analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

adobe_photoshop_2022_234_mac_os_x.exe

Full analysis: https://app.any.run/tasks/4fc1b9ab-fb15-4c4a-a833-9576f9b99650
Verdict: Malicious activity
Analysis date: March 31, 2023, 21:16:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

1A5962C8775965C66035B96AAED2F25F

SHA1:

25CA6501A07DEC9341F45A9A33A00E26AB370C1B

SHA256:

8861E56ACB22A7131E3A61952020E6AA52CC78B1F670953071109F6388539125

SSDEEP:

98304:7v6W8zntQwyUgOlHpKjcCAYSmOppy3Olar:76ftKKlHpUChgr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

  • SUSPICIOUS

    • Reads the Internet Settings

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)

    • Reads settings of System Certificates

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)

    • Searches for installed software

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • Application launched itself

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)

    • Executable content was dropped or overwritten

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Reads security settings of Internet Explorer

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)

    • Reads the Windows owner or organization settings

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • Checks Windows Trust Settings

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)

    • Adds/modifies Windows certificates

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • The process creates files with name similar to system file names

      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

  • INFO

    • Checks supported languages

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • saBSI.exe (PID: 2740)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • The process checks LSA protection

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Reads the machine GUID from the registry

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • saBSI.exe (PID: 2740)

    • Create files in a temporary directory

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Creates files or folders in the user directory

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • Reads Environment values

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)

    • Reads the computer name

      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2368)
      • saBSI.exe (PID: 2740)
      • adobe_photoshop_2022_234_mac_os_x.exe (PID: 2724)
      • kodi-20.0-Nexus_rc2-x64.exe (PID: 1872)

    • Creates files in the program directory

      • saBSI.exe (PID: 2740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

AssemblyVersion: 1.5.1.6476
ProductName: InstallCapital
OriginalFileName: GenericSetup.exe
LegalTrademarks: -
LegalCopyright: Copyright © Adaware 2023
InternalName: IC001.exe
FileDescription: Software Installation
CompanyName: IC001
Comments: -
ProductVersion: 6.95.1.0
FileVersion: 1.5.1.6476
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 6.95.1.0
FileVersionNumber: 1.5.1.6476
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x3e9a0e
UninitializedDataSize: -
InitializedDataSize: 3584
CodeSize: 4094976
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2023:01:19 21:21:38+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
4
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start adobe_photoshop_2022_234_mac_os_x.exe adobe_photoshop_2022_234_mac_os_x.exe sabsi.exe kodi-20.0-nexus_rc2-x64.exe

Process information

PID
CMD
Path
Indicators
Parent process
2368"C:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe" C:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe
explorer.exe
User:
admin
Company:
IC001
Integrity Level:
MEDIUM
Description:
Software Installation
Exit code:
3762504530
Version:
1.5.1.6476
Modules
Images
c:\users\admin\appdata\local\temp\adobe_photoshop_2022_234_mac_os_x.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
2724"C:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe" huac hpp=QzpcVXNlcnNcYWRtaW5cQXBwRGF0YVxMb2NhbFxUZW1wXGFkb2JlX3Bob3Rvc2hvcF8yMDIyXzIzNF9tYWNfb3NfeC5leGU=C:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
User:
admin
Company:
IC001
Integrity Level:
HIGH
Description:
Software Installation
Exit code:
0
Version:
1.5.1.6476
Modules
Images
c:\users\admin\appdata\local\temp\adobe_photoshop_2022_234_mac_os_x.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2740"saBSI.exe" /affid 91212 PaidDistribution=true InstallID=76d7c3e0-7997-4aae-9925-f595be7a34e1 subID=JBC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\saBSI.exe
adobe_photoshop_2022_234_mac_os_x.exe
User:
admin
Company:
McAfee, LLC
Integrity Level:
HIGH
Description:
McAfee WebAdvisor(bootstrap installer)
Exit code:
4294967295
Version:
4,1,1,663
Modules
Images
c:\users\admin\appdata\local\temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\sabsi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\gdi32.dll
1872"C:\Users\admin\Downloads\kodi-20.0-Nexus_rc2-x64.exe" C:\Users\admin\Downloads\kodi-20.0-Nexus_rc2-x64.exe
adobe_photoshop_2022_234_mac_os_x.exe
User:
admin
Company:
XBMC Foundation
Integrity Level:
HIGH
Description:
Kodi 19.90.905.0 Setup
Exit code:
2
Version:
19.90.905.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\downloads\kodi-20.0-nexus_rc2-x64.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
Total events
34 552
Read events
34 386
Write events
166
Delete events
0

Modification events

(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2368) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2724) adobe_photoshop_2022_234_mac_os_x.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
12
Suspicious files
6
Text files
38
Unknown types
2

