File name:

systeminformer-3.0.7660-release-setup.exe

Full analysis: https://app.any.run/tasks/5a513abf-5312-4ed6-9f18-63179f156546
Verdict: Malicious activity
Analysis date: July 29, 2024, 08:38:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0D909A4A638465A17BC9F37C5024E574

SHA1:

EAB2BC1CA6EBFA17B95B8CACEBCB04043238164E

SHA256:

A82821A4C18EF940354B84CD625CE0FD8ED5CFBA5418014063F054071BD5FCCD

SSDEEP:

98304:BfuShiqGEHMUGmL1Yt0zJWL9omlWA9ag2liM1UIWMK1CIV3YCQmJhax83+m13oLm:IlKBUMjqQBJa0Kq5JTtIYHTJ5LSGIuy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • systeminformer-3.0.7660-release-setup.exe (PID: 6056)
      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • systeminformer-3.0.7660-release-setup.exe (PID: 6056)
      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)
      • SystemInformer.exe (PID: 6176)

    • Reads the date of Windows installation

      • systeminformer-3.0.7660-release-setup.exe (PID: 6056)
      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)

    • Application launched itself

      • systeminformer-3.0.7660-release-setup.exe (PID: 6056)

    • Creates a software uninstall entry

      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)

    • Executable content was dropped or overwritten

      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)

    • Drops a system driver (possible attempt to evade defenses)

      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)

    • The process creates files with name similar to system file names

      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)

    • Checks Windows Trust Settings

      • SystemInformer.exe (PID: 6176)

  • INFO

    • Checks supported languages

      • systeminformer-3.0.7660-release-setup.exe (PID: 6056)
      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)
      • SystemInformer.exe (PID: 6176)

    • Reads the computer name

      • systeminformer-3.0.7660-release-setup.exe (PID: 6056)
      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)
      • SystemInformer.exe (PID: 6176)

    • Process checks computer location settings

      • systeminformer-3.0.7660-release-setup.exe (PID: 6056)
      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)

    • Creates files in the program directory

      • systeminformer-3.0.7660-release-setup.exe (PID: 2736)

    • Reads the time zone

      • SystemInformer.exe (PID: 6176)

    • Reads CPU info

      • SystemInformer.exe (PID: 6176)

    • Reads the machine GUID from the registry

      • SystemInformer.exe (PID: 6176)

    • Reads the software policy settings

      • SystemInformer.exe (PID: 6176)

    • Checks proxy server information

      • SystemInformer.exe (PID: 6176)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2054:10:22 23:54:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 253952
InitializedDataSize: 15585280
UninitializedDataSize: -
EntryPoint: 0x20300
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 3.0.12187.7660
ProductVersionNumber: 3.0.12187.7660
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: System Informer
FileDescription: System Informer - Setup
FileVersion: 3.0.12187.7660
InternalName: systeminformer-setup.exe
LegalCopyright: Copyright (c) Winsider Seminars & Solutions, Inc. All rights reserved.
OriginalFileName: systeminformer-setup.exe
ProductName: System Informer
ProductVersion: 3.0.12187.7660
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start systeminformer-3.0.7660-release-setup.exe no specs systeminformer-3.0.7660-release-setup.exe slui.exe no specs systeminformer.exe

Process information

PID
CMD
Path
Indicators
Parent process
2736"C:\Users\admin\AppData\Local\Temp\systeminformer-3.0.7660-release-setup.exe" "C:\Users\admin\AppData\Local\Temp\systeminformer-3.0.7660-release-setup.exe" C:\Users\admin\AppData\Local\Temp\systeminformer-3.0.7660-release-setup.exe
systeminformer-3.0.7660-release-setup.exe
User:
admin
Company:
System Informer
Integrity Level:
HIGH
Description:
System Informer - Setup
Exit code:
0
Version:
3.0.12187.7660
Modules
Images
c:\users\admin\appdata\local\temp\systeminformer-3.0.7660-release-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6056"C:\Users\admin\AppData\Local\Temp\systeminformer-3.0.7660-release-setup.exe" C:\Users\admin\AppData\Local\Temp\systeminformer-3.0.7660-release-setup.exe—explorer.exe
User:
admin
Company:
System Informer
Integrity Level:
MEDIUM
Description:
System Informer - Setup
Exit code:
0
Version:
3.0.12187.7660
Modules
Images
c:\users\admin\appdata\local\temp\systeminformer-3.0.7660-release-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6176"C:\Program Files\SystemInformer\SystemInformer.exe" -channel releaseC:\Program Files\SystemInformer\SystemInformer.exe
systeminformer-3.0.7660-release-setup.exe
User:
admin
Company:
System Informer
Integrity Level:
HIGH
Description:
System Informer
Version:
3.0.12187.7660
Modules
Images
c:\program files\systeminformer\systeminformer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6324C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
12 247
Read events
12 238
Write events
9
Delete events
0

