File name:

9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe

Full analysis: https://app.any.run/tasks/1cf72fdb-3fb2-4e7d-9f6a-b64464cacadd
Verdict: Malicious activity
Analysis date: June 19, 2024, 23:23:09
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

E0EFCD15DAAA87D864F56C803156AE43

SHA1:

5327DD70591FD8687B5514C44C3604D1728F909E

SHA256:

9601F3921C2CD270B6DA0BA265C06BAE94FD7D4DC512E8CB82718EAA24ACCC43

SSDEEP:

98304:UinwbtVakUZc76B8BTBfKFztGvfM12Tcns06B1wLeuTCFdjvZgEMbWwikTVMJR8+:0LdlpxzljlL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • MSTeamsSetup_c_l_.exe (PID: 3556)
      • Update.exe (PID: 2820)

    • Connects to the CnC server

      • rundll32.exe (PID: 5272)

    • The DLL Hijacking

      • Teams.exe (PID: 2044)
      • Teams.exe (PID: 5344)

    • Changes the autorun value in the registry

      • Teams.exe (PID: 2436)

    • Registers / Runs the DLL via REGSVR32.EXE

      • Update.exe (PID: 2820)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • Update.exe (PID: 2820)
      • MSTeamsSetup_c_l_.exe (PID: 3556)

    • Reads security settings of Internet Explorer

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • Update.exe (PID: 2820)
      • Teams.exe (PID: 2436)

    • Starts a Microsoft application from unusual location

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • MSTeamsSetup_c_l_.exe (PID: 3556)

    • Reads the date of Windows installation

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • Update.exe (PID: 2820)

    • Executable content was dropped or overwritten

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • MSTeamsSetup_c_l_.exe (PID: 3556)
      • Update.exe (PID: 2820)

    • Uses RUNDLL32.EXE to load library

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)

    • The process drops C-runtime libraries

      • Update.exe (PID: 2820)

    • Checks Windows Trust Settings

      • Update.exe (PID: 2820)

    • Application launched itself

      • Teams.exe (PID: 4000)
      • Teams.exe (PID: 2436)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 4028)
      • regsvr32.exe (PID: 1740)

    • Creates a software uninstall entry

      • Update.exe (PID: 2820)

    • Searches for installed software

      • Update.exe (PID: 2820)

  • INFO

    • Checks supported languages

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • MSTeamsSetup_c_l_.exe (PID: 3556)
      • Update.exe (PID: 2820)
      • Squirrel.exe (PID: 3688)
      • Teams.exe (PID: 4000)
      • Update.exe (PID: 3992)
      • Teams.exe (PID: 2044)
      • Teams.exe (PID: 2112)
      • Teams.exe (PID: 2436)
      • Teams.exe (PID: 5344)
      • Teams.exe (PID: 2936)
      • Teams.exe (PID: 2888)
      • Teams.exe (PID: 5808)
      • Teams.exe (PID: 2276)
      • Teams.exe (PID: 3880)

    • Reads the computer name

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • Update.exe (PID: 2820)
      • Squirrel.exe (PID: 3688)
      • Teams.exe (PID: 4000)
      • Update.exe (PID: 3992)
      • Teams.exe (PID: 2044)
      • Teams.exe (PID: 2112)
      • Teams.exe (PID: 2436)
      • Teams.exe (PID: 5344)
      • Teams.exe (PID: 2936)
      • Teams.exe (PID: 5808)

    • Create files in a temporary directory

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • Update.exe (PID: 2820)
      • Teams.exe (PID: 4000)
      • Teams.exe (PID: 2436)

    • Process checks computer location settings

      • 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe (PID: 1332)
      • Update.exe (PID: 2820)
      • Teams.exe (PID: 4000)
      • Teams.exe (PID: 2436)
      • Teams.exe (PID: 2888)
      • Teams.exe (PID: 2276)
      • Teams.exe (PID: 3880)