Dropped files

PID
Process
Filename
Type
2368adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\3dba2b032e844ea98475f6258ce8bb25\sciter32.dllexecutable
MD5:B431083586E39D018E19880AD1A5CE8F
SHA256:B525FDCC32C5A359A7F5738A30EFF0C6390734D8A2C987C62E14C619F99D406B
2368adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\IC001\adobe_photoshop_2022_234__Url_r30kpen5joe55zehkaky51uluwlvtvfx\1.5.1.6476\csqaurxh.newcfgxml
MD5:C76D70D8440A273C2B2A2764F33323B8
SHA256:8F6658DFB498D9BC831670DFFD055D850D327A2DEFD82E1F24416316B037135D
2368adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\IC001\adobe_photoshop_2022_234__Url_r30kpen5joe55zehkaky51uluwlvtvfx\1.5.1.6476\user.configxml
MD5:C76D70D8440A273C2B2A2764F33323B8
SHA256:8F6658DFB498D9BC831670DFFD055D850D327A2DEFD82E1F24416316B037135D
2368adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\3dba2b032e844ea98475f6258ce8bb25\ServiceHide.Net.dllexecutable
MD5:0B036CE556E8C7C403948068D810F32A
SHA256:FC9BF8465906F8F9C979D976BD833D403AF1C0D3000AD555420347794E6C4A4D
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\Resources\DownloadFolderPage.htmlhtml
MD5:9DEA08DCA124C9CA58A082E62220ABEE
SHA256:00724E06138C68EB7AB40CDF3275CC7DB45698F10A98AC8C78B5F6582393F64C
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\IC001\adobe_photoshop_2022_234__Url_r30kpen5joe55zehkaky51uluwlvtvfx\1.5.1.6476\hsrufirj.newcfgxml
MD5:C76D70D8440A273C2B2A2764F33323B8
SHA256:8F6658DFB498D9BC831670DFFD055D850D327A2DEFD82E1F24416316B037135D
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\IC001\adobe_photoshop_2022_234__Url_r30kpen5joe55zehkaky51uluwlvtvfx\1.5.1.6476\user.configxml
MD5:C76D70D8440A273C2B2A2764F33323B8
SHA256:8F6658DFB498D9BC831670DFFD055D850D327A2DEFD82E1F24416316B037135D
2368adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\3dba2b032e844ea98475f6258ce8bb25\msvcp140.dllexecutable
MD5:8FF1898897F3F4391803C7253366A87B
SHA256:51398691FEEF7AE0A876B523AEC47C4A06D9A1EE62F1A0AEE27DE6D6191C68AD
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\app.icoimage
MD5:4003EFA6E7D44E2CBD3D7486E2E0451A
SHA256:EFFD42C5E471EA3792F12538BF7C982A5CDA4D25BFBFFAF51EED7E09035F4508
2724adobe_photoshop_2022_234_mac_os_x.exeC:\Users\admin\AppData\Local\Temp\adobe_photoshop_2022_234_mac_os_x.exe_1680300974\Resources\images\warning48x48.pngimage
MD5:D3361CF0D689A1B34D84F483D60BA9C9
SHA256:56739925AADA73F9489F9A6B72BFAAA92892B27D20F4D221380BA3EAE17F1442
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
26
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2724
adobe_photoshop_2022_234_mac_os_x.exe
HEAD
200
104.18.212.25:80
http://webcompanion.com/nano_download.php?partner=IT200301
unknown
—
—
malicious
2724
adobe_photoshop_2022_234_mac_os_x.exe
GET
200
209.197.3.8:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?133020b60f3eaa92
US
compressed
61.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2724
adobe_photoshop_2022_234_mac_os_x.exe
104.18.212.25:80
webcompanion.com
CLOUDFLARENET
—
malicious
2724
adobe_photoshop_2022_234_mac_os_x.exe
104.18.67.73:443
h2oapi.adaware.com
CLOUDFLARENET
—
malicious
2724
adobe_photoshop_2022_234_mac_os_x.exe
104.18.68.73:443
h2oapi.adaware.com
CLOUDFLARENET
—
malicious
2368
adobe_photoshop_2022_234_mac_os_x.exe
104.18.68.73:443
h2oapi.adaware.com
CLOUDFLARENET
—
malicious
2724
adobe_photoshop_2022_234_mac_os_x.exe
104.17.9.52:443
flow.lavasoft.com
CLOUDFLARENET
—
shared
2724
adobe_photoshop_2022_234_mac_os_x.exe
172.67.189.175:443
walliant.com
CLOUDFLARENET
US
malicious
—
—
209.197.3.8:80
ctldl.windowsupdate.com
STACKPATH-CDN
US
whitelisted
2740
saBSI.exe
35.166.221.252:443
apis.mosaic.analytics.awscommon.mcafee.com
AMAZON-02
US
unknown
2740
saBSI.exe
104.208.16.0:443
cu1pehnswad01.servicebus.windows.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2724
adobe_photoshop_2022_234_mac_os_x.exe
185.31.172.243:443
kodi.mirror.liteserver.nl
The Infrastructure Group B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
h2oapi.adaware.com
  • 104.18.68.73
  • 104.18.67.73
malicious
www.google.com
  • 142.250.185.100
whitelisted
flow.lavasoft.com
  • 104.17.9.52
  • 104.17.8.52
whitelisted
sos.adaware.com
  • 104.18.67.73
  • 104.18.68.73
whitelisted
webcompanion.com
  • 104.18.212.25
  • 104.18.211.25
malicious
walliant.com
  • 172.67.189.175
  • 104.21.57.77
malicious
sdl.adaware.com
  • 104.18.68.73
  • 104.18.67.73
whitelisted
kodi.mirror.liteserver.nl
  • 185.31.172.243
unknown
ctldl.windowsupdate.com
  • 209.197.3.8
whitelisted
cu1pehnswad01.servicebus.windows.net
  • 104.208.16.0
whitelisted

Threats

PID
Process
Class
Message
2740
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
2740
saBSI.exe
Potentially Bad Traffic
ET INFO TLS Handshake Failure
6 ETPRO signatures available at the full report
Process
Message
adobe_photoshop_2022_234_mac_os_x.exe
Error: File not found - genericsetup.wrappers.sciter:console.tis
adobe_photoshop_2022_234_mac_os_x.exe
at sciter:init-script.tis
adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
adobe_photoshop_2022_234_mac_os_x.exe
Error: File not found - genericsetup.wrappers.sciter:console.tis
adobe_photoshop_2022_234_mac_os_x.exe
at sciter:init-script.tis
adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
adobe_photoshop_2022_234_mac_os_x.exe
file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
adobe_photoshop_2022_234_mac_os_x.exe