File name:

ISASetup.exe

Full analysis: https://app.any.run/tasks/5e2d169e-26f3-4c9f-ab10-1b109c2b5135
Verdict: Malicious activity
Analysis date: September 04, 2020, 00:45:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

FDD6F6E0468B99F0AD3E9D7C12D78027

SHA1:

B7AAE027D7A1FDD2DC4251D3CB94650D159C8F21

SHA256:

4816F5CF175CC72D66DF12CC001B38FB726F3892834D78D08FFBCA32BA9D0A37

SSDEEP:

196608:p1pbeVug0YKqEmgkn9YQeddiT5IJHrFNM32/DWJ:npiYBYKqEmg2geyLTaX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • ISASetup.exe (PID: 1428)
      • ISASetup.exe (PID: 3296)

    • Application was dropped or rewritten from another process

      • ISA.exe (PID: 3260)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • ISASetup.exe (PID: 1428)

    • Executable content was dropped or overwritten

      • ISASetup.exe (PID: 3296)
      • ISASetup.exe (PID: 1428)

    • Creates files in the program directory

      • ISASetup.exe (PID: 1428)

    • Application launched itself

      • ISASetup.exe (PID: 3296)

    • Creates a software uninstall entry

      • ISASetup.exe (PID: 1428)

  • INFO

    • Reads settings of System Certificates

      • ISA.exe (PID: 3260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 01:50:56+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 162816
UninitializedDataSize: 1024
EntryPoint: 0x326b
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.4.2.0
ProductVersionNumber: 3.4.2.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: TTEC
FileDescription: TTEC Initial System Assessment
FileVersion: 3.4.2.0
LegalCopyright: © TTEC 2020
ProductName: TTEC Initial System Assessment

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Dec-2019 00:50:56
Detected languages:
  • English - United States
CompanyName: TTEC
FileDescription: TTEC Initial System Assessment
FileVersion: 3.4.2.0
LegalCopyright: © TTEC 2020
ProductName: TTEC Initial System Assessment

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 16-Dec-2019 00:50:56
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000062FF
0x00006400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45782
.rdata
0x00008000
0x0000134A
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.23892
.data
0x0000A000
0x00025518
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.0492
.ndata
0x00030000
0x00019000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00049000
0x00007B60
0x00007C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.47018

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29665
1059
UNKNOWN
English - United States
RT_MANIFEST
2
3.5712
4264
UNKNOWN
English - United States
RT_ICON
3
3.1992
3752
UNKNOWN
English - United States
RT_ICON
4
3.56947
2216
UNKNOWN
English - United States
RT_ICON
5
4.1822
1640
UNKNOWN
English - United States
RT_ICON
6
3.49886
1384
UNKNOWN
English - United States
RT_ICON
7
4.17555
1128
UNKNOWN
English - United States
RT_ICON
8
4.39758
744
UNKNOWN
English - United States
RT_ICON
9
3.83163
296
UNKNOWN
English - United States
RT_ICON
102
2.71813
180
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
6
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start isasetup.exe isasetup.exe taskkill.exe no specs msiexec.exe no specs taskkill.exe no specs isa.exe

Process information

PID
CMD
Path
Indicators
Parent process
1248MsiExec.exe /x{6A5649B7-E471-482F-8137-7970AB43D6B4} /qnC:\Windows\system32\MsiExec.exe—ISASetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
1605
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1428"C:\Users\admin\AppData\Local\Temp\ISASetup.exe" /UAC:60134 /NCRC C:\Users\admin\AppData\Local\Temp\ISASetup.exe
ISASetup.exe
User:
admin
Company:
TTEC
Integrity Level:
HIGH
Description:
TTEC Initial System Assessment
Exit code:
1223
Version:
3.4.2.0
Modules
Images
c:\users\admin\appdata\local\temp\isasetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2420taskkill /F /IM "ISA.exe" /TC:\Windows\system32\taskkill.exe—ISASetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
3260"C:\Program Files\TTEC\WBISA\ISA.exe"C:\Program Files\TTEC\WBISA\ISA.exe
ISASetup.exe
User:
admin
Company:
TTEC
Integrity Level:
HIGH
Description:
ISA
Exit code:
0
Version:
3.4.2.0
Modules
Images
c:\program files\ttec\wbisa\isa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3296"C:\Users\admin\AppData\Local\Temp\ISASetup.exe" C:\Users\admin\AppData\Local\Temp\ISASetup.exe
explorer.exe
User:
admin
Company:
TTEC
Integrity Level:
MEDIUM
Description:
TTEC Initial System Assessment
Exit code:
1223
Version:
3.4.2.0
Modules
Images
c:\users\admin\appdata\local\temp\isasetup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
4020TaskKill /IM ISA.exe /FC:\Windows\system32\TaskKill.exe—ISASetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
Total events
764
Read events
722
Write events
42
Delete events
0

