download:

BavPro_Setup_Mini_C1.exe

Full analysis: https://app.any.run/tasks/e715267c-5c32-483a-a8ee-60f00ead4bc5
Verdict: Malicious activity
Analysis date: January 03, 2019, 10:15:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

8DF5C5B42F193D5924AC553B6AFD900E

SHA1:

5D06652209E291F59831BA1F3028B4B4DBBC6BEC

SHA256:

55D9D9FBD26F8A2CEF0D2B73FD8DF0627308766A07150324C4CA0A378F1D9FD3

SSDEEP:

49152:GRxQGStXfLD6iHQrjqSi+6wv1bnPCytNlmO+Y01:GdMjuCQ3q3+6wTtNlmOa1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • BavPro_Setup_Mini_C1.exe (PID: 3824)
      • BavPro_Setup_Mini_C1.exe (PID: 3004)
      • BavPro_Setup_C1.exe (PID: 2168)
      • BavSvc.exe (PID: 3904)
      • BavCheckOpponent.exe (PID: 3072)
      • Bav.exe (PID: 2348)
      • BHipsSvc.exe (PID: 2628)
      • BavUpdater.exe (PID: 3704)
      • BavTray.exe (PID: 3208)
      • ReportCommRetry.exe (PID: 3928)
      • BavUpdater.exe (PID: 2720)
      • bavupdater.exe (PID: 2808)
      • explorer.exe (PID: 284)
      • regsvr32.exe (PID: 3600)
      • CheckNetwork.exe (PID: 4004)
      • CheckNetwork.exe (PID: 3036)
      • regsvr32.exe (PID: 3396)
      • svchost.exe (PID: 844)
      • BsrSvc.exe (PID: 324)
      • BavSandbox.exe (PID: 3864)
      • BsrGUI.exe (PID: 3688)
      • BdSandboxCtrl.exe (PID: 1036)
      • svchost.exe (PID: 2560)
      • svchost.exe (PID: 2260)
      • svchost.exe (PID: 2544)
      • opera.exe (PID: 3364)
      • BsrSvc.exe (PID: 3316)
      • BavPluginRemove.exe (PID: 2892)

    • Application was dropped or rewritten from another process

      • BavMSService.exe (PID: 3172)
      • BavPro_Setup_Mini_C1.exe (PID: 3004)
      • Bav.exe (PID: 2348)
      • BavCheckOpponent.exe (PID: 3072)
      • BavSvc.exe (PID: 3904)
      • bavupdater.exe (PID: 2808)
      • BavTray.exe (PID: 3208)
      • BavUpdater.exe (PID: 3704)
      • BavUpdater.exe (PID: 2720)
      • BHipsSvc.exe (PID: 2628)
      • BavMSService.exe (PID: 2708)
      • CheckNetwork.exe (PID: 4004)
      • BavMSService.exe (PID: 2892)
      • ReportCommRetry.exe (PID: 3928)
      • CheckNetwork.exe (PID: 3036)
      • BdSandboxSrv.exe (PID: 4068)
      • BsrSvc.exe (PID: 324)
      • BsrGUI.exe (PID: 3688)
      • BdSandboxCtrl.exe (PID: 3552)
      • BavSandbox.exe (PID: 3864)
      • BsrSvc.exe (PID: 3316)
      • BavPluginRemove.exe (PID: 2892)
      • BdSandboxCtrl.exe (PID: 1036)

    • Changes the autorun value in the registry

      • BavPro_Setup_C1.exe (PID: 2168)
      • BavSvc.exe (PID: 3904)

    • Uses Task Scheduler to run other applications

      • BavPro_Setup_C1.exe (PID: 2168)
      • BavPluginRemove.exe (PID: 2892)

    • Registers / Runs the DLL via REGSVR32.EXE

      • BavPro_Setup_C1.exe (PID: 2168)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2284)
      • schtasks.exe (PID: 3364)
      • schtasks.exe (PID: 2648)
      • BavPro_Setup_C1.exe (PID: 2168)
      • BavSvc.exe (PID: 3904)
      • BsrSvc.exe (PID: 324)
      • schtasks.exe (PID: 3784)

