File name:

daemon4091-x86.exe

Full analysis: https://app.any.run/tasks/53b183ba-681e-4665-a866-679df72f5410
Verdict: Malicious activity
Analysis date: January 27, 2024, 18:07:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

473C6FC92E4FEEDDB691ECED0DDF4BE2

SHA1:

FF8D540B43CF22B0E622E5712F4285032C0B2560

SHA256:

8AFAACAECA2BF8877D8A0976C211F8C902E181B9435C99BF7D804FCAC4BCF96E

SSDEEP:

98304:nos41/5sb5RofavXw2gUGhelcAoMDsXwxkWmn57cG3Ph518Cj0RbucnWElUuvfNj:G2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • daemon4091-x86.exe (PID: 1880)
      • SPTDinst-x86.exe (PID: 2260)
      • daemon4091-x86.exe (PID: 2204)
      • SPTDinst-x86.exe (PID: 2508)

    • Creates a writable file in the system directory

      • SPTDinst-x86.exe (PID: 2260)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • daemon4091-x86.exe (PID: 1880)
      • SPTDinst-x86.exe (PID: 2260)
      • daemon4091-x86.exe (PID: 2204)
      • SPTDinst-x86.exe (PID: 2508)

    • Searches for installed software

      • dllhost.exe (PID: 2688)
      • SPTDinst-x86.exe (PID: 2260)
      • SPTDinst-x86.exe (PID: 2508)

    • Adds/modifies Windows certificates

      • SPTDinst-x86.exe (PID: 2260)
      • sipnotify.exe (PID: 1632)

    • Creates files in the driver directory

      • SPTDinst-x86.exe (PID: 2260)

    • Creates or modifies Windows services

      • SPTDinst-x86.exe (PID: 2260)

    • Drops a system driver (possible attempt to evade defenses)

      • SPTDinst-x86.exe (PID: 2260)
      • SPTDinst-x86.exe (PID: 2508)

    • The process executes via Task Scheduler

      • ctfmon.exe (PID: 1564)
      • sipnotify.exe (PID: 1632)

    • Reads the Internet Settings

      • sipnotify.exe (PID: 1632)

    • Reads settings of System Certificates

      • sipnotify.exe (PID: 1632)

  • INFO

    • Checks supported languages

      • daemon4091-x86.exe (PID: 1880)
      • SPTDinst-x86.exe (PID: 2260)
      • IMEKLMG.EXE (PID: 356)
      • IMEKLMG.EXE (PID: 1412)
      • daemon4091-x86.exe (PID: 2204)
      • wmpnscfg.exe (PID: 2388)
      • SPTDinst-x86.exe (PID: 2508)
      • wmpnscfg.exe (PID: 2344)

    • Reads the computer name

      • SPTDinst-x86.exe (PID: 2260)
      • daemon4091-x86.exe (PID: 1880)
      • IMEKLMG.EXE (PID: 356)
      • IMEKLMG.EXE (PID: 1412)
      • wmpnscfg.exe (PID: 2388)
      • SPTDinst-x86.exe (PID: 2508)
      • wmpnscfg.exe (PID: 2344)

    • Reads the machine GUID from the registry

      • SPTDinst-x86.exe (PID: 2260)
      • SPTDinst-x86.exe (PID: 2508)

