| download: | /web/20140722113202/http://hyperionics.swmirror.com/hc2setup.exe |
| Full analysis: | https://app.any.run/tasks/5f6919d0-5a7b-4883-b5d5-4c619581c70b |
| Verdict: | Malicious activity |
| Analysis date: | July 21, 2024, 13:30:57 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive |
| MD5: | 671CF757E28768FD98EF9E32EF795A7B |
| SHA1: | 30BE0C6F953ED09629A802FD3AEAABB4B3F22F8F |
| SHA256: | 78E17664EE969C9A1064EA286BDBE6C5D37EA4672AD672541885023F06233B91 |
| SSDEEP: | 98304:+8QNEExsVkYP54EeF1jS5wB5MSsjIJ/FkzSr7d9LF3i+QAxeVGrGSxGPwl20ifE3:WVP9 |
MALICIOUS
Drops the executable file immediately after the start
- hc2setup.exe (PID: 3700)
- Setup.exe (PID: 2956)
SUSPICIOUS
Process drops legitimate windows executable
- hc2setup.exe (PID: 3700)
- Setup.exe (PID: 2956)
Reads security settings of Internet Explorer
- hc2setup.exe (PID: 3700)
- HyCam2.exe (PID: 3152)
Executable content was dropped or overwritten
- hc2setup.exe (PID: 3700)
- Setup.exe (PID: 2956)
Uses RUNDLL32.EXE to load library
- Setup.exe (PID: 2956)
Reads the Internet Settings
- rundll32.exe (PID: 2092)
- hc2setup.exe (PID: 3700)
- rundll32.exe (PID: 3144)
- HyCam2.exe (PID: 3152)
- HyCam2.exe (PID: 2068)
The process drops C-runtime libraries
- hc2setup.exe (PID: 3700)
- Setup.exe (PID: 2956)
Creates a software uninstall entry
- Setup.exe (PID: 2956)
There is functionality for taking screenshot (YARA)
- vlc.exe (PID: 4060)
INFO
Reads the computer name
- hc2setup.exe (PID: 3700)
- Setup.exe (PID: 2956)
- HyCam2.exe (PID: 3152)
- vlc.exe (PID: 4060)
- HyCam2.exe (PID: 2068)
- HyCam2.exe (PID: 3408)
Checks supported languages
- hc2setup.exe (PID: 3700)
- Setup.exe (PID: 2956)
- HyCam2.exe (PID: 3152)
- vlc.exe (PID: 4060)
- HyCam2.exe (PID: 3408)
- HyCam2.exe (PID: 2068)
Create files in a temporary directory
- hc2setup.exe (PID: 3700)
Checks proxy server information
- rundll32.exe (PID: 3144)
- rundll32.exe (PID: 2092)
- HyCam2.exe (PID: 3152)
Creates files in the program directory
- Setup.exe (PID: 2956)
Manual execution by a user
- HyCam2.exe (PID: 3152)
- explorer.exe (PID: 1788)
- HyCam2.exe (PID: 3408)
- HyCam2.exe (PID: 2068)
Creates files or folders in the user directory
- Setup.exe (PID: 2956)
- HyCam2.exe (PID: 3152)
Reads the machine GUID from the registry
- HyCam2.exe (PID: 3152)
Application launched itself
- msedge.exe (PID: 3820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2012:02:17 14:55:21+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 9 |
| CodeSize: | 73216 |
| InitializedDataSize: | 113152 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb583 |
| OSVersion: | 5 |
| ImageVersion: | - |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
Total processes
64
Monitored processes
22
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1788 | "C:\Windows\explorer.exe" | C:\Windows\explorer.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2068 | "C:\Program Files\HyperCam 2\HyCam2.exe" | C:\Program Files\HyperCam 2\HyCam2.exe | — | explorer.exe | |||||||||||
User: admin Company: Hyperionics Integrity Level: MEDIUM Description: HyperCam Version: 2.29.1.0 Modules
| |||||||||||||||
