File name:

winaerotweaker.zip

Full analysis: https://app.any.run/tasks/1d54a6d9-6a18-4fd6-8e83-2306186d42c9
Verdict: Malicious activity
Analysis date: November 01, 2023, 14:36:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
tweaker
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BF982C18BF19FDEA302D12D99CC14483

SHA1:

79F9C93636E024A86508E82CDBEBBA4EC129C139

SHA256:

370095778B69F763AF03E553F5A83B192C7183D098CB0D87350F66FB525573B8

SSDEEP:

98304:PpA9q6ssUcCvuoKU+TyRTtyopLcxO7fiKiQMtA+Oh+EX4PLfKMxLKkqY9UlH6E4U:qB61oBA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinaeroTweaker-1.55.0.0-setup.exe (PID: 1032)
      • WinaeroTweaker-1.55.0.0-setup.exe (PID: 960)
      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 3812)
      • WinaeroTweaker.exe (PID: 3116)

    • Creates or modifies Windows services

      • WinaeroTweaker.exe (PID: 3116)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 3812)

    • Starts CMD.EXE for commands execution

      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 3812)
      • WinaeroTweaker.exe (PID: 3116)

    • Reads the Internet Settings

      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 3812)
      • WinaeroTweaker.exe (PID: 2216)
      • WinaeroTweaker.exe (PID: 3116)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2224)
      • cmd.exe (PID: 2084)

    • Application launched itself

      • WinaeroTweaker.exe (PID: 2216)

    • Reads settings of System Certificates

      • WinaeroTweaker.exe (PID: 3116)

    • Reads Internet Explorer settings

      • WinaeroTweaker.exe (PID: 3116)

    • Adds/modifies Windows certificates

      • WinaeroTweaker.exe (PID: 2216)

    • Process drops legitimate windows executable

      • WinaeroTweaker.exe (PID: 3116)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3076)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3372)

    • Checks supported languages

      • WinaeroTweaker-1.55.0.0-setup.exe (PID: 1032)
      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 1248)
      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 3812)
      • WinaeroTweaker-1.55.0.0-setup.exe (PID: 960)
      • WinaeroTweaker.exe (PID: 2216)
      • WinaeroTweaker.exe (PID: 3116)
      • WinaeroTweakerHelper.exe (PID: 3064)

    • Manual execution by a user

      • cmd.exe (PID: 2296)
      • WinaeroTweaker.exe (PID: 2216)

    • Reads the computer name

      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 1248)
      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 3812)
      • WinaeroTweaker.exe (PID: 3116)
      • WinaeroTweaker.exe (PID: 2216)

    • Create files in a temporary directory

      • WinaeroTweaker-1.55.0.0-setup.exe (PID: 960)
      • WinaeroTweaker-1.55.0.0-setup.exe (PID: 1032)
      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 3812)
      • WinaeroTweaker.exe (PID: 3116)

    • Creates files in the program directory

      • WinaeroTweaker-1.55.0.0-setup.tmp (PID: 3812)
      • WinaeroTweaker.exe (PID: 3116)

    • Reads the machine GUID from the registry

      • WinaeroTweaker.exe (PID: 2216)
      • WinaeroTweaker.exe (PID: 3116)

    • Reads CPU info

      • WinaeroTweaker.exe (PID: 3116)

