File name:

driver_web_installer.exe

Full analysis: https://app.any.run/tasks/dfa4e3dc-eb0d-4a1e-9365-cdaa0d1f5d12
Verdict: Malicious activity
Analysis date: April 29, 2025, 09:50:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

F025C4DEF915CB2E5449CB5DFB2ACEF5

SHA1:

CFC65DB69DB3B32254C2C7F545C8AE5FD9A627ED

SHA256:

8282DF7DC7ECD6AE7689B89E6BA091F0F266622B1907D95F61D6B5B3DEA0F050

SSDEEP:

98304:zyjdEa2NQMIWK9evl0KYoyXvy9KPsvXcrojGDeHL427xhUVdYM9qem97kdsoBckf:w9ld0Kmm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • ISBEW64.exe (PID: 4920)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • driver_web_installer.exe (PID: 7148)
      • _isB9AD.exe (PID: 4652)

    • Reads security settings of Internet Explorer

      • _isB9AD.exe (PID: 4652)

    • Starts itself from another location

      • driver_web_installer.exe (PID: 7148)

    • Application launched itself

      • _isB9AD.exe (PID: 4652)

    • There is functionality for taking screenshot (YARA)

      • _isB9AD.exe (PID: 4652)

  • INFO

    • The sample compiled with english language support

      • driver_web_installer.exe (PID: 7148)
      • _isB9AD.exe (PID: 4652)

    • Reads the computer name

      • driver_web_installer.exe (PID: 7148)
      • _isB9AD.exe (PID: 4652)
      • driver_web_installer.exe (PID: 4448)
      • ISBEW64.exe (PID: 4920)
      • _isB9AD.exe (PID: 1164)

    • Create files in a temporary directory

      • driver_web_installer.exe (PID: 7148)
      • _isB9AD.exe (PID: 4652)

    • Checks supported languages

      • driver_web_installer.exe (PID: 7148)
      • _isB9AD.exe (PID: 4652)
      • driver_web_installer.exe (PID: 4448)
      • _isB9AD.exe (PID: 1164)
      • ISBEW64.exe (PID: 4920)

    • Process checks computer location settings

      • _isB9AD.exe (PID: 4652)

    • Creates files in the program directory

      • driver_web_installer.exe (PID: 4448)

    • Checks proxy server information

      • driver_web_installer.exe (PID: 4448)
      • slui.exe (PID: 5084)

    • Reads the software policy settings

      • slui.exe (PID: 6988)
      • slui.exe (PID: 5084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (17.3)
.dll | Win32 Dynamic Link Library (generic) (4.1)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:07:27 12:52:21+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 868352
InitializedDataSize: 619008
UninitializedDataSize: -
EntryPoint: 0xa098e
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.32.0.0
ProductVersionNumber: 2.32.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Flexera Software LLC
FileDescription: Setup Suite Launcher Unicode
FileVersion: 2.32.0.0
InternalName: SetupSuite
LegalCopyright: Copyright (c) 2015 Flexera Software LLC. All Rights Reserved.
OriginalFileName: InstallShield SetupSuite.exe
ProductName: Device Software Manager Setup Tool 2.32.0.0
ProductVersion: 2.32.0.0
InternalBuildNumber: 176888
ISInternalVersion: 22.0.401
ISInternalDescription: Setup Suite Launcher Unicode
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
10
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start driver_web_installer.exe _isb9ad.exe driver_web_installer.exe sppextcomobj.exe no specs slui.exe slui.exe _isb9ad.exe no specs isbew64.exe no specs explorer.exe no specs driver_web_installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1164"C:\Users\admin\AppData\Local\Temp\{0E888A56-99E3-4BDB-974D-6E8C4F7393BE}\_isB9AD.exe" -embedded:BBD1FE27-EE42-4A25-9C03-282FC9BA4CF7 -IS_tempC:\Users\admin\AppData\Local\Temp\{0E888A56-99E3-4BDB-974D-6E8C4F7393BE}\_isB9AD.exe—_isB9AD.exe
User:
admin
Company:
Flexera Software LLC
Integrity Level:
HIGH
Description:
Setup Suite Launcher Unicode
Exit code:
0
Version:
2.32.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{0e888a56-99e3-4bdb-974d-6e8c4f7393be}\_isb9ad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4448"C:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\driver_web_installer.exe" C:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\driver_web_installer.exe
_isB9AD.exe
User:
admin
Company:
Ricoh Company, Ltd.
Integrity Level:
HIGH
Description:
Device Software Manager Web Installer
Exit code:
0
Version:
2.32.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{bff78324-372e-4cd4-b813-e6984a38259c}\driver_web_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4652"C:\Users\admin\AppData\Local\Temp\driver_web_installer.exe" C:\Users\admin\AppData\Local\Temp\driver_web_installer.exe—explorer.exe
User:
admin
Company:
Flexera Software LLC
Integrity Level:
MEDIUM
Description:
Setup Suite Launcher Unicode
Exit code:
3221226540
Version:
2.32.0.0
Modules
Images
c:\users\admin\appdata\local\temp\driver_web_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4652"C:\Users\admin\AppData\Local\Temp\{0E888A56-99E3-4BDB-974D-6E8C4F7393BE}\_isB9AD.exe" -IS_temp ORIGINALSETUPEXEDIR="C:\Users\admin\AppData\Local\Temp" ORIGINALSETUPEXENAME="driver_web_installer.exe" C:\Users\admin\AppData\Local\Temp\{0E888A56-99E3-4BDB-974D-6E8C4F7393BE}\_isB9AD.exe
driver_web_installer.exe
User:
admin
Company:
Flexera Software LLC
Integrity Level:
HIGH
Description:
Setup Suite Launcher Unicode
Exit code:
1603
Version:
2.32.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{0e888a56-99e3-4bdb-974d-6e8c4f7393be}\_isb9ad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4920C:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{16C5CC5F-0E59-49C7-BCAF-F3AAB48587AD}C:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\ISBEW64.exe—_isB9AD.exe
User:
admin
Company:
Flexera Software LLC
Integrity Level:
HIGH
Description:
InstallShield (R) 64-bit Setup Engine
Exit code:
0
Version:
22.0.401
Modules
Images
c:\users\admin\appdata\local\temp\{bff78324-372e-4cd4-b813-e6984a38259c}\isbew64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
5084C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5512explorer.exeC:\Windows\SysWOW64\explorer.exe—_isB9AD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
6988"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7000C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7148"C:\Users\admin\AppData\Local\Temp\driver_web_installer.exe" C:\Users\admin\AppData\Local\Temp\driver_web_installer.exe
explorer.exe
User:
admin
Company:
Flexera Software LLC
Integrity Level:
HIGH
Description:
Setup Suite Launcher Unicode
Exit code:
1603
Version:
2.32.0.0
Modules
Images
c:\users\admin\appdata\local\temp\driver_web_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
2 072
Read events
2 069
Write events
1
Delete events
2