Modification events

(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TTEC\Assessment\ISA
Operation:writeName:Path
Value:
C:\Program Files\TTEC\WBISA\ISA.exe
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TTEC\Assessment\ISA
Operation:writeName:Version
Value:
3.4.2.0
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\TTEC\Assessment\ISA
Operation:writeName:Installer Language
Value:
1033
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TTEC ISA
Operation:writeName:DisplayName
Value:
TTEC Initial System Assessment
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TTEC ISA
Operation:writeName:UninstallString
Value:
C:\Program Files\TTEC\WBISA\uninstall.exe
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TTEC ISA
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\TTEC\WBISA\uninstall.exe" /S
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TTEC ISA
Operation:writeName:InstallLocation
Value:
"C:\Program Files\TTEC\WBISA"
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TTEC ISA
Operation:writeName:DisplayIcon
Value:
"C:\Program Files\TTEC\WBISA\TTECLogo.ico"
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TTEC ISA
Operation:writeName:Publisher
Value:
TTEC
(PID) Process:(1428) ISASetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TTEC ISA
Operation:writeName:HelpLink
Value:
"https://workbooth.info/"
Executable files
11
Suspicious files
0
Text files
4
Unknown types
1

Dropped files

PID
Process
Filename
Type
1428ISASetup.exeC:\Program Files\TTEC\WBISA\vcredist_x86.exe —
MD5:—
SHA256:—
1428ISASetup.exeC:\Program Files\TTEC\WBISA\ISA.exeexecutable
MD5:—
SHA256:—
1428ISASetup.exeC:\Users\admin\AppData\Local\Temp\nse3B99.tmp\LangDLL.dllexecutable
MD5:20231D894BF014965D1AECCF79AB8EF3
SHA256:6AB9EE3478F20C33EE37944720E2FAB4FD21580D66E60DE18A5D9B559D2589B0
1428ISASetup.exeC:\Users\admin\AppData\Local\Temp\nse3B99.tmp\UAC.dllexecutable
MD5:4814167AA1C7EC892E84907094646FAA
SHA256:32DD7269ABF5A0E5DB888E307D9DF313E87CEF4F1B597965A9D8E00934658822
1428ISASetup.exeC:\Users\admin\AppData\Local\Temp\nse3B99.tmp\nsDialogs.dllexecutable
MD5:6E64E5D5F9498058A300B26B8741D9D5
SHA256:8D4B1C275FD1CD0782A265080B56D1AEC8D1C93EDCA5EF3B050D1D20D7B61F33
1428ISASetup.exeC:\Users\admin\AppData\Local\Temp\nse3B99.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
1428ISASetup.exeC:\Users\admin\AppData\Local\Temp\nse3B99.tmp\System.dllexecutable
MD5:0063D48AFE5A0CDC02833145667B6641
SHA256:AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
1428ISASetup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\TTEC\TTEC Initial System Assessment.lnklnk
MD5:—
SHA256:—
1428ISASetup.exeC:\Program Files\TTEC\WBISA\TTECLogo.icoimage
MD5:—
SHA256:—
1428ISASetup.exeC:\Program Files\TTEC\WBISA\fr-CA\ISA.resources.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3260
ISA.exe
170.65.129.43:443
services.workbooth.com
TeleTech Holdings, Inc
US
unknown

DNS requests

Domain
IP
Reputation
services.workbooth.com
  • 170.65.129.43
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ISASetup.exe