| URL: | https://www.solvusoft.com/en/download/fileviewpro/current/ |
| Full analysis: | https://app.any.run/tasks/e6625458-38e8-4308-8fe8-b69341ea8bd8 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | March 05, 2019, 10:34:51 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MD5: | CCCE463917F4363E99C1DB6CA14D582A |
| SHA1: | F71A0335F5B7D875E40B63FA1BAE2902B0F65810 |
| SHA256: | 8FAC15EB4D028CC3123A8A23C242195F52BDFF531FC844F28D40F7D1B0A596D5 |
| SSDEEP: | 3:N8DSLgN4GFBKSC/KGCl:2OLGXFByKGu |
MALICIOUS
Application was dropped or rewritten from another process
- Setup_FileViewPro_2019[1].exe (PID: 3668)
- Setup_FileViewPro_2019[1].exe (PID: 3108)
- Setup_WinThruster_2018.exe (PID: 2840)
- WinThruster.exe (PID: 3804)
- WinThruster.exe (PID: 1056)
- FileViewPro.exe (PID: 3028)
- FileViewPro.exe (PID: 2004)
Registers / Runs the DLL via REGSVR32.EXE
- Setup_WinThruster_2018.tmp (PID: 2252)
Loads the Task Scheduler DLL interface
- WinThruster.exe (PID: 3804)
- WinThruster.exe (PID: 1056)
Downloads executable files from the Internet
- Setup_FileViewPro_2019[1].exe (PID: 3108)
Changes settings of System certificates
- WinThruster.exe (PID: 3804)
- FileViewPro.exe (PID: 3028)
Loads dropped or rewritten executable
- WinThruster.exe (PID: 3804)
- regsvr32.exe (PID: 3000)
- FileViewPro.exe (PID: 3028)
- FileViewPro.exe (PID: 2004)
SUSPICIOUS
Executable content was dropped or overwritten
- iexplore.exe (PID: 548)
- iexplore.exe (PID: 3644)
- Setup_FileViewPro_2019[1].exe (PID: 3108)
- Setup_WinThruster_2018.exe (PID: 2840)
- Setup_WinThruster_2018.tmp (PID: 2252)
- FileViewPro-N-1.9.8.15.exe (PID: 2368)
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Reads internet explorer settings
- Setup_FileViewPro_2019[1].exe (PID: 3108)
- WinThruster.exe (PID: 3804)
Reads Windows owner or organization settings
- Setup_WinThruster_2018.tmp (PID: 2252)
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Reads the Windows organization settings
- Setup_WinThruster_2018.tmp (PID: 2252)
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Creates COM task schedule object
- regsvr32.exe (PID: 3000)
Creates files in the program directory
- WinThruster.exe (PID: 3804)
- FileViewPro.exe (PID: 3028)
Adds / modifies Windows certificates
- WinThruster.exe (PID: 3804)
- FileViewPro.exe (PID: 3028)
Reads CPU info
- WinThruster.exe (PID: 3804)
Starts Internet Explorer
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Creates files in the user directory
- FileViewPro.exe (PID: 3028)
Reads Environment values
- FileViewPro.exe (PID: 2004)
INFO
Reads Internet Cache Settings
- iexplore.exe (PID: 548)
- iexplore.exe (PID: 3644)
- iexplore.exe (PID: 3916)
Creates files in the user directory
- iexplore.exe (PID: 548)
- iexplore.exe (PID: 3916)
Creates files in the program directory
- Setup_WinThruster_2018.tmp (PID: 2252)
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Dropped object may contain Bitcoin addresses
- Setup_WinThruster_2018.tmp (PID: 2252)
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Application was dropped or rewritten from another process
- Setup_WinThruster_2018.tmp (PID: 2252)
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Application launched itself
- iexplore.exe (PID: 3644)
- iexplore.exe (PID: 3864)
Changes internet zones settings
- iexplore.exe (PID: 3644)
- iexplore.exe (PID: 3864)
Loads dropped or rewritten executable
- Setup_WinThruster_2018.tmp (PID: 2252)
