File name:

MacroCreator-setup.exe

Full analysis: https://app.any.run/tasks/19ffd90a-d219-41f2-ac26-ae7a10496a3f
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: September 27, 2024, 17:43:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
adware
innosetup
loader
exploit
adaware
xor-url
generic
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

93A1B47EEDC7BEC9D4B76D03DA1719EE

SHA1:

0BE8C720DFF7AB941EC79541C9B7769ABBEABFA6

SHA256:

92FFA6DA0BEA664F2499CFBEC2A578BF882ED861CBB218B384E6AF6EA589DDE9

SSDEEP:

98304:/+QqZ8flc9UTCDz6/eWUTOF3Hbn9wnxykeEd128XdXjfgh+r8KIF0GEvBS4XrGEC:dVdgXkyuEfoLUKM2r5/0MQe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • INNOSETUP has been detected (SURICATA)

      • MacroCreator-setup.tmp (PID: 5556)

    • Starts NET.EXE for service management

      • WebCompanionInstaller.exe (PID: 5756)
      • net.exe (PID: 6688)

    • Starts Visual C# compiler

      • WebCompanion.exe (PID: 6276)
      • WebCompanion.exe (PID: 1420)

    • EXPLOIT has been detected (SURICATA)

      • WebCompanion.exe (PID: 1420)
      • WebCompanion.exe (PID: 6276)

    • ADAWARE has been detected (SURICATA)

      • WebCompanion.exe (PID: 6276)

    • XORed URL has been found (YARA)

      • DCIService.exe (PID: 6872)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • MacroCreator-setup.exe (PID: 5760)
      • MacroCreator-setup.exe (PID: 2640)
      • MacroCreator-setup.tmp (PID: 5556)
      • WcInstaller.exe (PID: 1076)
      • WebCompanionInstaller.exe (PID: 5756)
      • rundll32.exe (PID: 3276)
      • csc.exe (PID: 5484)
      • csc.exe (PID: 1636)

    • Reads security settings of Internet Explorer

      • MacroCreator-setup.tmp (PID: 6568)

    • Access to an unwanted program domain was detected

      • MacroCreator-setup.tmp (PID: 5556)
      • WebCompanion.exe (PID: 6276)

    • Reads the Windows owner or organization settings

      • MacroCreator-setup.tmp (PID: 5556)

    • Potential Corporate Privacy Violation

      • MacroCreator-setup.tmp (PID: 5556)

    • Drops 7-zip archiver for unpacking

      • WebCompanionInstaller.exe (PID: 5756)

    • Process drops legitimate windows executable

      • WebCompanionInstaller.exe (PID: 5756)

    • The process drops C-runtime libraries

      • WebCompanionInstaller.exe (PID: 5756)

    • Drops a system driver (possible attempt to evade defenses)

      • WebCompanionInstaller.exe (PID: 5756)
      • rundll32.exe (PID: 3276)

    • Uses RUNDLL32.EXE to load library

      • WebCompanionInstaller.exe (PID: 5756)

    • Starts CMD.EXE for commands execution

      • Lavasoft.WCAssistant.WinService.exe (PID: 7148)
      • WebCompanionInstaller.exe (PID: 5756)

    • Uses .NET C# to load dll

      • WebCompanion.exe (PID: 6276)
      • WebCompanion.exe (PID: 1420)

    • Executes as Windows Service

      • PresentationFontCache.exe (PID: 4088)
      • DCIService.exe (PID: 6872)
      • Lavasoft.WCAssistant.WinService.exe (PID: 7148)

    • Executing commands from ".cmd" file

      • WebCompanionInstaller.exe (PID: 5756)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 2448)
      • cmd.exe (PID: 4820)

  • INFO

    • Checks supported languages

      • MacroCreator-setup.exe (PID: 2640)
      • MacroCreator-setup.tmp (PID: 6568)
      • MacroCreator-setup.exe (PID: 5760)
      • MacroCreator-setup.tmp (PID: 5556)

