File name:

LocalServiceComponents.exe

Full analysis: https://app.any.run/tasks/a1e57e35-ba93-4388-b908-608ec4935ecb
Verdict: Malicious activity
Analysis date: July 19, 2024, 10:58:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2DA42136E5E75DAC9FD2E1EE71D717D9

SHA1:

247A6C68F2B3F09936A536EF534666BC1E52D816

SHA256:

48EE450675C347546C7E615493A10AE9F1F475427092D95DC5464B2E92DDB20C

SSDEEP:

98304:dm3NFw1dl5CGmOslj//GF8iLpIuJRCNbX975Cum3AzA8s9rZByxY4XtQ42Xah9Gf:z9iJkTuheAqRMdg//h5QILhH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • LocalServiceComponents.exe (PID: 6148)
      • LocalServiceComponents.exe (PID: 6876)
      • LocalServiceComponents.tmp (PID: 6868)

    • Changes the autorun value in the registry

      • LocalServiceComponents.tmp (PID: 6868)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • LocalServiceComponents.exe (PID: 6148)
      • LocalServiceComponents.exe (PID: 6876)
      • LocalServiceComponents.tmp (PID: 6868)

    • Reads security settings of Internet Explorer

      • LocalServiceComponents.tmp (PID: 2116)
      • LocalServiceControl.exe (PID: 6216)
      • LocalServiceControl.exe (PID: 7348)

    • Reads the date of Windows installation

      • LocalServiceComponents.tmp (PID: 2116)
      • LocalServiceControl.exe (PID: 6216)
      • LocalServiceControl.exe (PID: 7348)

    • Process drops legitimate windows executable

      • LocalServiceComponents.tmp (PID: 6868)

    • Reads the Windows owner or organization settings

      • LocalServiceComponents.tmp (PID: 6868)

    • The process drops C-runtime libraries

      • LocalServiceComponents.tmp (PID: 6868)

    • Creates file in the systems drive root

      • LocalServiceControl.exe (PID: 6612)
      • LocalServiceControl.exe (PID: 7228)
      • LocalServiceControl.exe (PID: 6216)
      • LocalServiceControl.exe (PID: 7348)
      • LocalServiceControl.exe (PID: 6276)

    • Application launched itself

      • LocalServiceControl.exe (PID: 6216)
      • LocalServiceControl.exe (PID: 7348)

    • There is functionality for taking screenshot (YARA)

      • LocalServiceControl.exe (PID: 7228)

  • INFO

    • Create files in a temporary directory

      • LocalServiceComponents.exe (PID: 6148)
      • LocalServiceComponents.exe (PID: 6876)
      • LocalServiceComponents.tmp (PID: 6868)

    • Checks supported languages

      • LocalServiceComponents.exe (PID: 6148)
      • LocalServiceComponents.tmp (PID: 2116)
      • LocalServiceComponents.exe (PID: 6876)
      • LocalServiceComponents.tmp (PID: 6868)
      • LocalServiceControl.exe (PID: 7228)
      • LocalServiceControl.exe (PID: 6216)
      • LocalServiceControl.exe (PID: 6612)
      • LocalServiceControl.exe (PID: 7348)
      • LocalServiceControl.exe (PID: 6276)

    • Reads the computer name

      • LocalServiceComponents.tmp (PID: 2116)
      • LocalServiceComponents.tmp (PID: 6868)
      • LocalServiceControl.exe (PID: 7228)
      • LocalServiceControl.exe (PID: 6216)
      • LocalServiceControl.exe (PID: 6612)
      • LocalServiceControl.exe (PID: 7348)
      • LocalServiceControl.exe (PID: 6276)

    • Process checks computer location settings

      • LocalServiceComponents.tmp (PID: 2116)
      • LocalServiceControl.exe (PID: 6216)
      • LocalServiceControl.exe (PID: 7348)

    • Creates files in the program directory

      • LocalServiceComponents.tmp (PID: 6868)
      • LocalServiceControl.exe (PID: 7228)

    • Creates a software uninstall entry

      • LocalServiceComponents.tmp (PID: 6868)

    • Manual execution by a user

      • LocalServiceControl.exe (PID: 6216)
      • LocalServiceControl.exe (PID: 7348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 14848
UninitializedDataSize: -
EntryPoint: 0x9b24
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.101
ProductVersionNumber: 1.0.0.101
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: LocalServiceComponents Setup
FileVersion: 1.0.0.101
LegalCopyright:
ProductName: LocalServiceComponents
ProductVersion: 1.0.0.101
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
11
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start localservicecomponents.exe localservicecomponents.tmp no specs localservicecomponents.exe localservicecomponents.tmp THREAT localservicecontrol.exe no specs slui.exe no specs rundll32.exe no specs localservicecontrol.exe no specs localservicecontrol.exe localservicecontrol.exe no specs localservicecontrol.exe

