Find similar analyses in TI Lookup
Analysis date (UTC): 24 July 2024, 13:41Analysis environment: Windows 7 Pro, build 7601, x86

http://download.unity3d.com/download_unity/21747dafc6ee/TargetSupportInstaller/UnitySetup-Android-Support-for-Editor-2023.2.3f1.exe

MD5:098E61E4FCDF5C3E4289DF9B130B4A25
SHA1:B77CD53FB133B481D0978A6C1437857B38CC5C08
SHA256:4FAD924DEE0882B93861D31FF422D20CDF5F1EEB32F88ABFC4E3A433ACB316D8

Analysis result

Threat level:Malicious activity
Tags:
loader
Full analysis:Analysis http://download.unity3d.com/download_unity/21747dafc6ee/TargetSupportInstaller/UnitySetup-Android-Support-for-Editor-2023.2.3f1.exe Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

  • ChromeSetup.exe (PID: 2252)
  • GoogleUpdateSetup.exe (PID: 3852)
  • GoogleUpdate.exe (PID: 1072)
  • 109.0.5414.120_chrome_installer.exe (PID: 1876)
  • setup.exe (PID: 3068)

Changes the autorun value in the registry

  • setup.exe (PID: 3068)

SUSPICIOUS

Potential Corporate Privacy Violation

  • chrome.exe (PID: 3980)

Reads the Internet Settings

  • rundll32.exe (PID: 3972)
  • GoogleUpdate.exe (PID: 3568)
  • GoogleUpdate.exe (PID: 1968)

Executable content was dropped or overwritten

  • ChromeSetup.exe (PID: 2252)
  • GoogleUpdateSetup.exe (PID: 3852)
  • GoogleUpdate.exe (PID: 1072)
  • 109.0.5414.120_chrome_installer.exe (PID: 1876)
  • setup.exe (PID: 3068)

Creates/Modifies COM task schedule object

  • GoogleUpdate.exe (PID: 3276)

Disables SEHOP

  • GoogleUpdate.exe (PID: 1072)

Executes as Windows Service

  • GoogleUpdate.exe (PID: 1784)

Reads settings of System Certificates

  • GoogleUpdate.exe (PID: 3568)
  • GoogleUpdate.exe (PID: 1968)

Checks Windows Trust Settings

  • GoogleUpdate.exe (PID: 1968)

Reads security settings of Internet Explorer

  • GoogleUpdate.exe (PID: 1968)

Application launched itself

  • setup.exe (PID: 3068)
  • setup.exe (PID: 3520)
  • GoogleUpdate.exe (PID: 1784)

Searches for installed software

  • setup.exe (PID: 3068)

Creates a software uninstall entry

  • setup.exe (PID: 3068)

Reads the date of Windows installation

  • setup.exe (PID: 3520)

INFO

Drops the executable file immediately after the start

  • chrome.exe (PID: 3156)
  • msedge.exe (PID: 3576)
  • msedge.exe (PID: 2112)

Manual execution by a user

  • rundll32.exe (PID: 3972)

Executable content was dropped or overwritten

  • chrome.exe (PID: 3156)
  • msedge.exe (PID: 2112)
  • msedge.exe (PID: 3576)

The process uses the downloaded file

  • msedge.exe (PID: 2724)
  • msedge.exe (PID: 2112)
  • ChromeSetup.exe (PID: 2252)
  • GoogleUpdateSetup.exe (PID: 3852)

Checks supported languages

  • ChromeSetup.exe (PID: 2252)
  • GoogleUpdate.exe (PID: 3788)
  • GoogleUpdate.exe (PID: 3276)
  • GoogleUpdate.exe (PID: 3568)
  • GoogleUpdateSetup.exe (PID: 3852)
  • GoogleUpdate.exe (PID: 1072)
  • GoogleUpdate.exe (PID: 3416)
  • GoogleUpdate.exe (PID: 1968)
  • GoogleUpdate.exe (PID: 1784)
  • 109.0.5414.120_chrome_installer.exe (PID: 1876)
  • setup.exe (PID: 3608)
  • setup.exe (PID: 3068)
  • setup.exe (PID: 3520)
  • GoogleCrashHandler.exe (PID: 1984)
  • GoogleUpdate.exe (PID: 720)
  • GoogleUpdate.exe (PID: 2456)
  • GoogleUpdateOnDemand.exe (PID: 3540)
  • setup.exe (PID: 3040)

Application launched itself

  • msedge.exe (PID: 2112)
  • chrome.exe (PID: 3156)
  • chrome.exe (PID: 3680)

Create files in a temporary directory

  • ChromeSetup.exe (PID: 2252)
  • GoogleUpdate.exe (PID: 1968)

Reads the computer name

  • GoogleUpdate.exe (PID: 3788)
  • GoogleUpdate.exe (PID: 3416)
  • GoogleUpdate.exe (PID: 3276)
  • GoogleUpdate.exe (PID: 1072)
  • GoogleUpdate.exe (PID: 3568)
  • GoogleUpdate.exe (PID: 1968)
  • GoogleUpdate.exe (PID: 1784)
  • 109.0.5414.120_chrome_installer.exe (PID: 1876)
  • setup.exe (PID: 3068)
  • GoogleUpdate.exe (PID: 720)
  • GoogleCrashHandler.exe (PID: 1984)
  • GoogleUpdate.exe (PID: 2456)
  • setup.exe (PID: 3520)

Creates files in the program directory

  • GoogleUpdate.exe (PID: 3416)
  • GoogleUpdate.exe (PID: 3276)
  • GoogleUpdateSetup.exe (PID: 3852)
  • GoogleUpdate.exe (PID: 1072)
  • GoogleUpdate.exe (PID: 3568)
  • GoogleUpdate.exe (PID: 1968)
  • GoogleUpdate.exe (PID: 1784)
  • 109.0.5414.120_chrome_installer.exe (PID: 1876)
  • setup.exe (PID: 3068)
  • setup.exe (PID: 3520)
  • GoogleCrashHandler.exe (PID: 1984)
  • GoogleUpdate.exe (PID: 2456)

Reads the machine GUID from the registry

  • GoogleUpdate.exe (PID: 3788)
  • GoogleUpdate.exe (PID: 1072)
  • GoogleUpdate.exe (PID: 1968)
  • GoogleUpdate.exe (PID: 3568)
  • GoogleUpdate.exe (PID: 1784)
  • setup.exe (PID: 3068)
  • GoogleUpdate.exe (PID: 720)
  • setup.exe (PID: 3520)
  • GoogleUpdate.exe (PID: 2456)

Reads the software policy settings

  • GoogleUpdate.exe (PID: 3568)
  • GoogleUpdate.exe (PID: 1968)
  • GoogleUpdate.exe (PID: 1784)
  • GoogleUpdate.exe (PID: 2456)

Checks proxy server information

  • GoogleUpdate.exe (PID: 1968)

Creates files or folders in the user directory

  • GoogleUpdate.exe (PID: 1968)

Threats

PIDProcessClassMessage
3980chrome.exePotential Corporate Privacy ViolationET POLICY PE EXE or DLL Windows file download HTTP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Interactive malware hunting service ANY.RUN

© 2017-2026 ANY.RUN LLC. ALL RIGHTS RESERVED