    • Create files in a temporary directory

      • MacroCreator-setup.exe (PID: 2640)
      • MacroCreator-setup.exe (PID: 5760)
      • MacroCreator-setup.tmp (PID: 5556)

    • Reads the computer name

      • MacroCreator-setup.tmp (PID: 6568)
      • MacroCreator-setup.tmp (PID: 5556)

    • Process checks computer location settings

      • MacroCreator-setup.tmp (PID: 6568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(6872) DCIService.exe
Decrypted-URLs (1)http://rt.webcompanion.com/notifications/download/rt/ActiveFeatures.zip]
Decrypted-URLs (1)http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=PU210901_ac]
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 5.4.1.0
ProductVersionNumber: 5.4.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Cloversoft Serviços de Informática Ltda
FileDescription: Pulover's Macro Creator Setup
FileVersion: 5.4.1
LegalCopyright: Copyright © 2012-2021 Cloversoft Serviços de Informática Ltda
OriginalFileName:
ProductName: Pulover's Macro Creator
ProductVersion: 5.4.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
43
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start macrocreator-setup.exe macrocreator-setup.tmp no specs macrocreator-setup.exe #INNOSETUP macrocreator-setup.tmp wcinstaller.exe webcompanioninstaller.exe sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs net.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs #XOR-URL dciservice.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs #EXPLOIT webcompanion.exe lavasoft.wcassistant.winservice.exe cmd.exe no specs conhost.exe no specs netsh.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs #EXPLOIT webcompanion.exe macrocreator.exe csc.exe conhost.exe no specs cvtres.exe no specs presentationfontcache.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1076"C:\Users\admin\AppData\Local\Temp\is-DQH0U.tmp\WcInstaller.exe" --silent --partner=PU210901 --webprotectionC:\Users\admin\AppData\Local\Temp\is-DQH0U.tmp\WcInstaller.exe
MacroCreator-setup.tmp
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion Installer
Exit code:
0
Version:
8.9.0.992
Modules
Images
c:\users\admin\appdata\local\temp\is-dqh0u.tmp\wcinstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1108sc start DCIServiceC:\Windows\SysWOW64\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1312\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1404"C:\Program Files\MacroCreator\MacroCreator.exe"C:\Program Files\MacroCreator\MacroCreator.exe
MacroCreator-setup.tmp
User:
admin
Integrity Level:
MEDIUM
Description:
Pulover's Macro Creator
Version:
5.4.1
Modules
Images
c:\program files\macrocreator\macrocreator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
1420"C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe" --silent --afterinstall C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
WebCompanionInstaller.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion
Version:
8.9.0.992
Modules
Images
c:\program files (x86)\lavasoft\web companion\application\webcompanion.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1448C:\WINDOWS\system32\net1 start bddciC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\samcli.dll
1636"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\3hpiwx-4.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
WebCompanion.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
1780C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES70DF.tmp" "c:\Users\admin\AppData\Local\Temp\CSC70DE.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.9672 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2092"sc.exe" failure WCAssistantService reset= 30 actions= restart/60000C:\Windows\SysWOW64\sc.exe—WebCompanionInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
29 117
Read events
29 002
Write events
110
Delete events
5

Modification events

(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.1.2
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\MacroCreator
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\MacroCreator\
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
Pulover's Macro Creator
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
install64bit,pmcassociation
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
install32bit,desktopicon,portableinstall
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:Inno Setup: Language
Value:
english
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:DisplayName
Value:
Pulover's Macro Creator version 5.4.1
(PID) Process:(5556) MacroCreator-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{223FFB42-2D49-4AF6-9EF2-82B7D0CAF8B4}_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files\MacroCreator\unins000.exe"
Executable files
243
Suspicious files
160
Text files
202
Unknown types
3

