File name:

telegramgroupscraper.com_Setup.exe

Full analysis: https://app.any.run/tasks/8b7e3cca-60cf-4f32-a717-ef271cbc7f44
Verdict: Malicious activity
Analysis date: December 06, 2022, 01:25:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9BFE06B6D19F1AB32CE9CEA7C38F455E

SHA1:

39A32C1BE053DDA7A8E2BB38D9F4CF601A213D74

SHA256:

3E2C7630BC24CE949233704478E4E49B8EE48416AAA29EE2F9F16137F1FD837C

SSDEEP:

98304:cSi6ve4zOknJ2rBiy/w61r2M1drHGZCR+DidXvh6d204OOR5qHW:vve4FnGBiYt5nrHGsegJ6M8YY2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • telegramgroupscraper.com_Setup.tmp (PID: 548)

    • Application was dropped or rewritten from another process

      • telegramgroupscraper.com.exe (PID: 3360)

  • SUSPICIOUS

    • Reads the Internet Settings

      • telegramgroupscraper.com.exe (PID: 3360)

    • Reads the Windows owner or organization settings

      • telegramgroupscraper.com_Setup.tmp (PID: 548)

    • Executable content was dropped or overwritten

      • telegramgroupscraper.com_Setup.tmp (PID: 548)

    • Changes default file association

      • telegramgroupscraper.com_Setup.tmp (PID: 548)

  • INFO

    • Checks supported languages

      • telegramgroupscraper.com_Setup.exe (PID: 856)
      • telegramgroupscraper.com.exe (PID: 3360)
      • telegramgroupscraper.com_Setup.tmp (PID: 548)

    • Manual execution by a user

      • explorer.exe (PID: 3316)

    • Drops a file that was compiled in debug mode

      • telegramgroupscraper.com_Setup.tmp (PID: 548)

    • Creates a software uninstall entry

      • telegramgroupscraper.com_Setup.tmp (PID: 548)

    • Reads the computer name

      • telegramgroupscraper.com.exe (PID: 3360)
      • telegramgroupscraper.com_Setup.tmp (PID: 548)

    • Application launched itself

      • iexplore.exe (PID: 3808)

    • Application was dropped or rewritten from another process

      • telegramgroupscraper.com_Setup.tmp (PID: 548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (51.8)
.exe | InstallShield setup (20.3)
.exe | Win32 EXE PECompact compressed (generic) (19.6)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2020-Nov-15 09:48:30
Detected languages:
  • Dutch - Netherlands
  • English - United States
Comments: This installation was built with Inno Setup.
CompanyName: telegramgroupscraper.com
FileDescription: telegramgroupscraper.com Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: telegramgroupscraper.com
ProductVersion: telegramgroupscraper.com

DOS Header

e_magic: MZ
e_cblp: 80
e_cp: 2
e_crlc: 0
e_cparhdr: 4
e_minalloc: 15
e_maxalloc: 65535
e_ss: 0
e_sp: 184
e_csum: 0
e_ip: 0
e_cs: 0
e_ovno: 26
e_oemid: 0
e_oeminfo: 0
e_lfanew: 256

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 10
TimeDateStamp: 2020-Nov-15 09:48:30
PointerToSymbolTable: 0
NumberOfSymbols: 0
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
734748
735232
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.35606
.itext
741376
5768
6144
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.97275
.data
749568
14244
14336
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.0444
.bss
765952
28136
0
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata
794624
3894
4096
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.8987
.didata
798720
420
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.75636
.edata
802816
154
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.87222
.tls
806912
24
0
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata
811008
93
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
1.38389
.rsrc
815104
18432
18432
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.42143

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.25755
296
UNKNOWN
Dutch - Netherlands
RT_ICON
2
3.47151
1384
UNKNOWN
Dutch - Netherlands
RT_ICON
3
3.91708
744
UNKNOWN
Dutch - Netherlands
RT_ICON
4
3.91366
2216
UNKNOWN
Dutch - Netherlands
RT_ICON
4086
3.16547
864
UNKNOWN
UNKNOWN
RT_STRING
4087
3.40938
608
UNKNOWN
UNKNOWN
RT_STRING
4088
3.31153
1116
UNKNOWN
UNKNOWN
RT_STRING
4089
3.33977
1036
UNKNOWN
UNKNOWN
RT_STRING
4090
3.36723
724
UNKNOWN
UNKNOWN
RT_STRING
4091
3.33978
184
UNKNOWN
UNKNOWN
RT_STRING

Imports

advapi32.dll
comctl32.dll
kernel32.dll
kernel32.dll (delay-loaded)
netapi32.dll
oleaut32.dll
user32.dll
version.dll

