File name:

Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe

Full analysis: https://app.any.run/tasks/4c701762-734c-4962-806a-bfda15f690f9
Verdict: Malicious activity
Analysis date: August 02, 2022, 10:03:44
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2326C880081D8B670C6307E1069FAC79

SHA1:

3A0E62C5F2446101EEB0C6817758515098BC863A

SHA256:

AE3D947AA265130B98719632A03A03FA4DA0FDA9A91ABBF269AACF349A8906B1

SSDEEP:

24576:CAdz4S2djzsyPk3Fx1WwYcYX6lPJPP/ssxUG1/LkxjKivS0WQ:CAdz4ScfKZtYXwPdPN3/kvDD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)

    • Loads dropped or rewritten executable

      • OfficeClickToRun.exe (PID: 1464)
      • OfficeClickToRun.exe (PID: 3932)
      • perfboost.exe (PID: 2992)
      • firstrun.exe (PID: 3344)
      • AppVShNotify.exe (PID: 1584)
      • perfboost.exe (PID: 1540)
      • OSPPSVC.EXE (PID: 1776)

    • Application was dropped or rewritten from another process

      • OfficeClickToRun.exe (PID: 1464)
      • OfficeClickToRun.exe (PID: 3932)
      • perfboost.exe (PID: 2992)
      • perfboost.exe (PID: 1540)
      • firstrun.exe (PID: 3344)
      • AppVShNotify.exe (PID: 1584)
      • integrator.exe (PID: 3856)
      • integrator.exe (PID: 1924)
      • OSPPSVC.EXE (PID: 1776)

  • SUSPICIOUS

    • Checks supported languages

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3160)
      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 1464)
      • OfficeClickToRun.exe (PID: 3932)
      • perfboost.exe (PID: 2992)
      • perfboost.exe (PID: 1540)
      • firstrun.exe (PID: 3344)
      • integrator.exe (PID: 3856)
      • msiexec.exe (PID: 3272)
      • MsiExec.exe (PID: 1996)
      • AppVShNotify.exe (PID: 1584)
      • mofcomp.exe (PID: 1868)
      • integrator.exe (PID: 1924)
      • OSPPSVC.EXE (PID: 1776)

    • Reads the computer name

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3160)
      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • OfficeClickToRun.exe (PID: 1464)
      • perfboost.exe (PID: 2992)
      • firstrun.exe (PID: 3344)
      • perfboost.exe (PID: 1540)
      • integrator.exe (PID: 3856)
      • AppVShNotify.exe (PID: 1584)
      • msiexec.exe (PID: 3272)
      • MsiExec.exe (PID: 1996)
      • OSPPSVC.EXE (PID: 1776)
      • mofcomp.exe (PID: 1868)
      • integrator.exe (PID: 1924)

    • Application launched itself

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3160)

    • Creates files in the program directory

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • OSPPSVC.EXE (PID: 1776)

    • Creates a directory in Program Files

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)

    • Executed as Windows Service

      • OfficeClickToRun.exe (PID: 3932)

    • Executable content was dropped or overwritten

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)

    • Drops a file with a compile date too recent

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)

    • Searches for installed software

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)

    • Creates a software uninstall entry

      • OfficeClickToRun.exe (PID: 3932)

    • Reads Environment values

      • firstrun.exe (PID: 3344)
      • integrator.exe (PID: 1924)
      • MsiExec.exe (PID: 1996)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 3272)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 3272)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 3272)

    • Disables SEHOP

      • msiexec.exe (PID: 3272)

  • INFO

    • Reads Microsoft Office registry keys

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3160)
      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • perfboost.exe (PID: 2992)
      • OfficeClickToRun.exe (PID: 1464)
      • perfboost.exe (PID: 1540)
      • firstrun.exe (PID: 3344)
      • OfficeClickToRun.exe (PID: 3932)
      • msiexec.exe (PID: 3272)
      • MsiExec.exe (PID: 1996)
      • integrator.exe (PID: 1924)
      • OSPPSVC.EXE (PID: 1776)

    • Reads settings of System Certificates

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • firstrun.exe (PID: 3344)

    • Checks Windows Trust Settings

      • Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe (PID: 3996)
      • OfficeClickToRun.exe (PID: 3932)
      • firstrun.exe (PID: 3344)

    • Manual execution by user

      • perfboost.exe (PID: 2992)
      • firstrun.exe (PID: 3344)
      • explorer.exe (PID: 1780)
      • perfboost.exe (PID: 1540)

    • Dropped object may contain Bitcoin addresses

      • OfficeClickToRun.exe (PID: 3932)

    • Checks supported languages

      • explorer.exe (PID: 1780)

    • Reads the computer name

      • explorer.exe (PID: 1780)

    • Application launched itself

      • msiexec.exe (PID: 3272)

    • Creates files in the program directory

      • msiexec.exe (PID: 3272)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1996)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3272)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

