File name:

Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe

Full analysis: https://app.any.run/tasks/4c701762-734c-4962-806a-bfda15f690f9
Verdict: Malicious activity
Analysis date: August 02, 2022, 10:03:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2326C880081D8B670C6307E1069FAC79

SHA1:

3A0E62C5F2446101EEB0C6817758515098BC863A

SHA256:

AE3D947AA265130B98719632A03A03FA4DA0FDA9A91ABBF269AACF349A8906B1

SSDEEP:

24576:CAdz4S2djzsyPk3Fx1WwYcYX6lPJPP/ssxUG1/LkxjKivS0WQ:CAdz4ScfKZtYXwPdPN3/kvDD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)

    • Loads dropped or rewritten executable

      • OfficeClickToRun.exe (PID: 3932)
      • OfficeClickToRun.exe (PID: 1464)
      • perfboost.exe (PID: 2992)
      • firstrun.exe (PID: 3344)
      • perfboost.exe (PID: 1540)
      • AppVShNotify.exe (PID: 1584)
      • OSPPSVC.EXE (PID: 1776)

    • Application was dropped or rewritten from another process

      • OfficeClickToRun.exe (PID: 3932)
      • OfficeClickToRun.exe (PID: 1464)
      • perfboost.exe (PID: 2992)
      • firstrun.exe (PID: 3344)
      • perfboost.exe (PID: 1540)
      • AppVShNotify.exe (PID: 1584)
      • integrator.exe (PID: 3856)
      • integrator.exe (PID: 1924)
      • OSPPSVC.EXE (PID: 1776)

  • SUSPICIOUS

    • Checks supported languages

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3160)
      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 1464)
      • OfficeClickToRun.exe (PID: 3932)
      • perfboost.exe (PID: 2992)
      • firstrun.exe (PID: 3344)
      • perfboost.exe (PID: 1540)
      • integrator.exe (PID: 3856)
      • msiexec.exe (PID: 3272)
      • MsiExec.exe (PID: 1996)
      • AppVShNotify.exe (PID: 1584)
      • OSPPSVC.EXE (PID: 1776)
      • mofcomp.exe (PID: 1868)
      • integrator.exe (PID: 1924)

    • Reads the computer name

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3160)
      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 1464)
      • OfficeClickToRun.exe (PID: 3932)
      • perfboost.exe (PID: 2992)
      • firstrun.exe (PID: 3344)
      • perfboost.exe (PID: 1540)
      • msiexec.exe (PID: 3272)
      • integrator.exe (PID: 3856)
      • AppVShNotify.exe (PID: 1584)
      • OSPPSVC.EXE (PID: 1776)
      • mofcomp.exe (PID: 1868)
      • MsiExec.exe (PID: 1996)
      • integrator.exe (PID: 1924)

    • Application launched itself

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3160)

    • Creates a directory in Program Files

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)

    • Creates files in the program directory

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OSPPSVC.EXE (PID: 1776)
      • OfficeClickToRun.exe (PID: 3932)

    • Executable content was dropped or overwritten

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)

    • Executed as Windows Service

      • OfficeClickToRun.exe (PID: 3932)

    • Drops a file with a compile date too recent

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)

    • Searches for installed software

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)

    • Creates a software uninstall entry

      • OfficeClickToRun.exe (PID: 3932)

    • Reads Environment values

      • firstrun.exe (PID: 3344)
      • MsiExec.exe (PID: 1996)
      • integrator.exe (PID: 1924)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 3272)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 3272)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 3272)

    • Disables SEHOP

      • msiexec.exe (PID: 3272)

  • INFO

    • Reads Microsoft Office registry keys

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3160)
      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 1464)
      • perfboost.exe (PID: 2992)
      • perfboost.exe (PID: 1540)
      • msiexec.exe (PID: 3272)
      • MsiExec.exe (PID: 1996)
      • firstrun.exe (PID: 3344)
      • integrator.exe (PID: 1924)
      • OfficeClickToRun.exe (PID: 3932)
      • OSPPSVC.EXE (PID: 1776)

    • Reads settings of System Certificates

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • firstrun.exe (PID: 3344)

