analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

windirstat1_1_2_setup.exe

Full analysis: https://app.any.run/tasks/fbeec980-61ab-4ec1-afac-0c47d0f0b7f8
Verdict: Malicious activity
Analysis date: May 20, 2022, 22:23:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

3ABF1C149873E25D4E266225FBF37CBF

SHA1:

6FA92DD2CA691C11DFBFC0A239E34369897A7FAB

SHA256:

370A27A30EE57247FADDEB1F99A83933247E07C8760A07ED82E451E1CB5E5CDD

SSDEEP:

12288:yCjeMsiGVBKvjxTNlZaLlcMj+wXZvQpd9nP2+ZMU2tYspZcMwr/GNd35:yCjeTZa7BTsxewXZUTP2HU2yawjY5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops executable file immediately after starts

      • windirstat1_1_2_setup.exe (PID: 4036)
    • Loads dropped or rewritten executable

      • windirstat1_1_2_setup.exe (PID: 4036)
    • Application was dropped or rewritten from another process

      • windirstat.exe (PID: 2680)
  • SUSPICIOUS

    • Checks supported languages

      • windirstat1_1_2_setup.exe (PID: 4036)
      • windirstat.exe (PID: 2680)
    • Reads the computer name

      • windirstat1_1_2_setup.exe (PID: 4036)
      • windirstat.exe (PID: 2680)
    • Drops a file with a compile date too recent

      • windirstat1_1_2_setup.exe (PID: 4036)
    • Executable content was dropped or overwritten

      • windirstat1_1_2_setup.exe (PID: 4036)
    • Creates a directory in Program Files

      • windirstat1_1_2_setup.exe (PID: 4036)
    • Creates a software uninstall entry

      • windirstat1_1_2_setup.exe (PID: 4036)
    • Creates files in the program directory

      • windirstat1_1_2_setup.exe (PID: 4036)
    • Reads default file associations for system extensions

      • windirstat.exe (PID: 2680)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

Comments: Diese Datei enthält sowohl die Unicode- als auch die ANSI-Version von WinDirStat
CharacterSet: Windows, Latin1
LanguageCode: German
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.1.2.79
FileVersionNumber: 1.1.2.79
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x3265
UninitializedDataSize: 1024
InitializedDataSize: 119808
CodeSize: 23040
LinkerVersion: 6
PEType: PE32
TimeStamp: 2007:08:25 18:16:04+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Aug-2007 16:16:04
Detected languages:
  • English - United States
  • German - Germany
Comments: This release contains both, Unicode and ANSI version of WinDirStat
CompanyName: WDS Team
FileDescription: WinDirStat 1.1.2
FileVersion: 1.1.2
InternalName: WDS Setup
LegalCopyright: © 2003-2007 WDS Team
OriginalFilename: WinDirStat1_1_2_setup.exe
ProductName: WinDirStat
Website: http://windirstat.info

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 25-Aug-2007 16:16:04
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005966
0x00005A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45366
.rdata
0x00007000
0x00001190
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.18095
.data
0x00009000
0x0001AFF8
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.06588
.ndata
0x00024000
0x0000A000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0002E000
0x000026F0
0x00002800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.09872

