URL:

https://sourceforge.net/projects/processhacker/files/processhacker2/processhacker-2.39-setup.exe/download

Full analysis: https://app.any.run/tasks/cdde4b63-3405-4545-9ee9-0d57952c1aab
Verdict: Malicious activity
Analysis date: January 17, 2024, 07:08:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

AD2610BB527018844065D32CB3B63136

SHA1:

FB1AFD1628AB41BAF3FC2CD50A178DB34442089D

SHA256:

4AE651B06A13AD6C3BE2D4A4B2710084B02B90BF86839A410D3E4AF3757C9874

SSDEEP:

3:N8HCGSuLAuUt6yAub1AuXKyA6i8VkvDLz:2iGnCt/915Pzi8VkvD/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • processhacker-2.39-setup.exe (PID: 876)
      • processhacker-2.39-setup.exe (PID: 1956)
      • processhacker-2.39-setup.tmp (PID: 2912)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • processhacker-2.39-setup.exe (PID: 876)
      • processhacker-2.39-setup.exe (PID: 1956)
      • processhacker-2.39-setup.tmp (PID: 2912)

    • Reads the Windows owner or organization settings

      • processhacker-2.39-setup.tmp (PID: 2912)

    • Process drops legitimate windows executable

      • processhacker-2.39-setup.tmp (PID: 2912)

    • Drops a system driver (possible attempt to evade defenses)

      • processhacker-2.39-setup.tmp (PID: 2912)

    • Reads the Internet Settings

      • ProcessHacker.exe (PID: 2856)

    • Reads security settings of Internet Explorer

      • ProcessHacker.exe (PID: 2856)

    • Checks Windows Trust Settings

      • ProcessHacker.exe (PID: 2856)

    • Reads settings of System Certificates

      • ProcessHacker.exe (PID: 2856)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2040)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 864)
      • iexplore.exe (PID: 2040)

    • Checks supported languages

      • processhacker-2.39-setup.exe (PID: 876)
      • processhacker-2.39-setup.tmp (PID: 2316)
      • processhacker-2.39-setup.exe (PID: 1956)
      • processhacker-2.39-setup.tmp (PID: 2912)
      • ProcessHacker.exe (PID: 2856)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2040)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 864)
      • iexplore.exe (PID: 2040)

    • Create files in a temporary directory

      • processhacker-2.39-setup.exe (PID: 876)
      • processhacker-2.39-setup.exe (PID: 1956)
      • processhacker-2.39-setup.tmp (PID: 2912)

    • Reads the computer name

      • processhacker-2.39-setup.tmp (PID: 2316)
      • processhacker-2.39-setup.tmp (PID: 2912)
      • ProcessHacker.exe (PID: 2856)

    • Creates files in the program directory

      • processhacker-2.39-setup.tmp (PID: 2912)

    • Reads Environment values

      • ProcessHacker.exe (PID: 2856)

    • Reads the machine GUID from the registry

      • ProcessHacker.exe (PID: 2856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
7
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe processhacker-2.39-setup.exe processhacker-2.39-setup.tmp no specs processhacker-2.39-setup.exe processhacker-2.39-setup.tmp processhacker.exe

Process information

PID
CMD
Path
Indicators
Parent process
864"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2040 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
876"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\processhacker-2.39-setup.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\processhacker-2.39-setup.exe
iexplore.exe
User:
admin
Company:
wj32
Integrity Level:
MEDIUM
Description:
Process Hacker Setup
Exit code:
0
Version:
2.39 (r124)
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\processhacker-2.39-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1956"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\processhacker-2.39-setup.exe" /SPAWNWND=$1023C /NOTIFYWND=$50204 C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\processhacker-2.39-setup.exe
processhacker-2.39-setup.tmp
User:
admin
Company:
wj32
Integrity Level:
HIGH
Description:
Process Hacker Setup
Exit code:
0
Version:
2.39 (r124)
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\processhacker-2.39-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2040"C:\Program Files\Internet Explorer\iexplore.exe" "https://sourceforge.net/projects/processhacker/files/processhacker2/processhacker-2.39-setup.exe/download"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2316"C:\Users\admin\AppData\Local\Temp\is-K043F.tmp\processhacker-2.39-setup.tmp" /SL5="$50204,1874675,150016,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\processhacker-2.39-setup.exe" C:\Users\admin\AppData\Local\Temp\is-K043F.tmp\processhacker-2.39-setup.tmp—processhacker-2.39-setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-k043f.tmp\processhacker-2.39-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2856"C:\Program Files\Process Hacker 2\ProcessHacker.exe"C:\Program Files\Process Hacker 2\ProcessHacker.exe
processhacker-2.39-setup.tmp
User:
admin
Company:
wj32
Integrity Level:
MEDIUM
Description:
Process Hacker
Exit code:
0
Version:
2.39.0.124
Modules
Images
c:\program files\process hacker 2\processhacker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winsta.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2912"C:\Users\admin\AppData\Local\Temp\is-2KHN9.tmp\processhacker-2.39-setup.tmp" /SL5="$2023E,1874675,150016,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\processhacker-2.39-setup.exe" /SPAWNWND=$1023C /NOTIFYWND=$50204 C:\Users\admin\AppData\Local\Temp\is-2KHN9.tmp\processhacker-2.39-setup.tmp
processhacker-2.39-setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-2khn9.tmp\processhacker-2.39-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
36 656
Read events
36 514
Write events
134
Delete events
8