Dropped files

PID
Process
Filename
Type
2640MacroCreator-setup.exeC:\Users\admin\AppData\Local\Temp\is-0PJHN.tmp\MacroCreator-setup.tmpexecutable
MD5:88198782F2AE55B1EAC21D760219049C
SHA256:BC2900F0E362C052ADF6C901B0F053DD0E31ABE85196D529725A19C02993B999
5556MacroCreator-setup.tmpC:\Program Files\MacroCreator\is-I6NRA.tmpexecutable
MD5:E8CA33F9F239F333244BB7272E9FE513
SHA256:E84149CA05C423D2024CB118D31AFE8AE79356511BB78FCB5E676FD16822EDBE
5556MacroCreator-setup.tmpC:\Users\admin\AppData\Local\Temp\is-DQH0U.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
5556MacroCreator-setup.tmpC:\Program Files\MacroCreator\MacroCreator_Help.chmbinary
MD5:0E7C86D54B369E372D575369D6D32634
SHA256:3D452EC7D5A78859E84F82FE471B1D8DBA8EA8EF196763B20877EE3E38F3991D
5556MacroCreator-setup.tmpC:\Program Files\MacroCreator\is-40CUM.tmpexecutable
MD5:391EB70F24F8276C1E857063E87C4495
SHA256:8D92F6C5F9F2643A8B323CD2CA50687BDC76103CFAE9387335D36A7D73100C94
5556MacroCreator-setup.tmpC:\Program Files\MacroCreator\is-GL96D.tmpexecutable
MD5:EE8CA3D88B0D80AD5E0BC270BFBDF507
SHA256:711A8CEEA0AE52371394B35A00D0B57893E4ABCAA29ECD9E34BA86FAE93C9277
5556MacroCreator-setup.tmpC:\Program Files\MacroCreator\is-BREQN.tmpbinary
MD5:0E7C86D54B369E372D575369D6D32634
SHA256:3D452EC7D5A78859E84F82FE471B1D8DBA8EA8EF196763B20877EE3E38F3991D
5556MacroCreator-setup.tmpC:\Users\admin\AppData\Roaming\MacroCreator\Lang\is-U4C92.tmptext
MD5:EA69316D3ACD83BF796A8170539EA05F
SHA256:FCB1EF450913DAF6156EC81EEBBE6B89FBAC8DA39FDCE922834B996A1E8D08D4
5556MacroCreator-setup.tmpC:\Program Files\MacroCreator\MacroCreator.exeexecutable
MD5:EE8CA3D88B0D80AD5E0BC270BFBDF507
SHA256:711A8CEEA0AE52371394B35A00D0B57893E4ABCAA29ECD9E34BA86FAE93C9277
5556MacroCreator-setup.tmpC:\Program Files\MacroCreator\Resources.dllexecutable
MD5:E8CA33F9F239F333244BB7272E9FE513
SHA256:E84149CA05C423D2024CB118D31AFE8AE79356511BB78FCB5E676FD16822EDBE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
44
DNS requests
19
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5556
MacroCreator-setup.tmp
GET
200
104.19.208.152:80
http://webcompanion.com/nano_download.php?partner=PU210901&webprotection
unknown
—
—
unknown
5756
WebCompanionInstaller.exe
GET
200
2.23.198.32:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTLXNCzDvBhHecWjg70iJhBW0InywQUanImetAe733nO2lR1GyNn5ASZqsCEE5A5DdU7eaMAAAAAFHTlH8%3D
unknown
—
—
whitelisted
5756
WebCompanionInstaller.exe
GET
200
2.23.198.32:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRp%2BmQDKauE4nIg%2FgknZHuBlLkfKgQUzolPglGqFaKEYsoxI2HSYfv4%2FngCEHTvSjTpoGUpJ37OBzkq8uU%3D
unknown
—
—
whitelisted
5756
WebCompanionInstaller.exe
GET
200
2.23.198.32:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D
unknown
—
—
whitelisted
5756
WebCompanionInstaller.exe
POST
200
64.18.87.82:80
http://wc-update-service.lavasoft.com/update.asmx
unknown
—
—
whitelisted
5756
WebCompanionInstaller.exe
GET
200
104.16.148.130:80
http://wcdownloadercdn.lavasoft.com/8.9.0.992/WebCompanion-8.9.0.992-prod.zip
unknown
—
—
whitelisted
6276
WebCompanion.exe
GET
200
104.19.208.152:80
http://webcompanion.com/version_logs?json=true&version=8.9.0.992
unknown
—
—
unknown
7148
Lavasoft.WCAssistant.WinService.exe
GET
200
69.192.162.201:80
http://ocsp.entrust.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRr2bwARTxMtEy9aspRAZg5QFhagQQUgrrWPZfOn89x6JI3r%2F2ztWk1V88CEDWvt3udNB9q%2FI%2BERqsxNSs%3D
unknown
—
—
whitelisted
6276
WebCompanion.exe
GET
200
64.18.87.81:80
http://wc-partners.lavasoft.com/Partner.svc/GetPartnerInfo?partner=PU210901_ac
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3588
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3588
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
webcompanion.com
  • 104.19.208.152
  • 104.19.159.224
unknown
ocsp.entrust.net
  • 2.23.198.32
  • 69.192.162.201
whitelisted
browser.pipe.aria.microsoft.com
  • 13.89.179.8
whitelisted
wc-update-service.lavasoft.com
  • 64.18.87.82
  • 64.18.87.81
whitelisted
wcdownloadercdn.lavasoft.com
  • 104.16.148.130
  • 104.16.149.130
whitelisted
rt.webcompanion.com
  • 104.19.159.224
  • 104.19.208.152
unknown
acs.lavasoft.com
  • 104.16.149.130
  • 104.16.148.130
whitelisted

