File name: | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe |
Full analysis: | https://app.any.run/tasks/b823f7f6-db65-4207-9e70-8c4f20d38bcc |
Verdict: | Malicious activity |
Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
Analysis date: | June 27, 2024, 06:41:15 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Tags: | |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | C6A1F489BDA66700F0481DA92BAA920C |
SHA1: | 97DB8AF5004CA98F9D2195B3ABC107F2609A1C2B |
SHA256: | 94884E8A17CAE503A062516EBEABEA0DF3A9326622ACC0C70747D7A685DD1CE5 |
SSDEEP: | 98304:BqS77Ke8NKNS7/RTLLq6lrNDthWJTK55Ds33lIKNlee4J/8Q9tOdWt1lSP+p4Y7K:Nix5mdPYeI++xjSQI |
.exe | | | Win32 Executable Delphi generic (57.2) |
---|---|---|
.exe | | | Win32 Executable (generic) (18.2) |
.exe | | | Win16/32 Executable Delphi generic (8.3) |
.exe | | | Generic Win/DOS Executable (8) |
.exe | | | DOS Executable Generic (8) |
ProductVersion: | 3.0.0.4073 |
---|---|
ProductName: | USTechSupport PC Optimizer |
LegalCopyright: | USTechSupport |
FileVersion: | USTechSupport PC Opt |
FileDescription: | USTechSupport PC Optimizer |
CompanyName: | USTechSupport LLC |
Comments: | This installation was built with Inno Setup. |
CharacterSet: | Unicode |
LanguageCode: | Neutral |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Win32 |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 3.0.0.4073 |
FileVersionNumber: | 3.0.0.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 5 |
ImageVersion: | 6 |
OSVersion: | 5 |
EntryPoint: | 0x113bc |
UninitializedDataSize: | - |
InitializedDataSize: | 150016 |
CodeSize: | 65024 |
LinkerVersion: | 2.25 |
PEType: | PE32 |
ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
TimeStamp: | 2015:07:16 13:24:20+00:00 |
MachineType: | Intel 386 or later, and compatibles |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
3400 | "C:\Users\admin\AppData\Local\Temp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe" | C:\Users\admin\AppData\Local\Temp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe | explorer.exe | ||||||||||||
User: admin Company: USTechSupport LLC Integrity Level: MEDIUM Description: USTechSupport PC Optimizer Exit code: 0 Version: USTechSupport PC Opt Modules
| |||||||||||||||
3332 | "C:\Users\admin\AppData\Local\Temp\is-75A1H.tmp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp" /SL5="$6015A,10137739,216064,C:\Users\admin\AppData\Local\Temp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe" | C:\Users\admin\AppData\Local\Temp\is-75A1H.tmp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | — | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
2944 | "C:\Users\admin\AppData\Local\Temp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe" /SPAWNWND=$F0168 /NOTIFYWND=$6015A | C:\Users\admin\AppData\Local\Temp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | ||||||||||||
User: admin Company: USTechSupport LLC Integrity Level: HIGH Description: USTechSupport PC Optimizer Exit code: 0 Version: USTechSupport PC Opt Modules
| |||||||||||||||
2100 | "C:\Users\admin\AppData\Local\Temp\is-JOJLV.tmp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp" /SL5="$6010A,10137739,216064,C:\Users\admin\AppData\Local\Temp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe" /SPAWNWND=$F0168 /NOTIFYWND=$6015A | C:\Users\admin\AppData\Local\Temp\is-JOJLV.tmp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
2348 | "C:\Windows\system32\net.exe" stop USTSPCODiskOptimizer /y | C:\Windows\System32\net.exe | — | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
2948 | C:\Windows\system32\net1 stop USTSPCODiskOptimizer /y | C:\Windows\System32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 2 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3176 | "C:\Windows\System32\taskkill.exe" /f /im "ustpcopt.exe" | C:\Windows\System32\taskkill.exe | — | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3292 | "C:\Windows\System32\taskkill.exe" /f /im "USTSPCOcheckupdate.exe" | C:\Windows\System32\taskkill.exe | — | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
1460 | "C:\Windows\System32\taskkill.exe" /f /im "USTSPCODefragSrv.exe" | C:\Windows\System32\taskkill.exe | — | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
3572 | "C:\Windows\System32\taskkill.exe" /f /im "USTSPCODefragSrv64.exe" | C:\Windows\System32\taskkill.exe | — | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
|
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Owner |
Value: 340800003A4FF4075DC8DA01 | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | SessionHash |
Value: 9D817C27714125D8154FDE01B3FA0E8968792FE10F9A600F02EEC9AC424F36A1 | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