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.10368
533
UNKNOWN
English - United States
RT_MANIFEST
2
3.98218
2216
UNKNOWN
English - United States
RT_ICON
103
1.96665
34
UNKNOWN
English - United States
RT_GROUP_ICON
104
2.67285
344
UNKNOWN
English - United States
RT_DIALOG
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG
107
2.52183
160
UNKNOWN
English - United States
RT_DIALOG
109
2.70146
212
UNKNOWN
English - United States
RT_DIALOG
110
2.82633
1638
UNKNOWN
English - United States
RT_BITMAP
111
2.92787
238
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start windirstat1_1_2_setup.exe no specs windirstat1_1_2_setup.exe windirstat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3032"C:\Users\admin\Desktop\windirstat1_1_2_setup.exe" C:\Users\admin\Desktop\windirstat1_1_2_setup.exeExplorer.EXE
User:
admin
Company:
WDS Team
Integrity Level:
MEDIUM
Description:
WinDirStat 1.1.2
Exit code:
3221226540
Version:
1.1.2
4036"C:\Users\admin\Desktop\windirstat1_1_2_setup.exe" C:\Users\admin\Desktop\windirstat1_1_2_setup.exe
Explorer.EXE
User:
admin
Company:
WDS Team
Integrity Level:
HIGH
Description:
WinDirStat 1.1.2
Version:
1.1.2
2680"C:\Program Files\WinDirStat\windirstat.exe"C:\Program Files\WinDirStat\windirstat.exewindirstat1_1_2_setup.exe
User:
admin
Company:
Seifert
Integrity Level:
HIGH
Description:
Windows Directory Statistics
Version:
1.1.2.80 (Unicode)
Total events
1 357
Read events
1 318
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
2
Text files
3
Unknown types
6

Dropped files

PID
Process
Filename
Type
4036windirstat1_1_2_setup.exeC:\Users\admin\Desktop\WinDirStat.lnklnk
MD5:62000CC5D4D96BD1C6E521C33F5C7F5B
SHA256:E71E2EA2284C723F92621083BBC5BB2FE78EE3A5BCE5C45C37D0320FEA880B26
4036windirstat1_1_2_setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDirStat\Uninstall WinDirStat.lnklnk
MD5:26C7B8429657B07FCC1566101448DABE
SHA256:04D8E540353223E4596227CE4C778F3022D64B533C17FB41CE00CBAA04513A1E
4036windirstat1_1_2_setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDirStat\WinDirStat.lnklnk
MD5:189A075588B835541A209A630F9AFDD8
SHA256:79E5E6C42F149BE15985F98AD9782C552F8E10306401F73D2102DEE1B8CF0B78
4036windirstat1_1_2_setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinDirStat\Help (ENG).lnklnk
MD5:FA5DF16CE9ECC177C5D2A0AE08C1AC92
SHA256:81F91978BF2531A0FAC11D64A0903D49EBF708B209377B8D1885A924E2C2048E
4036windirstat1_1_2_setup.exeC:\Users\admin\AppData\Local\Temp\nsx17E1.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
4036windirstat1_1_2_setup.exeC:\Program Files\WinDirStat\windirstat.chmchm
MD5:1BDDB8A0E0F9CD90A5B3936EC2C2C4CF
SHA256:1E87C07744054709D271337D8CE06929429B334D70875605CB68ECC4C6610CD1
2680windirstat.exeC:\$RECYCLE.BIN\S-1-5-21-1302019708-1500728564-335382590-1000\$I1Z54D3.batbinary
MD5:D13BC00917E27FF58E00CAC448ACF3F1
SHA256:AF9CCFE89BED69EA9E934D53ADA47C8B600724ADB0FA4F5FD76172E91BD0F5DE
4036windirstat1_1_2_setup.exeC:\Users\Administrator\Desktop\WinDirStat.lnklnk
MD5:62000CC5D4D96BD1C6E521C33F5C7F5B
SHA256:E71E2EA2284C723F92621083BBC5BB2FE78EE3A5BCE5C45C37D0320FEA880B26
4036windirstat1_1_2_setup.exeC:\Program Files\WinDirStat\Uninstall.exeexecutable
MD5:A127E6118B9DD2F9D5A7CC4D697A0105
SHA256:AFC864CFCE79B2A6ADD491A27EA672D958233ED7A97A2CBBCE60100D2FA1E670
4036windirstat1_1_2_setup.exeC:\Program Files\WinDirStat\windirstat.exeexecutable
MD5:24CD9A82FCFC658DD3AE7BA25C958FFB
SHA256:CC3EE246F2710DC9BA9E2A88E3192B88F1DB4CAA2EEFB8641642A33DF04E585C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info