File name:

HPPSdr.exe

Full analysis: https://app.any.run/tasks/4f623063-345d-4b36-9cfc-e67cb019b6e6
Verdict: Malicious activity
Analysis date: November 03, 2023, 14:21:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FE236937872C20107145A8F8A0869EBD

SHA1:

C4818093839C24A3EBC583B49EF8789C5CEEA130

SHA256:

5F4467BA1D28CCD2367ACF1D4B6DB15A0D973C5CEC1FF59B25AC8074520B9BA4

SSDEEP:

98304:Z9MnRNTsjNNJusPSo1vomxCHv4AmOwruCVFKomWdyCc/stSvFwg8kJhpA7w26QGQ:EyUOaQtGLYmPU3dTszFTBo7r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • NDP46-KB3045560-Web.exe (PID: 3688)
      • HPPSdr.exe (PID: 3372)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • HPPSdr.exe (PID: 3372)
      • NDP46-KB3045560-Web.exe (PID: 3688)

    • The process drops C-runtime libraries

      • HPPSdr.exe (PID: 3372)

    • Reads the Internet Settings

      • FileExtractor.exe (PID: 3624)
      • HPPSdr.exe (PID: 3372)
      • Setup.exe (PID: 3844)

    • The process creates files with name similar to system file names

      • HPPSdr.exe (PID: 3372)

    • Checks Windows Trust Settings

      • Setup.exe (PID: 3844)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 3844)

    • Reads settings of System Certificates

      • Setup.exe (PID: 3844)

    • Adds/modifies Windows certificates

      • NDP46-KB3045560-Web.exe (PID: 3688)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 3416)
      • HPPSdr.exe (PID: 3372)
      • FileExtractor.exe (PID: 3624)
      • NDP46-KB3045560-Web.exe (PID: 3688)
      • Setup.exe (PID: 3844)
      • SetupUtility.exe (PID: 3924)
      • wmpnscfg.exe (PID: 3748)
      • SetupUtility.exe (PID: 4008)
      • TMPB620.tmp.exe (PID: 3980)

    • Checks supported languages

      • HPPSdr.exe (PID: 3372)
      • wmpnscfg.exe (PID: 3416)
      • FileExtractor.exe (PID: 3624)
      • NDP46-KB3045560-Web.exe (PID: 3688)
      • SetupUtility.exe (PID: 3924)
      • wmpnscfg.exe (PID: 3748)
      • Setup.exe (PID: 3844)
      • TMPB620.tmp.exe (PID: 3980)
      • SetupUtility.exe (PID: 4008)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3416)
      • NDP46-KB3045560-Web.exe (PID: 3688)
      • Setup.exe (PID: 3844)
      • SetupUtility.exe (PID: 3924)
      • wmpnscfg.exe (PID: 3748)

    • Creates files in the program directory

      • HPPSdr.exe (PID: 3372)

    • Create files in a temporary directory

      • NDP46-KB3045560-Web.exe (PID: 3688)
      • Setup.exe (PID: 3844)
      • SetupUtility.exe (PID: 3924)
      • TMPB620.tmp.exe (PID: 3980)

    • Reads CPU info

      • Setup.exe (PID: 3844)

    • Reads Environment values

      • Setup.exe (PID: 3844)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3748)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 3844)