    • Runs injected code in another process

      • BavSvc.exe (PID: 3904)

    • Application was injected by another process

      • explorer.exe (PID: 284)

    • Changes settings of System certificates

      • BavSvc.exe (PID: 3904)

    • Loads the Task Scheduler DLL interface

      • BavSvc.exe (PID: 3904)
      • BsrSvc.exe (PID: 324)

    • Actions looks like stealing of personal data

      • BavSvc.exe (PID: 3904)
      • BsrSvc.exe (PID: 324)

    • Changes Windows auto-update feature

      • BavPluginRemove.exe (PID: 2892)

    • Uses SVCHOST.EXE for hidden code execution

      • BdSandboxSrv.exe (PID: 4068)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BavPro_Setup_Mini_C1.exe (PID: 3824)
      • BavPro_Setup_Mini_C1.exe (PID: 3004)
      • BavSvc.exe (PID: 3904)
      • BavPro_Setup_C1.exe (PID: 2168)
      • BHipsSvc.exe (PID: 2628)
      • Bav.exe (PID: 2348)
      • BdSandboxCtrl.exe (PID: 3552)

    • Creates files in the user directory

      • BavPro_Setup_Mini_C1.exe (PID: 3824)

    • Creates files in the program directory

      • BavPro_Setup_Mini_C1.exe (PID: 3004)
      • BHipsSvc.exe (PID: 2628)
      • CheckNetwork.exe (PID: 3036)
      • BavSvc.exe (PID: 3904)
      • BavUpdater.exe (PID: 3704)
      • Bav.exe (PID: 2348)
      • ReportCommRetry.exe (PID: 3928)
      • BavTray.exe (PID: 3208)
      • BavUpdater.exe (PID: 2720)
      • bavupdater.exe (PID: 2808)
      • BsrSvc.exe (PID: 324)
      • BsrGUI.exe (PID: 3688)
      • BavSandbox.exe (PID: 3864)
      • BdSandboxCtrl.exe (PID: 3552)
      • BavPro_Setup_C1.exe (PID: 2168)
      • BdSandboxCtrl.exe (PID: 1036)
      • opera.exe (PID: 3364)
      • BavPluginRemove.exe (PID: 2892)

    • Creates a software uninstall entry

      • BavPro_Setup_Mini_C1.exe (PID: 3004)
      • BavPro_Setup_C1.exe (PID: 2168)
      • BHipsSvc.exe (PID: 2628)

    • Low-level read access rights to disk partition

      • BavPro_Setup_Mini_C1.exe (PID: 3004)
      • BavPro_Setup_C1.exe (PID: 2168)
      • BavSvc.exe (PID: 3904)
      • BHipsSvc.exe (PID: 2628)
      • bavupdater.exe (PID: 2808)
      • BsrSvc.exe (PID: 324)
      • BdSandboxCtrl.exe (PID: 1036)
      • opera.exe (PID: 3364)
      • BsrSvc.exe (PID: 3316)

    • Executes scripts

      • BavPro_Setup_Mini_C1.exe (PID: 3004)
      • BavPro_Setup_C1.exe (PID: 2168)

    • Creates or modifies windows services

      • BavPro_Setup_C1.exe (PID: 2168)
      • BHipsSvc.exe (PID: 2628)
      • BavSvc.exe (PID: 3904)
      • BdSandboxCtrl.exe (PID: 3552)
      • BdSandboxSrv.exe (PID: 4068)

    • Modifies the open verb of a shell class

      • BavPro_Setup_C1.exe (PID: 2168)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 3600)
      • regsvr32.exe (PID: 3396)

    • Creates files in the Windows directory

      • svchost.exe (PID: 844)
      • BavSvc.exe (PID: 3904)
      • CheckNetwork.exe (PID: 3036)
      • BHipsSvc.exe (PID: 2628)
      • BdSandboxCtrl.exe (PID: 3552)

    • Creates files in the driver directory

      • BavSvc.exe (PID: 3904)
      • BHipsSvc.exe (PID: 2628)
      • BdSandboxCtrl.exe (PID: 3552)

    • Searches for installed software

      • Bav.exe (PID: 2348)
      • BavSvc.exe (PID: 3904)

