We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
4 August 2023, 13:59
Analysis environment:
Windows 7 Pro, build 7601, x86
Setup_WebCompanion.exe
MD5:
BAAAE88074273E75505C073215CF24EE
SHA1:
8FC218E1E6F1FA103048D091671773BB4D358440
SHA256:
6DE25D09F4E405BD52E81D21C6DB3C080A7CE49F907CF335DEF0E2728BD3104D
Analysis result
Threat level:
Malicious activity
Tags:
installer
Full analysis:
Analysis Setup_WebCompanion.exe (MD5: BAAAE88074273E75505C073215CF24EE) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Application was dropped or rewritten from another process
WebCompanionInstaller.exe (PID: 3864)
WebCompanion.exe (PID: 768)
Loads dropped or rewritten executable
WebCompanionInstaller.exe (PID: 3864)
WebCompanion.exe (PID: 768)
SUSPICIOUS
Searches for installed software
WebCompanionInstaller.exe (PID: 3864)
WebCompanion.exe (PID: 768)
Reads settings of System Certificates
WebCompanionInstaller.exe (PID: 3864)
WebCompanion.exe (PID: 768)
Changes internet zones settings
WebCompanionInstaller.exe (PID: 3864)
Executable content was dropped or overwritten
WebCompanionInstaller.exe (PID: 3864)
Setup_WebCompanion.exe (PID: 2880)
The process creates files with name similar to system file names
WebCompanionInstaller.exe (PID: 3864)
Suspicious use of NETSH.EXE
cmd.exe (PID: 2628)
Starts CMD.EXE for commands execution
WebCompanionInstaller.exe (PID: 3864)
Reads the Internet Settings
WebCompanionInstaller.exe (PID: 3864)
WebCompanion.exe (PID: 768)
Checks Windows Trust Settings
WebCompanion.exe (PID: 768)
Reads security settings of Internet Explorer
WebCompanion.exe (PID: 768)
INFO
Create files in a temporary directory
Setup_WebCompanion.exe (PID: 2880)
WebCompanionInstaller.exe (PID: 3864)
Checks supported languages
WebCompanionInstaller.exe (PID: 3864)
wmpnscfg.exe (PID: 1048)
WebCompanion.exe (PID: 768)
Setup_WebCompanion.exe (PID: 2880)
The process checks LSA protection
WebCompanionInstaller.exe (PID: 3864)
wisptis.exe (PID: 3832)
wmpnscfg.exe (PID: 1048)
netsh.exe (PID: 312)
WebCompanion.exe (PID: 768)
Reads the machine GUID from the registry
WebCompanionInstaller.exe (PID: 3864)
wmpnscfg.exe (PID: 1048)
WebCompanion.exe (PID: 768)
Reads the computer name
WebCompanionInstaller.exe (PID: 3864)
WebCompanion.exe (PID: 768)
wmpnscfg.exe (PID: 1048)
Reads Environment values
WebCompanionInstaller.exe (PID: 3864)
WebCompanion.exe (PID: 768)
Creates files or folders in the user directory
WebCompanionInstaller.exe (PID: 3864)
WebCompanion.exe (PID: 768)
[YARA] HTTP manipulation strings were found
WebCompanionInstaller.exe (PID: 3864)
Manual execution by a user
wmpnscfg.exe (PID: 1048)
Creates files in the program directory
WebCompanion.exe (PID: 768)
Threats
PID
Process
Class
Message
3864
WebCompanionInstaller.exe
Potentially Bad Traffic
ET HUNTING Terse Request for Zip File (GET)