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Creates a software uninstall entry
- Setup_WinThruster_2018.tmp (PID: 2252)
- FileViewPro-N-1.9.8.15.tmp (PID: 3076)
Reads settings of System Certificates
- WinThruster.exe (PID: 3804)
Reads internet explorer settings
- iexplore.exe (PID: 3916)
Changes settings of System certificates
- iexplore.exe (PID: 3916)
Adds / modifies Windows certificates
- iexplore.exe (PID: 3916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
51
Monitored processes
17
Malicious processes
10
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 548 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3644 CREDAT:71937 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 0 Version: 8.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1056 | "C:\Program Files\WinThruster\WinThruster.exe" /setLang 1 /install /forceExit | C:\Program Files\WinThruster\WinThruster.exe | — | Setup_WinThruster_2018.tmp | |||||||||||
User: admin Company: Solvusoft Integrity Level: HIGH Description: WinThruster Exit code: 0 Version: 1.3.5.138 Modules
| |||||||||||||||
| 1744 | "C:\Windows\explorer.exe" C:\Program Files\FileViewPro\FileViewPro.exe | C:\Windows\explorer.exe | — | FileViewPro.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Explorer Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2004 | "C:\Program Files\FileViewPro\FileViewPro.exe" | C:\Program Files\FileViewPro\FileViewPro.exe | explorer.exe | ||||||||||||
User: admin Company: Solvusoft Corporation Integrity Level: MEDIUM Description: FileViewPro Exit code: 0 Version: 1.9.8.15 Modules
| |||||||||||||||
| 2252 | "C:\Users\admin\AppData\Local\Temp\is-V35MN.tmp\Setup_WinThruster_2018.tmp" /SL5="$5016E,2218989,141824,C:\Users\admin\AppData\Local\Temp\{5364B363-2D1D-405A-9ADF-13AEF1A8DC28}\Setup_WinThruster_2018.exe" /verysilent /LANG en-us /scan | C:\Users\admin\AppData\Local\Temp\is-V35MN.tmp\Setup_WinThruster_2018.tmp | Setup_WinThruster_2018.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2368 | "C:\Users\admin\AppData\Local\Temp\{3FA725EB-27E2-4C5C-A108-66E4AEC5F03C}\FileViewPro-N-1.9.8.15.exe" /verysilent /norestart /LANG en-us | C:\Users\admin\AppData\Local\Temp\{3FA725EB-27E2-4C5C-A108-66E4AEC5F03C}\FileViewPro-N-1.9.8.15.exe | Setup_FileViewPro_2019[1].exe | ||||||||||||
User: admin Company: Solvusoft Corporation Integrity Level: HIGH Description: FileViewPro Setup Exit code: 0 Version: 1.9.8.15 Modules
| |||||||||||||||
| 2840 | "C:\Users\admin\AppData\Local\Temp\{5364B363-2D1D-405A-9ADF-13AEF1A8DC28}\Setup_WinThruster_2018.exe" /verysilent /LANG en-us /scan | C:\Users\admin\AppData\Local\Temp\{5364B363-2D1D-405A-9ADF-13AEF1A8DC28}\Setup_WinThruster_2018.exe | Setup_FileViewPro_2019[1].exe | ||||||||||||
User: admin Company: Solvusoft Integrity Level: HIGH Description: WinThruster Setup Exit code: 0 Version: 1.3.5.138 Modules
| |||||||||||||||
| 3000 | "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\WinThruster\IsLicense50.dll" | C:\Windows\system32\regsvr32.exe | — | Setup_WinThruster_2018.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3028 | "C:\Program Files\FileViewPro\FileViewPro.exe" /restartWithNoAdminRights lang=en-us | C:\Program Files\FileViewPro\FileViewPro.exe | FileViewPro-N-1.9.8.15.tmp | ||||||||||||
User: admin Company: Solvusoft Corporation Integrity Level: HIGH Description: FileViewPro Exit code: 0 Version: 1.9.8.15 Modules
| |||||||||||||||