Modification events

(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2040) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
38
Suspicious files
64
Text files
324
Unknown types
1

Dropped files

PID
Process
Filename
Type
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:32EC33B0FB01AC1E9375DF20B52A52A9
SHA256:BA5B977EC4C04062FB7DFD0540BE26F8B940B4C5193F26645B384D5F794AA5B0
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:05C22BA005A9D97554BF65BF0E3629E7
SHA256:B0600B1B82AB5F6829208C6B52869B2CDE962F93E4CD7608AFD350A2B8BECE8F
864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:DE13AF43765C4CD28AF824C3E81E2E5C
SHA256:C8B4A05D6F4AA251F6E238C94F568C2B05168B61F2267260BF0E601EF990BA39
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\sf.sandiego-cmp-top[1].jshtml
MD5:C3C9DA61F2361CC9A5CC5FB102565F53
SHA256:1D48F195B9979C2845D7E803A67DD5ADD33B7CF136770ECE36C9F78EEAA593D3
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\lato[1].csstext
MD5:8F61F228AD51184B5F8BBBF14B436DF9
SHA256:DA04907546EDDC4640039BB9EFBBB483D220B1E4EC553F9830A9510B7FF14899
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\cmp[1].csstext
MD5:38C8ACF2B4EF7DEF65BACFB6E9A26E8E
SHA256:4BAAE150A27BC5716BA8F5160FBD2414F5B731C470D8EE0956612DAFA106E950
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\sf.sandiego-head[1].jstext
MD5:D05F98B211F1AC879F9378468F3D6649
SHA256:981BB3EEE156C83AFDED72FAD8F7CD5ECCE65B769E1FA842AC9E356CBA4530D9
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\adsbanner[1].jstext
MD5:1A9F5B5D41007226049E6EF054C9F935
SHA256:E3E69CC01AD15179EB67E1F90E1774ED5A5DA075F85420A1D9B01029B28B14DC
864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\altushost-xlarge[1].pngimage
MD5:294EAF667826B502295BA3FA9AF91846
SHA256:AC7CB388ED6E57EC2EF2E9F3E7981EEC5D5FCFB8BAE6A34B1D7B0D351F9626A6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
141
DNS requests
49
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2040
iexplore.exe
GET
304
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bb7a787b0c23a419
unknown
—
—
unknown
864
iexplore.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
864
iexplore.exe
GET
200
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1370d8f2dc7c184e
unknown
compressed
65.2 Kb
unknown
864
iexplore.exe
GET
200
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6f825234c2810feb
unknown
compressed
4.66 Kb
unknown
864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
864
iexplore.exe
GET
200
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2f131cf452408714
unknown
compressed
4.66 Kb
unknown
864
iexplore.exe
GET
200
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?02e66f896758e1a5
unknown
compressed
65.2 Kb
unknown
864
iexplore.exe
GET
200
184.24.77.47:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgR%2B5rJNDRLPmf6wKNriwkmuQQ%3D%3D
unknown
binary
503 b
unknown
2040
iexplore.exe
GET
304
23.32.238.235:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?85105a2067e5fff2
unknown
—
—
unknown
2040
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
864
iexplore.exe
172.64.150.145:443
sourceforge.net
CLOUDFLARENET
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
864
iexplore.exe
23.32.238.235:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
864
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
864
iexplore.exe
172.64.147.47:443
a.fsdn.com
CLOUDFLARENET
US
unknown
864
iexplore.exe
87.230.98.76:443
d.delivery.consentmanager.net
PlusServer GmbH
DE
unknown
864
iexplore.exe
212.102.56.181:443
cdn.consentmanager.net
Datacamp Limited
DE
unknown
864
iexplore.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
sourceforge.net
  • 172.64.150.145
  • 104.18.37.111
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.235
  • 23.32.238.240
  • 23.32.238.234
  • 23.32.238.232
  • 23.32.238.242
  • 23.32.238.241
  • 23.32.238.176
  • 23.32.238.227
  • 23.32.238.169
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
a.fsdn.com
  • 172.64.147.47
  • 104.18.40.209
whitelisted
static.cloudflareinsights.com
  • 104.16.56.101
  • 104.16.57.101
whitelisted
d.delivery.consentmanager.net
  • 87.230.98.76
unknown
cdn.consentmanager.net
  • 212.102.56.181
  • 212.102.56.179
  • 195.181.175.16
  • 156.146.33.140
  • 195.181.175.41
  • 156.146.33.138
  • 195.181.170.18
malicious
x1.c.lencr.org
  • 69.192.161.44
whitelisted
c.sf-syn.com
  • 104.18.33.97
  • 172.64.154.159
whitelisted
r3.o.lencr.org
  • 184.24.77.47
  • 184.24.77.67
  • 184.24.77.52
  • 184.24.77.71
  • 184.24.77.53
  • 184.24.77.74
  • 184.24.77.62
  • 184.24.77.54
  • 184.24.77.57
  • 95.101.54.107
  • 95.101.54.208
  • 95.101.54.203
  • 2.16.202.115
  • 95.101.54.216
  • 95.101.54.145
shared

Threats

PID
Process
Class
Message
864
iexplore.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
864
iexplore.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sourceforge.net/projects/processhacker/files/processhacker2/processhacker-2.39-setup.exe/download