    • Reads the machine GUID from the registry

      • Update.exe (PID: 2820)
      • Squirrel.exe (PID: 3688)
      • Update.exe (PID: 3992)
      • Teams.exe (PID: 2436)

    • Reads Environment values

      • Update.exe (PID: 2820)
      • Squirrel.exe (PID: 3688)
      • Teams.exe (PID: 4000)
      • Update.exe (PID: 3992)
      • Teams.exe (PID: 2436)

    • Reads Microsoft Office registry keys

      • Update.exe (PID: 2820)
      • Squirrel.exe (PID: 3688)
      • Update.exe (PID: 3992)
      • Teams.exe (PID: 4000)
      • Teams.exe (PID: 2436)

    • Disables trace logs

      • Update.exe (PID: 2820)
      • Update.exe (PID: 3992)
      • Squirrel.exe (PID: 3688)

    • Checks proxy server information

      • Update.exe (PID: 2820)
      • Teams.exe (PID: 4000)
      • Update.exe (PID: 3992)
      • Teams.exe (PID: 2436)
      • Squirrel.exe (PID: 3688)

    • Creates files or folders in the user directory

      • MSTeamsSetup_c_l_.exe (PID: 3556)
      • Update.exe (PID: 2820)
      • Squirrel.exe (PID: 3688)
      • Teams.exe (PID: 4000)
      • Update.exe (PID: 3992)
      • Teams.exe (PID: 2436)
      • Teams.exe (PID: 2936)

    • Reads the software policy settings

      • Update.exe (PID: 2820)
      • Update.exe (PID: 3992)
      • Teams.exe (PID: 2436)
      • Squirrel.exe (PID: 3688)

    • Reads product name

      • Teams.exe (PID: 4000)
      • Teams.exe (PID: 2436)