| 2092 | RunDll32.exe "C:\Users\admin\AppData\Local\Temp\RarSFX0\OCSetupHlp.dll",_OCPID203OpenCandy2@16 2956,52F8C096004943CE816B62095C087C9A,29690371C0984BD8865A4B4455F0834C,40B3F89C531748B6AD6434D72C633154 | C:\Windows\System32\rundll32.exe | — | Setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2364 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2304 --field-trial-handle=1236,i,18056620125644515751,10796788104236050646,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2396 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2336 --field-trial-handle=1236,i,18056620125644515751,10796788104236050646,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2452 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=1388 --field-trial-handle=1236,i,18056620125644515751,10796788104236050646,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2672 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1464 --field-trial-handle=1236,i,18056620125644515751,10796788104236050646,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 2956 | "C:\Users\admin\AppData\Local\Temp\RarSFX0\Setup.exe" | C:\Users\admin\AppData\Local\Temp\RarSFX0\Setup.exe | hc2setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3144 | RunDll32.exe "C:\Users\admin\AppData\Local\Temp\RarSFX0\OCSetupHlp.dll",_OCPID203OpenCandy2@16 2956,10A4506830A8431F8774C10EFA6EEE9D,4489FE44B90043A2A7BB883E20D7CDA0,40B3F89C531748B6AD6434D72C633154 | C:\Windows\System32\rundll32.exe | — | Setup.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3152 | "C:\Program Files\HyperCam 2\HyCam2.exe" | C:\Program Files\HyperCam 2\HyCam2.exe | explorer.exe | ||||||||||||
User: admin Company: Hyperionics Integrity Level: MEDIUM Description: HyperCam Exit code: 20 Version: 2.29.1.0 Modules
| |||||||||||||||
Total events
22 138
Read events
21 393
Write events
237
Delete events
508
Modification events
| (PID) Process: | (3700) hc2setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3700) hc2setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3700) hc2setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (3700) hc2setup.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (2092) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (2092) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyServer |
Value: | |||
| (PID) Process: | (2092) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | ProxyOverride |
Value: | |||
| (PID) Process: | (2092) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoConfigURL |
Value: | |||
| (PID) Process: | (2092) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | delete value | Name: | AutoDetect |
Value: | |||
| (PID) Process: | (2092) rundll32.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 460000005D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
Executable files
17
Suspicious files
45
Text files
38
Unknown types
16
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\8-11025u.wav | wav | |
MD5:C928167AE840C4D092D2D11157458B72 | SHA256:C1D1F055679140D002EEADCD16FD2D72FA6BDC03E0649520E1CF4EEEA6182EF7 | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\8-22050u.wav | binary | |
MD5:BF39380290ED50079B752A2593B9A50D | SHA256:C809DB4B1D49BB7F70A1E91FA8769563BD1E2BEFF8EC979B881713CD55FF99E9 | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\8-11025d.wav | wav | |
MD5:A8BBF1676207514D90693EE2FB0364F8 | SHA256:D6A44B57B047E4FBCF4886A713CC5143AF065D157FD4972334DD7B5861798FE5 | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\8-44100d.wav | wav | |
MD5:38A775466B8DC0A1F2D7E04F34F72BD9 | SHA256:FF20BEF1BA7566685B22F5F92DD215178A312DB97DA4C6C743585405F5C040ED | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\8-8000u.wav | wav | |
MD5:D6A10FFAB0437CB757CA0DD098B8B3A7 | SHA256:F3B90092A7F0313D5D0B97AD470CE6D68AA4F4780B18D39560A4988520F4C849 | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\16-22050d.wav | binary | |
MD5:E00C8AE722FD731A639F34571375ADB1 | SHA256:60C7BC95E033888F55022B12C9D9BAD16FC458B9E499515B2223FDF2D4F8E741 | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\8-22050d.wav | wav | |
