| File name: | viewndowlp.exe |
| Full analysis: | https://app.any.run/tasks/c48b3a73-7665-412f-87f9-3ffc6f44c438 |
| Verdict: | Malicious activity |
| Analysis date: | February 27, 2024, 20:23:40 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 45DC770549A636543076E997F0A30637 |
| SHA1: | 1B239A825198DB0801BE8DA11DCED088E14747A9 |
| SHA256: | 9E51F4F0E3B15565D5FCC874888E331F35D0948795E5C46A2EF74BFB3FF9C946 |
| SSDEEP: | 98304:R+cD4dnXuZhyOFUZmIrYvrPRPyvW0QSCma3cNedTuzU1PlcLsXbyW9HRxRd9Bqr+:fJBk |
MALICIOUS
Drops the executable file immediately after the start
- viewndowlp.exe (PID: 3972)
- viewndowlp.tmp (PID: 2044)
Changes the autorun value in the registry
- Viewndow.exe (PID: 3660)
SUSPICIOUS
Executable content was dropped or overwritten
- viewndowlp.exe (PID: 3972)
- viewndowlp.tmp (PID: 2044)
Reads the Windows owner or organization settings
- viewndowlp.tmp (PID: 2044)
Reads settings of System Certificates
- viewndowlp.tmp (PID: 2044)
- Viewndow.exe (PID: 3660)
Reads the Internet Settings
- viewndowlp.tmp (PID: 2044)
- Viewndow.exe (PID: 3660)
Process drops legitimate windows executable
- viewndowlp.tmp (PID: 2044)
Reads security settings of Internet Explorer
- Viewndow.exe (PID: 3660)
Reads Microsoft Outlook installation path
- Viewndow.exe (PID: 3660)
Reads Internet Explorer settings
- Viewndow.exe (PID: 3660)
Checks Windows Trust Settings
- Viewndow.exe (PID: 3660)
INFO
Create files in a temporary directory
- viewndowlp.exe (PID: 3972)
- viewndowlp.tmp (PID: 2044)
Checks supported languages
- viewndowlp.exe (PID: 3972)
- wmpnscfg.exe (PID: 2160)
- viewndowlp.tmp (PID: 2044)
- Viewndow.exe (PID: 3660)
Reads the computer name
- wmpnscfg.exe (PID: 2160)
- viewndowlp.tmp (PID: 2044)
- Viewndow.exe (PID: 3660)
Reads the machine GUID from the registry
- viewndowlp.tmp (PID: 2044)
- Viewndow.exe (PID: 3660)
Reads the software policy settings
- viewndowlp.tmp (PID: 2044)
- Viewndow.exe (PID: 3660)
Creates files or folders in the user directory
- viewndowlp.tmp (PID: 2044)
- Viewndow.exe (PID: 3660)
Creates a software uninstall entry
- viewndowlp.tmp (PID: 2044)
Reads Environment values
- Viewndow.exe (PID: 3660)
Reads product name
- Viewndow.exe (PID: 3660)
Reads the time zone
- Viewndow.exe (PID: 3660)
Checks proxy server information
- Viewndow.exe (PID: 3660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (65.1) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (24.6) |
| .dll | | | Win32 Dynamic Link Library (generic) (3.9) |
| .exe | | | Win32 Executable (generic) (2.6) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:04:14 16:10:23+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 53248 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 1.0.6.0 |
| ProductVersionNumber: | 1.0.6.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Viewndow |
| FileDescription: | Viewndow Setup |
| FileVersion: | 1.0.6.0 |
| LegalCopyright: | Copyright © 2023 Viewndow |
| OriginalFileName: | |
| ProductName: | Viewndow |
| ProductVersion: | 1.0.6.0 |
Total processes
39
Monitored processes
4
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2044 | "C:\Users\admin\AppData\Local\Temp\is-9SHO4.tmp\viewndowlp.tmp" /SL5="$E0170,3243931,796160,C:\Users\admin\AppData\Local\Temp\viewndowlp.exe" | C:\Users\admin\AppData\Local\Temp\is-9SHO4.tmp\viewndowlp.tmp | viewndowlp.exe | ||||||||||||
User: admin Company: Viewndow Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 2160 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3660 | "C:\Users\admin\AppData\Local\Programs\Viewndow\Viewndow.exe" | C:\Users\admin\AppData\Local\Programs\Viewndow\Viewndow.exe | viewndowlp.tmp | ||||||||||||
User: admin Integrity Level: MEDIUM Description: Viewndow Exit code: 0 Version: 1.0.6.0 Modules
| |||||||||||||||
| 3972 | "C:\Users\admin\AppData\Local\Temp\viewndowlp.exe" | C:\Users\admin\AppData\Local\Temp\viewndowlp.exe | explorer.exe | ||||||||||||
User: admin Company: Viewndow Integrity Level: MEDIUM Description: Viewndow Setup Exit code: 0 Version: 1.0.6.0 Modules
| |||||||||||||||
Total events
12 411
Read events
12 327
Write events
78
Delete events
6
Modification events
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: FC070000E84AE5E1BA69DA01 | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: 0C70BD60F034F705022254F73874587DFD88BE8B896C895D255B55BC298ADED2 | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFiles0000 |
