File name:

vcredist_x86.exe

Full analysis: https://app.any.run/tasks/b9c13f70-8381-4d75-9ed3-72b26a1e6d6b
Verdict: Malicious activity
Analysis date: July 17, 2024, 18:07:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B88228D5FEF4B6DC019D69D4471F23EC

SHA1:

372D9C1670343D3FB252209BA210D4DC4D67D358

SHA256:

8162B2D665CA52884507EDE19549E99939CE4EA4A638C537FA653539819138C8

SSDEEP:

98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • vcredist_x86.exe (PID: 5396)
      • msiexec.exe (PID: 6696)

    • Creates a writable file in the system directory

      • msiexec.exe (PID: 6696)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • vcredist_x86.exe (PID: 5396)
      • msiexec.exe (PID: 6696)

    • Starts a Microsoft application from unusual location

      • vcredist_x86.exe (PID: 1328)
      • vcredist_x86.exe (PID: 5396)

    • Executable content was dropped or overwritten

      • vcredist_x86.exe (PID: 5396)

    • Creates file in the systems drive root

      • vcredist_x86.exe (PID: 5396)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 3724)

    • Checks Windows Trust Settings

      • Setup.exe (PID: 3724)
      • msiexec.exe (PID: 6696)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6696)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6696)

  • INFO

    • Checks supported languages

      • vcredist_x86.exe (PID: 5396)
      • Setup.exe (PID: 3724)
      • msiexec.exe (PID: 6696)

    • Reads the computer name

      • vcredist_x86.exe (PID: 5396)
      • Setup.exe (PID: 3724)
      • msiexec.exe (PID: 6696)

    • Reads the machine GUID from the registry

      • vcredist_x86.exe (PID: 5396)
      • Setup.exe (PID: 3724)
      • msiexec.exe (PID: 6696)

    • Reads CPU info

      • Setup.exe (PID: 3724)

    • Create files in a temporary directory

      • Setup.exe (PID: 3724)

    • Reads the software policy settings

      • Setup.exe (PID: 3724)
      • msiexec.exe (PID: 6696)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6696)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6696)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (80.1)
.exe | Win32 Executable MS Visual C++ (generic) (7.1)
.exe | Win64 Executable (generic) (6.3)
.scr | Windows screen saver (2.9)
.dll | Win32 Dynamic Link Library (generic) (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:12:21 07:26:24+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 7.1
CodeSize: 34304
InitializedDataSize: 6656
UninitializedDataSize: -
EntryPoint: 0x63ff
OSVersion: 5.2
ImageVersion: 5.2
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 10.0.30319.1
ProductVersionNumber: 10.0.30319.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Visual C++ 2010 x86 Redistributable Setup
FileVersion: 10.0.30319.01
InternalName: vcredist_x86.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: vcredist_x86.exe
ProductName: Microsoft Visual C++ 2010 x86 Redistributable
ProductVersion: 10.0.30319.01
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vcredist_x86.exe setup.exe msiexec.exe vcredist_x86.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1328"C:\Users\admin\AppData\Local\Temp\vcredist_x86.exe" C:\Users\admin\AppData\Local\Temp\vcredist_x86.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Visual C++ 2010 x86 Redistributable Setup
Exit code:
3221226540
Version:
10.0.30319.01
Modules
Images
c:\users\admin\appdata\local\temp\vcredist_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3724c:\f931870723e7da354fd7\Setup.exe C:\f931870723e7da354fd7\Setup.exe
vcredist_x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
0
Version:
10.0.30319.1 built by: RTMRel
Modules
Images
c:\f931870723e7da354fd7\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5396"C:\Users\admin\AppData\Local\Temp\vcredist_x86.exe" C:\Users\admin\AppData\Local\Temp\vcredist_x86.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2010 x86 Redistributable Setup
Exit code:
0
Version:
10.0.30319.01
Modules
Images
c:\users\admin\appdata\local\temp\vcredist_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6696C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
9 299
Read events
9 110
Write events
180
Delete events
9