    • Reads CPU info

      • Teams.exe (PID: 4000)
      • Teams.exe (PID: 2436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:03:07 06:19:40+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.29
CodeSize: 234496
InitializedDataSize: 7798272
UninitializedDataSize: -
EntryPoint: 0x177c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.7.0.3315
ProductVersionNumber: 1.7.0.3315
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Microsoft Teams
FileVersion: 1.7.00.3315
InternalName: Setup.exe
LegalCopyright: Copyright (C) 2016 Microsoft. All rights reserved.
OriginalFileName: Setup.exe
ProductName: Microsoft Teams
ProductVersion: 1.7.00.3315
SquirrelAwareVersion: 1
CompanyName: Microsoft Corporation
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
20
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe rundll32.exe no specs rundll32.exe msteamssetup_c_l_.exe update.exe squirrel.exe teams.exe no specs update.exe teams.exe no specs teams.exe no specs teams.exe teams.exe no specs teams.exe teams.exe no specs teams.exe no specs teams.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs teams.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1332"C:\Users\admin\AppData\Local\Temp\9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe" C:\Users\admin\AppData\Local\Temp\9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Teams
Exit code:
0
Version:
1.7.00.3315
Modules
Images
c:\users\admin\appdata\local\temp\9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1740"C:\WINDOWS\SysWOW64\regsvr32.exe" /s /n /i:user "C:\Users\admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll"C:\Windows\SysWOW64\regsvr32.exe—Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2044"C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\Microsoft\Teams" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1836,i,8610081319510413677,2669308233474293127,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe—Teams.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Teams
Exit code:
0
Version:
1.7.00.15969
Modules
Images
c:\users\admin\appdata\local\microsoft\teams\current\teams.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2112"C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\Microsoft\Teams" --mojo-platform-channel-handle=2148 --field-trial-handle=1836,i,8610081319510413677,2669308233474293127,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe—Teams.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Teams
Exit code:
0
Version:
1.7.00.15969
Modules
Images
c:\users\admin\appdata\local\microsoft\teams\current\teams.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\users\admin\appdata\local\microsoft\teams\current\ffmpeg.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2260"C:\Windows\System32\rundll32.exe" "C:\Users\admin\AppData\Local\Temp\CleanUp.dll", TestC:\Windows\System32\rundll32.exe—9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
2276"C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=renderer --enable-wer --user-data-dir="C:\Users\admin\AppData\Roaming\Microsoft\Teams" --app-user-model-id=com.squirrel.Teams.Teams --app-path="C:\Users\admin\AppData\Local\Microsoft\Teams\current\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4472 --field-trial-handle=1824,i,7878461435629312275,7406317330464644521,131072 --enable-features=ContextBridgeMutability,SharedArrayBuffer,WinUseBrowserSpellChecker,WinUseHybridSpellChecker --disable-features=CalculateNativeWinOcclusion,ExtraCookieValidityChecks,ForcedColors,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --msteams-process-type=accountSelectWindow /prefetch:1C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe—Teams.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Teams
Version:
1.7.00.15969
Modules
Images
c:\users\admin\appdata\local\microsoft\teams\current\teams.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2436"C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-firstrunC:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe
Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Teams
Version:
1.7.00.15969
Modules
Images
c:\users\admin\appdata\local\microsoft\teams\current\teams.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2820"C:\Users\admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=MSTeamsSetup_c_l_.exe --bootstrapperModeC:\Users\admin\AppData\Local\SquirrelTemp\Update.exe
MSTeamsSetup_c_l_.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Teams classic
Exit code:
0
Version:
3.3.15.0
Modules
Images
c:\users\admin\appdata\local\squirreltemp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2888"C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=renderer --enable-wer --user-data-dir="C:\Users\admin\AppData\Roaming\Microsoft\Teams" --app-user-model-id=com.squirrel.Teams.Teams --app-path="C:\Users\admin\AppData\Local\Microsoft\Teams\current\resources\app.asar" --enable-sandbox --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3024 --field-trial-handle=1824,i,7878461435629312275,7406317330464644521,131072 --enable-features=ContextBridgeMutability,SharedArrayBuffer,WinUseBrowserSpellChecker,WinUseHybridSpellChecker --disable-features=CalculateNativeWinOcclusion,ExtraCookieValidityChecks,ForcedColors,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --msteams-process-type=notificationsManager /prefetch:1C:\Users\admin\AppData\Local\Microsoft\Teams\current\Teams.exe—Teams.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Teams
Version:
1.7.00.15969
Modules
Images
c:\users\admin\appdata\local\microsoft\teams\current\teams.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2896"C:\WINDOWS\system32\regsvr32.exe" /s /n /i:user "C:\Users\admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll"C:\Windows\SysWOW64\regsvr32.exe—Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
30 992
Read events
30 304
Write events
669
Delete events
19

Modification events

(PID) Process:(1332) 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1332) 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1332) 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1332) 9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2820) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2820) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2820) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2820) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2820) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2820) Update.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Update_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
348
Suspicious files
95
Text files
143
Unknown types
78