    • Checks proxy server information

      • Setup.exe (PID: 3844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:02:24 06:14:02+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 183808
InitializedDataSize: 122880
UninitializedDataSize: -
EntryPoint: 0x250b7
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 19.0.0.0
ProductVersionNumber: 19.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Hewlett-Packard Company
FileDescription: HP Webpack
FileVersion: 19.0.0.0
InternalName: 7zS.sfx
LegalCopyright: Hewlett-Packard Company
OriginalFileName: 7zS.sfx
ProductName: HP Webpack
ProductVersion: 19.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hppsdr.exe no specs fileextractor.exe no specs fileextractor.exe ndp46-kb3045560-web.exe no specs setup.exe setuputility.exe no specs wmpnscfg.exe no specs setuputility.exe no specs tmpb620.tmp.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3372"C:\Users\admin\AppData\Local\Temp\HPPSdr.exe" C:\Users\admin\AppData\Local\Temp\HPPSdr.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\hppsdr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3416"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3496"C:\HP\Diagnostics\PSDR\FileExtractor.exe" C:\HP\Diagnostics\PSDR\FileExtractor.exe—HPPSdr.exe
User:
admin
Company:
HPDC LP
Integrity Level:
MEDIUM
Description:
HP Print and Scan Doctor 5.7.4
Exit code:
3221226540
Version:
1.0.0.2
Modules
Images
c:\hp\diagnostics\psdr\fileextractor.exe
c:\windows\system32\ntdll.dll
3624"C:\HP\Diagnostics\PSDR\FileExtractor.exe" C:\HP\Diagnostics\PSDR\FileExtractor.exe
HPPSdr.exe
User:
admin
Company:
HPDC LP
Integrity Level:
HIGH
Description:
HP Print and Scan Doctor 5.7.4
Exit code:
0
Version:
1.0.0.2
Modules
Images
c:\hp\diagnostics\psdr\fileextractor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\rpcrt4.dll
3688"C:\HP\Diagnostics\PSDR\NDP46-KB3045560-Web.exe" C:\HP\Diagnostics\PSDR\NDP46-KB3045560-Web.exe—FileExtractor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.6 Setup
Exit code:
1602
Version:
4.6.00081.00
Modules
Images
c:\hp\diagnostics\psdr\ndp46-kb3045560-web.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3748"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3844C:\54123ad1e0459d779813aa0587\\Setup.exe /x86 /x64 /webC:\54123ad1e0459d779813aa0587\Setup.exe
NDP46-KB3045560-Web.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
1602
Version:
14.0.0081.0 built by: NETFXREL2
Modules
Images
c:\54123ad1e0459d779813aa0587\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\54123ad1e0459d779813aa0587\setupengine.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3924SetupUtility.exe /aupauseC:\54123ad1e0459d779813aa0587\SetupUtility.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.5 Setup
Exit code:
0
Version:
14.0.0081.0 built by: NETFXREL2
Modules
Images
c:\54123ad1e0459d779813aa0587\setuputility.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3980TMPB620.tmp.exe /Q /X:C:\54123ad1e0459d779813aa0587\TMPB620.tmp.exe.tmpC:\54123ad1e0459d779813aa0587\TMPB620.tmp.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.6 Setup
Exit code:
0
Version:
4.6.00081.00
Modules
Images
c:\54123ad1e0459d779813aa0587\tmpb620.tmp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
4008SetupUtility.exe /screbootC:\54123ad1e0459d779813aa0587\SetupUtility.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.5 Setup
Exit code:
0
Version:
14.0.0081.0 built by: NETFXREL2
Modules
Images
c:\54123ad1e0459d779813aa0587\setuputility.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
9 001
Read events
8 926
Write events
61
Delete events
14

Modification events

(PID) Process:(3416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{A8E678A2-6901-4282-B4F7-A3E5A6C83760}\{E484809C-2353-4669-A8A0-CAEDBE311F21}
Operation:delete keyName:(default)
Value:
(PID) Process:(3416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{A8E678A2-6901-4282-B4F7-A3E5A6C83760}
Operation:delete keyName:(default)
Value:
(PID) Process:(3416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{D80F53DD-09C3-4F44-AF6F-3C7102B6D22B}\{E484809C-2353-4669-A8A0-CAEDBE311F21}
Operation:delete keyName:(default)
Value:
(PID) Process:(3416) wmpnscfg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Events\{D80F53DD-09C3-4F44-AF6F-3C7102B6D22B}
Operation:delete keyName:(default)
Value:
(PID) Process:(3416) wmpnscfg.exeKey:HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Health\{ADA2D2C1-5D74-47C7-8C9D-49273AAF4C05}
Operation:delete keyName:(default)
Value:
(PID) Process:(3372) HPPSdr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3372) HPPSdr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3372) HPPSdr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3372) HPPSdr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3624) FileExtractor.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
135
Suspicious files
41
Text files
114
Unknown types
0