Value: C:\Users\admin\AppData\Local\Programs\Viewndow\Viewndow.exe | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFilesHash |
Value: BB1C6D251BD40E5EE577F80D59B26F2AE4FEB22539A8E53DF5FAAB1D20CFCE85 | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\TopperJob |
| Operation: | write | Name: | version |
Value: 1.0.6.0 | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8D6FF72A-E431-43A2-9620-1254B047EC86}_is1 |
| Operation: | write | Name: | Inno Setup: Setup Version |
Value: 6.2.1 | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8D6FF72A-E431-43A2-9620-1254B047EC86}_is1 |
| Operation: | write | Name: | Inno Setup: App Path |
Value: C:\Users\admin\AppData\Local\Programs\Viewndow | |||
| (PID) Process: | (2044) viewndowlp.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{8D6FF72A-E431-43A2-9620-1254B047EC86}_is1 |
| Operation: | write | Name: | InstallLocation |
Value: C:\Users\admin\AppData\Local\Programs\Viewndow\ | |||
Executable files
19
Suspicious files
6
Text files
5
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\Local\Temp\Cab1BE0.tmp | compressed | |
MD5:753DF6889FD7410A2E9FE333DA83A429 | SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78 | |||
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\Local\Temp\is-JKUMQ.tmp\consent.rtf | text | |
MD5:757477E7C7B861FEF867D4D67DBCEA95 | SHA256:7029BE3900E8A50FD6C4A4FD81DC925F64C156125F8F12765D8AE5C1AE100DF6 | |||
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\Local\Programs\Viewndow\is-48IHU.tmp | executable | |
MD5:2E467BA532ACF588C6EB1F5A28EF0146 | SHA256:CE0AD8466A2E559D1926C310DC282BD1979140A1E4B9A8C56B9F4F5A8B47A615 | |||
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\Local\Programs\Viewndow\unins000.exe | executable | |
MD5:2E467BA532ACF588C6EB1F5A28EF0146 | SHA256:CE0AD8466A2E559D1926C310DC282BD1979140A1E4B9A8C56B9F4F5A8B47A615 | |||
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:753DF6889FD7410A2E9FE333DA83A429 | SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78 | |||
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\Local\Programs\Viewndow\is-P9U1Q.tmp | executable | |
MD5:3CAAC8E1A6F73F7B53D9F29CA6429C2E | SHA256:59B5C25765F5363536C1DFA9B405FF12286527852EDBD517E12775956D8262AF | |||
| 3972 | viewndowlp.exe | C:\Users\admin\AppData\Local\Temp\is-9SHO4.tmp\viewndowlp.tmp | executable | |
MD5:2E467BA532ACF588C6EB1F5A28EF0146 | SHA256:CE0AD8466A2E559D1926C310DC282BD1979140A1E4B9A8C56B9F4F5A8B47A615 | |||
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\Local\Programs\Viewndow\Gh.Common.dll | executable | |
MD5:E5C829160DE5875812E6B113C989BDE1 | SHA256:DFBD775EFA489D160110184C3173224A4EA3635397C4983C09B66FAB41B5F4A6 | |||
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\Local\Programs\Viewndow\Countly.dll | executable | |
MD5:304E0F414C764D7A5C2647D721646E13 | SHA256:86CB999EF8B3D20CB81B69FF03580CC6F3D2CA6CC699AB0810FAB8CAC0E7397E | |||
| 2044 | viewndowlp.tmp | C:\Users\admin\AppData\Local\Programs\Viewndow\is-TI8DO.tmp | executable | |
MD5:304E0F414C764D7A5C2647D721646E13 | SHA256:86CB999EF8B3D20CB81B69FF03580CC6F3D2CA6CC699AB0810FAB8CAC0E7397E | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
11
DNS requests
7
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2044 | viewndowlp.tmp | GET | 200 | 173.222.108.243:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?885aed0998e37d88 | unknown | compressed | 67.5 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
2044 | viewndowlp.tmp | 188.114.97.3:443 | stats.viewndow.com | CLOUDFLARENET | NL | unknown |
2044 | viewndowlp.tmp | 173.222.108.243:80 | ctldl.windowsupdate.com | Akamai International B.V. | CH | unknown |
2044 | viewndowlp.tmp | 188.114.96.3:443 | stats.viewndow.com | CLOUDFLARENET | NL | unknown |
3660 | Viewndow.exe | 88.198.66.150:5001 | correspongfast.org | — | — | unknown |
3660 | Viewndow.exe | 148.251.184.159:5001 | equickping.com | — | — | unknown |
3660 | Viewndow.exe | 188.114.97.3:443 | stats.viewndow.com | CLOUDFLARENET | NL | unknown |
3660 | Viewndow.exe | 104.16.123.96:443 | www.cloudflare.com | CLOUDFLARENET | — | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
stats.viewndow.com |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
track.viewndow.com |
| unknown |
correspongfast.org |
| unknown |
equickping.com |
| unknown |
www.cloudflare.com |
| whitelisted |
update.viewndow.com |
| unknown |