Modification events

(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:DisplayIcon
Value:
C:\Program Files\SystemInformer\systeminformer.exe,0
(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:DisplayName
Value:
System Informer
(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:DisplayVersion
Value:
3.0
(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:HelpLink
Value:
https://systeminformer.sourceforge.io/
(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:InstallLocation
Value:
C:\Program Files\SystemInformer\
(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:Publisher
Value:
System Informer
(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:UninstallString
Value:
"C:\Program Files\SystemInformer\systeminformer-setup.exe" -uninstall
(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:NoModify
Value:
1
(PID) Process:(2736) systeminformer-3.0.7660-release-setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemInformer
Operation:writeName:NoRepair
Value:
1
Executable files
19
Suspicious files
23
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
2736systeminformer-3.0.7660-release-setup.exeC:\Program Files\SystemInformer\README.txttext
MD5:0CCC7E76DA4E38CD2F73BD197DEA80C3
SHA256:29C068275F2B99405DFED86B2C6C6E0722944B743565796B76FBF74F42DA8039
2736systeminformer-3.0.7660-release-setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\PE Viewer.lnklnk
MD5:B75ACE2E9E96CA66DC62C5B39C3FEEDD
SHA256:A69A368F43987E528B91C289FF036ABEC71AE131A5AEB2137D8892D1DF213299
2736systeminformer-3.0.7660-release-setup.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Informer.lnklnk
MD5:2E2893D76C1802E3838C343D0ACC0044
SHA256:13562C787CEA59D09EBDE8FFC94A1A6D83AE01EA05465DEBFD1E717B27114633
2736systeminformer-3.0.7660-release-setup.exeC:\Program Files\SystemInformer\icon.pngimage
MD5:5352EBD888E7E6C1DABD20C4D6B921C5
SHA256:46E1C3D45F5085FA4F97F6BCB2AD0197DABB0E1C7EFD2A6CBA1A0BD3461E2387
2736systeminformer-3.0.7660-release-setup.exeC:\Program Files\SystemInformer\LICENSE.txttext
MD5:00B5F3DE97978ECBFCAA88C3D9D87CE5
SHA256:E0CD000380F49907CB856B00AC44C436DF10E2B0AD24EA77576F8EF77F508BDD
2736systeminformer-3.0.7660-release-setup.exeC:\Program Files\SystemInformer\CapsList.txttext
MD5:397F7C66959A56EF89133733B56A9616
SHA256:D74FA0FF77E0FB81EE2A5B7211CBE7CC33F03EE1EB1AA488CDAFC45540A8FE5A
2736systeminformer-3.0.7660-release-setup.exeC:\Program Files\SystemInformer\ksidyn.binbinary
MD5:93B34D4692A951C5463B7AB1571686B1
SHA256:841BBE82D443930DFC81F7AB80111B41695B28D96BC212E305496C2E60F08B82
2736systeminformer-3.0.7660-release-setup.exeC:\Program Files\SystemInformer\ksi.dllexecutable
MD5:4857DA220E9B678865C0CCBBA22F4E94
SHA256:28A54EFCF5CEC9190D5AB210A50AF00C4ED91D1AD27C76C868FCD54D8C553FCF
2736systeminformer-3.0.7660-release-setup.exeC:\Users\Public\Desktop\System Informer.lnklnk
MD5:33ACAF16A48F662D62ACB2E0406DE152
SHA256:623E792ACD760E0B5E88BCA0A83EAFA9E88387BEC920F427D0B7E3F246FE34B1
2736systeminformer-3.0.7660-release-setup.exeC:\Program Files\SystemInformer\COPYRIGHT.txttext
MD5:D97229C38736F130D83B1C9BA9F68703
SHA256:6DEB8978832A3B5CB8B4AD79F33EFAAC9857AC539D771EEBB3C5680A12436D2C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
38
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
3940
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4340
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
95.100.146.40:443
www.bing.com
Akamai International B.V.
CZ
unknown
6012
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6076
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5488
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5692
slui.exe
20.83.72.98:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
www.bing.com
  • 95.100.146.40
  • 95.100.146.35
  • 95.100.146.27
  • 95.100.146.16
  • 95.100.146.25
  • 95.100.146.10
  • 95.100.146.11
  • 95.100.146.18
  • 95.100.146.26
whitelisted
google.com
  • 142.250.186.174
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.253.72
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.64
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.4
  • 20.190.159.2
  • 20.190.159.68
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
self.events.data.microsoft.com
  • 52.182.143.215
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
systeminformer-3.0.7660-release-setup.exe