download:

/downloads/ice/pafmicesetup.exe

Full analysis: https://app.any.run/tasks/d2a762d5-e943-463a-83e8-d662760d0cb3
Verdict: Malicious activity
Analysis date: February 16, 2024, 04:32:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

80F920260ED19EA076A8AF4BC1FF6B14

SHA1:

59B06D9242000D00D25473A560618A448FA56230

SHA256:

8F727B1191B73F4B0560EBBE11A38D15D542BC6A85B4E7F1D126CA325D773CFE

SSDEEP:

98304:2Sk/3GPGaNuAElhSD3gY4PCRgURws5zkA2asFs2mb3Tz9S:2liGaNk4Lw8OsDO2Hb33s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pafmicesetup.exe (PID: 3668)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pafmicesetup.exe (PID: 3668)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3732)
      • pafmupd.exe (PID: 2364)
      • pafmice.exe (PID: 2072)

  • INFO

    • Checks supported languages

      • pafmicesetup.exe (PID: 3668)
      • pafmupd.exe (PID: 2364)
      • pafmice.exe (PID: 2072)

    • Reads the computer name

      • pafmicesetup.exe (PID: 3668)
      • pafmupd.exe (PID: 2364)
      • pafmice.exe (PID: 2072)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1432)

    • Reads the software policy settings

      • msiexec.exe (PID: 1432)

    • Create files in a temporary directory

      • pafmicesetup.exe (PID: 3668)

    • Reads the machine GUID from the registry

      • pafmupd.exe (PID: 2364)

    • Creates files in the program directory

      • pafmupd.exe (PID: 2364)
      • pafmice.exe (PID: 2072)

    • Manual execution by a user

      • explorer.exe (PID: 2900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (38.7)
.exe | Win64 Executable (generic) (34.3)
.scr | Windows screen saver (16.2)
.exe | Win32 Executable (generic) (5.6)
.exe | Generic Win/DOS Executable (2.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2008:09:11 05:55:59+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 425984
InitializedDataSize: 200704
UninitializedDataSize: -
EntryPoint: 0x36327
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 15.0.0.591
ProductVersionNumber: 15.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: PJLM Software Inc.
FileDescription: Contact: Your local administrator
FileVersion: 1.35.0
InternalName: Setup
LegalCopyright: Copyright 2007-2017
OriginalFileName: Setup.exe
ProductName: Print Audit Facilities Manager ICE
ProductVersion: 1.35.0
InternalBuildNumber: 82160
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pafmicesetup.exe msiexec.exe no specs vssvc.exe no specs pafmupd.exe no specs pafmice.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1432MSIEXEC.EXE /i "C:\Users\admin\AppData\Local\Temp\{85CA6654-F18E-4AA5-9F75-9E67A5EF2198}\pafmice.msi" SETUPEXEDIR="C:\Users\admin\AppData\Local\Temp" SETUPEXENAME="pafmicesetup.exe"C:\Windows\System32\msiexec.exe—pafmicesetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2072"C:\Program Files\Print Audit Inc\Facilities Manager\pafmice.exe"C:\Program Files\Print Audit Inc\Facilities Manager\pafmice.exe—services.exe
User:
SYSTEM
Company:
PJLM Software Inc.
Integrity Level:
SYSTEM
Description:
Retrieves meters reads from network capable MFP's
Exit code:
0
Version:
1.35.0.0
Modules
Images
c:\program files\print audit inc\facilities manager\pafmice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\snmpapi.dll
c:\windows\system32\version.dll
2364"C:\Program Files\Print Audit Inc\Facilities Manager\pafmupd.exe"C:\Program Files\Print Audit Inc\Facilities Manager\pafmupd.exe—services.exe
User:
SYSTEM
Company:
PJLM Software Inc.
Integrity Level:
SYSTEM
Description:
Automatically downloads updates for the Print Audit FM Information Collection Engine
Exit code:
0
Version:
1.35.0.0
Modules
Images
c:\program files\print audit inc\facilities manager\pafmupd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2900"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3668"C:\Users\admin\AppData\Local\Temp\pafmicesetup.exe" C:\Users\admin\AppData\Local\Temp\pafmicesetup.exe
explorer.exe
User:
admin
Company:
PJLM Software Inc.
Integrity Level:
MEDIUM
Description:
Contact: Your local administrator
Exit code:
0
Version:
1.35.0
Modules
Images
c:\users\admin\appdata\local\temp\pafmicesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3732C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 177
Read events
5 042
Write events
135
Delete events
0

