressed
MD5:05AB0B0B5F3B0999DFB7DC3611BCEA8E
SHA256:C7F6D16F0BFA0B0AA45AA31DC6197ED51696BD3DD54444AAE6F7ABD1C4F9AB9C
6820Raptor7StudentSetup.exeC:\Users\admin\AppData\Local\Temp\bye8001.tmp\Disk1\Setup.bmpbinary
MD5:81A8E1B9D7F46B4F93FD7D2AB5564AA4
SHA256:67A66AA65AC238A59AA7B28D22948012088D6CA57080223DC6F45DF2F878E361
6820Raptor7StudentSetup.exeC:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp84F4.tmp\temp.000executable
MD5:369ECACA6C59265F47D234DA8FAAB871
SHA256:AD010C642F2BB264C69C153DCDE78DAA0BBF4699155F22E16641BBA82158E7B1
6820Raptor7StudentSetup.exeC:\Users\admin\AppData\Local\Temp\bye8001.tmp\Disk1\setup.skinbinary
MD5:9CD943C9DCE41DED4147C03368E34C08
SHA256:7C10A9B1D37363CAB8630711D4FCB2ABA3570E0DD54D851B5F272422EFFBB34B
6820Raptor7StudentSetup.exeC:\Users\admin\AppData\Local\Temp\iss838C.tmp\setup.iniini
MD5:EFD756ED8169A36DECDFC8DAADD858C8
SHA256:5CC1A9C470334672A3AA8236D37988586CBA943FEF55D1A8A2062F6A37302ABE
6820Raptor7StudentSetup.exeC:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\09\01\Intel32\isp84F4.tmp\setup.dllexecutable
MD5:369ECACA6C59265F47D234DA8FAAB871
SHA256:AD010C642F2BB264C69C153DCDE78DAA0BBF4699155F22E16641BBA82158E7B1
6820Raptor7StudentSetup.exeC:\Users\admin\AppData\Local\Temp\igd8602.tmpbinary
MD5:5599D56F10ABFEEB19400A9983773807
SHA256:7AB50F0D097E676093C4734EB08FD0319D0C337CCD88A9E86C9774147C2B63EC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
47
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1412
svchost.exe
GET
200
23.48.23.161:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6452
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
6768
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1412
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6768
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6452
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
92.123.104.17:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1412
svchost.exe
23.48.23.161:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1412
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
www.bing.com
  • 92.123.104.17
  • 92.123.104.18
  • 92.123.104.59
  • 92.123.104.61
  • 92.123.104.53
  • 92.123.104.11
  • 92.123.104.22
  • 92.123.104.64
  • 92.123.104.10
  • 104.126.37.155
  • 104.126.37.152
  • 104.126.37.161
  • 104.126.37.153
  • 104.126.37.136
  • 104.126.37.147
  • 104.126.37.139
  • 104.126.37.154
  • 104.126.37.145
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.48.23.161
  • 23.48.23.143
  • 23.48.23.192
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.35.229.160
whitelisted
google.com
  • 216.58.206.46
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.68
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.159.0
  • 20.190.159.75
  • 20.190.159.23
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Raptor7StudentSetup.exe