File name:

wlsetup-web.exe

Full analysis: https://app.any.run/tasks/2872bc20-e4d0-4bcd-883e-2adea835281b
Verdict: Malicious activity
Analysis date: January 19, 2023, 04:32:46
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8423B539D6DCECF2D710C210F01D6C6A

SHA1:

24BCEF46EA3ED47158C72A753F6B1B6005468879

SHA256:

7D9C68B11E45A763FACC7577A51C8C00B7FB654B9BA044DEB223E7140A2EFE50

SSDEEP:

24576:nnz7O4ILdA9KHjStCd8Xxpqo01fgBOV2o+b5r7t:zfIIKCBBpN0eO2o+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • wlsetup-web.exe (PID: 3140)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • wlsetup-web.exe (PID: 3140)

    • Reads the Internet Settings

      • wlsetup-web.exe (PID: 3140)

    • Reads settings of System Certificates

      • wlsetup-web.exe (PID: 3140)

    • Executable content was dropped or overwritten

      • wlsetup-web.exe (PID: 3140)

    • Checks Windows Trust Settings

      • wlsetup-web.exe (PID: 3140)

  • INFO

    • Checks supported languages

      • wlsetup-web.exe (PID: 3140)

    • Drops a file that was compiled in debug mode

      • wlsetup-web.exe (PID: 3140)

    • Reads the machine GUID from the registry

      • wlsetup-web.exe (PID: 3140)

    • The process checks LSA protection

      • wlsetup-web.exe (PID: 3140)

    • Reads the computer name

      • wlsetup-web.exe (PID: 3140)

    • Create files in a temporary directory

      • wlsetup-web.exe (PID: 3140)

    • Creates files in the program directory

      • wlsetup-web.exe (PID: 3140)

    • Checks proxy server information

      • wlsetup-web.exe (PID: 3140)

    • Creates files or folders in the user directory

      • wlsetup-web.exe (PID: 3140)

    • Dropped object may contain Bitcoin addresses

      • wlsetup-web.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (54.3)
.exe | Win64 Executable (generic) (34.8)
.exe | Win32 Executable (generic) (5.6)
.exe | Generic Win/DOS Executable (2.5)
.exe | DOS Executable Generic (2.5)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2014-Apr-01 04:27:13
Debug artifacts:
  • wlsetup.pdb
CompanyName: Microsoft Corporation
FileDescription: Windows Essentials Installer
InternalName: wlsres
LegalCopyright: © Microsoft Corporation. Reservados todos los derechos.
OriginalFilename: wlsres.dll.mui
ProductName: Windows Essentials
FileVersion: 16.4.3528.0331
ProductVersion: 16.4.3528.0331

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 264

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 4
TimeDateStamp: 2014-Apr-01 04:27:13
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
947128
947200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.33348
.data
954368
46008
26624
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.10382
.rsrc
1003520
184576
184832
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.85832
.reloc
1191936
66112
66560
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.79139

Resources

Title
Entropy
Size
Codepage
Language
Type
1
2.95466
1884
Latin 1 / Western European
UNKNOWN
TYPELIB
2
2.88492
744
Latin 1 / Western European
UNKNOWN
RT_ICON
3
2.61243
488
Latin 1 / Western European
UNKNOWN
RT_ICON
4
2.60227
296
Latin 1 / Western European
UNKNOWN
RT_ICON
5
4.35159
3752
Latin 1 / Western European
UNKNOWN
RT_ICON
6
4.11143
2216
Latin 1 / Western European
UNKNOWN
RT_ICON
7
3.49375
1736
Latin 1 / Western European
UNKNOWN
RT_ICON
8
2.49145
1384
Latin 1 / Western European
UNKNOWN
RT_ICON
9
7.91587
17058
Latin 1 / Western European
UNKNOWN
RT_ICON
10
3.43385
9640
Latin 1 / Western European
UNKNOWN
RT_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
CRYPT32.dll
Cabinet.dll
GDI32.dll
KERNEL32.dll
OLEACC.dll
OLEAUT32.dll
PSAPI.DLL
RstrtMgr.DLL
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wlsetup-web.exe wlsetup-web.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1580"C:\Users\admin\AppData\Local\Temp\wlsetup-web.exe" C:\Users\admin\AppData\Local\Temp\wlsetup-web.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Essentials Installer
Exit code:
3221226540
Version:
16.4.3528.0331
Modules
Images
c:\users\admin\appdata\local\temp\wlsetup-web.exe
c:\windows\system32\ntdll.dll
3140"C:\Users\admin\AppData\Local\Temp\wlsetup-web.exe" C:\Users\admin\AppData\Local\Temp\wlsetup-web.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Essentials Installer
Exit code:
0
Version:
16.4.3528.0331
Modules
Images
c:\users\admin\appdata\local\temp\wlsetup-web.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
Total events
12 696
Read events
12 614
Write events
76
Delete events
6

