File name:

Transwiz.exe

Full analysis: https://app.any.run/tasks/ea719160-b443-46f3-be21-a07e1f7ebe54
Verdict: Malicious activity
Analysis date: January 04, 2024, 13:06:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

471CE7E66C5C66F1CDE267D0DABBFE8E

SHA1:

E52A84149B200DD6E6E6866A6FFAB02FCD834479

SHA256:

7B557A3D47416E5E15964AC00161BCC3EB9BF97617085501C0EF60A1B4F3795E

SSDEEP:

49152:37qPyadnSeWsfGegJrOhKUMAhhsO+xhygTaAwJUyL:36dnSNrOhKUQzTwJUc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • Transwiz.exe (PID: 2268)

    • Steals credentials from Web Browsers

      • Transwiz.exe (PID: 2268)

    • Actions looks like stealing of personal data

      • Transwiz.exe (PID: 2268)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Transwiz.exe (PID: 2268)

    • Reads browser cookies

      • Transwiz.exe (PID: 2268)

  • INFO

    • Reads the computer name

      • Transwiz.exe (PID: 2268)
      • profhlp.exe (PID: 1236)

    • Reads the machine GUID from the registry

      • Transwiz.exe (PID: 2268)
      • profhlp.exe (PID: 1236)

    • Drops the executable file immediately after the start

      • Transwiz.exe (PID: 2268)

    • Checks supported languages

      • Transwiz.exe (PID: 2268)
      • profhlp.exe (PID: 1236)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1624)

    • Create files in a temporary directory

      • Transwiz.exe (PID: 2268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:06 18:00:26+02:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 1095168
InitializedDataSize: 906752
UninitializedDataSize: -
EntryPoint: 0x963c1
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.19.1099.0
ProductVersionNumber: 1.19.1099.0
FileFlagsMask: 0x001f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
Build: 1.19.1099
CompanyName: ForensiT Limited
FileDescription: ForensiT Transwiz
FileVersion: 1.19.1099.0
InternalName: Transwiz
LegalCopyright: Copyright © ForensiT 2006-2021
ProductName: Transwiz
ProductVersion: 1.19.1099.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start transwiz.exe profhlp.exe vssvc.exe no specs transwiz.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1236C:\Windows\system32\profhlp.exe /1C:\Windows\System32\profhlp.exe
Transwiz.exe
User:
admin
Company:
ForensiT
Integrity Level:
HIGH
Description:
User Profile Migration Helper
Exit code:
0
Version:
3.0.0.1
Modules
Images
c:\windows\system32\profhlp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1624C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2044"C:\Users\admin\AppData\Local\Temp\Transwiz.exe" C:\Users\admin\AppData\Local\Temp\Transwiz.exe—explorer.exe
User:
admin
Company:
ForensiT Limited
Integrity Level:
MEDIUM
Description:
ForensiT Transwiz
Exit code:
3221226540
Version:
1.19.1099.0
Modules
Images
c:\users\admin\appdata\local\temp\transwiz.exe
c:\windows\system32\ntdll.dll
2268"C:\Users\admin\AppData\Local\Temp\Transwiz.exe" C:\Users\admin\AppData\Local\Temp\Transwiz.exe
explorer.exe
User:
admin
Company:
ForensiT Limited
Integrity Level:
HIGH
Description:
ForensiT Transwiz
Exit code:
0
Version:
1.19.1099.0
Modules
Images
c:\users\admin\appdata\local\temp\transwiz.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wkscli.dll
Total events
4 581
Read events
4 533
Write events
45
Delete events
3

Modification events

(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
06000000000000000B0000000100000002000000070000000C0000000D0000000A0000000900000008000000030000000500000004000000FFFFFFFF
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
0200000006000000000000000B00000001000000070000000C0000000D0000000A0000000900000008000000030000000500000004000000FFFFFFFF
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_FolderType
Value:
{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewID
Value:
{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\50\ComDlg
Operation:writeName:TV_TopViewVersion
Value:
0
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
010000000200000006000000000000000B000000070000000C0000000D0000000A0000000900000008000000030000000500000004000000FFFFFFFF
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:Mode
Value:
4
(PID) Process:(2268) Transwiz.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}
Operation:writeName:LogicalViewMode
Value:
1
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2268Transwiz.exeC:\admin.trans.zip —
MD5:—
SHA256:—
2268Transwiz.exeC:\Windows\system32\profhlp.exeexecutable
MD5:E2AF49D657FAC39F6B9ABBFA01737578
SHA256:6DF3B3328714E29356D6251411B2CA96E332DFC9D015D63054FC4AF4CA504B19
2268Transwiz.exeC:\Users\admin\AppData\Local\Temp\transfer.transfer.xmlxml
MD5:386324447B2C08A95391C56DF0A50681
SHA256:C4C338983F84C0E7C9EC07A72B2E77A2B1870C48F35EA5F0747617460F8C5772
2268Transwiz.exeC:\Users\admin\AppData\Local\Temp\19f5d17c-2c07-4490-aba0-32cd971a4f29binary
MD5:8F4BEAB5B726969171345E6F7D141457
SHA256:D21EB20BA7762BB729DFE129AB9C3A0D8E10016D76D19F99AC6CF31975E7563C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
profhlp.exe
VSS: Waiting on Backup Complete
Transwiz.exe
\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy20\Users\admin\AppData\Local\Google\Chrome\User Data\SwReporter
Transwiz.exe
TAKING OWNERSHIP
profhlp.exe
VSS: Backup Complete.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Transwiz.exe