    • Checks Windows Trust Settings

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • firstrun.exe (PID: 3344)

    • Dropped object may contain Bitcoin addresses

      • OfficeClickToRun.exe (PID: 3932)

    • Manual execution by user

      • perfboost.exe (PID: 2992)
      • firstrun.exe (PID: 3344)
      • explorer.exe (PID: 1780)
      • perfboost.exe (PID: 1540)

    • Checks supported languages

      • explorer.exe (PID: 1780)

    • Reads the computer name

      • explorer.exe (PID: 1780)

    • Application launched itself

      • msiexec.exe (PID: 3272)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1996)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3272)

    • Creates files in the program directory

      • msiexec.exe (PID: 3272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

ProductVersion: 15.0.4745.1000
ProductName: Microsoft Office
OriginalFileName: Bootstrapper.exe
LegalTrademarks2: Windows® は米国 Microsoft Corporation の米国およびその他の国における登録商標です。
LegalTrademarks1: Microsoft® は米国 Microsoft Corporation の米国およびその他の国における登録商標です。
InternalName: Bootstrapper.exe
FileVersion: 15.0.4745.1000
FileDescription: Microsoft Office クイック実行
CompanyName: Microsoft Corporation
CharacterSet: Windows, Japan (Shift - JIS X-0208)
LanguageCode: Japanese
FileSubtype: -
ObjectFileType: Unknown
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 15.0.4745.1000
FileVersionNumber: 15.0.4745.1000
Subsystem: Windows GUI
SubsystemVersion: 5.2
ImageVersion: -
OSVersion: 5.2
EntryPoint: 0x5fcfa
UninitializedDataSize: -
InitializedDataSize: 182784
CodeSize: 907264
LinkerVersion: 10.1
PEType: PE32
TimeStamp: 2015:07:14 09:03:40+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Jul-2015 07:03:40
Detected languages:
  • Japanese - Japan
Debug artifacts:
  • P:\Target\x86\ship\click2run\en-us.pre\bootstrapper.pdb
CompanyName: Microsoft Corporation
FileDescription: Microsoft Office クイック実行
FileVersion: 15.0.4745.1000
InternalName: Bootstrapper.exe
LegalTrademarks1: Microsoft® は米国 Microsoft Corporation の米国およびその他の国における登録商標です。
LegalTrademarks2: Windows® は米国 Microsoft Corporation の米国およびその他の国における登録商標です。
OriginalFilename: Bootstrapper.exe
ProductName: Microsoft Office
ProductVersion: 15.0.4745.1000

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000120

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 14-Jul-2015 07:03:40
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_NET_RUN_FROM_SWAP
  • IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000DD764
0x000DD800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.28188
.data
0x000DF000
0x0000A47C
0x00007C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.82391
.rsrc
0x000EA000
0x0001B000
0x0001A800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.51086
.reloc
0x00105000
0x0000A47C
0x0000A600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.60794

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.27008
1004
Latin 1 / Western European
Japanese - Japan
RT_MANIFEST
2
1.96082
9640
Latin 1 / Western European
Japanese - Japan
RT_ICON
3
2.20562
4264
Latin 1 / Western European
Japanese - Japan
RT_ICON
4
2.87138
1128
Latin 1 / Western European
Japanese - Japan
RT_ICON
101
2.65982
62
Latin 1 / Western European
Japanese - Japan
RT_GROUP_ICON
188
5.01352
1486
Latin 1 / Western European
Japanese - Japan
RT_STRING
189
5.02636
1984
Latin 1 / Western European
Japanese - Japan
RT_STRING
190
4.93717
3544
Latin 1 / Western European
Japanese - Japan
RT_STRING
191
4.82331
924
Latin 1 / Western European
Japanese - Japan
RT_STRING
192
4.80336
1322
Latin 1 / Western European
Japanese - Japan
RT_STRING