MD5:CA12246A9F402472599F55F894D9183A | SHA256:43B8C0E7D0BCB7EE07B02CB9A9EDA353876E344976BDF6E8D508C10C3C549124 | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\16-11025u.wav | binary | |
MD5:12A8E35F4B87AAE6DF4D824D4BF2D601 | SHA256:ED614186535078B71D7534F1B2A4DB00BB04389C81D7865D0241C7548A9B5D93 | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\8-8000d.wav | binary | |
MD5:1912519EA64D50843AE9084D37E8A0C1 | SHA256:5F8D2BDA27A1036902C82778FF4C947AC57D63D558C1D6F0AA4B168489774538 | |||
| 3700 | hc2setup.exe | C:\Users\admin\AppData\Local\Temp\RarSFX0\16-8000u.wav | binary | |
MD5:0FCE94CFEC32E5D6084184A34DC60501 | SHA256:2A23479428FCD329D4025FB24C112466237B512A233828FA40B215276CCB84ED | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
21
DNS requests
28
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3788 | msedge.exe | GET | 200 | 66.135.60.154:80 | http://www.hyperionics.com/atVoice/images/at_voice128x128.png | unknown | — | — | malicious |
3788 | msedge.exe | GET | 200 | 66.135.60.154:80 | http://www.hyperionics.com/atVoice/ | unknown | — | — | malicious |
3788 | msedge.exe | GET | 404 | 66.135.60.154:80 | http://www.hyperionics.com/favicon.ico | unknown | — | — | malicious |
3788 | msedge.exe | GET | 200 | 66.135.60.154:80 | http://www.hyperionics.com/atVoice/images/apkmonk2.png | unknown | — | — | malicious |
3152 | HyCam2.exe | GET | 200 | 66.135.60.154:80 | http://www.hyperionics.com/vers/hc2.txt | unknown | — | — | malicious |
3152 | HyCam2.exe | GET | 200 | 66.135.60.154:80 | http://www.hyperionics.com/vers/HyperCamPromo.gif | unknown | — | — | malicious |
1372 | svchost.exe | GET | 304 | 23.50.131.216:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | whitelisted |
3152 | HyCam2.exe | GET | 200 | 66.135.60.154:80 | http://www.hyperionics.com/vers/HC4offer.gif | unknown | — | — | malicious |
1372 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1372 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
1372 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2564 | svchost.exe | 239.255.255.250:3702 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3152 | HyCam2.exe | 66.135.60.154:80 | www.hyperionics.com | COGECO-PEER1 | US | unknown |
1372 | svchost.exe | 23.50.131.216:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
api.opencandy.com |
| whitelisted |
www.hyperionics.com |
| malicious |
settings-win.data.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
Threats
Process | Message |
|---|---|
vlc.exe | main libvlc debug: VLC media player - 3.0.11 Vetinari
|
vlc.exe | main libvlc debug: Copyright © 1996-2020 the VideoLAN team
|
vlc.exe | main libvlc debug: revision 3.0.11-0-gdc0c5ced72
|
vlc.exe | main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--with-breakpad=https://win.crashes.videolan.org' 'host_alias=i686-w64-mingw32' 'PKG_CONFIG_LIBDIR=/home/jenkins/workspace/vlc-release/windows/vlc-release-win32-x86/contrib/i686-w64-mingw32/lib/pkgconfig'
|
vlc.exe | main libvlc debug: using multimedia timers as clock source
|
vlc.exe | main libvlc debug: min period: 1 ms, max period: 1000000 ms
|
vlc.exe | main libvlc debug: searching plug-in modules
|
vlc.exe | main libvlc debug: loading plugins cache file C:\Program Files\VideoLAN\VLC\plugins\plugins.dat
|
vlc.exe | main libvlc debug: recursively browsing `C:\Program Files\VideoLAN\VLC\plugins'
|
vlc.exe | main libvlc error: stale plugins cache: modified C:\Program Files\VideoLAN\VLC\plugins\access\libaccess_concat_plugin.dll
|