    • Connects to unusual port

      • BavSvc.exe (PID: 3904)
      • BHipsSvc.exe (PID: 2628)
      • BdSandboxCtrl.exe (PID: 1036)

    • Removes files from Windows directory

      • BHipsSvc.exe (PID: 2628)
      • BavSvc.exe (PID: 3904)

    • Adds / modifies Windows certificates

      • BavSvc.exe (PID: 3904)

    • Application launched itself

      • BsrSvc.exe (PID: 324)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • BavPro_Setup_C1.exe (PID: 2168)

    • Reads settings of System Certificates

      • BHipsSvc.exe (PID: 2628)
      • BavSvc.exe (PID: 3904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 14:19:31+02:00
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x354b
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 5.9.0.21205
ProductVersionNumber: 5.9.0.21205
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Baidu, Inc.
FileDescription: Baidu Antivirus MiniSetup
FileVersion: 5.9.0.217813
LegalCopyright: Copyright (C) 2014 Baidu, Inc. All Rights Reserved.
ProductName: Baidu Antivirus
ProductVersion: 5.9.0.217813

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 10-Apr-2010 12:19:31
Detected languages:
  • English - United States
CompanyName: Baidu, Inc.
FileDescription: Baidu Antivirus MiniSetup
FileVersion: 5.9.0.217813
LegalCopyright: Copyright (C) 2014 Baidu, Inc. All Rights Reserved.
ProductName: Baidu Antivirus
ProductVersion: 5.9.0.217813

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 10-Apr-2010 12:19:31
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000063A2
0x00006400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.48045
.rdata
0x00008000
0x000018F2
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.88829
.data
0x0000A000
0x0006669C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.42988
.ndata
0x00071000
0x0008D000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x000FE000
0x000087A0
0x00008800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.03194

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.19535
735
UNKNOWN
English - United States
RT_MANIFEST
2
6.11939
9640
UNKNOWN
English - United States
RT_ICON
3
6.21159
4264
UNKNOWN
English - United States
RT_ICON
4
5.54039
1128
UNKNOWN
English - United States
RT_ICON
103
2.62308
62
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
92
Monitored processes
44
Malicious processes
19
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start inject bavpro_setup_mini_c1.exe bavpro_setup_mini_c1.exe bavmsservice.exe no specs cscript.exe no specs cscript.exe no specs bavpro_setup_c1.exe cscript.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs regsvr32.exe no specs regsvr32.exe no specs bavsvc.exe cscript.exe no specs bhipssvc.exe checknetwork.exe bav.exe bavcheckopponent.exe no specs explorer.exe bavupdater.exe bavtray.exe checknetwork.exe reportcommretry.exe bavupdater.exe cscript.exe no specs cscript.exe no specs bavupdater.exe bavmsservice.exe no specs bavmsservice.exe no specs svchost.exe bsrgui.exe no specs bsrsvc.exe bdsandboxctrl.exe bavsandbox.exe no specs bdsandboxctrl.exe bdsandboxsrv.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs opera.exe bsrsvc.exe no specs bavpluginremove.exe schtasks.exe no specs bavpro_setup_mini_c1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
324"C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavAdvTools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\tool\BsrSvc.exe" -serviceC:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BavAdvTools\128B4BEC-5D89-43AD-BAA8-207084AA0E4F\tool\BsrSvc.exe
services.exe
User:
SYSTEM
Company:
Baidu, Inc.
Integrity Level:
SYSTEM
Description:
BsrSvc
Exit code:
0
Version:
4,6,2,116220
Modules
Images
c:\program files\baidu security\baidu antivirus\5.4.3.147185.0\bavadvtools\128b4bec-5d89-43ad-baa8-207084aa0e4f\tool\bsrsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
844C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1036"C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdSandboxCtrl.exe" -start Default "C:\Users\Public\Desktop\Opera.lnk"C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\BdSandboxCtrl.exe
BavSandbox.exe
User:
admin
Company:
Baidu, Inc.
Integrity Level:
HIGH
Description:
Baidu Antivirus BdSandboxCtrl
Exit code:
1
Version:
5,4,1,106335
Modules
Images
c:\program files\baidu security\baidu antivirus\5.4.3.147185.0\bdsandboxctrl.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2168"C:\Users\admin\AppData\Local\Temp\baidu_secure\update\BavPro_Setup_C1.exe" /S -joinue=0 -LANG=1033 -src=minisetup -miniwnd=196878 -path="C:\Program Files\Baidu Security\Baidu Antivirus" -installchannel=web|cn|official|directC:\Users\admin\AppData\Local\Temp\baidu_secure\update\BavPro_Setup_C1.exe
BavPro_Setup_Mini_C1.exe
User:
admin
Company:
Baidu, Inc.
Integrity Level:
HIGH
Description:
Baidu Antivirus Setup
Exit code:
0
Version:
5.4.3.147185
Modules
Images
c:\users\admin\appdata\local\temp\baidu_secure\update\bavpro_setup_c1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2260C:\Windows\system32\svchost.exe -k rpcssC:\Windows\system32\svchost.exe—BdSandboxSrv.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bdsandboxdll32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2284"C:\Windows\system32\schtasks.exe" /Delete /TN "Baidu Antivirus Delay Reinstall" /FC:\Windows\system32\schtasks.exe—BavPro_Setup_C1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2332cscript.exe "C:\Users\admin\AppData\Local\Temp\bmt2396.vbs" "C:\Users\admin\AppData\Local\Temp\VbsReprot.ini" "00000002"C:\Windows\system32\cscript.exe—BavPro_Setup_Mini_C1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2348"C:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav.exe" UI_Start_From_Install_MiniAutoNewC:\Program Files\Baidu Security\Baidu Antivirus\5.4.3.147185.0\Bav.exe
BavPro_Setup_C1.exe
User:
admin
Company:
Baidu, Inc.
Integrity Level:
MEDIUM
Description:
Bav
Exit code:
1
Version:
5,4,3,147185
Modules
Images
c:\program files\baidu security\baidu antivirus\5.4.3.147185.0\bav.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2488cscript.exe "C:\Users\admin\AppData\Local\Temp\bmt39DF.vbs" "C:\Users\admin\AppData\Local\Temp\VbsReprot.ini" "00000003"C:\Windows\system32\cscript.exe—BavPro_Setup_Mini_C1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
9 317
Read events
8 360
Write events
928
Delete events
29

