analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

setup.exe.7z

Full analysis: https://app.any.run/tasks/db069a00-b9ea-4c51-9fe1-da4479aaf452
Verdict: Malicious activity
Analysis date: August 12, 2022, 14:01:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

EFE59ABA376549A39223B2E6F48EAF92

SHA1:

61009ACCF810A6AC50EB98F271D90539CAEC4D5E

SHA256:

629A2C38D6FD0C5598FEE94BA3BE36DB2A1F5C6A519D9FC3392B66F08E171025

SSDEEP:

384:lk+spo2rEtpNnBUsbl7eJDfw3Kv0VS4aUttk/ijCSAIZfc1L9V6k+B5UjPG:vtpNn2sb8dw3MqS4zxjnZfc3loUa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops executable file immediately after starts

      • WinRAR.exe (PID: 3596)
      • setup.exe (PID: 2260)
    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 3596)
    • Changes settings of System certificates

      • setup.exe (PID: 2260)
    • Application was dropped or rewritten from another process

      • setup.exe (PID: 2260)
      • EasyScreen.exe (PID: 688)
      • MyEss.exe (PID: 3768)
    • Changes the autorun value in the registry

      • setup.exe (PID: 2260)
  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 3596)
      • setup.exe (PID: 2260)
      • MyEss.exe (PID: 3768)
      • EasyScreen.exe (PID: 688)
    • Reads the computer name

      • setup.exe (PID: 2260)
      • WinRAR.exe (PID: 3596)
      • MyEss.exe (PID: 3768)
      • EasyScreen.exe (PID: 688)
    • Drops a file with a compile date too recent

      • WinRAR.exe (PID: 3596)
      • setup.exe (PID: 2260)
    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3596)
      • setup.exe (PID: 2260)
    • Reads Environment values

      • setup.exe (PID: 2260)
    • Creates a software uninstall entry

      • setup.exe (PID: 2260)
    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2240)
  • INFO

    • Reads settings of System Certificates

      • setup.exe (PID: 2260)
      • MyEss.exe (PID: 3768)
      • iexplore.exe (PID: 2240)
      • iexplore.exe (PID: 2556)
    • Checks supported languages

      • WISPTIS.EXE (PID: 3380)
      • iexplore.exe (PID: 2556)
      • iexplore.exe (PID: 2240)
    • Reads the computer name

      • WISPTIS.EXE (PID: 3380)
      • iexplore.exe (PID: 2556)
      • iexplore.exe (PID: 2240)
    • Application launched itself

      • iexplore.exe (PID: 2556)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2240)
      • iexplore.exe (PID: 2556)
    • Changes internet zones settings

      • iexplore.exe (PID: 2556)
    • Changes settings of System certificates

      • iexplore.exe (PID: 2556)
    • Reads internet explorer settings

      • iexplore.exe (PID: 2240)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start winrar.exe setup.exe wisptis.exe no specs wisptis.exe myess.exe easyscreen.exe no specs iexplore.exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3596"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\setup.exe.7z"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
2260"C:\Users\admin\AppData\Local\Temp\Rar$EXb3596.9512\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb3596.9512\setup.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
EasyScreen
Exit code:
0
Version:
1.0.0.0
3804"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXEsetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3380"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Pen and Touch Input Component
Exit code:
24
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3768"C:\Users\admin\AppData\Local\MyEss\MyEss.exe" C:\Users\admin\AppData\Local\MyEss\MyEss.exe
setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
MyEss
Version:
1.0.0.0
688"C:\Users\admin\AppData\Local\EasyScreen\EasyScreen.exe" C:\Users\admin\AppData\Local\EasyScreen\EasyScreen.exesetup.exe
User:
admin
Company:
Zoodotnet Limited
Integrity Level:
MEDIUM
Description:
EasyScreen
Exit code:
3221225547
Version:
1.0.0.0
2556"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch&plcid=0x409&o1=.NETFramework,Version=v4.6.1&processName=EasyScreen.exe&platform=0000&osver=5&isServer=0&shimver=4.0.30319.34209C:\Program Files\Internet Explorer\iexplore.exe
EasyScreen.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
2240"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2556 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
21 539
Read events
21 309
Write events
0
Delete events
0

Modification events

No data
Executable files
42
Suspicious files
40
Text files
22
Unknown types
5

Dropped files

PID
Process
Filename
Type
2260setup.exeC:\Users\admin\AppData\Local\EasyScreen\EasyScreen.exe.configxml
MD5:A84BA6BB321EED16C8B348D0F477B182
SHA256:9E25BCC9EEFBBE88CA72F263733847E0C439ECFF41CAF3887AEFA837095CD699
2260setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30D802E0E248FEE17AAF4A62594CC75Abinary
MD5:715AD524B6219B8DE8BF6021F4CC49BB
SHA256:59A3AC679EEE5BF2FA046F99BA2E335043AF1CDA36403CECB855ECADCEB5A949
2260setup.exeC:\Users\admin\AppData\Local\EasyScreen\languages\be.jsonbinary
MD5:94AC4650E68026F94A415A68658FC577
SHA256:7AC3D36EA799378E80916018718DD1D61863A054904E1B8B93D6ADB4F2689D2E
2260setup.exeC:\Users\admin\AppData\Local\EasyScreen\es.icoimage
MD5:B5C5E6C778FD714E4D18B270A1E69632
SHA256:59E27E8D8F98A04CBC4F33934642067929451C928D305556BD1E650D5A943748
2260setup.exeC:\Users\admin\AppData\Local\EasyScreen\EasyScreen.exeexecutable
MD5:5E804B9F1914DF6C9F5A13972025836D
SHA256:44047C8584BD2CFAC26707AEC7C3EE42566B8199FBD2346B997D1B4FCB8B2B86
3596WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb3596.9512\setup.exeexecutable
MD5:AFBDCD376D0C053907D2F8078827580B
SHA256:11B2AF06AB77EC37274C00B16C9FE9601C6D3D2078ABF222A2046148E0FAEB96
2260setup.exeC:\Users\admin\AppData\Local\EasyScreen\keymaps\ml.jsontext
MD5:F8D6EAD512C8AB4E066D6FE1B61AD16C
SHA256:12333880709B5656FB7D96E8375CDFA34B9492B2A14B7DA8263ED55646951ACD
2260setup.exeC:\Users\admin\AppData\Local\EasyScreen\languages\en.jsonbinary
MD5:6E6BE4A16B578CF98EC1657507487487
SHA256:C05E9725E09C65E65319ECAD2614726BC98552F582086D8B120B57E7397CC360
2260setup.exeC:\Users\admin\AppData\Local\Temp\PFJNAGX79B.dllexecutable
MD5:1FFA91F1258A00636300A89D21516F5E
SHA256:4F88242618CCE5C1341E1075038E9BFFE926876990938E663E0BF95736200F3E
2260setup.exeC:\Users\admin\AppData\Local\EasyScreen\languages\da.jsonbinary
MD5:CC87C9D43AD3E9618FAEE7AC99049204
SHA256:F06B872C726F9A1B00C8408388D2503A239239C5BE2FE26E23816AC7604F5D40
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
33
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2556
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
2240
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2240
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
2260
setup.exe
GET
200
91.199.212.52:80
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt
GB
der
1.52 Kb
whitelisted
2240
iexplore.exe
GET
200
8.253.204.121:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2614554b007721c9
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2260
setup.exe
91.199.212.52:80
crt.sectigo.com
Comodo CA Ltd
GB
suspicious
2240
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2240
iexplore.exe
96.16.143.41:443
go.microsoft.com
Akamai International B.V.
US
whitelisted
2260
setup.exe
188.166.70.149:443
easyscreen.me
Digital Ocean, Inc.
NL
unknown
3768
MyEss.exe
188.166.70.149:443
easyscreen.me
Digital Ocean, Inc.
NL
unknown
2240
iexplore.exe
8.253.204.121:80
ctldl.windowsupdate.com
Global Crossing
US
malicious
2556
iexplore.exe
20.25.53.147:443
query.prod.cms.msn.com
US
unknown
2556
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2240
iexplore.exe
13.107.219.44:443
dotnet.microsoft.com
Microsoft Corporation
US
suspicious
2556
iexplore.exe
131.253.33.203:443
www.msn.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
easyscreen.me
  • 188.166.70.149
unknown
crt.sectigo.com
  • 91.199.212.52
whitelisted
go.microsoft.com
  • 96.16.143.41
whitelisted
ctldl.windowsupdate.com
  • 8.253.204.121
  • 8.253.204.249
  • 67.27.157.254
  • 67.27.159.126
  • 67.27.234.126
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
dotnet.microsoft.com
  • 13.107.219.44
  • 13.107.227.44
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info