Modification events

(PID) Process:(4652) _isB9AD.exeKey:HKEY_CURRENT_USER\SOFTWARE\InstallShield\SuiteInstallers\{57CC066F-A168-42C6-B6E9-49210982F292}
Operation:writeName:InfoPath
Value:
C:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\_isBA59
(PID) Process:(4652) _isB9AD.exeKey:HKEY_CURRENT_USER\SOFTWARE\InstallShield\SuiteInstallers\{57CC066F-A168-42C6-B6E9-49210982F292}
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) _isB9AD.exeKey:HKEY_CURRENT_USER\SOFTWARE\InstallShield\SuiteInstallers
Operation:delete keyName:(default)
Value:
Executable files
6
Suspicious files
3
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\Custom.pngimage
MD5:2C2D11D76ACCCC73633B7782D430DDB7
SHA256:5E25814B728687E17C31572DA4B93CD6BA34E6D30C9760FDEDD8AE8598DA7720
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\scale-150\Typical.pngimage
MD5:BE7A62B3CF3AA240CCBB2E8CDF60F29F
SHA256:1D21BEA5C93FCED9F777A86F2B7D9EE11B697BCB4D9306794A81BEBA60CA7AAC
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\Setup_UI.dllexecutable
MD5:F6BE9DD6F4F8640A9EA4636B69BF94B6
SHA256:19F61F7C23244FDB48EB2938419916755DC704CEFFCD611FD5EEB7E7F26E687A
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\Repair.pngimage
MD5:260D3EDFC4ED042A8E152613CFC0D59C
SHA256:5B4CC813A251FBBE0C2EA6BAB31C512DA865BAA9B20FA61B46CA8A30D302BBFA
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\scale-150\Folder.pngimage
MD5:F3F9575A23F7C4CD35C8324231F5BD9E
SHA256:2EE9AA1DDA88CD9964D342DDA3FE56164C9906D5441E8381297F4DCDAE6C3E9D
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\scale-150\Application.pngimage
MD5:46B2EB6C23572DA87ADA5A342F854641
SHA256:016604E80FFC9921EE9CA036B6DDE317094C9D1CD8BF4928087317C708EB7C84
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\ISLogoSmall.pngimage
MD5:0DE9D9BD4AE583015157D5D3BC77801F
SHA256:3039E1E23AFC42BD3C07A8F4B65FB5D0377CA70F9F4FFB6FD7E7F33D82D837D1
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\scale-150\Custom.pngimage
MD5:41404BDC8ACC738078A96E03836A7017
SHA256:2760DC6DA4DA352973B99D8209E54DC68C679D8C2800408F6D9481E03D9D3D9B
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\scale-150\Repair.pngimage
MD5:C404CB5D0854361968716C3AB8630F92
SHA256:ABDCECCB0963B6A2621BC1C1477C5D7FA0743E6656275FF1E3402464D7946C87
4652_isB9AD.exeC:\Users\admin\AppData\Local\Temp\{BFF78324-372E-4CD4-B813-E6984A38259C}\scale-150\Remove.pngimage
MD5:3935F5F99E5930A26FF9C78E7004EF1E
SHA256:759A320B1B41F49D95333AE9636AB772C64DDE712208BBAE1850D134F870A70E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
44
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7052
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7052
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.25
  • 23.216.77.18
  • 23.216.77.8
  • 23.216.77.22
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.131
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.130
  • 40.126.31.131
  • 20.190.159.4
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
auto-ds1.support-download.com
  • 23.56.207.76
unknown
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
driver_web_installer.exe