Modification events

(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus
Operation:writeName:InstallFlag
Value:
1
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_CURRENT_USER\Software\Baidu Security\PC Faster
Operation:writeName:pcfaster-id
Value:
S-1-5-21-1302019708-1500728564-335382590-1000#5254004A04AF
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Baidu Security\PC Faster
Operation:writeName:pcfaster-guid
Value:
4fa285ca-8f04-4339-a8bb-72f653a562b0
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Baidu Antivirus
Operation:writeName:InstallFlag
Value:
4
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BavPro_Setup_Mini_C1_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BavPro_Setup_Mini_C1_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BavPro_Setup_Mini_C1_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BavPro_Setup_Mini_C1_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BavPro_Setup_Mini_C1_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3004) BavPro_Setup_Mini_C1.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\BavPro_Setup_Mini_C1_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
199
Suspicious files
151
Text files
2 123
Unknown types
45

Dropped files

PID
Process
Filename
Type
3824BavPro_Setup_Mini_C1.exeC:\Users\admin\AppData\Roaming\BavMini\BavMiniSetup.exe —
MD5:—
SHA256:—
3004BavPro_Setup_Mini_C1.exeC:\Users\admin\AppData\Local\Temp\baidu_secure\update\test4822FBB5_0309_420f_9DA2_FA5B8B854946\test4822FBB5_0309_420f_9DA2_FA5B8B854947.txt —
MD5:—
SHA256:—
3004BavPro_Setup_Mini_C1.exeC:\Users\admin\AppData\Local\Temp\baidu_secure\update\fc0ac22005b90dd614992c6f0666fa53.gnet.tmp —
MD5:—
SHA256:—
3004BavPro_Setup_Mini_C1.exeC:\Users\admin\AppData\Local\Temp\baidu_secure\update\fc0ac22005b90dd614992c6f0666fa53.gnet —
MD5:—
SHA256:—
3004BavPro_Setup_Mini_C1.exeC:\Users\admin\AppData\Local\Temp\baidu_secure\update\newver_.xml —
MD5:—
SHA256:—
3004BavPro_Setup_Mini_C1.exeC:\Users\admin\AppData\Local\Temp\baidu_secure\update\6b95e8b70b3f71d2c805ba21a75b7081.gnet.tmp —
MD5:—
SHA256:—
3004BavPro_Setup_Mini_C1.exeC:\ProgramData\Baidu\Antivirus\ReportComm_ForMini.dllexecutable
MD5:—
SHA256:—
844svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
3004BavPro_Setup_Mini_C1.exeC:\ProgramData\Baidu\Antivirus\MiniSetupRF0binary
MD5:—
SHA256:—
2168BavPro_Setup_C1.exeC:\Users\admin\AppData\Local\Temp\nse37DA.tmp\bav.7z —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3 502
TCP/UDP connections
3 500
DNS requests
183
Threats
472

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3004
BavPro_Setup_Mini_C1.exe
POST
200
103.235.46.12:80
http://up.eg.bav.baidu.com/up.cgi
HK
—
—
suspicious
3004
BavPro_Setup_Mini_C1.exe
POST
200
103.235.46.12:80
http://up.eg.bav.baidu.com/up.cgi
HK
—
—
suspicious
3004
BavPro_Setup_Mini_C1.exe
POST
200
103.235.46.12:80
http://up.eg.bav.baidu.com/up.cgi
