File name:

SystemTools.exe

Full analysis: https://app.any.run/tasks/e716440c-c938-4a2d-b28c-af1dc475cd61
Verdict: Malicious activity
Analysis date: September 23, 2024, 16:05:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

930C9ADA0AFC31D73D134DC346357C06

SHA1:

DFC42C295FF95944CBDC1A360E602B5C7D155A19

SHA256:

65E37EE21D0B6A588A4822F93DF9589E447EF2C3405D5F28C69A865C0633BD36

SSDEEP:

24576:jzvHK8GoBTFRf/yTlLLuEsI893iBkvxhVd:jzS8GeTFRf/yTlLLuEsIA3iBkph/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • SystemTools.tmp (PID: 2392)
      • SystemTools.tmp (PID: 2280)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SystemTools.exe (PID: 1136)
      • SystemTools.exe (PID: 2020)
      • SystemTools.tmp (PID: 2392)
      • SystemTools.exe (PID: 3152)
      • SystemTools.exe (PID: 3496)
      • SystemTools.tmp (PID: 2280)

    • Reads the Windows owner or organization settings

      • SystemTools.tmp (PID: 2392)
      • SystemTools.tmp (PID: 1756)
      • SystemTools.tmp (PID: 2280)

    • Searches for installed software

      • SystemTools.tmp (PID: 1756)
      • SystemTools.tmp (PID: 2280)

  • INFO

    • Checks supported languages

      • SystemTools.exe (PID: 1136)
      • SystemTools.tmp (PID: 1796)
      • wmpnscfg.exe (PID: 2504)
      • SystemTools.exe (PID: 2020)
      • SystemTools.tmp (PID: 2392)
      • SystemTools.exe (PID: 3152)
      • SystemTools.tmp (PID: 1756)
      • SystemTools.exe (PID: 3496)
      • SystemTools.exe (PID: 2600)
      • SystemTools.tmp (PID: 2280)
      • SystemTools.exe (PID: 3592)

    • Reads the computer name

      • SystemTools.tmp (PID: 1796)
      • wmpnscfg.exe (PID: 2504)
      • SystemTools.tmp (PID: 2392)
      • SystemTools.tmp (PID: 1756)
      • SystemTools.exe (PID: 2600)
      • SystemTools.exe (PID: 3592)
      • SystemTools.tmp (PID: 2280)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2504)
      • SystemTools.exe (PID: 3496)
      • SystemTools.exe (PID: 3152)

    • Create files in a temporary directory

      • SystemTools.exe (PID: 1136)
      • SystemTools.exe (PID: 2020)
      • SystemTools.exe (PID: 3152)
      • SystemTools.exe (PID: 3496)

    • Creates files in the program directory

      • SystemTools.tmp (PID: 2392)
      • SystemTools.tmp (PID: 2280)

    • Creates a software uninstall entry

      • SystemTools.tmp (PID: 2392)
      • SystemTools.tmp (PID: 2280)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41472
InitializedDataSize: 11776
UninitializedDataSize: -
EntryPoint: 0xaa98
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: SystemTools, Inc.
FileDescription: System Tools 9.0.0 Setup
FileVersion:
LegalCopyright:
ProductName: System Tools 9.0.0
ProductVersion: 9.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
12
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start systemtools.exe systemtools.tmp no specs wmpnscfg.exe no specs systemtools.exe systemtools.tmp systemtools.exe no specs svchost.exe systemtools.exe systemtools.tmp no specs systemtools.exe systemtools.tmp systemtools.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1060C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1136"C:\Users\admin\Desktop\SystemTools.exe" C:\Users\admin\Desktop\SystemTools.exe
explorer.exe
User:
admin
Company:
SystemTools, Inc.
Integrity Level:
MEDIUM
Description:
System Tools 9.0.0 Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\systemtools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1756"C:\Users\admin\AppData\Local\Temp\is-5SOB2.tmp\SystemTools.tmp" /SL5="$D019E,228189,54272,C:\Users\admin\Desktop\SystemTools.exe" C:\Users\admin\AppData\Local\Temp\is-5SOB2.tmp\SystemTools.tmp—SystemTools.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
2
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-5sob2.tmp\systemtools.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1796"C:\Users\admin\AppData\Local\Temp\is-DLA6U.tmp\SystemTools.tmp" /SL5="$160164,228189,54272,C:\Users\admin\Desktop\SystemTools.exe" C:\Users\admin\AppData\Local\Temp\is-DLA6U.tmp\SystemTools.tmp—SystemTools.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-dla6u.tmp\systemtools.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2020"C:\Users\admin\Desktop\SystemTools.exe" /SPAWNWND=$A0196 /NOTIFYWND=$160164 C:\Users\admin\Desktop\SystemTools.exe
SystemTools.tmp
User:
admin
Company:
SystemTools, Inc.
Integrity Level:
HIGH
Description:
System Tools 9.0.0 Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\systemtools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2280"C:\Users\admin\AppData\Local\Temp\is-G92NF.tmp\SystemTools.tmp" /SL5="$E01B6,228189,54272,C:\Users\admin\Desktop\SystemTools.exe" C:\Users\admin\AppData\Local\Temp\is-G92NF.tmp\SystemTools.tmp
SystemTools.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-g92nf.tmp\systemtools.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2392"C:\Users\admin\AppData\Local\Temp\is-JPV8I.tmp\SystemTools.tmp" /SL5="$80218,228189,54272,C:\Users\admin\Desktop\SystemTools.exe" /SPAWNWND=$A0196 /NOTIFYWND=$160164 C:\Users\admin\AppData\Local\Temp\is-JPV8I.tmp\SystemTools.tmp
SystemTools.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-jpv8i.tmp\systemtools.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2504"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2600"C:\Program Files\System Tools 9.0.0\SystemTools.exe"C:\Program Files\System Tools 9.0.0\SystemTools.exe—SystemTools.tmp
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\system tools 9.0.0\systemtools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3152"C:\Users\admin\Desktop\SystemTools.exe" C:\Users\admin\Desktop\SystemTools.exe
explorer.exe
User:
admin
Company:
SystemTools, Inc.
Integrity Level:
HIGH
Description:
System Tools 9.0.0 Setup
Exit code:
2
Version:
Modules
Images
c:\users\admin\desktop\systemtools.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
Total events
1 753
Read events
1 668
Write events
68
Delete events
17

Modification events

(PID) Process:(2392) SystemTools.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
58090000DC9F6674D20DDB01
(PID) Process:(2392) SystemTools.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
5296A6296C1D5700B8F38A3B8214CCE02208987008B107AB867CDF1B61F4C398
(PID) Process:(2392) SystemTools.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(1060) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\Intranet
Operation:writeName:{4040CF00-1B3E-486A-B407-FA14C56B6FC0}
Value:
525400363EFF
(PID) Process:(2392) SystemTools.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\System Tools 9.0.0\SystemTools.exe
(PID) Process:(2392) SystemTools.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
5E318F4C26C21D6B813EDC16B65C2418528E285D38B7F4ECB13CDCC00E31FAA7
(PID) Process:(2392) SystemTools.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SystemTools
Value:
"C:\Program Files\System Tools 9.0.0\SystemTools.exe"
(PID) Process:(2392) SystemTools.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FFB1E223-2052-49F4-B500-2F9A2DDBA756}}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.9 (a)
(PID) Process:(2392) SystemTools.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FFB1E223-2052-49F4-B500-2F9A2DDBA756}}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\System Tools 9.0.0
(PID) Process:(2392) SystemTools.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FFB1E223-2052-49F4-B500-2F9A2DDBA756}}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\System Tools 9.0.0\
Executable files
12
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1136SystemTools.exeC:\Users\admin\AppData\Local\Temp\is-DLA6U.tmp\SystemTools.tmpexecutable
MD5:7AD0F3597D518A971FA93A94B9E5BFCE
SHA256:092254B92D1674012B71189AF0074051ACBDA0A9ECD9F80750A319126E013AAA
2392SystemTools.tmpC:\Program Files\System Tools 9.0.0\is-KLNP8.tmpexecutable
MD5:4462B97E7CDD628D71C4CFECBFAC6723
SHA256:6310B44B0DB09AFDDDC12ADB2261D55DE45414FECA79FD5A74C147E1EDB1591B
3496SystemTools.exeC:\Users\admin\AppData\Local\Temp\is-G92NF.tmp\SystemTools.tmpexecutable
MD5:7AD0F3597D518A971FA93A94B9E5BFCE
SHA256:092254B92D1674012B71189AF0074051ACBDA0A9ECD9F80750A319126E013AAA
2392SystemTools.tmpC:\Program Files\System Tools 9.0.0\unins000.exeexecutable
MD5:93580EB6B85591732227679E30853441
SHA256:176BF07852ED3F674785C5C28308A819AEC1594BBFA21BF5D97B55895FE37FBF
2392SystemTools.tmpC:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools 9.0.0\System Tools 9.0.0.lnkbinary
MD5:759F6BF3323AB058BA0DDD346EC946B2
SHA256:FC3B3CDD69C769CB46712B6E6C6A37D46AB0FC1334456277FAD6562FECD09818
2020SystemTools.exeC:\Users\admin\AppData\Local\Temp\is-JPV8I.tmp\SystemTools.tmpexecutable
MD5:7AD0F3597D518A971FA93A94B9E5BFCE
SHA256:092254B92D1674012B71189AF0074051ACBDA0A9ECD9F80750A319126E013AAA
2280SystemTools.tmpC:\Program Files\System Tools 9.0.0\is-1TICR.tmpexecutable
MD5:93580EB6B85591732227679E30853441
SHA256:176BF07852ED3F674785C5C28308A819AEC1594BBFA21BF5D97B55895FE37FBF
2280SystemTools.tmpC:\Program Files\System Tools 9.0.0\SystemTools.exeexecutable
MD5:4462B97E7CDD628D71C4CFECBFAC6723
SHA256:6310B44B0DB09AFDDDC12ADB2261D55DE45414FECA79FD5A74C147E1EDB1591B
2280SystemTools.tmpC:\Program Files\System Tools 9.0.0\is-E24E5.tmpexecutable
MD5:4462B97E7CDD628D71C4CFECBFAC6723
SHA256:6310B44B0DB09AFDDDC12ADB2261D55DE45414FECA79FD5A74C147E1EDB1591B
2280SystemTools.tmpC:\Program Files\System Tools 9.0.0\unins000.exeexecutable
MD5:93580EB6B85591732227679E30853441
SHA256:176BF07852ED3F674785C5C28308A819AEC1594BBFA21BF5D97B55895FE37FBF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2564
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
vkhost.tk
  • —
unknown

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SystemTools.exe