| 3076 | "C:\Users\admin\AppData\Local\Temp\is-LRF87.tmp\FileViewPro-N-1.9.8.15.tmp" /SL5="$7016E,60213002,131584,C:\Users\admin\AppData\Local\Temp\{3FA725EB-27E2-4C5C-A108-66E4AEC5F03C}\FileViewPro-N-1.9.8.15.exe" /verysilent /norestart /LANG en-us | C:\Users\admin\AppData\Local\Temp\is-LRF87.tmp\FileViewPro-N-1.9.8.15.tmp | FileViewPro-N-1.9.8.15.exe | ||||||||||||
User: admin Company: SolvuSoft Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
Total events
3 287
Read events
2 899
Write events
371
Delete events
17
Modification events
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones |
| Operation: | write | Name: | SecuritySafe |
Value: 1 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
| Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
| Operation: | write | Name: | SavedLegacySettings |
Value: 4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active |
| Operation: | write | Name: | {580AD393-3F32-11E9-BEEC-5254004A04AF} |
Value: 0 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Type |
Value: 4 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Count |
Value: 3 | |||
| (PID) Process: | (3644) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore |
| Operation: | write | Name: | Time |
Value: E3070300020005000A00230008000901 | |||
Executable files
84
Suspicious files
9
Text files
177
Unknown types
18
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3644 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico | — | |
MD5:— | SHA256:— | |||
| 3644 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico | — | |
MD5:— | SHA256:— | |||
| 3644 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DFFC673FB49ADF668C.TMP | — | |
MD5:— | SHA256:— | |||
| 3644 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\~DF2EEABC9853559EE0.TMP | — | |
MD5:— | SHA256:— | |||
| 3644 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\RecoveryStore.{580AD393-3F32-11E9-BEEC-5254004A04AF}.dat | — | |
MD5:— | SHA256:— | |||
| 2252 | Setup_WinThruster_2018.tmp | C:\Program Files\WinThruster\is-UI8A3.tmp | — | |
MD5:— | SHA256:— | |||
| 2252 | Setup_WinThruster_2018.tmp | C:\Program Files\WinThruster\is-4AHOB.tmp | — | |
MD5:— | SHA256:— | |||
| 548 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@www.solvusoft[1].txt | text | |
MD5:— | SHA256:— | |||
| 548 | iexplore.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\admin@solvusoft[1].txt | text | |
MD5:— | SHA256:— | |||
| 2252 | Setup_WinThruster_2018.tmp | C:\Program Files\WinThruster\is-U75VV.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
34
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3108 | Setup_FileViewPro_2019[1].exe | GET | 200 | 95.100.77.34:80 | http://www.solvusoft.com/file-downloads/builds/fileviewpro/installers/2018_12_8-22-40-N/FileViewPro-N-1.9.8.15.exe | unknown | executable | 58.0 Mb | whitelisted |
3916 | iexplore.exe | GET | 301 | 104.103.81.30:80 | http://www.solvusoft.com/en-us/fileviewpro/install/?utm_source=fileviewpro&utm_campaign=version_1.9.8.15_12212018&utm_medium=bundle-winthruster | NL | html | 177 b | whitelisted |
3108 | Setup_FileViewPro_2019[1].exe | GET | 200 | 95.100.77.34:80 | http://www.solvusoft.com/file-downloads/builds/fileviewpro/res/resources.1.0.0.27n | unknown | compressed | 1.57 Mb | whitelisted |
3108 | Setup_FileViewPro_2019[1].exe | GET | 200 | 95.100.77.34:80 | http://www.solvusoft.com/file-downloads/builds/static_delivery/installers/winthruster/solvusoft/072418_1.3.5.138/Setup_WinThruster_2018.exe | unknown | executable | 2.63 Mb | whitelisted |