    • Create files in a temporary directory

      • daemon4091-x86.exe (PID: 1880)
      • daemon4091-x86.exe (PID: 2204)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 1412)
      • daemon4091-x86.exe (PID: 2204)
      • daemon4091-x86.exe (PID: 1020)
      • IMEKLMG.EXE (PID: 356)
      • wmpnscfg.exe (PID: 2388)
      • wmpnscfg.exe (PID: 2344)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 356)
      • IMEKLMG.EXE (PID: 1412)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2007:04:24 21:17:01+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7.1
CodeSize: 23552
InitializedDataSize: 121344
UninitializedDataSize: 1024
EntryPoint: 0x3fb9
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.9.1.0
ProductVersionNumber: 4.9.1.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: DT Soft Ltd.
FileDescription: DAEMON Tools Setup
FileVersion: 4.09.1.0
InternalName: daemon409.exe
LegalCopyright: Copyright (C) 2000-2007
OriginalFileName: daemon409.exe
ProductName: DAEMON Tools
ProductVersion: 4.09.1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
100
Monitored processes
13
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start daemon4091-x86.exe sptdinst-x86.exe SPPSurrogate no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs daemon4091-x86.exe no specs daemon4091-x86.exe wmpnscfg.exe no specs wmpnscfg.exe no specs sptdinst-x86.exe daemon4091-x86.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
356"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /JPN /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
984"C:\Users\admin\AppData\Local\Temp\daemon4091-x86.exe" C:\Users\admin\AppData\Local\Temp\daemon4091-x86.exe—explorer.exe
User:
admin
Company:
DT Soft Ltd.
Integrity Level:
MEDIUM
Description:
DAEMON Tools Setup
Exit code:
3221226540
Version:
4.09.1.0
Modules
Images
c:\users\admin\appdata\local\temp\daemon4091-x86.exe
c:\windows\system32\ntdll.dll
1020"C:\Users\admin\AppData\Local\Temp\daemon4091-x86.exe" C:\Users\admin\AppData\Local\Temp\daemon4091-x86.exe—explorer.exe
User:
admin
Company:
DT Soft Ltd.
Integrity Level:
MEDIUM
Description:
DAEMON Tools Setup
Exit code:
3221226540
Version:
4.09.1.0
Modules
Images
c:\users\admin\appdata\local\temp\daemon4091-x86.exe
c:\windows\system32\ntdll.dll
1412"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
1564C:\Windows\System32\ctfmon.exe C:\Windows\System32\ctfmon.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CTF Loader
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1632C:\Windows\system32\sipnotify.exe -LogonOrUnlockC:\Windows\System32\sipnotify.exe
taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
sipnotify
Exit code:
0
Version:
6.1.7602.20480 (win7sp1_ldr_escrow.191010-1716)
Modules
Images
c:\windows\system32\sipnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1880"C:\Users\admin\AppData\Local\Temp\daemon4091-x86.exe" C:\Users\admin\AppData\Local\Temp\daemon4091-x86.exe
explorer.exe
User:
admin
Company:
DT Soft Ltd.
Integrity Level:
HIGH
Description:
DAEMON Tools Setup
Exit code:
0
Version:
4.09.1.0
Modules
Images
c:\users\admin\appdata\local\temp\daemon4091-x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2204"C:\Users\admin\AppData\Local\Temp\daemon4091-x86.exe" C:\Users\admin\AppData\Local\Temp\daemon4091-x86.exe
explorer.exe
User:
admin
Company:
DT Soft Ltd.
Integrity Level:
HIGH
Description:
DAEMON Tools Setup
Exit code:
0
Version:
4.09.1.0
Modules
Images
c:\users\admin\appdata\local\temp\daemon4091-x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2260"C:\Users\admin\AppData\Local\Temp\SPTDinst-x86.exe" add /qC:\Users\admin\AppData\Local\Temp\SPTDinst-x86.exe
daemon4091-x86.exe
User:
admin
Company:
Duplex Secure Ltd.
Integrity Level:
HIGH
Description:
SCSI Pass Through Direct setup
Exit code:
1
Version:
1.43.0.0
Modules
Images
c:\users\admin\appdata\local\temp\sptdinst-x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2344"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 700
Read events
5 608
Write events
85
Delete events
7

