| File name: | ipscan24.exe |
| Full analysis: | https://app.any.run/tasks/d6d4f58f-a14c-4c45-9dac-69abd230c181 |
| Verdict: | Malicious activity |
| Analysis date: | February 14, 2024, 16:04:47 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 8BAF1B03BECE135CB8B89AB454F5DF4A |
| SHA1: | A01B7F55C5EDC6576D1349A0A23B781552C74244 |
| SHA256: | 4179E299C24A130F3C567DDBBFE1835064A3497E8C2A1971AABA597794E8C14D |
| SSDEEP: | 98304:MfxDjmWOEC6GZD+7spi1p2uW0+jZLkmbS96olDw1sXFpsZqky09C5+wHPrDnMdls:NmOeUPXOqsCdEJ |
MALICIOUS
Drops the executable file immediately after the start
- ipscan24.exe (PID: 1384)
- ipscan24.tmp (PID: 2472)
SUSPICIOUS
Executable content was dropped or overwritten
- ipscan24.exe (PID: 1384)
- ipscan24.tmp (PID: 2472)
Reads the Windows owner or organization settings
- ipscan24.tmp (PID: 2472)
Process drops legitimate windows executable
- ipscan24.tmp (PID: 2472)
Reads settings of System Certificates
- advanced_ip_scanner.exe (PID: 2672)
INFO
Checks supported languages
- ipscan24.exe (PID: 1384)
- ipscan24.tmp (PID: 2472)
- advanced_ip_scanner.exe (PID: 2672)
Create files in a temporary directory
- ipscan24.exe (PID: 1384)
- ipscan24.tmp (PID: 2472)
Reads the computer name
- advanced_ip_scanner.exe (PID: 2672)
- ipscan24.tmp (PID: 2472)
Reads the machine GUID from the registry
- advanced_ip_scanner.exe (PID: 2672)
- ipscan24.tmp (PID: 2472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable Delphi generic (57.2) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (18.2) |
| .exe | | | Win16/32 Executable Delphi generic (8.3) |
| .exe | | | Generic Win/DOS Executable (8) |
| .exe | | | DOS Executable Generic (8) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2013:01:30 14:21:56+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 65024 |
| InitializedDataSize: | 73728 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x113bc |
| OSVersion: | 5 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 2.4.2601.0 |
| ProductVersionNumber: | 2.4.2601.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | Advanced IP Scanner Setup |
| FileVersion: | 2.4.2601 |
| LegalCopyright: | Copyright © 2002-2015 Famatech Corp. and its licensors. All rights reserved. |
| ProductName: | Advanced IP Scanner |
| ProductVersion: | 2.4 |
Total processes
42
Monitored processes
3
Malicious processes
2
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1384 | "C:\Users\admin\AppData\Local\Temp\ipscan24.exe" | C:\Users\admin\AppData\Local\Temp\ipscan24.exe | explorer.exe | ||||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Advanced IP Scanner Setup Exit code: 0 Version: 2.4.2601 Modules
| |||||||||||||||
| 2472 | "C:\Users\admin\AppData\Local\Temp\is-3CTE5.tmp\ipscan24.tmp" /SL5="$E0170,8317799,139776,C:\Users\admin\AppData\Local\Temp\ipscan24.exe" | C:\Users\admin\AppData\Local\Temp\is-3CTE5.tmp\ipscan24.tmp | ipscan24.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2672 | "C:\Program Files\Advanced IP Scanner\advanced_ip_scanner.exe" | C:\Program Files\Advanced IP Scanner\advanced_ip_scanner.exe | ipscan24.tmp | ||||||||||||
User: admin Company: Famatech Corp. Integrity Level: MEDIUM Description: Advanced IP Scanner Exit code: 0 Modules
| |||||||||||||||
Total events
2 843
Read events
2 760
Write events
77
Delete events
6
Modification events
| (PID) Process: | (2472) ipscan24.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: A8090000D68F1B8E5F5FDA01 | |||
| (PID) Process: | (2472) ipscan24.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: AA9AF57F8F9779D1A1EFF7FDAF6042072F1B48F357126F6CDC636EB428B35546 | |||
| (PID) Process: | (2472) ipscan24.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (2472) ipscan24.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFiles0000 |
Value: C:\Program Files\Advanced IP Scanner\advanced_ip_scanner.exe | |||
| (PID) Process: | (2472) ipscan24.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFilesHash |
Value: 8DAE304CBCE05B1CA7F68A15C705A50F2EDB01D01E22EE68C4C14F9E442576E4 | |||
| (PID) Process: | (2672) advanced_ip_scanner.exe | Key: | HKEY_CURRENT_USER\Software\famatech\advanced_ip_scanner |
| Operation: | write | Name: | locale |
Value: en_us | |||
| (PID) Process: | (2672) advanced_ip_scanner.exe | Key: | HKEY_CURRENT_USER\Software\famatech\advanced_ip_scanner |
| Operation: | write | Name: | locale_timestamp |
Value: 1707926729499 | |||
| (PID) Process: | (2672) advanced_ip_scanner.exe | Key: | HKEY_CURRENT_USER\Software\famatech\advanced_ip_scanner |
| Operation: | write | Name: | locale |
Value: English | |||
| (PID) Process: | (2472) ipscan24.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFilesHash |
Value: 꺍䰰ᱛᖊׇྥ�퀁∞森쇄鹏╄ | |||
| (PID) Process: | (2472) ipscan24.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFiles0000 |
Value: C:\Program Files\Advanced IP Scanner\advanced_ip_scanner.exe | |||
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2472 | ipscan24.tmp | C:\Users\admin\AppData\Local\Temp\is-1HO8S.tmp\is-CSAPS.tmp | — | |
MD5:— | SHA256:— | |||
| 2472 | ipscan24.tmp | C:\Users\admin\AppData\Local\Temp\is-1HO8S.tmp\ip_scan_en_us_Release_2.4.2601.msi | — | |
MD5:— | SHA256:— | |||
| 1384 | ipscan24.exe | C:\Users\admin\AppData\Local\Temp\is-3CTE5.tmp\ipscan24.tmp | executable | |
MD5:B87639F9A6CF5BA8C9E1F297C5745A67 | SHA256:EC8252A333F68865160E26DC95607F2C49AF00F78C657F7F8417AB9D86E90BF7 | |||
| 2472 | ipscan24.tmp | C:\Users\admin\AppData\Local\Temp\is-1HO8S.tmp\_isetup\_shfoldr.dll | executable | |
MD5:92DC6EF532FBB4A5C3201469A5B5EB63 | SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87 | |||
| 2472 | ipscan24.tmp | C:\Users\admin\AppData\Local\Temp\is-1HO8S.tmp\aips_is_install_dll.dll | executable | |
MD5:4693C87357FD7479B3F280CB18A24DE3 | SHA256:09EA4F3D28E382C51EE8C88BC1A70158BCFFFE76001C26FEEC39A5DD5BE749BA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
1
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2672 | advanced_ip_scanner.exe | GET | 200 | 188.40.30.100:80 | http://www.advanced-ip-scanner.com/checkupdate.php?lng=en&ver=2-4-2601&beta=n&type=upd&rmode=i&product=aips | unknown | text | 28 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2672 | advanced_ip_scanner.exe | 188.40.30.100:80 | www.advanced-ip-scanner.com | Hetzner Online GmbH | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.advanced-ip-scanner.com |
| shared |
Threats
1 ETPRO signatures available at the full report