Imports

ADVAPI32.dll
Cabinet.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.dll
OLEAUT32.dll
RPCRT4.dll
SETUPAPI.dll
VERSION.dll
WINHTTP.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
15
Malicious processes
11
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start setup.x86.ja-jp_powerpointretail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_tx_sg_ (1).exe no specs setup.x86.ja-jp_powerpointretail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_tx_sg_ (1).exe officeclicktorun.exe no specs officeclicktorun.exe perfboost.exe no specs firstrun.exe explorer.exe no specs perfboost.exe no specs appvshnotify.exe no specs integrator.exe no specs msiexec.exe msiexec.exe no specs osppsvc.exe no specs mofcomp.exe no specs integrator.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1464OfficeClickToRun.exe scenario=unknown scenariosubtype=CDN cdnbaseurl="http://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675" productreleaseid="PowerPointRetail" culture="ja-jp" lcid="1041" platform="x86" version="15.0.5467.1000" prereleasebuild="4419" firstrun="root\office15\firstrun.exe" powerpointretail="5286acb0-3ed7-49c1-8bcd-ad279ab00d45" tx="SG" baseurl="http://officecdn.microsoft.com/SG/39168D7E-077B-48E7-872C-B232C3E72675" mediatype="CDN" updatesenabled="True" autoUpgrade="True" productstoadd="PowerPointRetail_ja-jp_x-none" trackedduration=3407C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe—Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office Click-to-Run
Exit code:
0
Version:
15.0.5449.1000
Modules
Images
c:\program files\microsoft office 15\clientx86\officeclicktorun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1540"C:\Program Files\Microsoft Office 15\root\office15\perfboost.exe" EnsureVEC:\Program Files\Microsoft Office 15\root\office15\perfboost.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\microsoft office 15\root\office15\perfboost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft office 15\root\office15\appvisvsubsystems32.dll
c:\program files\microsoft office 15\root\office15\appvisvstream32.dll
c:\program files\microsoft office 15\root\office15\c2r32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1584"C:\Program Files\Microsoft Office 15\ClientX86\AppVShNotify.exe"C:\Program Files\Microsoft Office 15\ClientX86\AppVShNotify.exe—OfficeClickToRun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AppVShNotify
Exit code:
0
Version:
5.2.162.0
Modules
Images
c:\program files\microsoft office 15\clientx86\appvshnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1776"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Software Protection Platform Service
Exit code:
0
Version:
15.0.0169.500 (win7sp1_gdr_oob_osppv2(oobla).120705-1631)
Modules
Images
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1780"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
1868"C:\Windows\system32\WBEM\mofcomp.exe" "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF"C:\Windows\system32\WBEM\mofcomp.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1924integrator.exe /I /License PRIDName=PowerPointRetail PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office 15\root"C:\Program Files\Microsoft Office 15\root\integration\integrator.exe—OfficeClickToRun.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Click-To-Run Integrator
Exit code:
0
Version:
15.0.5337.1000
Modules
Images
c:\program files\microsoft office 15\root\integration\integrator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1996C:\Windows\system32\MsiExec.exe -Embedding 0E1B56FCDB31DC27C7BB990371E905D0 E Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2992"C:\Program Files\Microsoft Office 15\root\office15\perfboost.exe" EnsureVEC:\Program Files\Microsoft Office 15\root\office15\perfboost.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\microsoft office 15\root\office15\perfboost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft office 15\root\office15\appvisvsubsystems32.dll
c:\program files\microsoft office 15\root\office15\appvisvstream32.dll
c:\program files\microsoft office 15\root\office15\c2r32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3160"C:\Users\admin\AppData\Local\Temp\Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe" C:\Users\admin\AppData\Local\Temp\Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office クイック実行
Exit code:
0
Version:
15.0.4745.1000
Modules
Images
c:\users\admin\appdata\local\temp\setup.x86.ja-jp_powerpointretail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_tx_sg_ (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
24 188
Read events
22 735
Write events
1 419
Delete events
34

Modification events

(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Registration\USER-PC
Operation:writeName:PowerPointRetail.AttemptGetKey
Value:
1
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Licensing\OlsToken
Operation:writeName:powerpointretail
Value:
5286acb0-3ed7-49c1-8bcd-ad279ab00d45
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3996) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Registration\USER-PC
Operation:writeName:PowerPointRetail.AttemptGetKey
Value:
1
(PID) Process:(3996) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Licensing\OlsToken
Operation:writeName:powerpointretail
Value:
5286acb0-3ed7-49c1-8bcd-ad279ab00d45
(PID) Process:(3996) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3996) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
183
Suspicious files
66
Text files
89
Unknown types
73

