File name:

HPPSdr.exe

Full analysis: https://app.any.run/tasks/4f623063-345d-4b36-9cfc-e67cb019b6e6
Verdict: Malicious activity
Analysis date: November 03, 2023, 14:21:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FE236937872C20107145A8F8A0869EBD

SHA1:

C4818093839C24A3EBC583B49EF8789C5CEEA130

SHA256:

5F4467BA1D28CCD2367ACF1D4B6DB15A0D973C5CEC1FF59B25AC8074520B9BA4

SSDEEP:

98304:Z9MnRNTsjNNJusPSo1vomxCHv4AmOwruCVFKomWdyCc/stSvFwg8kJhpA7w26QGQ:EyUOaQtGLYmPU3dTszFTBo7r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • NDP46-KB3045560-Web.exe (PID: 3688)
      • HPPSdr.exe (PID: 3372)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • HPPSdr.exe (PID: 3372)
      • NDP46-KB3045560-Web.exe (PID: 3688)

    • The process drops C-runtime libraries

      • HPPSdr.exe (PID: 3372)

    • The process creates files with name similar to system file names

      • HPPSdr.exe (PID: 3372)

    • Reads the Internet Settings

      • HPPSdr.exe (PID: 3372)
      • FileExtractor.exe (PID: 3624)
      • Setup.exe (PID: 3844)

    • Checks Windows Trust Settings

      • Setup.exe (PID: 3844)

    • Reads settings of System Certificates

      • Setup.exe (PID: 3844)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 3844)

    • Adds/modifies Windows certificates

      • NDP46-KB3045560-Web.exe (PID: 3688)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3416)
      • HPPSdr.exe (PID: 3372)
      • FileExtractor.exe (PID: 3624)
      • NDP46-KB3045560-Web.exe (PID: 3688)
      • SetupUtility.exe (PID: 3924)
      • wmpnscfg.exe (PID: 3748)
      • SetupUtility.exe (PID: 4008)
      • Setup.exe (PID: 3844)
      • TMPB620.tmp.exe (PID: 3980)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3416)
      • HPPSdr.exe (PID: 3372)
      • FileExtractor.exe (PID: 3624)
      • NDP46-KB3045560-Web.exe (PID: 3688)
      • SetupUtility.exe (PID: 3924)
      • wmpnscfg.exe (PID: 3748)
      • Setup.exe (PID: 3844)
      • SetupUtility.exe (PID: 4008)
      • TMPB620.tmp.exe (PID: 3980)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3416)
      • NDP46-KB3045560-Web.exe (PID: 3688)
      • Setup.exe (PID: 3844)
      • SetupUtility.exe (PID: 3924)
      • wmpnscfg.exe (PID: 3748)

    • Creates files in the program directory

      • HPPSdr.exe (PID: 3372)

    • Create files in a temporary directory

      • NDP46-KB3045560-Web.exe (PID: 3688)
      • Setup.exe (PID: 3844)
      • SetupUtility.exe (PID: 3924)
      • TMPB620.tmp.exe (PID: 3980)

    • Reads CPU info

      • Setup.exe (PID: 3844)

    • Reads Environment values

      • Setup.exe (PID: 3844)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3748)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 3844)

    • Checks proxy server information

      • Setup.exe (PID: 3844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:02:24 06:14:02+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 183808
InitializedDataSize: 122880
UninitializedDataSize: -
EntryPoint: 0x250b7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 19.0.0.0
ProductVersionNumber: 19.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Hewlett-Packard Company
FileDescription: HP Webpack
FileVersion: 19.0.0.0
InternalName: 7zS.sfx
LegalCopyright: Hewlett-Packard Company
OriginalFileName: 7zS.sfx
ProductName: HP Webpack
ProductVersion: 19.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hppsdr.exe no specs fileextractor.exe no specs fileextractor.exe ndp46-kb3045560-web.exe no specs setup.exe setuputility.exe no specs wmpnscfg.exe no specs setuputility.exe no specs tmpb620.tmp.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3372"C:\Users\admin\AppData\Local\Temp\HPPSdr.exe" C:\Users\admin\AppData\Local\Temp\HPPSdr.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\hppsdr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3416"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3496"C:\HP\Diagnostics\PSDR\FileExtractor.exe" C:\HP\Diagnostics\PSDR\FileExtractor.exe—HPPSdr.exe
User:
admin
Company:
HPDC LP
Integrity Level:
MEDIUM
Description:
HP Print and Scan Doctor 5.7.4
Exit code:
3221226540
Version:
1.0.0.2
Modules
Images
c:\hp\diagnostics\psdr\fileextractor.exe
c:\windows\system32\ntdll.dll
3624"C:\HP\Diagnostics\PSDR\FileExtractor.exe" C:\HP\Diagnostics\PSDR\FileExtractor.exe
HPPSdr.exe
User:
admin
Company:
HPDC LP
Integrity Level:
HIGH
Description:
HP Print and Scan Doctor 5.7.4
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\hp\diagnostics\psdr\fileextractor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
3688"C:\HP\Diagnostics\PSDR\NDP46-KB3045560-Web.exe" C:\HP\Diagnostics\PSDR\NDP46-KB3045560-Web.exe—FileExtractor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.6 Setup
Exit code:
1602
Version:
4.6.00081.00
Modules
Images
c:\hp\diagnostics\psdr\ndp46-kb3045560-web.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3748"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3844C:\54123ad1e0459d779813aa0587\\Setup.exe /x86 /x64 /webC:\54123ad1e0459d779813aa0587\Setup.exe
NDP46-KB3045560-Web.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
1602
Version:
14.0.0081.0 built by: NETFXREL2
Modules
Images
c:\54123ad1e0459d779813aa0587\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\54123ad1e0459d779813aa0587\setupengine.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3924SetupUtility.exe /aupauseC:\54123ad1e0459d779813aa0587\SetupUtility.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.5 Setup
Exit code:
0
Version:
14.0.0081.0 built by: NETFXREL2
Modules
Images
c:\54123ad1e0459d779813aa0587\setuputility.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3980TMPB620.tmp.exe /Q /X:C:\54123ad1e0459d779813aa0587\TMPB620.tmp.exe.tmpC:\54123ad1e0459d779813aa0587\TMPB620.tmp.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.6 Setup
Exit code:
0
Version:
4.6.00081.00
Modules
Images
c:\54123ad1e0459d779813aa0587\tmpb620.tmp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
4008SetupUtility.exe /screbootC:\54123ad1e0459d779813aa0587\SetupUtility.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.5 Setup
Exit code:
0
Version:
14.0.0081.0 built by: NETFXREL2
Modules
Images
c:\54123ad1e0459d779813aa0587\setuputility.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
9 001
Read events
8 926
Write events
61
Delete events
14

