File name:

vcredist_x86.exe

Full analysis: https://app.any.run/tasks/b9c13f70-8381-4d75-9ed3-72b26a1e6d6b
Verdict: Malicious activity
Analysis date: July 17, 2024, 18:07:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B88228D5FEF4B6DC019D69D4471F23EC

SHA1:

372D9C1670343D3FB252209BA210D4DC4D67D358

SHA256:

8162B2D665CA52884507EDE19549E99939CE4EA4A638C537FA653539819138C8

SSDEEP:

98304:RuLgywiN1ah6HcG0UJrN7SDgndrHZDMeaNNjt0CKKBgY2r71pZ/APaOR72HgQo0z:I7wq1W6HqULS8djZDTaNNeCKVP5ORsg0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • vcredist_x86.exe (PID: 5396)
      • msiexec.exe (PID: 6696)

    • Creates a writable file in the system directory

      • msiexec.exe (PID: 6696)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • vcredist_x86.exe (PID: 5396)

    • Starts a Microsoft application from unusual location

      • vcredist_x86.exe (PID: 5396)
      • vcredist_x86.exe (PID: 1328)

    • Creates file in the systems drive root

      • vcredist_x86.exe (PID: 5396)

    • Process drops legitimate windows executable

      • vcredist_x86.exe (PID: 5396)
      • msiexec.exe (PID: 6696)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 3724)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6696)
      • Setup.exe (PID: 3724)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6696)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 6696)

  • INFO

    • Checks supported languages

      • vcredist_x86.exe (PID: 5396)
      • msiexec.exe (PID: 6696)
      • Setup.exe (PID: 3724)

    • Reads the computer name

      • Setup.exe (PID: 3724)
      • vcredist_x86.exe (PID: 5396)
      • msiexec.exe (PID: 6696)

    • Reads CPU info

      • Setup.exe (PID: 3724)

    • Reads the machine GUID from the registry

      • Setup.exe (PID: 3724)
      • vcredist_x86.exe (PID: 5396)
      • msiexec.exe (PID: 6696)

    • Create files in a temporary directory

      • Setup.exe (PID: 3724)

    • Reads the software policy settings

      • Setup.exe (PID: 3724)
      • msiexec.exe (PID: 6696)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6696)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6696)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (80.1)
.exe | Win32 Executable MS Visual C++ (generic) (7.1)
.exe | Win64 Executable (generic) (6.3)
.scr | Windows screen saver (2.9)
.dll | Win32 Dynamic Link Library (generic) (1.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:12:21 07:26:24+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 7.1
CodeSize: 34304
InitializedDataSize: 6656
UninitializedDataSize: -
EntryPoint: 0x63ff
OSVersion: 5.2
ImageVersion: 5.2
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 10.0.30319.1
ProductVersionNumber: 10.0.30319.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Visual C++ 2010 x86 Redistributable Setup
FileVersion: 10.0.30319.01
InternalName: vcredist_x86.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: vcredist_x86.exe
ProductName: Microsoft Visual C++ 2010 x86 Redistributable
ProductVersion: 10.0.30319.01
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vcredist_x86.exe setup.exe msiexec.exe vcredist_x86.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1328"C:\Users\admin\AppData\Local\Temp\vcredist_x86.exe" C:\Users\admin\AppData\Local\Temp\vcredist_x86.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Visual C++ 2010 x86 Redistributable Setup
Exit code:
3221226540
Version:
10.0.30319.01
Modules
Images
c:\users\admin\appdata\local\temp\vcredist_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3724c:\f931870723e7da354fd7\Setup.exe C:\f931870723e7da354fd7\Setup.exe
vcredist_x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
0
Version:
10.0.30319.1 built by: RTMRel
Modules
Images
c:\f931870723e7da354fd7\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5396"C:\Users\admin\AppData\Local\Temp\vcredist_x86.exe" C:\Users\admin\AppData\Local\Temp\vcredist_x86.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2010 x86 Redistributable Setup
Exit code:
0
Version:
10.0.30319.01
Modules
Images
c:\users\admin\appdata\local\temp\vcredist_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6696C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
9 299
Read events
9 110
Write events
180
Delete events
9

