File name:

wlsetup-web.exe

Full analysis: https://app.any.run/tasks/2872bc20-e4d0-4bcd-883e-2adea835281b
Verdict: Malicious activity
Analysis date: January 19, 2023, 04:32:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8423B539D6DCECF2D710C210F01D6C6A

SHA1:

24BCEF46EA3ED47158C72A753F6B1B6005468879

SHA256:

7D9C68B11E45A763FACC7577A51C8C00B7FB654B9BA044DEB223E7140A2EFE50

SSDEEP:

24576:nnz7O4ILdA9KHjStCd8Xxpqo01fgBOV2o+b5r7t:zfIIKCBBpN0eO2o+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • wlsetup-web.exe (PID: 3140)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • wlsetup-web.exe (PID: 3140)

    • Executable content was dropped or overwritten

      • wlsetup-web.exe (PID: 3140)

    • Reads the Internet Settings

      • wlsetup-web.exe (PID: 3140)

    • Reads security settings of Internet Explorer

      • wlsetup-web.exe (PID: 3140)

    • Checks Windows Trust Settings

      • wlsetup-web.exe (PID: 3140)

  • INFO

    • Reads the computer name

      • wlsetup-web.exe (PID: 3140)

    • Checks supported languages

      • wlsetup-web.exe (PID: 3140)

    • The process checks LSA protection

      • wlsetup-web.exe (PID: 3140)

    • Reads the machine GUID from the registry

      • wlsetup-web.exe (PID: 3140)

    • Drops a file that was compiled in debug mode

      • wlsetup-web.exe (PID: 3140)

    • Create files in a temporary directory

      • wlsetup-web.exe (PID: 3140)

    • Creates files in the program directory

      • wlsetup-web.exe (PID: 3140)

    • Checks proxy server information

      • wlsetup-web.exe (PID: 3140)

    • Dropped object may contain Bitcoin addresses

      • wlsetup-web.exe (PID: 3140)

    • Creates files or folders in the user directory

      • wlsetup-web.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (54.3)
.exe | Win64 Executable (generic) (34.8)
.exe | Win32 Executable (generic) (5.6)
.exe | Generic Win/DOS Executable (2.5)
.exe | DOS Executable Generic (2.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2014-Apr-01 04:27:13
Debug artifacts:
  • wlsetup.pdb
CompanyName: Microsoft Corporation
FileDescription: Windows Essentials Installer
InternalName: wlsres
LegalCopyright: © Microsoft Corporation. Reservados todos los derechos.
OriginalFilename: wlsres.dll.mui
ProductName: Windows Essentials
FileVersion: 16.4.3528.0331
ProductVersion: 16.4.3528.0331

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 264

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 4
TimeDateStamp: 2014-Apr-01 04:27:13
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
947128
947200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.33348
.data
954368
46008
26624
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.10382
.rsrc
1003520
184576
184832
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.85832
.reloc
1191936
66112
66560
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.79139

Resources

Title
Entropy
Size
Codepage
Language
Type
1
2.95466
1884
Latin 1 / Western European
UNKNOWN
TYPELIB
2
2.88492
744
Latin 1 / Western European
UNKNOWN
RT_ICON
3
2.61243
488
Latin 1 / Western European
UNKNOWN
RT_ICON
4
2.60227
296
Latin 1 / Western European
UNKNOWN
RT_ICON
5
4.35159
3752
Latin 1 / Western European
UNKNOWN
RT_ICON
6
4.11143
2216
Latin 1 / Western European
UNKNOWN
RT_ICON
7
3.49375
1736
Latin 1 / Western European
UNKNOWN
RT_ICON
8
2.49145
1384
Latin 1 / Western European
UNKNOWN
RT_ICON
9
7.91587
17058
Latin 1 / Western European
UNKNOWN
RT_ICON
10
3.43385
9640
Latin 1 / Western European
UNKNOWN
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
CRYPT32.dll
Cabinet.dll
GDI32.dll
KERNEL32.dll
OLEACC.dll
OLEAUT32.dll
PSAPI.DLL
RstrtMgr.DLL
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wlsetup-web.exe wlsetup-web.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1580"C:\Users\admin\AppData\Local\Temp\wlsetup-web.exe" C:\Users\admin\AppData\Local\Temp\wlsetup-web.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Essentials Installer
Exit code:
3221226540
Version:
16.4.3528.0331
Modules
Images
c:\users\admin\appdata\local\temp\wlsetup-web.exe
c:\windows\system32\ntdll.dll
3140"C:\Users\admin\AppData\Local\Temp\wlsetup-web.exe" C:\Users\admin\AppData\Local\Temp\wlsetup-web.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Essentials Installer
Exit code:
0
Version:
16.4.3528.0331
Modules
Images
c:\users\admin\appdata\local\temp\wlsetup-web.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
Total events
12 696
Read events
12 614
Write events
76
Delete events
6

