File name:

vip72socks-set-x5.exe

Full analysis: https://app.any.run/tasks/964e188c-fd61-462f-a7cd-2820239afb40
Verdict: Malicious activity
Analysis date: November 29, 2023, 01:56:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C26C8DB0A4C41D0C5E729E145F597F58

SHA1:

9C600B2D4FC5BAF3D88FCE713EF01F456C5AA25B

SHA256:

8E704BE5B85D219A9AFF3FD493D00D287DBB55AAE4D2DF530AA361E04723716A

SSDEEP:

98304:bmpyFPPEw6SDVAXxnLjfiiQe+IDYDdH/sRvdGi3h7qnn22jWW7IZi1ESaOP5kmGN:wT/xGYEq0odTZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • vip72socks-set-x5.exe (PID: 2692)
      • vip72socks-set-x5.exe (PID: 2232)
      • vip72socks-set-x5.tmp (PID: 1444)

    • Creates a writable file in the system directory

      • vip72socks-set-x5.tmp (PID: 1444)

    • Actions looks like stealing of personal data

      • vip72socks.exe (PID: 580)

    • Steals credentials from Web Browsers

      • vip72socks.exe (PID: 580)

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • vip72socks-set-x5.tmp (PID: 1444)

    • Process drops legitimate windows executable

      • vip72socks-set-x5.tmp (PID: 1444)

    • Reads the Internet Settings

      • Proxifier.exe (PID: 3380)

  • INFO

    • Checks supported languages

      • vip72socks-set-x5.tmp (PID: 3060)
      • vip72socks-set-x5.exe (PID: 2232)
      • vip72socks-set-x5.exe (PID: 2692)
      • vip72socks-set-x5.tmp (PID: 1444)
      • SysSettings32.exe (PID: 924)
      • vip72socks.exe (PID: 580)
      • vip72socks.exe (PID: 944)
      • Proxifier.exe (PID: 3380)
      • wmpnscfg.exe (PID: 3924)
      • SysSettings32.exe (PID: 1660)

    • Create files in a temporary directory

      • vip72socks-set-x5.exe (PID: 2692)
      • vip72socks-set-x5.exe (PID: 2232)
      • Proxifier.exe (PID: 3380)

    • Reads the computer name

      • vip72socks-set-x5.tmp (PID: 3060)
      • vip72socks-set-x5.tmp (PID: 1444)
      • vip72socks.exe (PID: 580)
      • Proxifier.exe (PID: 3380)
      • wmpnscfg.exe (PID: 3924)

    • Creates files or folders in the user directory

      • vip72socks-set-x5.tmp (PID: 1444)
      • vip72socks.exe (PID: 580)

    • Creates files in the program directory

      • vip72socks-set-x5.tmp (PID: 1444)

    • Manual execution by a user

      • vip72socks.exe (PID: 580)
      • vip72socks.exe (PID: 944)
      • Proxifier.exe (PID: 3380)
      • wmpnscfg.exe (PID: 3924)

    • Reads the machine GUID from the registry

      • Proxifier.exe (PID: 3380)
      • wmpnscfg.exe (PID: 3924)

    • Checks proxy server information

      • Proxifier.exe (PID: 3380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41984
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0xaad0
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.8.7.14
ProductVersionNumber: 1.8.7.14
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: VIP Technologies
FileDescription: VIP72 Socks Client Setup
FileVersion: 1.8.7.14
LegalCopyright:
ProductName: VIP72 Socks Client
ProductVersion: 1.8.7.14
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
50
Monitored processes
10
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start vip72socks-set-x5.exe no specs vip72socks-set-x5.tmp no specs vip72socks-set-x5.exe vip72socks-set-x5.tmp no specs syssettings32.exe no specs vip72socks.exe vip72socks.exe no specs proxifier.exe wmpnscfg.exe no specs syssettings32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
580"C:\Users\admin\AppData\Roaming\VIP72 Socks Client\vip72socks.exe" C:\Users\admin\AppData\Roaming\VIP72 Socks Client\vip72socks.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\vip72 socks client\vip72socks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
924"C:\Users\admin\AppData\Roaming\VIP72 Socks Client\proxifier-standart\SysSettings32.exe" silent-installC:\Users\admin\AppData\Roaming\VIP72 Socks Client\proxifier-standart\SysSettings32.exe—vip72socks-set-x5.tmp
User:
admin
Company:
Initex
Integrity Level:
HIGH
Description:
Proxifier System Settings
Exit code:
0
Version:
3.42.0.1
Modules
Images
c:\users\admin\appdata\roaming\vip72 socks client\proxifier-standart\syssettings32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
944"C:\Users\admin\AppData\Roaming\VIP72 Socks Client\vip72socks.exe" -hidepassC:\Users\admin\AppData\Roaming\VIP72 Socks Client\vip72socks.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\vip72 socks client\vip72socks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
1444"C:\Users\admin\AppData\Local\Temp\is-2VEU5.tmp\vip72socks-set-x5.tmp" /SL5="$E0182,4505720,58368,C:\Users\admin\AppData\Local\Temp\vip72socks-set-x5.exe" /SPAWNWND=$9016A /NOTIFYWND=$7019C C:\Users\admin\AppData\Local\Temp\is-2VEU5.tmp\vip72socks-set-x5.tmp—vip72socks-set-x5.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-2veu5.tmp\vip72socks-set-x5.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1660"C:\Users\admin\AppData\Roaming\VIP72 Socks Client\proxifier-standart\SysSettings32.exe" silent-checkC:\Users\admin\AppData\Roaming\VIP72 Socks Client\proxifier-standart\SysSettings32.exe—Proxifier.exe
User:
admin
Company:
Initex
Integrity Level:
MEDIUM
Description:
Proxifier System Settings
Exit code:
0
Version:
3.42.0.1
Modules
Images
c:\users\admin\appdata\roaming\vip72 socks client\proxifier-standart\syssettings32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winspool.drv
2232"C:\Users\admin\AppData\Local\Temp\vip72socks-set-x5.exe" /SPAWNWND=$9016A /NOTIFYWND=$7019C C:\Users\admin\AppData\Local\Temp\vip72socks-set-x5.exe
vip72socks-set-x5.tmp
User:
admin
Company:
VIP Technologies
Integrity Level:
HIGH
Description:
VIP72 Socks Client Setup
Exit code:
0
Version:
1.8.7.14
Modules
Images
c:\users\admin\appdata\local\temp\vip72socks-set-x5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
2692"C:\Users\admin\AppData\Local\Temp\vip72socks-set-x5.exe" C:\Users\admin\AppData\Local\Temp\vip72socks-set-x5.exe—explorer.exe
User:
admin
Company:
VIP Technologies
Integrity Level:
MEDIUM
Description:
VIP72 Socks Client Setup
Exit code:
0
Version:
1.8.7.14
Modules
Images
c:\users\admin\appdata\local\temp\vip72socks-set-x5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3060"C:\Users\admin\AppData\Local\Temp\is-QFMBV.tmp\vip72socks-set-x5.tmp" /SL5="$7019C,4505720,58368,C:\Users\admin\AppData\Local\Temp\vip72socks-set-x5.exe" C:\Users\admin\AppData\Local\Temp\is-QFMBV.tmp\vip72socks-set-x5.tmp—vip72socks-set-x5.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-qfmbv.tmp\vip72socks-set-x5.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3380"C:\Users\admin\AppData\Roaming\VIP72 Socks Client\proxifier-standart\Proxifier.exe" C:\Users\admin\AppData\Roaming\VIP72 Socks Client\proxifier-standart\Proxifier.exe
explorer.exe
User:
admin
Company:
Initex
Integrity Level:
MEDIUM
Description:
Proxifier Standard Edition v3.42
Exit code:
0
Version:
3.42.0.1
Modules
Images
c:\users\admin\appdata\roaming\vip72 socks client\proxifier-standart\proxifier.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
3924"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
4 990
Read events
4 701
Write events
70
Delete events
219

Modification events

(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009
Operation:delete keyName:(default)
Value:
(PID) Process:(924) SysSettings32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010
Operation:delete keyName:(default)
Value:
Executable files
50
Suspicious files
26
Text files
24
Unknown types
0

Dropped files

PID
Process
Filename
Type
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\is-BI6U6.tmp —
MD5:—
SHA256:—
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\somd.dat —
MD5:—
SHA256:—
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\is-ANUH4.tmp —
MD5:—
SHA256:—
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\some.dat —
MD5:—
SHA256:—
2692vip72socks-set-x5.exeC:\Users\admin\AppData\Local\Temp\is-QFMBV.tmp\vip72socks-set-x5.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\is-ET7LB.tmpexecutable
MD5:9F082C3B29C5053448A6B8A89FAE6CBE
SHA256:CA8AE7AE516FA5998725E7329DF29148A1F60CC6CFDB3F26DC56183B1CC8BB27
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\readme.txttext
MD5:C682FFB47AA7D4424774C97C4DE615BB
SHA256:3DE7FFAAA85290B87A77954E104C54972FC0552D4D27286EA93CACE9763DDB6C
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\is-4DP79.tmpexecutable
MD5:D6014FB98B8AD05934ADD6A9909880DF
SHA256:E69E30A46C06CF82BEC74A1E76F2ACA300CE1C03C80F79A1BA0A780F09C99DA8
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\is-NOKTL.tmptext
MD5:C682FFB47AA7D4424774C97C4DE615BB
SHA256:3DE7FFAAA85290B87A77954E104C54972FC0552D4D27286EA93CACE9763DDB6C
1444vip72socks-set-x5.tmpC:\Users\admin\AppData\Roaming\VIP72 Socks Client\HELP-cert.urlbinary
MD5:B100EFBC8C57A5EAEB695B313DEDE1EA
SHA256:EC9B11320BB88BD0999F61763C1649BF5410AE60FE1A5D2B57BD07F07169391D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
580
vip72socks.exe
GET
301
31.184.242.16:80
http://vip72.org/version.text
unknown
html
169 b
unknown
3380
Proxifier.exe
GET
200
172.104.17.238:80
http://www.proxifier.com/distr/last_versions/ProxifierStandard/?nocache=9ABCF1836B53806BB8
unknown
text
47 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
580
vip72socks.exe
31.184.242.16:80
vip72.org
MIRholding B.V.
RU
unknown
3380
Proxifier.exe
172.104.17.238:80
www.proxifier.com
Linode, LLC
US
unknown

DNS requests

Domain
IP
Reputation
vip72.org
  • 31.184.242.16
unknown
www.proxifier.com
  • 172.104.17.238
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vip72socks-set-x5.exe