Modification events

(PID) Process:(6696) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
281A000003BC934F74D8DA01
(PID) Process:(6696) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
9EBFE8E1247E897F71905A90F8AFBCBD631FE184BC3F06446CFDB915A19FCE7F
(PID) Process:(6696) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:c:\Config.Msi\
Value:
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:c:\Config.Msi\1d2678.rbs
Value:
31119476
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:c:\Config.Msi\1d2678.rbsLow
Value:
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7E4C35488E6280433B4A9504AC59CB06
Operation:writeName:D04BB691875110D32B98EBCF771AA1E1
Value:
02:\SOFTWARE\Microsoft\VisualStudio\10.0\VC\VCRedist\x86\Version
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\48DB41415A9D5EE3AA3711D8C7703207
Operation:writeName:D04BB691875110D32B98EBCF771AA1E1
Value:
02:\SOFTWARE\Microsoft\DevDiv\vc\Servicing\10.0\red\x86\1033\Install
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\SharedDlls
Operation:writeName:c:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll
Value:
1
(PID) Process:(6696) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\33964F2EF4FF0E649B796FD4C2D6F41A
Operation:writeName:D04BB691875110D32B98EBCF771AA1E1
Value:
c:\?Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll
Executable files
36
Suspicious files
20
Text files
50
Unknown types
0

Dropped files

PID
Process
Filename
Type
5396vcredist_x86.exeC:\f931870723e7da354fd7\header.bmpimage
MD5:3AD1A8C3B96993BCDF45244BE2C00EEF
SHA256:133B86A4F1C67A159167489FDAEAB765BFA1050C23A7AE6D5C517188FB45F94A
5396vcredist_x86.exeC:\f931870723e7da354fd7\Strings.xmlxml
MD5:332ADF643747297B9BFA9527EAEFE084
SHA256:E49545FEEAE22198728AD04236E31E02035AF7CC4D68E10CBECFFD08669CBECA
5396vcredist_x86.exeC:\f931870723e7da354fd7\ParameterInfo.xmlxml
MD5:66590F13F4C9BA563A9180BDF25A5B80
SHA256:BF787B8C697CE418F9D4C07260F56D1145CA70DB1CC4B1321D37840837621E8F
5396vcredist_x86.exeC:\f931870723e7da354fd7\1041\eula.rtftext
MD5:89D66A0B94450729015D021BC8F859E9
SHA256:6A1884515CC4378D732F681934658252A4B45D76CE7F53CF8650BE794CC8D390
5396vcredist_x86.exeC:\f931870723e7da354fd7\1041\SetupResources.dllexecutable
MD5:278FD7595B580A016705D00BE363612F
SHA256:B3ECD3AEA74D0D97539C4971C69F87C4B5FE478FC42A4A31F7E1593D1EBA073F
5396vcredist_x86.exeC:\f931870723e7da354fd7\UiInfo.xmlxml
MD5:812F8D2E53F076366FA3A214BB4CF558
SHA256:0D36A884A8381778BEA71F5F9F0FC60CACADEBD3F814679CB13414B8E7DBC283
5396vcredist_x86.exeC:\f931870723e7da354fd7\sqmapi.dllexecutable
MD5:3F0363B40376047EFF6A9B97D633B750
SHA256:BD6395A58F55A8B1F4063E813CE7438F695B9B086BB965D8AC44E7A97D35A93C
5396vcredist_x86.exeC:\f931870723e7da354fd7\SplashScreen.bmpimage
MD5:43B254D97B4FB6F9974AD3F935762C55
SHA256:91A21EBA9F5E1674919EE3B36EFA99714CFB919491423D888CB56C0F25845969
5396vcredist_x86.exeC:\f931870723e7da354fd7\SetupUi.dllexecutable
MD5:EB881E3DDDC84B20BD92ABCEC444455F
SHA256:11565D97287C01D22AD2E46C78D8A822FA3E6524561D4C02DFC87E8D346C44E7
5396vcredist_x86.exeC:\f931870723e7da354fd7\1033\eula.rtftext
MD5:19D028345AADCC05697EEC6D8C5B5874
SHA256:F4FF4EACE31B75176A0806E1693041D546D2599AEC0C77D295BAD09CAC7D9FE7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
45
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6064
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2032
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6696
msiexec.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/CSPCA.crl
unknown
—
—
whitelisted
2032
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7064
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
368
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
188
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2032
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4656
SearchApp.exe
184.86.251.22:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6064
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6064
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 184.86.251.22
  • 184.86.251.4
  • 184.86.251.28
  • 184.86.251.26
  • 184.86.251.30
  • 184.86.251.25
  • 184.86.251.29
  • 184.86.251.19
  • 184.86.251.18
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.22
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.134
  • 20.190.160.20
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.48
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted

Threats

No threats detected
Process
Message
Setup.exe
The operation completed successfully.
Setup.exe
The operation completed successfully.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vcredist_x86.exe