2004 | FileViewPro.exe | GET | 200 | 104.103.81.30:80 | http://www.solvusoft.com/file-downloads/builds/fileviewpro/updates/update.php | NL | text | 140 b | whitelisted |
3804 | WinThruster.exe | GET | 301 | 95.100.77.34:80 | http://www.solvusoft.com/api/check-config.php?k=build_tracking | unknown | html | 177 b | whitelisted |
3804 | WinThruster.exe | GET | 200 | 52.38.153.176:80 | http://tracking.solvusoft.com/?PID=winthruster&os=v6.1.7601x32sp1.0ws&uid=4c8a055f29724d39853d983ca6c8751c&lang=en&build_id=WTH_VERSION_1.3.5.138_SUBNAME_ABTEST&fixclicks=0&errcnt=&paid=0&aboutclck=&askclose=&askno=&askyes=&buyactiv=&buyinstant=&buylater=&buypaste=&inetapply=&mrireg=&mriresid=&mristrtp=&mristtgs=&mriunnec=&restorecrt=&scanfilec=&scanregc=&scanresc=&scanshtsc=&scantotalc=&schedclck=&secapply=&srtpclick=&stopfiles=&stopregs=&stopresus=&stoptotals=&sysapply=&topshtcts=&virt=0&unnfsize=0.00%20B&resfsize=0.00%20B®brkdwn=&event_id=install | US | binary | 1 b | unknown |
3028 | FileViewPro.exe | GET | 200 | 91.199.212.52:80 | http://crt.comodoca.com/COMODORSAAddTrustCA.crt | GB | der | 1.37 Kb | whitelisted |
3644 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
3864 | iexplore.exe | GET | 200 | 204.79.197.200:80 | http://www.bing.com/favicon.ico | US | image | 237 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
548 | iexplore.exe | 95.100.77.34:443 | www.solvusoft.com | Akamai Technologies, Inc. | — | whitelisted |
3644 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
3108 | Setup_FileViewPro_2019[1].exe | 172.217.23.164:80 | www.google.com | Google Inc. | US | whitelisted |
3108 | Setup_FileViewPro_2019[1].exe | 95.100.77.34:80 | www.solvusoft.com | Akamai Technologies, Inc. | — | whitelisted |
3804 | WinThruster.exe | 95.100.77.34:80 | www.solvusoft.com | Akamai Technologies, Inc. | — | whitelisted |
3804 | WinThruster.exe | 95.100.77.34:443 | www.solvusoft.com | Akamai Technologies, Inc. | — | whitelisted |
3804 | WinThruster.exe | 52.38.153.176:80 | tracking.solvusoft.com | Amazon.com, Inc. | US | unknown |
3028 | FileViewPro.exe | 91.199.212.52:80 | crt.comodoca.com | Comodo CA Ltd | GB | suspicious |
3916 | iexplore.exe | 104.103.81.30:80 | www.solvusoft.com | Akamai Technologies, Inc. | NL | whitelisted |
3916 | iexplore.exe | 104.103.81.30:443 | www.solvusoft.com | Akamai Technologies, Inc. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
www.solvusoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
www.google.com |
| malicious |
tracking.solvusoft.com |
| unknown |
crt.comodoca.com |
| whitelisted |
www.googletagmanager.com |
| whitelisted |
seal.websecurity.norton.com |
| whitelisted |
www.googlecommerce.com |
| whitelisted |
apis.google.com |
| whitelisted |
js-agent.newrelic.com |
| whitelisted |
Threats
Process | Message |
|---|---|
Setup_FileViewPro_2019[1].exe | C:\Users\admin\AppData\Local\Temp\{6875CF61-28A6-4A35-8305-0BD481593BD0}\resources.db |
FileViewPro.exe | 1648
|
FileViewPro.exe | Windows.Forms.Application.StartupPath C:\Program Files\FileViewPro
|
FileViewPro.exe | Globals.GetLangFolderName() Langs
|
FileViewPro.exe | LanguageFolderPath C:\Program Files\FileViewPro\Langs
|
FileViewPro.exe | 1564
|
FileViewPro.exe | Windows.Forms.Application.StartupPath C:\Program Files\FileViewPro
|
FileViewPro.exe | Globals.GetLangFolderName() Langs
|
FileViewPro.exe | LanguageFolderPath C:\Program Files\FileViewPro\Langs
|
FileViewPro.exe | Translator.MainInstance.CurrentLanguage en
|