| URL: | http://download.2345.com/2345pcsafe/2345pcsafe_up_v5.0.5.11697.exe |
| Full analysis: | https://app.any.run/tasks/17abc8f7-e6ea-474f-be21-be1214e2e176 |
| Verdict: | Malicious activity |
| Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
| Analysis date: | August 06, 2019, 05:49:02 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 5CF7E754D585E4B3C1C40B3727CEEE79 |
| SHA1: | 886415F001D714356679828D8109C67365A7F12F |
| SHA256: | 66878951252EBFFC26771B50FCB48594FA20F92930854631D1F91E332FB7C2A9 |
| SSDEEP: | 3:N1KaKElGRQyK3GjXX8QVD4N:Ca5Hy9jcQVD4 |
MALICIOUS
Application was dropped or rewritten from another process
- 2345pcsafe_up_v5.0.5.11697.exe (PID: 1388)
- 2345pcsafe_up_v5.0.5.11697.exe (PID: 4056)
- 2345ShellPro.exe (PID: 3340)
- 2345SafeCenterSvc.exe (PID: 2524)
- 2345ShellPro.exe (PID: 2976)
- 2345SafeCenterInstaller.exe (PID: 3668)
- 2345SafeSvc.exe (PID: 3628)
Downloads executable files from the Internet
- chrome.exe (PID: 2920)
Loads dropped or rewritten executable
- 2345pcsafe_up_v5.0.5.11697.exe (PID: 1388)
- 2345RTProtect.exe (PID: 3048)
Registers / Runs the DLL via REGSVR32.EXE
- 2345SafeCenterInstaller.exe (PID: 3552)
SUSPICIOUS
Executable content was dropped or overwritten
- chrome.exe (PID: 916)
- 2345pcsafe_up_v5.0.5.11697.exe (PID: 1388)
- 2345SafeCenterInstaller.exe (PID: 3552)
- 2345ShellPro.exe (PID: 3340)
Creates a software uninstall entry
- 2345pcsafe_up_v5.0.5.11697.exe (PID: 1388)
Creates or modifies windows services
- 2345SafeCenterInstaller.exe (PID: 3552)
- 2345ShellPro.exe (PID: 2976)
Creates files in the driver directory
- 2345SafeCenterInstaller.exe (PID: 3552)
Creates files in the user directory
- 2345SafeCenterInstaller.exe (PID: 3552)
- 2345RTProtect.exe (PID: 3048)
Creates files in the Windows directory
- 2345SafeCenterInstaller.exe (PID: 3552)
- 2345SafeCenterSvc.exe (PID: 2524)
Executed as Windows Service
- 2345SafeCenterSvc.exe (PID: 2524)
- 2345SafeSvc.exe (PID: 3628)
Creates COM task schedule object
- regsvr32.exe (PID: 3664)
Creates files in the program directory
- 2345pcsafe_up_v5.0.5.11697.exe (PID: 1388)
- 2345RTProtect.exe (PID: 3048)
- 2345SafeCenterInstaller.exe (PID: 3552)
Removes files from Windows directory
- 2345RTProtect.exe (PID: 3048)
INFO
Application launched itself
- chrome.exe (PID: 916)
Reads Internet Cache Settings
- chrome.exe (PID: 916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
60
Monitored processes
22
Malicious processes
7
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 916 | "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://download.2345.com/2345pcsafe/2345pcsafe_up_v5.0.5.11697.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 1048 | "C:\Program Files\2345Soft\2345SafeCenter\5.0.5.6611\2345SafeCenterCrashReport.exe" --crashtype=Driver | C:\Program Files\2345Soft\2345SafeCenter\5.0.5.6611\2345SafeCenterCrashReport.exe | — | 2345RTProtect.exe | |||||||||||
User: admin Company: 2345.cc Integrity Level: HIGH Description: 2345安全中心-错误报告 Exit code: 1 Version: 5.0.5.6611 Modules
| |||||||||||||||
| 1388 | "C:\Users\admin\Downloads\2345pcsafe_up_v5.0.5.11697.exe" | C:\Users\admin\Downloads\2345pcsafe_up_v5.0.5.11697.exe | chrome.exe | ||||||||||||
User: admin Company: 2345.cc Integrity Level: HIGH Description: 2345安全卫士 v5.0 安装程序 Exit code: 0 Version: 5.0.5.11697 Modules
| |||||||||||||||
| 1640 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,7420454280154205658,12246987502469101269,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=3563210020666865247 --mojo-platform-channel-handle=980 --ignored=" --type=renderer " /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2524 | "C:\Program Files\2345Soft\2345SafeCenter\5.0.5.6611\2345SafeCenterSvc.exe" | C:\Program Files\2345Soft\2345SafeCenter\5.0.5.6611\2345SafeCenterSvc.exe | services.exe | ||||||||||||
User: SYSTEM Company: 2345.cc Integrity Level: SYSTEM Description: 2345安全平台-服务程序 Exit code: 0 Version: 5.0.5.6611 Modules
| |||||||||||||||