Modification events

(PID) Process:(3416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{A8E678A2-6901-4282-B4F7-A3E5A6C83760}\{E484809C-2353-4669-A8A0-CAEDBE311F21}
Operation:delete keyName:(default)
Value:
(PID) Process:(3416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{A8E678A2-6901-4282-B4F7-A3E5A6C83760}
Operation:delete keyName:(default)
Value:
(PID) Process:(3416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{D80F53DD-09C3-4F44-AF6F-3C7102B6D22B}\{E484809C-2353-4669-A8A0-CAEDBE311F21}
Operation:delete keyName:(default)
Value:
(PID) Process:(3416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{D80F53DD-09C3-4F44-AF6F-3C7102B6D22B}
Operation:delete keyName:(default)
Value:
(PID) Process:(3416) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{ADA2D2C1-5D74-47C7-8C9D-49273AAF4C05}
Operation:delete keyName:(default)
Value:
(PID) Process:(3372) HPPSdr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3372) HPPSdr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3372) HPPSdr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3372) HPPSdr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3624) FileExtractor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
135
Suspicious files
41
Text files
114
Unknown types
0

Dropped files

PID
Process
Filename
Type
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1028\ndu_firewall.chmbinary
MD5:48E0D6E4553100FF92E8DDE011306CE5
SHA256:80E213CB1CA268094974772AD34F8AE8C583C7A7D480A0289945E526B9C9655F
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1035\ndu_firewall.chmbinary
MD5:93F9A8AFD7BBBCFA86814F1AB8C5EC5B
SHA256:E1FF52A1EF93EC3D38EEBB5AF6EBBB819873AB2EFC9B325C1F6DC1FDCB04976B
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1030\ndu_firewall.chmbinary
MD5:73D8024987151A49BC8D821609A9BC07
SHA256:15FE05930F8E06955C9A405F8B26C012441B292D7A141D7949B5ABF6F837931E
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1029\ndu_firewall.chmbinary
MD5:561548CCEE59C3B2ED984D9F4368FC2A
SHA256:2429BEA8F4F2D42F8F53D1474A51FF0532F2324A854533FDE9DB4DA0AA54766D
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1034\ndu_firewall.chmbinary
MD5:37A3CA5C4AE35B1B4BA9FA83F4427534
SHA256:DE01F7846378175050717C3BB7876E03B0260A3D31352A794ECBA0797DEE53B8
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1032\ndu_firewall.chmbinary
MD5:2EF3B036FA90ADE4021E7AA64B1B3E17
SHA256:31FC0B144D73F12F2EF4CD0F8F9B3EBF6EA908CA446BE1DC79947B73A018FA89
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1040\ndu_firewall.chmbinary
MD5:F511DEAAEEFFA7CA8D00213D05A8B647
SHA256:F591B09D3918804C82002A9F7541DE32693828E20B0F7E4AB40BFAEB2D373C29
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1025\ndu_firewall.chmbinary
MD5:5DB4574DC67604873C3A5BDAE114BB78
SHA256:4FB1B4CC7892625E1AE1842B47A1C873F9AB1BBFEC68FF6D66557684C82EC836
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1044\ndu_firewall.chmbinary
MD5:6AA6F8368AB323CAF5AA970AFE9EBB79
SHA256:065C49111DEDE2B78FC258B5F3F66CE5DB9B0A20E9DB8D428C97F1BF29F17074
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1043\ndu_firewall.chmbinary
MD5:49AEA0EDC8071DF7AE9D30B3F4246AC0
SHA256:506E3E0B1D5CF5DC85728E28500E13D95453879C7F939B4728DF7D3325327AA8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
15
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
868
svchost.exe
HEAD
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=249117&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
GET
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=249117&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
HEAD
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528231&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
GET
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528231&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
HEAD
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
GET
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
3844
Setup.exe
GET
302
2.19.246.123:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
3844
Setup.exe
GET
302
2.19.246.123:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
HEAD
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
GET
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3844
Setup.exe
46.228.146.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
3844
Setup.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
868
svchost.exe
23.218.210.69:80
go.microsoft.com
AKAMAI-AS
DE
unknown
868
svchost.exe
184.30.24.206:443
download.microsoft.com
AKAMAI-AS
DE
unknown
868
svchost.exe
68.232.34.200:443
download.visualstudio.microsoft.com
EDGECAST
US
whitelisted
3844
Setup.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 46.228.146.128
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
go.microsoft.com
  • 23.218.210.69
  • 2.19.246.123
whitelisted
download.microsoft.com
  • 184.30.24.206
whitelisted
download.visualstudio.microsoft.com
  • 68.232.34.200
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
Process
Message
Setup.exe
User cancelled installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HPPSdr.exe