Exports

Title
Ordinal
Address
dbkFCallWrapperAddr
1
779836
__dbk_fcall_wrapper
2
53408
TMethodImplementationIntercept
3
344160
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
6
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start telegramgroupscraper.com_setup.exe no specs telegramgroupscraper.com_setup.tmp telegramgroupscraper.com.exe no specs iexplore.exe iexplore.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856"C:\Users\admin\AppData\Local\Temp\telegramgroupscraper.com_Setup.exe" C:\Users\admin\AppData\Local\Temp\telegramgroupscraper.com_Setup.exe—Explorer.EXE
User:
admin
Company:
telegramgroupscraper.com
Integrity Level:
MEDIUM
Description:
telegramgroupscraper.com Setup
Version:
Modules
Images
c:\users\admin\appdata\local\temp\telegramgroupscraper.com_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
548"C:\Users\admin\AppData\Local\Temp\is-HNIQI.tmp\telegramgroupscraper.com_Setup.tmp" /SL5="$50198,3328045,780800,C:\Users\admin\AppData\Local\Temp\telegramgroupscraper.com_Setup.exe" C:\Users\admin\AppData\Local\Temp\is-HNIQI.tmp\telegramgroupscraper.com_Setup.tmp
telegramgroupscraper.com_Setup.exe
User:
admin
Company:
telegramgroupscraper.com
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-hniqi.tmp\telegramgroupscraper.com_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3360"C:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\telegramgroupscraper.com.exe"C:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\telegramgroupscraper.com.exe—telegramgroupscraper.com_Setup.tmp
User:
admin
Integrity Level:
MEDIUM
Description:
telegramgroupscraper.com
Exit code:
2148734720
Version:
1.0.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\programs\telegramgroupscraper.com\telegramgroupscraper.com.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3808"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.7.2&processName=telegramgroupscraper.com.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
telegramgroupscraper.com.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
2668"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3808 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3316"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\explorer.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
11 952
Read events
11 823
Write events
122
Delete events
7

Modification events

(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
240200005AC838A51109D901
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
EC73CC7EDF2546CFCF735FC5374C37D0C33A8911CFA6F31A27C58BF7240399CA
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\telegramgroupscraper.com.exe
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
8219484DFF65C033446881F7C13640758DCC6E3FE2BC0828DFBCC4D538A5FF9E
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CLASSES_ROOT\.myp\OpenWithProgids
Operation:writeName:telegramgroupscraper.comFile.myp
Value:
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CLASSES_ROOT\telegramgroupscraper.comFile.myp
Operation:writeName:(default)
Value:
telegramgroupscraper.com File
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CLASSES_ROOT\telegramgroupscraper.comFile.myp\DefaultIcon
Operation:writeName:(default)
Value:
C:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\telegramgroupscraper.com.exe,0
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CLASSES_ROOT\telegramgroupscraper.comFile.myp\shell\open\command
Operation:writeName:(default)
Value:
"C:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\telegramgroupscraper.com.exe" "%1"
(PID) Process:(548) telegramgroupscraper.com_Setup.tmpKey:HKEY_CLASSES_ROOT\Applications\telegramgroupscraper.com.exe\SupportedTypes
Operation:writeName:.myp
Value:
Executable files
41
Suspicious files
12
Text files
33
Unknown types
12

Dropped files

PID
Process
Filename
Type
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\HtmlAgilityPack.dllexecutable
MD5:6D6423834A78BED27700A095FACAA678
SHA256:4183655DE0B44E42B1A177C86A0042376AEA2025AF9923EAE147E74DE2FAD7E8
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\MaterialDesignColors.pdbbinary
MD5:027432065A3C483883BEFB13F8F162FB
SHA256:AB8143C0C0876BC285F208B85BDE0E2C5C54343B1139BD25B570B3D6B52912CF
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\is-EHDB1.tmppdb
MD5:9002EF1EDC7ED8BA88CCF58AFD89CA69
SHA256:5EC04202765C637FAFD7BF443A1BB486A289E17130567E34402203252A5C076C
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\is-3NGID.tmpexecutable
MD5:2402C4F4AF67AC863292AE95FE40BFF4
SHA256:AAAE75E3FAA1FCCF0DE0B33B1A4EF6FE2DABB0F3B05E046CCE31ECACD49CB6E9
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\is-PBRRG.tmpexecutable
MD5:B0C0EFD2A6799663CF62A96E4F6ED5ED
SHA256:8691B0E5D8A1089DC98D01DD09DAA248A48F9240B9530AE761EB9C46284E10CE
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\is-QG1PD.tmpxml
MD5:1C935C8213A5DDAFFD71838B76C4FDFB
SHA256:AEC148366FE5CCD4F5C8DEBD53F718C8B3720B7BEE9F1E531001327053483AB5
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\is-77LNO.tmpbinary
MD5:618D176019D2A6AC3EA4BBA9AB40F472
SHA256:DBF963823A595C3E0CB3559AAF77261AB4809A0D718FD6E03C6C85B57BBF0B1B
856telegramgroupscraper.com_Setup.exeC:\Users\admin\AppData\Local\Temp\is-HNIQI.tmp\telegramgroupscraper.com_Setup.tmpexecutable
MD5:37ACF61A0E756724AC44FFCADAFE03B6
SHA256:5B21E1C62D880DF39A5CDC0FCE3FF8F3251D830D86B184C21C8385C2183F47AF
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\is-2TD5N.tmpexecutable
MD5:0B3FA388485AC78EF83D1221BA6693B7
SHA256:9FA38197EED5CA1FAC2D056FCFD2767A74648BC836725D255477B251567BADB6
548telegramgroupscraper.com_Setup.tmpC:\Users\admin\AppData\Local\Programs\telegramgroupscraper.com\MaterialDesignColors.dllexecutable
MD5:0B3FA388485AC78EF83D1221BA6693B7
SHA256:9FA38197EED5CA1FAC2D056FCFD2767A74648BC836725D255477B251567BADB6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
15
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3808
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
2668
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?18d8ceee3bd64f70
US
compressed
4.70 Kb
whitelisted
2668
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
2668
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?09d5eccd6ad25f4d
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2668
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
3808
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2668
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2668
iexplore.exe
96.16.143.41:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
3808
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
2668
iexplore.exe
13.107.246.45:443
dotnet.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 96.16.143.41
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
dotnet.microsoft.com
  • 13.107.246.45
  • 13.107.213.45
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2023 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
telegramgroupscraper.com_Setup.exe