HK
—
—
suspicious
3004
BavPro_Setup_Mini_C1.exe
POST
200
103.235.46.12:80
http://up.eg.bav.baidu.com/up.cgi
HK
—
—
suspicious
3004
BavPro_Setup_Mini_C1.exe
POST
200
103.235.46.12:80
http://up.eg.bav.baidu.com/up.cgi
HK
—
—
suspicious
3004
BavPro_Setup_Mini_C1.exe
POST
200
103.235.46.12:80
http://up.eg.bav.baidu.com/up.cgi
HK
—
—
suspicious
3004
BavPro_Setup_Mini_C1.exe
POST
200
103.235.46.12:80
http://up.eg.bav.baidu.com/up.cgi
HK
—
—
suspicious
3004
BavPro_Setup_Mini_C1.exe
GET
200
103.235.46.33:80
http://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=install_pi&id=e6c5f99bff76ee6a2a12018b828851e7&chl=web%7Ccn%7Cofficial%7Cdirect&ver=5.9.0.217813&pname=175ab56a567c1b72db1b6fed524305c5085aee6a6e7c2372c11b64ed7c4337c5245aff6a4e7c2f72dc1b6bed7c433ac53b5aec6a6b7c2272f41b5eed45431bc5245ad36a487c2f72de1b5aed524319c50b5adc6a6f7c3a72dd1b7aed7f433bc53d5ae16a637c1172eb1b3bed0e4313c52c5aea6a&pm=d9af4ade2565732b8cb75fd64abee6cb&ps=14a8916a&os=6.6.1.7601.1.0.0&oldid=00000000-5254004A04AF!4fa285ca-8f04-4339-a8bb-72f653a562b0@%235254004A04AF&gfname=175ab56a567c1972c11b64ed444319c5235afc6a567c0b72d01b7aed4c4319c5265aea6a787c6072ed1b52ed6543&gfm=148df8dda3224e2b96aa5c6148123256&gfs=54b6a86a
HK
text
17 b
whitelisted
3004
BavPro_Setup_Mini_C1.exe
GET
200
103.235.46.33:80
http://sync.bav.baidu.com/cgi-bin-py/report_mini_info.cgi?type=install_start&id=e6c5f99bff76ee6a2a12018b828851e7&partnerID=baidu&downloadspeed=0&installname=BavPro_Setup_Mini_C1.exe&chl=web%7Ccn%7Cofficial%7Cdirect&ver=5.9.0.217813&sip=&drc=20000&dt=0&firc=100&oldid=00000000-5254004A04AF!4fa285ca-8f04-4339-a8bb-72f653a562b0@%235254004A04AF
HK
text
17 b
whitelisted
3004
BavPro_Setup_Mini_C1.exe
POST
200
103.235.46.12:80
http://up.eg.bav.baidu.com/up.cgi
HK
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2628
BHipsSvc.exe
103.235.46.9:4006
rtp.bav.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
2628
BHipsSvc.exe
103.235.46.11:80
f.eg.bav.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
suspicious
3904
BavSvc.exe
103.235.46.33:80
sync.bav.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
3904
BavSvc.exe
103.235.46.12:80
up.eg.bav.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
suspicious
2168
BavPro_Setup_C1.exe
103.235.46.33:80
sync.bav.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
3704
BavUpdater.exe
103.235.46.39:80
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
3208
BavTray.exe
104.193.88.96:80
download.sd.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
US
suspicious
3004
BavPro_Setup_Mini_C1.exe
103.235.46.12:80
up.eg.bav.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
suspicious
3004
BavPro_Setup_Mini_C1.exe
103.235.46.33:80
sync.bav.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown
3004
BavPro_Setup_Mini_C1.exe
103.235.46.39:80
www.baidu.com
Beijing Baidu Netcom Science and Technology Co., Ltd.
HK
unknown