Process information

PID
CMD
Path
Indicators
Parent process
2116"C:\Users\admin\AppData\Local\Temp\is-D5GEC.tmp\LocalServiceComponents.tmp" /SL5="$100274,15656822,53760,C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" C:\Users\admin\AppData\Local\Temp\is-D5GEC.tmp\LocalServiceComponents.tmp—LocalServiceComponents.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.50.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-d5gec.tmp\localservicecomponents.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4568C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6148"C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
LocalServiceComponents Setup
Exit code:
0
Version:
1.0.0.101
Modules
Images
c:\users\admin\appdata\local\temp\localservicecomponents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6216"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6276"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
LocalServiceControl.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6612"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
LocalServiceControl.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6868"C:\Users\admin\AppData\Local\Temp\is-A4A5Q.tmp\LocalServiceComponents.tmp" /SL5="$502B4,15656822,53760,C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" /SPAWNWND=$30254 /NOTIFYWND=$100274 C:\Users\admin\AppData\Local\Temp\is-A4A5Q.tmp\LocalServiceComponents.tmp
LocalServiceComponents.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.50.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-a4a5q.tmp\localservicecomponents.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6876"C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe" /SPAWNWND=$30254 /NOTIFYWND=$100274 C:\Users\admin\AppData\Local\Temp\LocalServiceComponents.exe
LocalServiceComponents.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
LocalServiceComponents Setup
Exit code:
0
Version:
1.0.0.101
Modules
Images
c:\users\admin\appdata\local\temp\localservicecomponents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7228"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
LocalServiceComponents.tmp
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
7348"C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe" C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\program files (x86)\localservicecomponents\localservicecontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
Total events
9 643
Read events
9 609
Write events
34
Delete events
0

Modification events

(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\LocalServiceControl
Operation:writeName:URL Protocol
Value:
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:LocalServiceControl
Value:
C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exe
Value:
HIGHDPIAWARE
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_CURRENT_USER\SOFTWARE\MozillaPlugins\LocalServiceControl
Operation:writeName:CurrentVersion
Value:
1.0.0.83
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.3.5 (a)
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\LocalServiceComponents
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\LocalServiceComponents\
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
LocalServiceComponents
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(6868) LocalServiceComponents.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{80DDB8B4-9C6F-44A2-81AD-155EE6917A9A}_is1
Operation:writeName:DisplayName
Value:
LocalServiceComponents
Executable files
158
Suspicious files
1
Text files
25
Unknown types
2

Dropped files

PID
Process
Filename
Type
6148LocalServiceComponents.exeC:\Users\admin\AppData\Local\Temp\is-D5GEC.tmp\LocalServiceComponents.tmpexecutable
MD5:9D321C7096F4BCAEB6F3D8D1636E1744
SHA256:43202B0DE2E718D35CDF7EB8B34DD35BF3FAE85C0ECD2108830230A121284322
6868LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-8L2LF.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
6876LocalServiceComponents.exeC:\Users\admin\AppData\Local\Temp\is-A4A5Q.tmp\LocalServiceComponents.tmpexecutable
MD5:9D321C7096F4BCAEB6F3D8D1636E1744
SHA256:43202B0DE2E718D35CDF7EB8B34DD35BF3FAE85C0ECD2108830230A121284322
6868LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-8L2LF.tmp\ISTask.dllexecutable
MD5:86A1311D51C00B278CB7F27796EA442E
SHA256:E916BDF232744E00CBD8D608168A019C9F41A68A7E8390AA48CFB525276C483D
6868LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\unins000.exeexecutable
MD5:905C6DC64BBC773C4CFF4B6ED21D214C
SHA256:1D7DC226DD83782EACC3F190078F65861B6510AF2D2286164C7348D1C50DC952
6868LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-8L2LF.tmp\_isetup\_RegDLL.tmpexecutable
MD5:0EE914C6F0BB93996C75941E1AD629C6
SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
6868LocalServiceComponents.tmpC:\Users\admin\AppData\Local\Temp\is-8L2LF.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
6868LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-7EIMF.tmpexecutable
MD5:905C6DC64BBC773C4CFF4B6ED21D214C
SHA256:1D7DC226DD83782EACC3F190078F65861B6510AF2D2286164C7348D1C50DC952
6868LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\is-NM4GP.tmpexecutable
MD5:1058F84DF7A6F6C0DF16D5F705CC4C8E
SHA256:9DBE14F949B100E1C9773F513B4B9629A65F7328AD4E40B97098CC4C2943E71F
6868LocalServiceComponents.tmpC:\Program Files (x86)\LocalServiceComponents\LocalServiceControl.exeexecutable
MD5:1058F84DF7A6F6C0DF16D5F705CC4C8E
SHA256:9DBE14F949B100E1C9773F513B4B9629A65F7328AD4E40B97098CC4C2943E71F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
32
DNS requests
11
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4716
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5620
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.115.3.253:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2760
svchost.exe
40.115.3.253:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7856
svchost.exe
4.209.32.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1580
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.14
  • 40.126.32.134
  • 20.190.160.22
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.68
  • 40.126.32.72
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 172.217.18.14
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
licensing.mp.microsoft.com
  • 4.209.32.198
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
LocalServiceComponents.exe