Operation: | write | Name: | Sequence |
Value: 1 | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\USTechSupport\PC Optimizer |
Operation: | write | Name: | InstalledSuccessfully |
Value: 0 | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\USTechSupport\PC Optimizer |
Operation: | delete value | Name: | ProceedUninstall |
Value: | |||
(PID) Process: | (2100) Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | Key: | HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Memory Management |
Operation: | write | Name: | ClearPageFileAtShutdown |
Value: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2944 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.exe | C:\Users\admin\AppData\Local\Temp\is-JOJLV.tmp\Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | executable | |
MD5:C7DF23C785B368B9D2DC8B1094FC71A1 | SHA256:788CDC1D09FB37FD28DB040D6F03B9F578A529846178045BBCA3C0F566AB6CA1 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Users\admin\AppData\Local\Temp\is-IVKMV.tmp\USTSPCOsys.dll | executable | |
MD5:92ED56A5C1C7BCC3B7278CF16D45A385 | SHA256:D3C29B16CA1A6A80A89A5BFDE8117293308E64C94F4CE76792B9E4AD283C0A24 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Program Files\USTechSupport\MCPPCO\is-RRUJ9.tmp | executable | |
MD5:C7DF23C785B368B9D2DC8B1094FC71A1 | SHA256:788CDC1D09FB37FD28DB040D6F03B9F578A529846178045BBCA3C0F566AB6CA1 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Program Files\USTechSupport\MCPPCO\is-Q38F8.tmp | text | |
MD5:C69223100211EBEB172ACB81B3560116 | SHA256:CA231B3BBF32D1634F08C91CE483D7E1D3BFE86B002C5E34B720E5C18BF569D8 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Program Files\USTechSupport\MCPPCO\is-OMRUI.tmp | text | |
MD5:F87057BB4A50AC6C89B9BC37BF0D1AB6 | SHA256:389F1CF3AC2803B5558343CA91094413A29A5F2A7E1DA21EED986ACF7FBDB330 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Program Files\USTechSupport\MCPPCO\privprotector.ini | ini | |
MD5:C69223100211EBEB172ACB81B3560116 | SHA256:CA231B3BBF32D1634F08C91CE483D7E1D3BFE86B002C5E34B720E5C18BF569D8 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Users\admin\AppData\Local\Temp\is-IVKMV.tmp\zlibwapi.dll | executable | |
MD5:CC3B19389FC774B7DFB3D54977062798 | SHA256:F836BFB06D7EBECD189B4568E2A04664B4C75C4EF8A3A4010B2032287A0B06F4 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Program Files\USTechSupport\MCPPCO\is-SH0B3.tmp | text | |
MD5:2269F50102850322EDD1B020138C243C | SHA256:13F098D627D68273DBB4D2545BECE81029EE9C7AE79CC20F68523907F55F0B71 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Program Files\USTechSupport\MCPPCO\is-3I2LF.tmp | text | |
MD5:3209FCFB3AB94E712CA9833F0E3F4FB4 | SHA256:DAF94D1010651CE08EF88F88064F13BA6975B72AAD5777D3AC03CE37E9E00267 | |||
2100 | Hoax.Win32.Inrogatio.gen-94884e8a17cae503a062516ebeabea0df3a9326622acc0c70747d7a685dd1ce5.tmp | C:\Program Files\USTechSupport\MCPPCO\is-4TRHU.tmp | ini | |
MD5:6014743C8693F5AA0083BCE1B079D1ED | SHA256:DAAB1873BDD9618EAEB48F707B5CE51AA27AC0BDFE40F465F3C5F5087DBCB469 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
1372 | svchost.exe | GET | 304 | 199.232.214.172:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | unknown |
2420 | USTSPCOCheckUpdate.exe | GET | 200 | 165.227.176.158:80 | http://www.activate123.com/ustechsupportupdates/pcoptimizer/update.zip | unknown | — | — | unknown |
2420 | USTSPCOCheckUpdate.exe | GET | 302 | 165.227.176.158:80 | http://www.activate123.com/ustechsupportupdates/pcoptimizer/update.asp?brandname=MyCleanPC%20PC%20Optimizer&phonenumber=(888)%20590-8910 | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
1372 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 239.255.255.250:3702 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1372 | svchost.exe | 199.232.214.172:80 | ctldl.windowsupdate.com | FASTLY | US | unknown |
1372 | svchost.exe | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | unknown |
2420 | USTSPCOCheckUpdate.exe | 165.227.176.158:80 | www.activate123.com | DIGITALOCEAN-ASN | US | unknown |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.activate123.com |
| unknown |
Process | Message |
---|---|
ustpcopt.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
ustpcopt.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
USTSPCOCheckUpdate.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
USTSPCOCheckUpdate.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
USTSPCOPrivacyProtector.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
USTSPCOPrivacyProtector.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
USTSPCOSystemCleaner.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |
USTSPCOSystemCleaner.exe | %s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s |