| 2728 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,7420454280154205658,12246987502469101269,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=2681567535808701423 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2920 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1016,7420454280154205658,12246987502469101269,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --service-request-channel-token=8393042094276648747 --mojo-platform-channel-handle=1564 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | chrome.exe | ||||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2960 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1016,7420454280154205658,12246987502469101269,131072 --enable-features=PasswordImport --lang=en-US --extension-process --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=6231538816715031928 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2416 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
| 2976 | "C:\Program Files\2345Soft\2345PCSafe\5.0.5.11697\2345ShellPro.exe" --type=repair | C:\Program Files\2345Soft\2345PCSafe\5.0.5.11697\2345ShellPro.exe | — | 2345RTProtect.exe | |||||||||||
User: admin Company: 2345.cc Integrity Level: HIGH Description: 2345安全卫士-安装辅助程序 Exit code: 0 Version: 5.0.5.11697 Modules
| |||||||||||||||
| 3044 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1016,7420454280154205658,12246987502469101269,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15188993651965078853 --mojo-platform-channel-handle=3504 /prefetch:2 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google LLC Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 75.0.3770.100 Modules
| |||||||||||||||
Total events
1 472
Read events
1 280
Write events
189
Delete events
3
Modification events
| (PID) Process: | (3184) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | write | Name: | 916-13209544158291250 |
Value: 259 | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome |
| Operation: | write | Name: | UsageStatsInSample |
Value: 0 | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes |
| Operation: | delete value | Name: | 1512-13197841398593750 |
Value: 0 | |||
| (PID) Process: | (916) chrome.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
Executable files
89
Suspicious files
46
Text files
59
Unknown types
3
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\fd8e6a6b-3d10-40dd-8bbd-3168a531d0ec.tmp | — | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000020.dbtmp | — | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old | text | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF36d6e1.TMP | text | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old | text | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF36d6e1.TMP | text | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\ShaderCache\GPUCache\data_1 | — | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old | text | |
MD5:— | SHA256:— | |||
| 916 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
22
DNS requests
15
Threats
11
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | — | 42.62.30.180:80 | http://42.62.30.180/ | CN | — | — | whitelisted |
2920 | chrome.exe | GET | 200 | 61.147.204.76:80 | http://download.2345.com/2345pcsafe/2345pcsafe_up_v5.0.5.11697.exe | CN | executable | 52.8 Mb | suspicious |
3552 | 2345SafeCenterInstaller.exe | POST | 200 | 221.228.75.116:80 | http://update.khd.2345.cc/dmdt/dmdt_data.php | CN | text | 230 b | malicious |
3048 | 2345RTProtect.exe | POST | 200 | 221.228.75.123:80 | http://push.khd.2345.cc/token | CN | text | 164 b | unknown |
3552 | 2345SafeCenterInstaller.exe | POST | 200 | 122.226.166.52:80 | http://t.safe.2345.com/safe_realtime/index.php | CN | text | 40 b | malicious |
3552 | 2345SafeCenterInstaller.exe | POST | 200 | 122.226.166.48:80 | http://t.safe.2345.com/safe_realtime/index.php | CN | text | 40 b | malicious |
3552 | 2345SafeCenterInstaller.exe | POST | 200 | 221.228.75.116:80 | http://update.khd.2345.cc/safe_center/index.php | CN | binary | 1 b | malicious |
