| File name: | CamManager_setupV1.09.exe |
| Full analysis: | https://app.any.run/tasks/bb989581-cbd8-4905-bd18-8c04414e1e45 |
| Verdict: | Malicious activity |
| Analysis date: | March 31, 2021, 07:57:27 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | CA0BBEB088307B6E61F71D369B05D782 |
| SHA1: | FE614FE54B4C0144D99C2771DF4291074D5C0E02 |
| SHA256: | 7E23A4A72FC65A5F723EDDB91C70E6FA3C6D33CDB13CA6997B9F9A66F3D82D52 |
| SSDEEP: | 393216:6dmYLSvwN0RrzhYfIFUWRXgdgjZzIgL0XL:6vLGa0RHhlJgwvQb |
MALICIOUS
Loads dropped or rewritten executable
- CamManager_setupV1.09.exe (PID: 3548)
- HRecord.exe (PID: 2784)
Drops executable file immediately after starts
- DIRECT~1.tmp (PID: 3820)
- rundll32.exe (PID: 2208)
- DrvInst.exe (PID: 3952)
Application was dropped or rewritten from another process
- DIRECT~1.EXE (PID: 2076)
- Setup.exe (PID: 2580)
- HRecord.exe (PID: 2784)
Actions looks like stealing of personal data
- vcredist_x86.exe (PID: 2448)
SUSPICIOUS
Executable content was dropped or overwritten
- CamManager_setupV1.09.exe (PID: 3548)
- rundll32.exe (PID: 2208)
- DIRECT~1.EXE (PID: 2076)
- DIRECT~1.tmp (PID: 3820)
- DrvInst.exe (PID: 3952)
- vcredist_x86.exe (PID: 2448)
Drops a file with too old compile date
- DIRECT~1.tmp (PID: 3820)
- CamManager_setupV1.09.exe (PID: 3548)
- DIRECT~1.EXE (PID: 2076)
- vcredist_x86.exe (PID: 2448)
Removes files from Windows directory
- CamManager_setupV1.09.exe (PID: 3548)
- DrvInst.exe (PID: 3952)
Creates a directory in Program Files
- CamManager_setupV1.09.exe (PID: 3548)
- DIRECT~1.tmp (PID: 3820)
Uses RUNDLL32.EXE to load library
- DIRECT~1.tmp (PID: 3820)
- DrvInst.exe (PID: 3952)
Drops a file that was compiled in debug mode
- rundll32.exe (PID: 2208)
- DIRECT~1.tmp (PID: 3820)
- CamManager_setupV1.09.exe (PID: 3548)
- DrvInst.exe (PID: 3952)
- vcredist_x86.exe (PID: 2448)
Creates a software uninstall entry
- CamManager_setupV1.09.exe (PID: 3548)
Drops a file with a compile date too recent
- DIRECT~1.tmp (PID: 3820)
- DrvInst.exe (PID: 3952)
Creates files in the program directory
- CamManager_setupV1.09.exe (PID: 3548)
Creates files in the Windows directory
- CamManager_setupV1.09.exe (PID: 3548)
- DrvInst.exe (PID: 3952)
Creates files in the driver directory
- DrvInst.exe (PID: 3952)
Executed via COM
- DrvInst.exe (PID: 3952)
INFO
Creates files in the program directory
- DIRECT~1.tmp (PID: 3820)
Application was dropped or rewritten from another process
- DIRECT~1.tmp (PID: 3820)
- vcredist_x86.exe (PID: 2448)
Creates a software uninstall entry
- DIRECT~1.tmp (PID: 3820)
Loads dropped or rewritten executable
- DIRECT~1.tmp (PID: 3820)
Searches for installed software
- DrvInst.exe (PID: 3952)
Manual execution by user
- HRecord.exe (PID: 2784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Wise Installer executable (91.7) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (5.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (1.2) |
| .exe | | | Win32 Executable (generic) (0.8) |
| .exe | | | Generic Win/DOS Executable (0.3) |
EXIF
EXE
| LegalCopyright: | WwW.YlmF.CoM |
|---|---|
| FileVersion: | Cam Manager |
| FileDescription: | Cam Manager |
| CompanyName: | WwW.YlmF.CoM |
| CharacterSet: | Windows, Latin1 |
| LanguageCode: | English (U.S.) |
| FileSubtype: | - |
| ObjectFileType: | Executable application |
| FileOS: | Windows 16-bit |
| FileFlags: | (none) |
| FileFlagsMask: | 0x003f |
| ProductVersionNumber: | 0.4455.0.0 |
| FileVersionNumber: | 0.4455.0.0 |
| Subsystem: | Windows GUI |
| SubsystemVersion: | 4 |
| ImageVersion: | 4 |
| OSVersion: | 4 |
| EntryPoint: | 0x21af |
| UninitializedDataSize: | - |
| InitializedDataSize: | 5632 |
| CodeSize: | 8704 |
| LinkerVersion: | 6 |
| PEType: | PE32 |
| TimeStamp: | 2001:10:25 21:47:11+02:00 |
| MachineType: | Intel 386 or later, and compatibles |
Total processes
49
Monitored processes
10
Malicious processes
5
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 976 | rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{055caab7-2bbd-59e1-3c9f-cf633d96fd22} Global\{6bbf433b-0cd2-3f5c-7834-2b6b8e2f400a} C:\Windows\System32\DriverStore\Temp\{3b6efd20-9984-167d-2377-747a603a8c4b}\Ambarella_Evaluation_Board_1.2.3.0.inf C:\Windows\System32\DriverStore\Temp\{3b6efd20-9984-167d-2377-747a603a8c4b}\Ambarella_Evaluation_Board_1.2.3.0.cat | C:\Windows\system32\rundll32.exe | — | DrvInst.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2076 | "C:\PROGRA~1\CAMMAN~1\DIRECT~1.EXE" | C:\PROGRA~1\CAMMAN~1\DIRECT~1.EXE | CamManager_setupV1.09.exe | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: DirectUSB Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 2208 | "rundll32" libusb0.dll,usb_install_driver_np_rundll .\Driver\Ambarella_Evaluation_Board_1.2.3.0.inf | C:\Windows\system32\rundll32.exe | DIRECT~1.tmp | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows host process (Rundll32) Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2448 | "C:\Users\admin\AppData\Local\Temp\is-97M6A.tmp\vcredist_x86.exe" /q | C:\Users\admin\AppData\Local\Temp\is-97M6A.tmp\vcredist_x86.exe | DIRECT~1.tmp | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft Visual C++ 2010 x86 Redistributable Setup Exit code: 5100 Version: 10.0.30319.01 Modules
| |||||||||||||||
| 2560 | "C:\Users\admin\AppData\Local\Temp\CamManager_setupV1.09.exe" | C:\Users\admin\AppData\Local\Temp\CamManager_setupV1.09.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221226540 Modules
| |||||||||||||||
| 2580 | c:\a5dfeb43a4c857962672b4e68727\Setup.exe /q | c:\a5dfeb43a4c857962672b4e68727\Setup.exe | — | vcredist_x86.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Setup Installer Exit code: 5100 Version: 10.0.30319.1 built by: RTMRel Modules
| |||||||||||||||
| 2784 | "C:\Program Files\Cam Manager\HRecord.exe" | C:\Program Files\Cam Manager\HRecord.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3548 | "C:\Users\admin\AppData\Local\Temp\CamManager_setupV1.09.exe" | C:\Users\admin\AppData\Local\Temp\CamManager_setupV1.09.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 3820 | "C:\Users\admin\AppData\Local\Temp\is-DEPVA.tmp\DIRECT~1.tmp" /SL5="$40160,12708337,54272,C:\PROGRA~1\CAMMAN~1\DIRECT~1.EXE" | C:\Users\admin\AppData\Local\Temp\is-DEPVA.tmp\DIRECT~1.tmp | DIRECT~1.EXE | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.52.0.0 Modules
| |||||||||||||||
| 3952 | DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{5d9ba9df-aac0-0e60-ef2f-7a45a8272d70}\Ambarella_Evaluation_Board_1.2.3.0.inf" "0" "60e296b5b" "00000498" "WinSta0\Default" "0000054C" "208" "C:\Program Files\Ambarella\DirectUSB II\Driver" | C:\Windows\system32\DrvInst.exe | svchost.exe | ||||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Driver Installation Module Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
480
Read events
403
Write events
77
Delete events
0
Modification events
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cam Manager |
| Operation: | write | Name: | DisplayName |
Value: Cam Manager | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Cam Manager |
| Operation: | write | Name: | UninstallString |
Value: C:\PROGRA~1\CAMMAN~1\UNWISE.EXE C:\PROGRA~1\CAMMAN~1\INSTALL.LOG | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wise Solutions\Wise Installation System\Repair\C:/Program Files/Cam Manager/INSTALL.LOG\Icons\1 |
| Operation: | write | Name: | Path |
Value: C:\PROGRA~1\CAMMAN~1\HRecord.exe | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wise Solutions\Wise Installation System\Repair\C:/Program Files/Cam Manager/INSTALL.LOG\Icons\1 |
| Operation: | write | Name: | ShowWindow |
Value: 1 | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wise Solutions\Wise Installation System\Repair\C:/Program Files/Cam Manager/INSTALL.LOG\Icons\1 |
| Operation: | write | Name: | Arguments |
Value: | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wise Solutions\Wise Installation System\Repair\C:/Program Files/Cam Manager/INSTALL.LOG\Icons\1 |
| Operation: | write | Name: | WorkingDir |
Value: | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wise Solutions\Wise Installation System\Repair\C:/Program Files/Cam Manager/INSTALL.LOG\Icons\2 |
| Operation: | write | Name: | Path |
Value: C:\PROGRA~1\CAMMAN~1\Unwise.exe | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wise Solutions\Wise Installation System\Repair\C:/Program Files/Cam Manager/INSTALL.LOG\Icons\2 |
| Operation: | write | Name: | ShowWindow |
Value: 1 | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wise Solutions\Wise Installation System\Repair\C:/Program Files/Cam Manager/INSTALL.LOG\Icons\2 |
| Operation: | write | Name: | Arguments |
Value: | |||
| (PID) Process: | (3548) CamManager_setupV1.09.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Wise Solutions\Wise Installation System\Repair\C:/Program Files/Cam Manager/INSTALL.LOG\Icons\2 |
| Operation: | write | Name: | WorkingDir |
Value: | |||
Executable files
43
Suspicious files
25
Text files
99
Unknown types
18
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3548 | CamManager_setupV1.09.exe | C:\Users\admin\AppData\Local\Temp\~GLH0000.TMP | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\Program Files\Cam Manager\~GLH0001.TMP | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\Program Files\Cam Manager\~GLH0002.TMP | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\Program Files\Cam Manager\temp.000 | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\PROGRA~1\CAMMAN~1\~GLH0003.TMP | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\Program Files\Cam Manager\~GLH0004.TMP | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\Program Files\Cam Manager\~GLH0005.TMP | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\PROGRA~1\CAMMAN~1\~GLH0006.TMP | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\Program Files\Cam Manager\~GLH0007.TMP | — | |
MD5:— | SHA256:— | |||
| 3548 | CamManager_setupV1.09.exe | C:\Program Files\Cam Manager\~GLH0008.TMP | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report