Dropped files

PID
Process
Filename
Type
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1033\ndu_firewall.chmbinary
MD5:0B98650C63C1D07AA22EA9E24627418F
SHA256:452F45E5937A80DF4A81DC58E7D2DD7F5A47D1F39E4D6047DB44B61EC95E34D1
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1025\ndu_firewall.chmbinary
MD5:5DB4574DC67604873C3A5BDAE114BB78
SHA256:4FB1B4CC7892625E1AE1842B47A1C873F9AB1BBFEC68FF6D66557684C82EC836
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1032\ndu_firewall.chmbinary
MD5:2EF3B036FA90ADE4021E7AA64B1B3E17
SHA256:31FC0B144D73F12F2EF4CD0F8F9B3EBF6EA908CA446BE1DC79947B73A018FA89
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1029\ndu_firewall.chmbinary
MD5:561548CCEE59C3B2ED984D9F4368FC2A
SHA256:2429BEA8F4F2D42F8F53D1474A51FF0532F2324A854533FDE9DB4DA0AA54766D
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1036\ndu_firewall.chmbinary
MD5:92202197C5115ACBDB5B4E438CAFADF5
SHA256:E84F5C3614CA4C2A7E6EA0F3A746081209EF0AF686CBDC4B0CD4BE786171AD41
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1030\ndu_firewall.chmbinary
MD5:73D8024987151A49BC8D821609A9BC07
SHA256:15FE05930F8E06955C9A405F8B26C012441B292D7A141D7949B5ABF6F837931E
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1031\ndu_firewall.chmbinary
MD5:A99322D2DE831785C6090FC556B760C0
SHA256:A9B4CAA83B51DB11BB9DE7B627EE7725F8EA79D08ABF40F4A9D491069E9B36C6
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1044\ndu_firewall.chmbinary
MD5:6AA6F8368AB323CAF5AA970AFE9EBB79
SHA256:065C49111DEDE2B78FC258B5F3F66CE5DB9B0A20E9DB8D428C97F1BF29F17074
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1037\ndu_firewall.chmbinary
MD5:7BBB78DF372C20327061AE7E5B2BB596
SHA256:818D69F45ADE71B22251C048919B375B0286F1AAE79E20C594F8C1397CDE548E
3372HPPSdr.exeC:\HP\Diagnostics\PSDR\help\1038\ndu_firewall.chmbinary
MD5:0EC7850CE9B076BBB74A80F6C52E45EF
SHA256:ED8320720F9BA690D073794FAEB049822411227FF994A8C0181D4D1CEBE3CDCA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
15
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
868
svchost.exe
HEAD
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=249117&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
GET
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=249117&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
HEAD
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528231&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
GET
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528231&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
HEAD
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
GET
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
3844
Setup.exe
GET
302
2.19.246.123:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
3844
Setup.exe
GET
302
2.19.246.123:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
GET
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
868
svchost.exe
HEAD
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkId=528226&clcid=0x409
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3844
Setup.exe
46.228.146.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
3844
Setup.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
868
svchost.exe
23.218.210.69:80
go.microsoft.com
AKAMAI-AS
DE
unknown
868
svchost.exe
184.30.24.206:443
download.microsoft.com
AKAMAI-AS
DE
unknown
868
svchost.exe
68.232.34.200:443
download.visualstudio.microsoft.com
EDGECAST
US
whitelisted
3844
Setup.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 46.228.146.128
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
go.microsoft.com
  • 23.218.210.69
  • 2.19.246.123
whitelisted
download.microsoft.com
  • 184.30.24.206
whitelisted
download.visualstudio.microsoft.com
  • 68.232.34.200
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
Process
Message
Setup.exe
User cancelled installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HPPSdr.exe