File name:

Pluginpack.exe

Full analysis: https://app.any.run/tasks/108c9bd4-a33a-4f6f-881d-939ee1bb5b09
Verdict: Malicious activity
Analysis date: September 06, 2024, 05:23:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

001AB715045DF3160396E472BEA0A14C

SHA1:

B215B49CD73D160CD7B5819198633F30D58F6907

SHA256:

AC698137BD27BECCD1F5C81B9E4E6D9A40372DEEB4680B36BE9F2D31D7EB5C7F

SSDEEP:

98304:L+fgwxAvQlT5Ne4r5KgBsVli+mXzeV6bZ4YQ9fC4QEjJjgNIixn1ZzQ3v9unx3Pj:e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7044)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Pluginpack.exe (PID: 6460)

    • Drops 7-zip archiver for unpacking

      • Pluginpack.exe (PID: 6460)

    • Executable content was dropped or overwritten

      • Pluginpack.exe (PID: 6460)

    • Creates a software uninstall entry

      • Pluginpack.exe (PID: 6460)

    • Executing commands from a ".bat" file

      • dllCrt32.exe (PID: 6148)

    • Starts CMD.EXE for commands execution

      • dllCrt32.exe (PID: 6148)
      • cmd.exe (PID: 7044)

    • Application launched itself

      • cmd.exe (PID: 7044)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7044)

    • Lists all scheduled tasks

      • schtasks.exe (PID: 6352)

  • INFO

    • Creates files or folders in the user directory

      • Pluginpack.exe (PID: 6460)

    • Create files in a temporary directory

      • Pluginpack.exe (PID: 6460)

    • Checks supported languages

      • Pluginpack.exe (PID: 6460)
      • dllCrt32.exe (PID: 6148)

    • Reads the computer name

      • Pluginpack.exe (PID: 6460)

    • Dropped object may contain TOR URL's

      • Pluginpack.exe (PID: 6460)

    • Process checks computer location settings

      • Pluginpack.exe (PID: 6460)

    • The process uses the downloaded file

      • Pluginpack.exe (PID: 6460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (31.9)
.scr | Windows screen saver (29.4)
.dll | Win32 Dynamic Link Library (generic) (14.8)
.exe | Win32 Executable (generic) (10.1)
.exe | Win16/32 Executable Delphi generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 148992
InitializedDataSize: 30720
UninitializedDataSize: -
EntryPoint: 0x25468
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.65.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: -
CompanyName: Thelanb Co.
FileDescription: PluginPack 4.65.0.0 Installation
FileVersion: 4.65.0.0
LegalCopyright: Thelanb Co.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
9
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start pluginpack.exe dllcrt32.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs findstr.exe no specs schtasks.exe no specs schtasks.exe no specs pluginpack.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2384C:\WINDOWS\system32\cmd.exe /S /D /c" echo C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Program Files\PowerShell\7\;C:\Users\admin\AppData\Local\Microsoft\WindowsApps "C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2628findstr WindowsApps C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4688"C:\Users\admin\AppData\Local\Temp\Pluginpack.exe" C:\Users\admin\AppData\Local\Temp\Pluginpack.exe—explorer.exe
User:
admin
Company:
Thelanb Co.
Integrity Level:
MEDIUM
Description:
PluginPack 4.65.0.0 Installation
Exit code:
3221226540
Version:
4.65.0.0
Modules
Images
c:\users\admin\appdata\local\temp\pluginpack.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6148"C:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt32.exe" C:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt32.exe—Pluginpack.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\microsoft\windowsapps\dllcrt32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6160schtasks /create /xml "C:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt.xml" /tn "Check dllHourly32" C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6352schtasks /query /tn "Check dllHourly32" C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6460"C:\Users\admin\AppData\Local\Temp\Pluginpack.exe" C:\Users\admin\AppData\Local\Temp\Pluginpack.exe
explorer.exe
User:
admin
Company:
Thelanb Co.
Integrity Level:
HIGH
Description:
PluginPack 4.65.0.0 Installation
Version:
4.65.0.0
Modules
Images
c:\users\admin\appdata\local\temp\pluginpack.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7044C:\WINDOWS\system32\cmd.exe /c dllCrt.batC:\Windows\SysWOW64\cmd.exe—dllCrt32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
406
Read events
390
Write events
16
Delete events
0

Modification events

(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:DisplayName
Value:
PluginPack 4.65.0.0
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:DisplayVersion
Value:
4.65.0.0
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:VersionMajor
Value:
4
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:VersionMinor
Value:
65
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:Publisher
Value:
Thelanb Co.
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Local\Temp\Uninstall.exe
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:UninstallString
Value:
C:\Users\admin\AppData\Local\Temp\Uninstall.exe
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:URLInfoAbout
Value:
https://thelanb.com
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:HelpLink
Value:
support@thelanb.com
(PID) Process:(6460) Pluginpack.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PluginPack 4.65.0.0
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\Temp\
Executable files
4
Suspicious files
2
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6460Pluginpack.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmpcompressed
MD5:07004A35B753BFE1DB65A81B3951AC8E
SHA256:11BCAB6470B49ADFFDC127A15CDF7C3BC4EE1382B97673C82FEEE8A50715C69A
6460Pluginpack.exeC:\Users\admin\AppData\Local\Temp\$inst\2.tmpcompressed
MD5:142E14924332279489364A68ECF8E576
SHA256:CD98C7F59BF0FEBA6BF4FD7E43E8A760C6FB951696987D65E170A6BFCB450437
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\curl.exeexecutable
MD5:3E54AFFFA30DB094DF4D6702AB0F956F
SHA256:DDCFDA5CDC4E22279C0A4E8E56F694FB34CB14495ADCA241FAB5B5BD6450C8A2
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dll_srv.txttext
MD5:38BAFDA16A0BE406E0A184F0E632DC78
SHA256:3E6C05FFEA6E6C861380FAF6C72D038BBB5E39B9F55C64E57892AC7F19B49B05
6460Pluginpack.exeC:\Users\admin\AppData\Local\Temp\$inst\4.tmpimage
MD5:0D8DBE5CD39F3369265D93195E5C6449
SHA256:FD17CA05FA0587FBF2D1AB722EBBF4A4B254F2EC0048E9CDAE20655F7DE06A39
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt.battext
MD5:069B9F2F6D181121354FACD2E9680474
SHA256:A89953915EABE5C4897E414E73F28C300472298A6A8C055FCC956C61C875FD96
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllBus32.exeexecutable
MD5:1B9549787F80BA4F41E4CF944D4501E4
SHA256:70BCE9C228AACBDADAAF18596C0EB308C102382D04632B01B826E9DB96210093
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllBus.battext
MD5:8E0C87F4AC098DC5F43E7367D1AD65C0
SHA256:C430CCDC07C9B517FAA4C9241F86466B9FF8AC55A7C49A491613D53E2EC3D00D
6460Pluginpack.exeC:\Users\admin\AppData\Local\Microsoft\WindowsApps\dllCrt.xmlxml
MD5:151A761FB5BF225EB2B382240C415A84
SHA256:CDC1F2430681E9278B3F738ED74954C4366B8EFF52C937F185D760C1BBBA2F1D
6460Pluginpack.exeC:\Users\admin\AppData\Local\Temp\$inst\5.tmpimage
MD5:AB2021E67E0E08657288D880ABFBAA72
SHA256:331D997E586CBA40D4DA0587887FC4CAA4CC44E53421737DAFA67E67445E6753
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
23
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2112
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2112
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2400
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6652
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1436
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1436
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.2
  • 40.126.31.67
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Pluginpack.exe