Modification events

(PID) Process:(6696) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
281A000003BC934F74D8DA01
(PID) Process:(6696) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
9EBFE8E1247E897F71905A90F8AFBCBD631FE184BC3F06446CFDB915A19FCE7F
(PID) Process:(6696) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:c:\Config.Msi\
Value:
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:c:\Config.Msi\1d2678.rbs
Value:
31119476
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:c:\Config.Msi\1d2678.rbsLow
Value:
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7E4C35488E6280433B4A9504AC59CB06
Operation:writeName:D04BB691875110D32B98EBCF771AA1E1
Value:
02:\SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x86\Version
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\48DB41415A9D5EE3AA3711D8C7703207
Operation:writeName:D04BB691875110D32B98EBCF771AA1E1
Value:
02:\SOFTWARE\Microsoft\DevDiv\vc\Servicing\10.0\red\x86\1033\Install
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll
Value:
1
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\33964F2EF4FF0E649B796FD4C2D6F41A
Operation:writeName:D04BB691875110D32B98EBCF771AA1E1
Value:
c:\?Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll
Executable files
36
Suspicious files
20
Text files
50
Unknown types
0

Dropped files

PID
Process
Filename
Type
5396vcredist_x86.exeC:\f931870723e7da354fd7\1033\SetupResources.dllexecutable
MD5:9547D24AC04B4D0D1DBF84F74F54FAF7
SHA256:36D0159ED1A7D88000737E920375868765C0A1DD6F5A5ACBB79CF7D97D9E7A34
5396vcredist_x86.exeC:\f931870723e7da354fd7\1041\eula.rtftext
MD5:89D66A0B94450729015D021BC8F859E9
SHA256:6A1884515CC4378D732F681934658252A4B45D76CE7F53CF8650BE794CC8D390
5396vcredist_x86.exeC:\f931870723e7da354fd7\Setup.exeexecutable
MD5:006F8A615020A4A17F5E63801485DF46
SHA256:D273460AA4D42F0B5764383E2AB852AB9AF6FECB3ED866F1783869F2F155D8BE
5396vcredist_x86.exeC:\f931870723e7da354fd7\DisplayIcon.icoimage
MD5:F9657D290048E169FFABBBB9C7412BE0
SHA256:B74AD253B9B8F9FCADE725336509143828EE739CC2B24782BE3ECFF26F229160
5396vcredist_x86.exeC:\f931870723e7da354fd7\header.bmpimage
MD5:3AD1A8C3B96993BCDF45244BE2C00EEF
SHA256:133B86A4F1C67A159167489FDAEAB765BFA1050C23A7AE6D5C517188FB45F94A
5396vcredist_x86.exeC:\f931870723e7da354fd7\SetupEngine.dllexecutable
MD5:84C1DAF5F30FF99895ECAB3A55354BCF
SHA256:7A0D281FA802D615EA1207BD2E9EBB98F3B74F9833BBA3CB964BA7C7E0FB67FD
5396vcredist_x86.exeC:\f931870723e7da354fd7\SetupUi.xsdxml
MD5:2FADD9E618EFF8175F2A6E8B95C0CACC
SHA256:222211E8F512EDF97D78BC93E1F271C922D5E91FA899E092B4A096776A704093
5396vcredist_x86.exeC:\f931870723e7da354fd7\SplashScreen.bmpimage
MD5:43B254D97B4FB6F9974AD3F935762C55
SHA256:91A21EBA9F5E1674919EE3B36EFA99714CFB919491423D888CB56C0F25845969
5396vcredist_x86.exeC:\f931870723e7da354fd7\watermark.bmpimage
MD5:1A5CAAFACFC8C7766E404D019249CF67
SHA256:2E87D5742413254DB10F7BD0762B6CDB98FF9C46CA9ACDDFD9B1C2E5418638F2
5396vcredist_x86.exeC:\f931870723e7da354fd7\sqmapi.dllexecutable
MD5:3F0363B40376047EFF6A9B97D633B750
SHA256:BD6395A58F55A8B1F4063E813CE7438F695B9B086BB965D8AC44E7A97D35A93C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
45
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6696
msiexec.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/CSPCA.crl
unknown
—
—
whitelisted
6064
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2104
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2032
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2032
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
368
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
188
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2032
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4656
SearchApp.exe
184.86.251.22:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6064
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6064
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.4
  • 184.86.251.28
  • 184.86.251.26
  • 184.86.251.30
  • 184.86.251.25
  • 184.86.251.29
  • 184.86.251.19
  • 184.86.251.18
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.22
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.134
  • 20.190.160.20
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted

Threats

No threats detected
Process
Message
Setup.exe
The operation completed successfully.
Setup.exe
The operation completed successfully.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vcredist_x86.exe