    • Reads Environment values

      • WinaeroTweaker.exe (PID: 3116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2023:06:16 12:29:34
ZipCRC: 0x68b2f9ca
ZipCompressedSize: 226
ZipUncompressedSize: 471
ZipFileName: SilentSetup.cmd
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
15
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs cmd.exe no specs winaerotweaker-1.55.0.0-setup.exe no specs winaerotweaker-1.55.0.0-setup.tmp no specs winaerotweaker-1.55.0.0-setup.exe winaerotweaker-1.55.0.0-setup.tmp no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs taskkill.exe no specs winaerotweaker.exe no specs winaerotweaker.exe winaerotweakerhelper.exe no specs cmd.exe no specs sc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
960"C:\Users\admin\Desktop\WinaeroTweaker-1.55.0.0-setup.exe" /SPAWNWND=$13012E /NOTIFYWND=$3045C /SP- /VERYSILENTC:\Users\admin\Desktop\WinaeroTweaker-1.55.0.0-setup.exe
WinaeroTweaker-1.55.0.0-setup.tmp
User:
admin
Company:
Winaero
Integrity Level:
HIGH
Description:
Winaero Tweaker
Exit code:
0
Version:
1.55.0.0
Modules
Images
c:\users\admin\desktop\winaerotweaker-1.55.0.0-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1032WinaeroTweaker-1.55.0.0-setup.exe /SP- /VERYSILENTC:\Users\admin\Desktop\WinaeroTweaker-1.55.0.0-setup.exe—cmd.exe
User:
admin
Company:
Winaero
Integrity Level:
MEDIUM
Description:
Winaero Tweaker
Exit code:
0
Version:
1.55.0.0
Modules
Images
c:\users\admin\desktop\winaerotweaker-1.55.0.0-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1248"C:\Users\admin\AppData\Local\Temp\is-TBD0L.tmp\WinaeroTweaker-1.55.0.0-setup.tmp" /SL5="$3045C,3507132,832000,C:\Users\admin\Desktop\WinaeroTweaker-1.55.0.0-setup.exe" /SP- /VERYSILENTC:\Users\admin\AppData\Local\Temp\is-TBD0L.tmp\WinaeroTweaker-1.55.0.0-setup.tmp—WinaeroTweaker-1.55.0.0-setup.exe
User:
admin
Company:
Winaero
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-tbd0l.tmp\winaerotweaker-1.55.0.0-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1440sc.exe config wuauserv start= demandC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2084"C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweakerhelper.exe /fC:\Windows\System32\cmd.exe—WinaeroTweaker-1.55.0.0-setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2216"C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe" C:\Program Files\Winaero Tweaker\WinaeroTweaker.exe—explorer.exe
User:
admin
Company:
https://winaero.com
Integrity Level:
MEDIUM
Description:
WinaeroTweaker
Exit code:
0
Version:
1.55.0.0
Modules
Images
c:\program files\winaero tweaker\winaerotweaker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2224"C:\Windows\System32\cmd.exe" /c taskkill /im winaerotweaker.exe /fC:\Windows\System32\cmd.exe—WinaeroTweaker-1.55.0.0-setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
128
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2296C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\SilentSetup.cmd" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3064"C:\Program Files\Winaero Tweaker\WinaeroTweakerHelper.exe" -C:\Program Files\Winaero Tweaker\WinaeroTweakerHelper.exe—WinaeroTweaker.exe
User:
admin
Company:
http://winaero.com
Integrity Level:
HIGH
Description:
Winaero Tweaker 32bit support process
Exit code:
0
Version:
1.1.0.0
Modules
Images
c:\program files\winaero tweaker\winaerotweakerhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\gdi32.dll
3076"C:\Windows\System32\cmd.exe" /c sc.exe config wuauserv start= demandC:\Windows\System32\cmd.exe—WinaeroTweaker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
6 358
Read events
6 282
Write events
69
Delete events
7

Modification events

(PID) Process:(3372) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(3372) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
21
Suspicious files
12
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\WinaeroControls.dllexecutable
MD5:E5EE2251D3CE665D15579D31F7504BF5
SHA256:632D7523E50A34C2A201C7D263B87CB4D96696BE91D6573A2A7BA964C9E573EA
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\WinaeroTweaker.exeexecutable
MD5:23C3E2111BE79604C718B474500213B8
SHA256:0C4B4FB9C424A158939D4CFA492E16226EDFAEA1DFE6B5C242B833C4DCB9EA5D
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\is-KDBD7.tmpexecutable
MD5:23C3E2111BE79604C718B474500213B8
SHA256:0C4B4FB9C424A158939D4CFA492E16226EDFAEA1DFE6B5C242B833C4DCB9EA5D
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\is-30NUA.tmpexecutable
MD5:DF2708F6C7B1D60CFCF071142519A834
SHA256:4AAB16C2765C4BBD729D41617ED6FBA08893CC3C71C9D250B3CBCBD600114749
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\WinaeroTweakerHelper.exeexecutable
MD5:8E0AEC38406AFACFF9487529ADD32C74
SHA256:C789872A6141E19F9CB71ABB8260C8303A2AC48DFD86F36912A4649800A78D39
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\is-1FCH3.tmpexecutable
MD5:BB3935CACCEA6DC73487045C7640AE7A
SHA256:A921DD143B295DFF3F4C1343A085980A50006A55797E239AB8AC1C0DA64E1BBE
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Users\admin\AppData\Local\Temp\is-7OU3A.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\Elevator.exeexecutable
MD5:DF2708F6C7B1D60CFCF071142519A834
SHA256:4AAB16C2765C4BBD729D41617ED6FBA08893CC3C71C9D250B3CBCBD600114749
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\is-8UDKE.tmpexecutable
MD5:8E0AEC38406AFACFF9487529ADD32C74
SHA256:C789872A6141E19F9CB71ABB8260C8303A2AC48DFD86F36912A4649800A78D39
3812WinaeroTweaker-1.55.0.0-setup.tmpC:\Program Files\Winaero Tweaker\is-VTUCU.tmpexecutable
MD5:FB6E5BD898E6D6369F29A3FE0EDA0198
SHA256:100AC04E146983684553D9FEDC8442E7B0C619A832A1CF414F2482334ED472C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3116
WinaeroTweaker.exe
GET
200
67.27.235.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?ece396c6e641254f
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3116
WinaeroTweaker.exe
68.183.112.81:443
winaero.com
DIGITALOCEAN-ASN
US
unknown
3116
WinaeroTweaker.exe
67.27.235.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown

DNS requests

Domain
IP
Reputation
winaero.com
  • 68.183.112.81
whitelisted
ctldl.windowsupdate.com
  • 67.27.235.254
  • 8.238.189.126
  • 8.241.123.254
  • 8.241.122.126
  • 8.253.95.121
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winaerotweaker.zip