Modification events

(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000003811FC442B2FDA01740A0000480C0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000003811FC442B2FDA01740A0000480C0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
74
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
400000000000000086834F452B2FDA01740A0000480C0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000E0E551452B2FDA01740A0000340B0000E8030000010000000000000000000000C3E45FD4C91B4942AEB82FA6735F4DE60000000000000000
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000A63F0E462B2FDA01740A0000340B0000E8030000000000000000000000000000C3E45FD4C91B4942AEB82FA6735F4DE60000000000000000
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Leave)
Value:
4000000000000000F070E2462B2FDA01740A0000480C0000D3070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Leave)
Value:
40000000000000006417CC472B2FDA01740A0000480C0000D0070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Leave)
Value:
40000000000000006417CC472B2FDA01740A0000480C0000D5070000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2260) SPTDinst-x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000007AB3F5C74B51DA01D408000014060000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
10
Suspicious files
5
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
2688dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1880daemon4091-x86.exeC:\Users\admin\AppData\Local\Temp\nsz93F3.tmp\setuphlp.dllexecutable
MD5:ECE12FA4A88CAB1E743C534E4F4B91DC
SHA256:00A6658AE50896C118A77AC5FBA398B98A3BFE9F488333FEDBB288E7B7C42743
2204daemon4091-x86.exeC:\Users\admin\AppData\Local\Temp\nsg2992.tmp\dtsetup.iniini
MD5:CE819CC71C59C4F69933159285E8E727
SHA256:AE10F55E6EEE0C64AD9DC5AB9998ED8DDE13F3EA050913B66CC5350DB7A6385E
1880daemon4091-x86.exeC:\Users\admin\AppData\Local\Temp\nsz93F2.tmpbinary
MD5:88D7CDF25CF711B54173D8C39C66269F
SHA256:EBAE682DAF1C288BD74EC2C368F22ABD97DF9F4060A895AA3CB9EA6E014775CC
2204daemon4091-x86.exeC:\Users\admin\AppData\Local\Temp\nsg2992.tmp\setuphlp.dllexecutable
MD5:ECE12FA4A88CAB1E743C534E4F4B91DC
SHA256:00A6658AE50896C118A77AC5FBA398B98A3BFE9F488333FEDBB288E7B7C42743
2688dllhost.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:568A4EA80DA52B19AC941EAB2B34E6B7
SHA256:0610432E1DF395DFD60DBE3E38F9572D9CE8BB9D9E1582E8D34B530A60C5EA5C
2688dllhost.exeC:\System Volume Information\SPP\OnlineMetadataCache\{d34101f0-2ef2-4b8a-bb03-cfc75b925fe5}_OnDiskSnapshotPropbinary
MD5:568A4EA80DA52B19AC941EAB2B34E6B7
SHA256:0610432E1DF395DFD60DBE3E38F9572D9CE8BB9D9E1582E8D34B530A60C5EA5C
2204daemon4091-x86.exeC:\Users\admin\AppData\Local\Temp\nsg2992.tmp\modern-header.bmpimage
MD5:24B108615B4A85E4DE2828FB7A474D61
SHA256:01C8E6395C2402B341192752EA7FF020A4D803DF6B74D693337A386F200692E9
1880daemon4091-x86.exeC:\Users\admin\AppData\Local\Temp\nsz93F3.tmp\InstallOptions.dllexecutable
MD5:07F3B3445F66E1089567796BF3C8BE78
SHA256:A505E6C537A5CE0166227DDA9F7671605395592AC9F1A3764E8A01B713939DB1
1880daemon4091-x86.exeC:\Users\admin\AppData\Local\Temp\SPTDinst-x86.exeexecutable
MD5:96FAD10A9481B20BD65C2255E60DC07A
SHA256:827DAF4B6A45BC5533B47C943977E5F66F9E63B7BBF600803E6A2A6B3AFE4B1C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1632
sipnotify.exe
HEAD
200
88.221.61.151:80
http://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE2JgkA?v=133508525140460000
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1104
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1632
sipnotify.exe
88.221.61.151:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
query.prod.cms.rt.microsoft.com
  • 88.221.61.151
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
daemon4091-x86.exe