Modification events

(PID) Process:(3140) wlsetup-web.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Live\QoS
Operation:writeName:UMID
Value:
B208E4E7-3AD5-416B-8451-91907DAB4F81
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Live\QoS
Operation:writeName:UUID
Value:
B399C295-FA12-4448-8837-3614CCC34CAA
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3140) wlsetup-web.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
2
Suspicious files
10
Text files
10
Unknown types
4

Dropped files

PID
Process
Filename
Type
3140wlsetup-web.exeC:\Users\admin\AppData\Local\Temp\01190432-00000c44-keqcow8zd8\tmpF34E.tmpcompressed
MD5:8274C233094AB59F40135619F32848CC
SHA256:AC1A5B92FC478ED69AEC3D94C6C0BA328789BB4E44A9C56598A4F961EDFCB09C
3140wlsetup-web.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:1C1CFFED01C733E05628CDF9411803DE
SHA256:CE92D7574358CC94EEB9634D30D8621850B995FC4B2666A4B507F89E4A9D0450
3140wlsetup-web.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\3YNFXOFJ.txttext
MD5:1B25A041D4ACAA94F4A58957F40E5A78
SHA256:4FD4AFB4BECF40E953225CF490C609FFD01FDBA7CD40C22CBF44D6AACFAF6E06
3140wlsetup-web.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\J69YQGMK.txttext
MD5:9A5B683E6D8A1D3652AA6FD0A7FAB3E9
SHA256:65B0251ECA906C5F526F288E9E4AF338EE80EB3B09239485702F74A396EC0F3D
3140wlsetup-web.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\VFP7VGNA.txttext
MD5:D72B95E7F4E0516240E2C8D8AB5FB756
SHA256:57BF67307C2F1E95110F1E93501A9990D6C67C0872568CFB500007E38362D1EA
3140wlsetup-web.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:F7DCB24540769805E5BB30D193944DCE
SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA
3140wlsetup-web.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:4173F2FDFC94BE2F82A300ADE49CD59E
SHA256:5F7C8EE5BA29429404E9E5F2C83DB13E15F19D35285A943220E0CFA82C8C026E
3140wlsetup-web.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:326CCFE87360FBF3877A66CA5726980B
SHA256:1235F6BB3EF41F97C958211DF52FB8428EDAA98E778F4FF1ED0F6D75C5E8C17C
3140wlsetup-web.exeC:\Users\admin\AppData\Local\Temp\01190432-00000c44-keqcow8zd8\tmpF40B.tmpexecutable
MD5:B3695953F17EB4EF1C67422007304546
SHA256:650B8D8737E5565709C740508B41B187720EAA32EDD12F8B66BACC27F2270953
3140wlsetup-web.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\nb-no[1].htmhtml
MD5:E4675C2655EA8D24F6AD1FFC26C69E2B
SHA256:F56FBF113BDC6E228D1A8DD49FEA0851E75EA3A3CC679561522AE9F73B378A80
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
13
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3140
wlsetup-web.exe
GET
302
204.79.197.203:80
http://www.msn.com/
US
html
143 b
whitelisted
3140
wlsetup-web.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
868
svchost.exe
HEAD
302
20.223.237.241:80
http://g.live.com/1rewlive5cat/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.48.23.21:80
http://wl.dlservice.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.35.228.223:80
http://download.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
20.223.237.241:80
http://g.live.com/1rewlive5cat/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.48.23.21:80
http://wl.dlservice.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
868
svchost.exe
HEAD
302
23.35.228.223:80
http://download.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
3140
wlsetup-web.exe
GET
302
20.223.237.241:80
http://g.live.com/1rewlive5cat/catalog-web.cab
US
—
—
whitelisted
3140
wlsetup-web.exe
GET
302
23.48.23.7:80
http://wl.dlservice.microsoft.com/download/C/1/B/C1BA42D6-6A50-4A4A-90E5-FA9347E9360C/en/catalog-web.cab
US
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3140
wlsetup-web.exe
20.223.237.241:80
g.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3140
wlsetup-web.exe
204.79.197.203:80
www.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious
3140
wlsetup-web.exe
204.79.197.203:443
www.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
malicious
3140
wlsetup-web.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3140
wlsetup-web.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
868
svchost.exe
23.35.228.223:80
download.microsoft.com
AKAMAI-AS
DE
malicious
868
svchost.exe
23.35.228.223:443
download.microsoft.com
AKAMAI-AS
DE
malicious
3140
wlsetup-web.exe
23.48.23.7:80
wl.dlservice.microsoft.com
Akamai International B.V.
DE
suspicious
3140
wlsetup-web.exe
23.35.228.223:80
download.microsoft.com
AKAMAI-AS
DE
malicious
3140
wlsetup-web.exe
23.35.228.223:443
download.microsoft.com
AKAMAI-AS
DE
malicious

DNS requests

Domain
IP
Reputation
g.live.com
  • 20.223.237.241
whitelisted
www.msn.com
  • 204.79.197.203
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
wl.dlservice.microsoft.com
  • 23.48.23.21
  • 23.48.23.7
whitelisted
download.microsoft.com
  • 23.35.228.223
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wlsetup-web.exe