Threats

PID
Process
Class
Message
5556
MacroCreator-setup.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
5556
MacroCreator-setup.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] InnoSetup Installer
5556
MacroCreator-setup.tmp
Misc activity
ET INFO EXE - Served Attached HTTP
5756
WebCompanionInstaller.exe
Potentially Bad Traffic
ET HUNTING Terse Request for Zip File (GET)
—
—
Potentially Bad Traffic
ET HUNTING Terse Request for Zip File (GET)
6276
WebCompanion.exe
Potentially Bad Traffic
ET HUNTING Terse Request for Zip File (GET)
6276
WebCompanion.exe
Attempted Administrator Privilege Gain
AV EXPLOIT Potential ZIP file exploiting CVE-2023-36413
6276
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
6276
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
6276
WebCompanion.exe
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Adaware Web Companion
Process
Message
WebCompanionInstaller.exe
Detecting windows culture
WebCompanionInstaller.exe
9/27/2024 5:44:03 PM :-> Starting installer 8.9.0.992 with: .\WebCompanionInstaller.exe --partner=PU210901 --webprotection --version=8.9.0.992 --silent --partner=PU210901 --webprotection, Run as admin: True
WebCompanionInstaller.exe
Failed to report progress in SendPostRequest: System.Net.WebException: The remote name could not be resolved: 'flow.lavasoft.com' at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context) at System.Net.HttpWebRequest.GetRequestStream() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanionInstaller.exe
SecurityProtocol set to 4032
WebCompanionInstaller.exe
Preparing for installing Web Companion
WebCompanionInstaller.exe
Failed to report progress in SendPostRequest: System.Net.WebException: The remote name could not be resolved: 'flow.lavasoft.com' at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context) at System.Net.HttpWebRequest.GetRequestStream() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanionInstaller.exe
9/27/2024 5:44:03 PM :-> Generating Machine and Install Id ...
WebCompanionInstaller.exe
9/27/2024 5:44:03 PM :-> Machine Id and Install Id has been generated
WebCompanionInstaller.exe
Failed to report progress in SendPostRequest: System.Net.WebException: The remote name could not be resolved: 'flow.lavasoft.com' at System.Net.HttpWebRequest.GetRequestStream(TransportContext& context) at System.Net.HttpWebRequest.GetRequestStream() at WebCompanionInstaller.Utils.RestUtils.SendPostRequest(String url, String body)
WebCompanionInstaller.exe
9/27/2024 5:44:03 PM :-> Checking prerequisites ...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MacroCreator-setup.exe