DNS requests

Domain
IP
Reputation
up.eg.bav.baidu.com
  • 103.235.46.12
suspicious
sync.bav.baidu.com
  • 103.235.46.33
whitelisted
download.sd.baidu.com
  • 104.193.88.96
malicious
www.baidu.com
  • 103.235.46.39
whitelisted
speedtest.wshifen.com
  • —
unknown
antivirus.baidu.com
  • 103.235.46.69
suspicious
rtp.bav.baidu.com
  • 103.235.46.9
unknown
www.pcfaster.com
  • 103.235.46.69
suspicious
upf.bav.baidu.com
  • —
unknown
f.eg.bav.baidu.com
  • 103.235.46.11
suspicious

Threats

PID
Process
Class
Message
3004
BavPro_Setup_Mini_C1.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Possible threat - .exe downloading with HEAD option
3004
BavPro_Setup_Mini_C1.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3036
CheckNetwork.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HTTP Downloader)
4004
CheckNetwork.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (HTTP Downloader)
3904
BavSvc.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3904
BavSvc.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3904
BavSvc.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3904
BavSvc.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3904
BavSvc.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
3904
BavSvc.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
Process
Message
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CBavMiniSetupImpl::Init( 156 ) Init enter!
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CReportAgent::BLSReportInitialize( 1527 ) BLSReportInitialize Success!
BavPro_Setup_Mini_C1.exe
[1144] MiniSetup Info : CBavMiniSetupImpl::GetFatherInfo( 6426 ) GetFatherInfo Thread Enter!!
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CBavMiniSetupImpl::Init( 211 ) command 0: C:\Users\admin\AppData\Roaming\BavMini\BavPro_Setup_Mini_C1.exe.
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CReportAgent::BLSReportSend( 1774 ) BLSLogType_ErrorInfo! strKey_name=run_point iValue=-1 strValue=process_start
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CBavMiniSetupImpl::Init( 356 ) Config info1: m_wstrChannel=web|cn|official|direct m_wstrVersion2=5.9.0.217813 m_wstrPartnerID=baidu m_wstrVersionInfoUrl=http://download.sd.baidu.com/newver_C1.xml
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CBavMiniSetupImpl::Init( 358 ) Config info2: m_bShowUI=1 m_bForceInstall=1 m_bHasMiniService=1 m_iServiceMaxInvokeCount=5 m_bHasS2SReport=0
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CReportAgent::BLSReportSend( 1774 ) BLSLogType_ErrorInfo! strKey_name=downloadlib_type iValue=-1 strValue=HTTP
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CReportAgent::BLSReportSend( 1774 ) BLSLogType_ErrorInfo! strKey_name=previous_fr iValue=-1 strValue=
BavPro_Setup_Mini_C1.exe
[3000] MiniSetup Info : CReportAgent::BLSReportSend( 1774 ) BLSLogType_ErrorInfo! strKey_name=reg_state iValue=-1 strValue=InstallDir nonexistent
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BavPro_Setup_Mini_C1.exe