Dropped files

PID
Process
Filename
Type
2820Update.exeC:\Users\admin\AppData\Local\Microsoft\Teams\packages\Teams-1.7.00.15969-full.nupkg —
MD5:—
SHA256:—
13329601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exeC:\Users\admin\AppData\Local\Temp\MSTeamsSetup_c_l_.exeexecutable
MD5:CF0E0F57B68A11D099EC944200A6069D
SHA256:73354811E3109E265821124A18B1B7D9FD3DD1207BB46C18937D250C6AB46DEC
13329601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exeC:\Users\admin\AppData\Local\Temp\CleanUp.dllexecutable
MD5:7121D0E9FDD9FA23ACFEA6B4939C2A65
SHA256:82B246D8E6FFBA1ABAFFBD386470C45CEF8383AD19394C7C0622C9E62128CB94
2820Update.exeC:\Users\admin\AppData\Local\Microsoft\Teams\setup.jsonbinary
MD5:F57CCF6F5B9C1E2AAC3C144605B53AA5
SHA256:A92CCAA545B4AF7A81AC10C260291C3C33FB68197D150F8A42D1FBF74EB27648
3556MSTeamsSetup_c_l_.exeC:\Users\admin\AppData\Local\SquirrelTemp\endpoint.jsonbinary
MD5:677CAB9A8B50AD026CFA7625A35DD2D7
SHA256:07890DDA20815E1E57DCA9553F5DFCFF1B85F4A4369685D4991599E2618978F0
3556MSTeamsSetup_c_l_.exeC:\Users\admin\AppData\Local\SquirrelTemp\downloading.gifimage
MD5:3488A1749B859E969C01BA981036FAB6
SHA256:C3FA333FDBCE95D504AEE31912993DC17AB31324428F557AC774F7E98B049B99
3556MSTeamsSetup_c_l_.exeC:\Users\admin\AppData\Local\SquirrelTemp\Update.exeexecutable
MD5:8F0E958D7EF57D727ADCDA1C67C24C2B
SHA256:4955CC6E58049EF1E274F340C8425CC55B324278199C92AC0DE87DF05BFAD35D
3556MSTeamsSetup_c_l_.exeC:\Users\admin\AppData\Local\SquirrelTemp\background.gifimage
MD5:FF1F29DCA0451246C3CA6CB7B023434F
SHA256:753D7D351E427246E2B6CC86C45E21F952939E306C3EB2FDB1BD7D67842C64B8
2820Update.exeC:\Users\admin\AppData\Roaming\Microsoft\Teams\teams_install_session.jsonbinary
MD5:1DB6629A68FB884A324AD9D7E7C886F4
SHA256:53E2958EB5633D89DA1038674887F8563D61C6A138405734C218FCF89EB27DC0
2820Update.exeC:\Users\admin\AppData\Local\SquirrelTemp\setup.jsonbinary
MD5:F57CCF6F5B9C1E2AAC3C144605B53AA5
SHA256:A92CCAA545B4AF7A81AC10C260291C3C33FB68197D150F8A42D1FBF74EB27648
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
72
DNS requests
26
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
5636
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5636
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
2520
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
3928
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
2520
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2328
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2504
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
239.255.255.250:1900
—
—
—
unknown
5636
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2476
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5272
rundll32.exe
64.95.10.243:443
supfoundrysettlers.us
—
US
unknown
3040
OfficeClickToRun.exe
13.89.179.10:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3040
OfficeClickToRun.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5636
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5636
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2820
Update.exe
52.113.194.132:443
teams.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
supfoundrysettlers.us
  • 64.95.10.243
unknown
self.events.data.microsoft.com
  • 13.89.179.10
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
teams.live.com
  • 52.113.194.132
unknown
statics.teams.cdn.office.net
  • 23.48.23.9
  • 23.48.23.22
whitelisted
www.bing.com
  • 92.123.104.38
  • 92.123.104.59
  • 92.123.104.33
  • 92.123.104.34
  • 92.123.104.32
whitelisted
r.bing.com
  • 92.123.104.33
  • 92.123.104.59
  • 92.123.104.32
  • 92.123.104.34
  • 92.123.104.38
whitelisted

Threats

Found threats are available for the paid subscriptions
3 ETPRO signatures available at the full report
Process
Message
Update.exe
TelemetryManagerImpl creation started
Update.exe
Starting TelemetryManager constructor
Update.exe
Update.exe Information: 0 :
Update.exe
Update.exe Information: 0 :
Update.exe
Update.exe Information: 0 :
Update.exe
Performance counters are disabled. Skipping creation of counters category.
Update.exe
Update.exe Information: 0 :
Update.exe
RecordBatcherTask with ID 4 started.
Update.exe
Update.exe Information: 0 :
Update.exe
DataPackageSender with UserAgent name: AST-exe-C#, version: 3.3.15.0, [Ast_Default_Source]
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
9601f3921c2cd270b6da0ba265c06bae94fd7d4dc512e8cb82718eaa24accc43.exe