Modification events

(PID) Process:(3140) wlsetup-web.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Live\QoS
Operation:writeName:UMID
Value:
B208E4E7-3AD5-416B-8451-91907DAB4F81
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Live\QoS
Operation:writeName:UUID
Value:
B399C295-FA12-4448-8837-3614CCC34CAA
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
2
Suspicious files
10
Text files
10
Unknown types
4

Dropped files

PID
Process
Filename
Type
3140wlsetup-web.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:—
SHA256:—
3140wlsetup-web.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:—
SHA256:—
3140wlsetup-web.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\LB63GW5F.txttext
MD5:—
SHA256:—
3140wlsetup-web.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\VFP7VGNA.txttext
MD5:—
SHA256:—
3140wlsetup-web.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3140wlsetup-web.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\nb-no[1].htmhtml
MD5:—
SHA256:—
3140wlsetup-web.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\3YNFXOFJ.txttext
MD5:—
SHA256:—
3140wlsetup-web.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\J69YQGMK.txttext
MD5:—
SHA256:—
3140wlsetup-web.exeC:\Users\admin\AppData\Local\Temp\01190432-00000c44-keqcow8zd8\tmpF40B.tmpexecutable
MD5:B3695953F17EB4EF1C67422007304546
SHA256:650B8D8737E5565709C740508B41B187720EAA32EDD12F8B66BACC27F2270953
3140wlsetup-web.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177der
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
13
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
868
svchost.exe
HEAD
302
20.223.237.241:80
http://g.live.com/1rewlive5cat/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.35.228.223:80
http://download.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
20.223.237.241:80
http://g.live.com/1rewlive5cat/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.48.23.21:80
http://wl.dlservice.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.35.228.223:80
http://download.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
20.223.237.241:80
http://g.live.com/1rewlive5cat/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.48.23.21:80
http://wl.dlservice.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.35.228.223:80
http://download.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
20.223.237.241:80
http://g.live.com/1rewlive5cat/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.48.23.21:80
http://wl.dlservice.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3140
wlsetup-web.exe
20.223.237.241:80
g.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3140
wlsetup-web.exe
204.79.197.203:80
www.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious
3140
wlsetup-web.exe
204.79.197.203:443
www.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious
3140
wlsetup-web.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
868
svchost.exe
20.223.237.241:80
g.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
868
svchost.exe
23.48.23.21:80
wl.dlservice.microsoft.com
Akamai International B.V.
DE
suspicious
868
svchost.exe
23.35.228.223:80
download.microsoft.com
AKAMAI-AS
DE
malicious
868
svchost.exe
23.35.228.223:443
download.microsoft.com
AKAMAI-AS
DE
malicious
3140
wlsetup-web.exe
23.35.228.223:80
download.microsoft.com
AKAMAI-AS
DE
malicious
3140
wlsetup-web.exe
23.35.228.223:443
download.microsoft.com
AKAMAI-AS
DE
malicious

DNS requests

Domain
IP
Reputation
g.live.com
  • 20.223.237.241
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
wl.dlservice.microsoft.com
  • 23.48.23.21
  • 23.48.23.7
whitelisted
download.microsoft.com
  • 23.35.228.223
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
wlsetup-web.exe