File name:

FileZilla_3.67.1_win64_sponsored-setup.exe

Full analysis: https://app.any.run/tasks/bf4bdb83-a314-449a-9614-60749a64cc27
Verdict: Malicious activity
Analysis date: July 22, 2024, 10:30:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

AC97E64C3E2E865C50155DFDFFE5428A

SHA1:

D473E2D49E908E6D1ABFA614C55BDAE485508153

SHA256:

6113A3F7C9469FCD9B53EA3ECB16BBEFB71318AF2864AE0A74A8FB633A05F24A

SSDEEP:

98304:KsnRuPqZZJewdJYfw3R+g6+i00+cl5qc9Jx4S4o6ijtfC9DKceEEh9iLHzyB5+8o:hvwYC3Ecp1cE4kTFlffqd6Mb9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)
      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)
      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • Executable content was dropped or overwritten

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)
      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • Reads security settings of Internet Explorer

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)
      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • The process creates files with name similar to system file names

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)
      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • Reads the date of Windows installation

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)

    • Application launched itself

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)

    • Checks Windows Trust Settings

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

  • INFO

    • Reads the computer name

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)
      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • Create files in a temporary directory

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)
      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • Checks supported languages

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)
      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • Process checks computer location settings

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6348)

    • Checks proxy server information

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • Reads the machine GUID from the registry

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)

    • Reads the software policy settings

      • FileZilla_3.67.1_win64_sponsored-setup.exe (PID: 6984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:02 02:09:43+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 139776
UninitializedDataSize: 2048
EntryPoint: 0x3645
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.67.1.0
ProductVersionNumber: 3.67.1.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Tim Kosse
FileDescription: FileZilla FTP Client
FileVersion: 3.67.1
LegalCopyright: Tim Kosse
OriginalFileName: FileZilla_3.67.1_win32-setup.exe
ProductName: FileZilla
ProductVersion: 3.67.1
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start filezilla_3.67.1_win64_sponsored-setup.exe filezilla_3.67.1_win64_sponsored-setup.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6348"C:\Users\admin\AppData\Local\Temp\FileZilla_3.67.1_win64_sponsored-setup.exe" C:\Users\admin\AppData\Local\Temp\FileZilla_3.67.1_win64_sponsored-setup.exe
explorer.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Version:
3.67.1
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_3.67.1_win64_sponsored-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6916C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6984"C:\Users\admin\AppData\Local\Temp\FileZilla_3.67.1_win64_sponsored-setup.exe" /UAC:A0274 /NCRC C:\Users\admin\AppData\Local\Temp\FileZilla_3.67.1_win64_sponsored-setup.exe
FileZilla_3.67.1_win64_sponsored-setup.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Version:
3.67.1
Modules
Images
c:\users\admin\appdata\local\temp\filezilla_3.67.1_win64_sponsored-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
7 209
Read events
7 198
Write events
11
Delete events
0

Modification events

(PID) Process:(6984) FileZilla_3.67.1_win64_sponsored-setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6984) FileZilla_3.67.1_win64_sponsored-setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6984) FileZilla_3.67.1_win64_sponsored-setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6984) FileZilla_3.67.1_win64_sponsored-setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6984) FileZilla_3.67.1_win64_sponsored-setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6984) FileZilla_3.67.1_win64_sponsored-setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6984) FileZilla_3.67.1_win64_sponsored-setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
8
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6348FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsc929C.tmp\UserInfo.dllexecutable
MD5:D458B8251443536E4A334147E0170E95
SHA256:4913D4CCCF84CD0534069107CFF3E8E2F427160CAD841547DB9019310AC86CC7
6984FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsd9693.tmp\System.dllexecutable
MD5:4ADD245D4BA34B04F213409BFE504C07
SHA256:9111099EFE9D5C9B391DC132B2FAF0A3851A760D4106D5368E30AC744EB42706
6348FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsc929C.tmp\System.dllexecutable
MD5:4ADD245D4BA34B04F213409BFE504C07
SHA256:9111099EFE9D5C9B391DC132B2FAF0A3851A760D4106D5368E30AC744EB42706
6984FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsd9693.tmp\INetC.dllexecutable
MD5:640BFF73A5F8E37B202D911E4749B2E9
SHA256:C1E568E25EC111184DEB1B87CFDA4BFEC529B1ABEAB39B66539D998012F33502
6984FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsd9693.tmp\nsDialogs.dllexecutable
MD5:1D8F01A83DDD259BC339902C1D33C8F1
SHA256:4B7D17DA290F41EBE244827CC295CE7E580DA2F7E9F7CC3EFC1ABC6898E3C9ED
6984FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
6984FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsy21CE.tmpimage
MD5:387A4D885282D7C89EDF65E76FD490FC
SHA256:EAF84352200694DF5DA40FFA71513778A934C0F21ECBDD021776A7E2F5921FF9
6984FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsd9693.tmp\modern-wizard.bmpimage
MD5:CBE40FD2B1EC96DAEDC65DA172D90022
SHA256:3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
6984FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsd9693.tmp\UserInfo.dllexecutable
MD5:D458B8251443536E4A334147E0170E95
SHA256:4913D4CCCF84CD0534069107CFF3E8E2F427160CAD841547DB9019310AC86CC7
6984FileZilla_3.67.1_win64_sponsored-setup.exeC:\Users\admin\AppData\Local\Temp\nsd9693.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
34
DNS requests
13
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7856
svchost.exe
4.209.32.198:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2760
svchost.exe
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7996
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
8140
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.22
  • 40.126.32.133
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.136
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.72
  • 20.190.160.20
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.174
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
www.bing.com
  • 2.16.110.193
  • 2.16.110.170
  • 2.16.110.123
  • 2.16.110.121
  • 2.16.110.171
whitelisted
fd.api.iris.microsoft.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
offers.filezilla-project.org
  • 49.12.121.47
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FileZilla_3.67.1_win64_sponsored-setup.exe