File name:

EpaCAD.zip

Full analysis: https://app.any.run/tasks/d78c2b48-6913-43f7-b98e-f569950a1ac5
Verdict: Malicious activity
Analysis date: May 09, 2025, 18:37:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data
MD5:

688B32A0951963FD3F8AED8232E91DDB

SHA1:

455F81AB52EF2D981E141B2871E9CFCB6C3B7E80

SHA256:

6111ADF2B05953C4A62A9FF0ED967537BE36FE7A3BE9B115FF8EF7D59AF19974

SSDEEP:

98304:qPdfrebOMvlUB6gybzN+7n/UoZAePU1vwIB5l6PAw2Ji3kaUSjgYQXf8PPyqoULc:tzKXp0oq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • dotNetFx35setup.exe (PID: 1012)
      • dotNetFx35setup.exe (PID: 5008)

    • Starts Visual C# compiler

      • EpaCAD.exe (PID: 4696)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5364)
      • setup.exe (PID: 2340)

    • Process drops legitimate windows executable

      • setup.exe (PID: 2340)
      • msiexec.exe (PID: 1228)
      • WinRAR.exe (PID: 5364)

    • Executable content was dropped or overwritten

      • setup.exe (PID: 2340)
      • csc.exe (PID: 3304)

    • Executes as Windows Service

      • VSSVC.exe (PID: 5360)

    • Starts a Microsoft application from unusual location

      • dotNetFx35setup.exe (PID: 1012)
      • dotNetFx35setup.exe (PID: 5008)

    • Uses .NET C# to load dll

      • EpaCAD.exe (PID: 4696)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5364)
      • msiexec.exe (PID: 1164)
      • msiexec.exe (PID: 1228)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 5364)
      • msiexec.exe (PID: 1228)
      • setup.exe (PID: 2340)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 2340)

    • Create files in a temporary directory

      • setup.exe (PID: 2340)
      • msiexec.exe (PID: 1300)

    • Checks supported languages

      • msiexec.exe (PID: 1228)
      • msiexec.exe (PID: 1300)
      • setup.exe (PID: 2340)

    • Reads the computer name

      • msiexec.exe (PID: 1228)
      • msiexec.exe (PID: 1300)
      • setup.exe (PID: 2340)

    • Creates files or folders in the user directory

      • setup.exe (PID: 2340)

    • Process checks computer location settings

      • setup.exe (PID: 2340)

    • The sample compiled with spanish language support

      • msiexec.exe (PID: 1228)

    • Manual execution by a user

      • EpaCAD.exe (PID: 4696)

    • Reads the software policy settings

      • slui.exe (PID: 720)
      • setup.exe (PID: 2340)

    • Manages system restore points

      • SrTasks.exe (PID: 2692)

    • Checks proxy server information

      • setup.exe (PID: 2340)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
19
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe setup.exe dotnetfx35setup.exe no specs dotnetfx35setup.exe msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs slui.exe srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs epacad.exe csc.exe conhost.exe no specs cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1012"C:\Users\admin\AppData\Local\Temp\VSDEA91.tmp\DotNetFX35\dotNetFx35setup.exe" /lang:esn /passive /norestartC:\Users\admin\AppData\Local\Temp\VSDEA91.tmp\DotNetFX35\dotNetFx35setup.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 3.5 Setup
Exit code:
3221226540
Version:
3.5.21022.08
Modules
Images
c:\users\admin\appdata\local\temp\vsdea91.tmp\dotnetfx35\dotnetfx35setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1164"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\admin\AppData\Local\Temp\Rar$EXa5364.16111\SetupEpaCAD.msi" C:\Windows\SysWOW64\msiexec.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1228C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1300C:\Windows\syswow64\MsiExec.exe -Embedding CC0394EC9E34266F68B791D428AE1AA8 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1600C:\Windows\syswow64\MsiExec.exe -Embedding FD8AB4CDFDA565C958A1F29B2060840C E Global\MSI0000C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2084C:\Windows\syswow64\MsiExec.exe -Embedding 4AF38DAE04611DD4A9C6D3596771BFA0C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2240C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2288\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
15 450
Read events
15 041
Write events
387
Delete events
22

Modification events

(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\EpaCAD.zip
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5364) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2340) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2340) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
29
Suspicious files
42
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
5364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5364.16111\SetupEpaCAD.msi —
MD5:—
SHA256:—
1228msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1228msiexec.exeC:\Windows\Installer\11fcfb.msi —
MD5:—
SHA256:—
2340setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:BC904762BCDFB25B9915ED65B40144D9
SHA256:4BD78B5D4B500141B336A82E83BFAAECE7ED30123C0B1AC67B0FDA9C7DCC2CE7
2340setup.exeC:\Users\admin\AppData\Local\Temp\VSDEA91.tmp\setup.exeexecutable
MD5:7754F8078BDA5A4DE05C23A8621A64BE
SHA256:12FA94DFC572724D82B91AC18DE0A027F2930CDA3A423AEEB8F464C0496B7176
2340setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:9AB744C8EE27A659C7AA07A68EBDB2E6
SHA256:322429656D76BF4E611D49BC25B8F2C702E7E8E770F655815F830DD790231D5F
5364WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa5364.16111\setup.exeexecutable
MD5:7754F8078BDA5A4DE05C23A8621A64BE
SHA256:12FA94DFC572724D82B91AC18DE0A027F2930CDA3A423AEEB8F464C0496B7176
2340setup.exeC:\Users\admin\AppData\Local\Temp\VSDEA91.tmp\DotNetFX35\dotNetFx35setup.exeexecutable
MD5:269F314B87E6222A20E5F745B6B89783
SHA256:C05A019CE69C2E6973E464F381C2B0B618AD9B135CA5275B052FEBF64C9F9257
1164msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI1710.tmpexecutable
MD5:D5CBD20B1B0D410590D9EBFBC86A7362
SHA256:A128ABDC6A6DB3EF8CBB523462D43FF6FD68015F83242D5FACB4AA78F1661769
2340setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9binary
MD5:A26DCBB948DA05EC8AF97885DBD149B0
SHA256:3CEB4A8069B2B9E5FDF508EF67D5AF5B9D3E6A7B417919953A89FA9773E16440
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
38
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2340
setup.exe
GET
302
23.35.238.131:80
http://go.microsoft.com/fwlink/?LinkId=97964
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.67.160.244:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2340
setup.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/CSPCA.crl
unknown
—
—
whitelisted
2340
setup.exe
GET
200
23.67.160.244:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
5116
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5116
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4696
EpaCAD.exe
GET
301
35.214.192.20:80
http://www.epacad.com/program/info-en.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.67.160.244:80
ocsp.digicert.com
AKAMAI-AS
JP
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2340
setup.exe
23.35.238.131:80
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.52.120.96
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.3
  • 40.126.31.73
  • 40.126.31.67
  • 20.190.159.131
  • 40.126.31.129
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 23.67.160.244
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
download.microsoft.com
  • 2.18.160.223
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EpaCAD.zip