3552 | 2345SafeCenterInstaller.exe | POST | 200 | 221.228.75.116:80 | http://update.khd.2345.cc/safe_center/index.php | CN | binary | 1 b | malicious |
— | — | POST | 200 | 122.226.166.49:80 | http://yb.safe.2345.com/tslist.php | CN | text | 60 b | malicious |
3552 | 2345SafeCenterInstaller.exe | POST | 200 | 122.226.166.52:80 | http://t.safe.2345.com/safe_realtime/index.php | CN | text | 40 b | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 218.75.155.242:80 | download.ruanjian.2345.com | No.31,Jin-rong Street | CN | unknown |
— | — | 42.62.30.180:80 | — | China Unicom Beijing Province Network | CN | unknown |
2920 | chrome.exe | 172.217.21.227:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
2920 | chrome.exe | 61.147.204.76:80 | download.2345.com | AS Number for CHINANET jiangsu province backbone | CN | suspicious |
2920 | chrome.exe | 216.58.207.77:443 | accounts.google.com | Google Inc. | US | whitelisted |
2920 | chrome.exe | 172.217.18.100:443 | www.google.com | Google Inc. | US | whitelisted |
2920 | chrome.exe | 172.217.18.99:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
2920 | chrome.exe | 61.147.204.77:80 | download.2345.com | AS Number for CHINANET jiangsu province backbone | CN | suspicious |
— | — | 216.58.207.78:443 | sb-ssl.google.com | Google Inc. | US | whitelisted |
3552 | 2345SafeCenterInstaller.exe | 122.226.166.52:80 | t.safe.2345.com | No.31,Jin-rong Street | CN | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
clientservices.googleapis.com |
| whitelisted |
download.2345.com |
| suspicious |
accounts.google.com |
| shared |
www.google.com |
| malicious |
ssl.gstatic.com |
| whitelisted |
sb-ssl.google.com |
| whitelisted |
t.safe.2345.com |
| malicious |
www.gstatic.com |
| whitelisted |
update.khd.2345.cc |
| unknown |
push.khd.2345.cc |
| unknown |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2920 | chrome.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2920 | chrome.exe | Misc activity | ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging) |
3552 | 2345SafeCenterInstaller.exe | A Network Trojan was detected | MALWARE [PTsecurity] BehavesLike.Win32.Backdoor.vc |
1064 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
3552 | 2345SafeCenterInstaller.exe | Misc activity | ADWARE [PTsecurity] PUA:Win32/Youxun |
3552 | 2345SafeCenterInstaller.exe | A Network Trojan was detected | MALWARE [PTsecurity] BehavesLike.Win32.Backdoor.vc |
3552 | 2345SafeCenterInstaller.exe | A Network Trojan was detected | MALWARE [PTsecurity] BehavesLike.Win32.Backdoor.vc |
3552 | 2345SafeCenterInstaller.exe | Misc activity | ADWARE [PTsecurity] Downloader.AgentCRTD PUP (2345.cn) |
1064 | svchost.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
3552 | 2345SafeCenterInstaller.exe | A Network Trojan was detected | MALWARE [PTsecurity] BehavesLike.Win32.Backdoor.vc |
Process | Message |
|---|---|
2345SafeCenterSvc.exe | [2524:804:0806/065028:3667930927us:INFO:crash_service.cc(467)] pipe name is \\.\pipe\57E60541-1540-4E0A-B505-88F6D4A547C8
|
2345SafeCenterSvc.exe | [2524:804:0806/065028:3667931124us:INFO:crash_service.cc(468)] dumps at C:\Windows\TEMP\2345_Crashes
|
2345SafeCenterSvc.exe | [2524:804:0806/065028:3667931387us:INFO:crash_service.cc(486)] dump start successfully
|
2345SafeCenterSvc.exe | [2524:804:0806/065028:3667931600us:INFO:crash_service_interface.cc(72)] ready to process crash requests
|
2345SafeCenterSvc.exe | [2524:2804:0806/065031:3670494444us:INFO:crash_service.cc(510)] client start. pid = 3048
|
2345SafeSvc.exe | [3628:2176:0806/065032:3671390536us:INFO:crash_service.cc(467)] pipe name is \\.\pipe\FD439895-091C-4492-B2F7-16AA7CB46B87
|
2345SafeSvc.exe | [3628:2176:0806/065032:3671390646us:INFO:crash_service.cc(468)] dumps at C:\Windows\TEMP\2345_Crashes
|
2345SafeSvc.exe | [3628:2176:0806/065032:3671390835us:INFO:crash_service.cc(486)] dump start successfully
|
2345SafeSvc.exe | [3628:2176:0806/065032:3671390896us:INFO:crash_service_interface.cc(72)] ready to process crash requests
|