Dropped files

PID
Process
Filename
Type
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\Local\Temp\OfficeC2RCEA8D3D2-D702-4DB3-8BC8-3E885C15C463\v32.cabcompressed
MD5:—
SHA256:—
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76binary
MD5:—
SHA256:—
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:—
SHA256:—
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850der
MD5:—
SHA256:—
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\36AC0BE60E1243344AE145F746D881FEbinary
MD5:—
SHA256:—
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\36AC0BE60E1243344AE145F746D881FEder
MD5:—
SHA256:—
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759ADbinary
MD5:—
SHA256:—
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76der
MD5:E95AF9B03513D729D28FD890CFF4EBE9
SHA256:B19F80A5970542F71E1728CDEEE5D4534598329BA22FABF5BBD2280EBD6BA629
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759ADder
MD5:6872FAE8288DB34207D9E7EE350157F4
SHA256:50795B027E2BC566D3B7ACB89913F8EFD23B70615C9DB9BF5B23323AD3132A7D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
846
TCP/UDP connections
53
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
—
8.248.131.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab
US
—
—
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
—
67.26.137.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/15.0.5467.1000/i321041.cab
US
—
—
whitelisted
3932
OfficeClickToRun.exe
GET
—
8.248.131.252:80
http://officecdn.microsoft.com/SG/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/15.0.5467.1000/stream.x86.ja-jp.dat
US
—
—
whitelisted
3932
OfficeClickToRun.exe
GET
—
8.248.131.252:80
http://officecdn.microsoft.com/SG/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/15.0.5467.1000/s321041.cab
US
—
—
whitelisted
3932
OfficeClickToRun.exe
GET
—
8.248.131.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/15.0.5467.1000/s321041.cab
US
—
—
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
206
67.26.137.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab
US
compressed
10.4 Kb
whitelisted
3932
OfficeClickToRun.exe
GET
206
8.248.131.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/15.0.5467.1000/s321041.cab
US
compressed
258 Kb
whitelisted
3932
OfficeClickToRun.exe
GET
200
2.18.233.62:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
der
1.05 Kb
whitelisted
3932
OfficeClickToRun.exe
GET
—
8.248.131.252:80
http://officecdn.microsoft.com/SG/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/15.0.5467.1000/s320.cab
US
—
—
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
US
der
767 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3932
OfficeClickToRun.exe
67.26.139.252:80
—
Level 3 Communications, Inc.
US
unknown
—
—
67.26.137.252:80
officecdn.microsoft.com
Level 3 Communications, Inc.
US
unknown
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
8.248.131.252:80
officecdn.microsoft.com
Level 3 Communications, Inc.
US
unknown
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
67.26.137.252:80
officecdn.microsoft.com
Level 3 Communications, Inc.
US
unknown
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
178.79.242.128:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
malicious
3932
OfficeClickToRun.exe
8.248.131.252:80
officecdn.microsoft.com
Level 3 Communications, Inc.
US
unknown
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
2.18.233.62:80
www.microsoft.com
Akamai International B.V.
—
whitelisted
3932
OfficeClickToRun.exe
2.18.233.62:80
www.microsoft.com
Akamai International B.V.
—
whitelisted
3932
OfficeClickToRun.exe
23.216.77.6:80
crl.microsoft.com
NTT DOCOMO, INC.
US
whitelisted
1096
svchost.exe
178.79.242.128:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
malicious

DNS requests

Domain
IP
Reputation
officecdn.microsoft.com
  • 8.248.131.252
  • 67.26.137.252
  • 8.248.115.252
  • 8.241.11.252
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.128
  • 95.140.236.0
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 2.18.233.62
whitelisted
o15.officeredir.microsoft.com
  • 52.109.89.13
whitelisted
clienttemplates.content.office.net
  • 23.6.112.160
  • 23.6.113.34
whitelisted
ols.officeapps.live.com
  • 52.109.16.0
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe