File name:

SiemensConnectSetup(5.1.00).exe

Full analysis: https://app.any.run/tasks/a4d3d2f0-a120-43f6-a841-1ad6229af674
Verdict: Malicious activity
Analysis date: April 29, 2025, 08:50:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

AD16E33FC73D8F0A742E9DA028236131

SHA1:

B36F0271C3F7F1A01B2374365A930ED9C8056B46

SHA256:

63A2460C887C005B160FEA34990D1942DD63BA3B0454EA0B6DCAF1DD58649DFD

SSDEEP:

98304:jn2deP4BXmJOSun2kEyaf70kUD2deBHoMLl3vvILlRg5SFsO99I90S25okD7/gfA:mP3GOqPwdQ8hnsO5Q/m9tn0ciTjo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • SiemensConnectSetup(5.1.00).exe (PID: 7260)

    • Process drops legitimate windows executable

      • SiemensConnectSetup(5.1.00).exe (PID: 7260)
      • msiexec.exe (PID: 7444)

    • Executable content was dropped or overwritten

      • SiemensConnectSetup(5.1.00).exe (PID: 7260)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 7280)

    • Drops a system driver (possible attempt to evade defenses)

      • msiexec.exe (PID: 7444)

    • Executes as Windows Service

      • VSSVC.exe (PID: 4208)

  • INFO

    • The sample compiled with german language support

      • SiemensConnectSetup(5.1.00).exe (PID: 7260)

    • Checks supported languages

      • SiemensConnectSetup(5.1.00).exe (PID: 7260)
      • setup.exe (PID: 7280)
      • msiexec.exe (PID: 7444)
      • msiexec.exe (PID: 7528)

    • The sample compiled with english language support

      • SiemensConnectSetup(5.1.00).exe (PID: 7260)
      • msiexec.exe (PID: 7408)
      • msiexec.exe (PID: 7444)

    • Create files in a temporary directory

      • SiemensConnectSetup(5.1.00).exe (PID: 7260)
      • setup.exe (PID: 7280)
      • msiexec.exe (PID: 7528)

    • Reads the computer name

      • setup.exe (PID: 7280)
      • msiexec.exe (PID: 7444)
      • msiexec.exe (PID: 7528)

    • Process checks computer location settings

      • setup.exe (PID: 7280)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7408)
      • msiexec.exe (PID: 7444)

    • Manages system restore points

      • SrTasks.exe (PID: 7252)

    • Manual execution by a user

      • SiemensConnect.exe (PID: 7764)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2000:11:24 11:50:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.2
CodeSize: 25600
InitializedDataSize: 15394304
UninitializedDataSize: -
EntryPoint: 0x6a00
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.19041.3570
ProductVersionNumber: 11.0.19041.3570
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: German
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.19041.3570 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. Alle Rechte vorbehalten.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.19041.3570
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
11
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start siemensconnectsetup(5.1.00).exe setup.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs slui.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs siemensconnect.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4208C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4812C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7252C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7260"C:\Users\admin\AppData\Local\Temp\SiemensConnectSetup(5.1.00).exe" C:\Users\admin\AppData\Local\Temp\SiemensConnectSetup(5.1.00).exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\siemensconnectsetup(5.1.00).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7280C:\Users\admin\AppData\Local\Temp\IXP000.TMP\setup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\setup.exe—SiemensConnectSetup(5.1.00).exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
0
Version:
17.0.33927.210 built by: D17.7
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7408"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\SiemensConnectSetup.msi" C:\Windows\SysWOW64\msiexec.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7444C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7528C:\Windows\syswow64\MsiExec.exe -Embedding 72A6D147A21B94D2BE683DE3A42C1347 CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7548C:\Windows\syswow64\MsiExec.exe -Embedding 3FA2E618AEE65362115402AF5371A608C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
4 863
Read events
4 458
Write events
388
Delete events
17

Modification events

(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000062E059EAE3B8DB01141D0000CC140000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000062E059EAE3B8DB01141D0000CC140000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000076FA60EAE3B8DB01141D0000CC140000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4800000000000000FF1D17EAE3B8DB01141D0000CC140000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000FF1D17EAE3B8DB01141D0000CC140000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
480000000000000085465CEAE3B8DB01141D0000CC140000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
11
(PID) Process:(4208) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4800000000000000CF33F7EAE3B8DB0170100000701A0000E80300000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4800000000000000BE38D8EAE3B8DB01141D0000CC140000D30700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(7444) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000459CDAEAE3B8DB01141D0000F8130000E80300000100000000000000000000001442CBCC068D0D419D912C94CE2A116D00000000000000000000000000000000
Executable files
67
Suspicious files
24
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
7260SiemensConnectSetup(5.1.00).exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\SiemensConnectSetup.msi —
MD5:—
SHA256:—
7444msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
7444msiexec.exeC:\Windows\Installer\120586.msi —
MD5:—
SHA256:—
7444msiexec.exeC:\Windows\Temp\~DF6B3F33C795DC87F0.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
7408msiexec.exeC:\Users\admin\AppData\Local\Temp\MSID1AA.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
7444msiexec.exeC:\Windows\Installer\MSIC2E.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
7260SiemensConnectSetup(5.1.00).exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\setup.exeexecutable
MD5:5A554D061FCD6301E81C3638F771EE17
SHA256:33AB25297489EA3C06AF2E2CC00C5B01475D2CC1DEE6A6F07B06C817306D9F0A
7444msiexec.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:7DA8E397E2A2730F2EEF65F4115609A7
SHA256:002EAF54F72820D2B8C8D82E91175708EC96B2836D9EC22C1270312FE12353DA
7444msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:28A1B2F6326F3EC4B20965F28EEDB2F4
SHA256:5B2E64F764DDBE140EC61EF7DA69AA94724AF61D1E5213A16D5D78F42E6157FD
7444msiexec.exeC:\Windows\Installer\MSIBC0.tmpexecutable
MD5:684F2D21637CB5835172EDAD55B6A8D9
SHA256:DA1FE86141C446921021BB26B6FE2BD2D1BB51E3E614F46F8103FFAD8042F2C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
29
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8040
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8040
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7000
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.30
  • 23.216.77.18
  • 23.216.77.41
  • 23.216.77.38
  • 23.216.77.28
  • 23.216.77.35
  • 23.216.77.21
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.128
  • 40.126.32.138
  • 40.126.32.74
  • 20.190.160.66
  • 40.126.32.134
  • 20.190.160.64
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SiemensConnectSetup(5.1.00).exe