Modification events

(PID) Process:(1432) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000024A3A52E9160DA01940E0000BC0E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
400000000000000024A3A52E9160DA01940E00006C0F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Leave)
Value:
40000000000000007E05A82E9160DA01940E00006C0F0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000007E05A82E9160DA01940E0000D4050000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000007E05A82E9160DA01940E00006C0F0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000D867AA2E9160DA01940E0000BC0E0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000D867AA2E9160DA01940E0000D4050000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Leave)
Value:
4000000000000000D867AA2E9160DA01940E00006C0F0000E8030000000000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3732) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SwProvider_{b5946137-7b9f-4925-af80-51abd60b20d5}
Operation:writeName:PROVIDER_BEGINPREPARE (Enter)
Value:
4000000000000000126850309160DA01940E00006C0F000001040000010000000000000000000000FE189973D5BAF549AFB91DD81D9ACDC70000000000000000
Executable files
1
Suspicious files
4
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\{85CA6654-F18E-4AA5-9F75-9E67A5EF2198}\0x0409.initext
MD5:758747727E96A23C7C5A5BBB011656E4
SHA256:BAD3B2E854149DF9413F06E6C1C7B7C875545393877F59B59907F6B083CE5825
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\{85CA6654-F18E-4AA5-9F75-9E67A5EF2198}\Setup.INIini
MD5:0C864C692AB369C3241E8859A6780D28
SHA256:F58526BB725149A499D1A31442DADD6F0DB863D5A72E8721042D604B9913DC7D
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\_isF281.tmppz
MD5:6FB294095B6CF0D7318BEF4CCD5A2923
SHA256:4725AB02F3437A3B58F5B20638E0A6ADDBBC3E2A972052B3B99D533D3AD79864
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\_isF260.tmppz
MD5:AE10F061AF304517F6E3F3157795A5B7
SHA256:C1C419BE1398ADDBD82F88BE6C3FF810ED04B8C970AB7349B07EC11B07368043
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\{85CA6654-F18E-4AA5-9F75-9E67A5EF2198}\_ISMSIDEL.INItext
MD5:C7EE18FE797A8C66ED063E44B8012DCD
SHA256:75B553599A6E4B87F3B1B22317A36E27489A8AFA5467A1CF0206504E421E1B1F
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\_isF2EF.tmpbinary
MD5:200E8710B960D1767D285A1A791CD760
SHA256:F221F1B3BB2EC0ADBD7290B8F7A91ADAADF39A4A13331191B827A622652C6A50
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\~F280.tmpini
MD5:0C864C692AB369C3241E8859A6780D28
SHA256:F58526BB725149A499D1A31442DADD6F0DB863D5A72E8721042D604B9913DC7D
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\{85CA6654-F18E-4AA5-9F75-9E67A5EF2198}\pafmice.msiexecutable
MD5:FB52B640A77E6668BD501610DC2840C4
SHA256:77A8587F561CC59C525FFAB97FD509939565719BC38228B5B0D6834DD095B5E7
3668pafmicesetup.exeC:\Users\admin\AppData\Local\Temp\_isF24F.tmppz
MD5:6FB294095B6CF0D7318BEF4CCD5A2923
SHA256:4725AB02F3437A3B58F5B20638E0A6ADDBBC3E2A972052B3B99D533D3AD79864
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/downloads/ice/pafmicesetup.exe