ProductVersion: 15.0.4745.1000
ProductName: Microsoft Office
OriginalFileName: Bootstrapper.exe
LegalTrademarks2: Windows® は米国 Microsoft Corporation の米国およびその他の国における登録商標です。
LegalTrademarks1: Microsoft® は米国 Microsoft Corporation の米国およびその他の国における登録商標です。
InternalName: Bootstrapper.exe
FileVersion: 15.0.4745.1000
FileDescription: Microsoft Office クイック実行
CompanyName: Microsoft Corporation
CharacterSet: Windows, Japan (Shift - JIS X-0208)
LanguageCode: Japanese
FileSubtype: -
ObjectFileType: Unknown
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 15.0.4745.1000
FileVersionNumber: 15.0.4745.1000
Subsystem: Windows GUI
SubsystemVersion: 5.2
ImageVersion: -
OSVersion: 5.2
EntryPoint: 0x5fcfa
UninitializedDataSize: -
InitializedDataSize: 182784
CodeSize: 907264
LinkerVersion: 10.1
PEType: PE32
TimeStamp: 2015:07:14 09:03:40+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 14-Jul-2015 07:03:40
Detected languages:
  • Japanese - Japan
Debug artifacts:
  • P:\Target\x86\ship\click2run\en-us.pre\bootstrapper.pdb
CompanyName: Microsoft Corporation
FileDescription: Microsoft Office クイック実行
FileVersion: 15.0.4745.1000
InternalName: Bootstrapper.exe
LegalTrademarks1: Microsoft® は米国 Microsoft Corporation の米国およびその他の国における登録商標です。
LegalTrademarks2: Windows® は米国 Microsoft Corporation の米国およびその他の国における登録商標です。
OriginalFilename: Bootstrapper.exe
ProductName: Microsoft Office
ProductVersion: 15.0.4745.1000

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000120

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 14-Jul-2015 07:03:40
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_NET_RUN_FROM_SWAP
  • IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000DD764
0x000DD800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.28188
.data
0x000DF000
0x0000A47C
0x00007C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.82391
.rsrc
0x000EA000
0x0001B000
0x0001A800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.51086
.reloc
0x00105000
0x0000A47C
0x0000A600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.60794

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.27008
1004
Latin 1 / Western European
Japanese - Japan
RT_MANIFEST
2
1.96082
9640
Latin 1 / Western European
Japanese - Japan
RT_ICON
3
2.20562
4264
Latin 1 / Western European
Japanese - Japan
RT_ICON
4
2.87138
1128
Latin 1 / Western European
Japanese - Japan
RT_ICON
101
2.65982
62
Latin 1 / Western European
Japanese - Japan
RT_GROUP_ICON
188
5.01352
1486
Latin 1 / Western European
Japanese - Japan
RT_STRING
189
5.02636
1984
Latin 1 / Western European
Japanese - Japan
RT_STRING
190
4.93717
3544
Latin 1 / Western European
Japanese - Japan
RT_STRING
191
4.82331
924
Latin 1 / Western European
Japanese - Japan
RT_STRING
192
4.80336
1322
Latin 1 / Western European
Japanese - Japan
RT_STRING

Imports

ADVAPI32.dll
Cabinet.dll
GDI32.dll
IPHLPAPI.DLL
KERNEL32.dll
OLEAUT32.dll
RPCRT4.dll
SETUPAPI.dll
VERSION.dll
WINHTTP.dll (delay-loaded)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
15
Malicious processes
11
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start setup.x86.ja-jp_powerpointretail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_tx_sg_ (1).exe no specs setup.x86.ja-jp_powerpointretail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_tx_sg_ (1).exe officeclicktorun.exe no specs officeclicktorun.exe perfboost.exe no specs firstrun.exe explorer.exe no specs perfboost.exe no specs appvshnotify.exe no specs integrator.exe no specs msiexec.exe msiexec.exe no specs osppsvc.exe no specs mofcomp.exe no specs integrator.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1464OfficeClickToRun.exe scenario=unknown scenariosubtype=CDN cdnbaseurl="http://officecdn.microsoft.com/pr/39168D7E-077B-48E7-872C-B232C3E72675" productreleaseid="PowerPointRetail" culture="ja-jp" lcid="1041" platform="x86" version="15.0.5467.1000" prereleasebuild="4419" firstrun="root\office15\firstrun.exe" powerpointretail="5286acb0-3ed7-49c1-8bcd-ad279ab00d45" tx="SG" baseurl="http://officecdn.microsoft.com/SG/39168D7E-077B-48E7-872C-B232C3E72675" mediatype="CDN" updatesenabled="True" autoUpgrade="True" productstoadd="PowerPointRetail_ja-jp_x-none" trackedduration=3407C:\Program Files\Microsoft Office 15\ClientX86\OfficeClickToRun.exe—Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office Click-to-Run
Exit code:
0
Version:
15.0.5449.1000
Modules
Images
c:\program files\microsoft office 15\clientx86\officeclicktorun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1540"C:\Program Files\Microsoft Office 15\root\office15\perfboost.exe" EnsureVEC:\Program Files\Microsoft Office 15\root\office15\perfboost.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\microsoft office 15\root\office15\perfboost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft office 15\root\office15\appvisvsubsystems32.dll
c:\program files\microsoft office 15\root\office15\appvisvstream32.dll
c:\program files\microsoft office 15\root\office15\c2r32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1584"C:\Program Files\Microsoft Office 15\ClientX86\AppVShNotify.exe"C:\Program Files\Microsoft Office 15\ClientX86\AppVShNotify.exe—OfficeClickToRun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AppVShNotify
Exit code:
0
Version:
5.2.162.0
Modules
Images
c:\program files\microsoft office 15\clientx86\appvshnotify.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1776"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Software Protection Platform Service
Exit code:
0
Version:
15.0.0169.500 (win7sp1_gdr_oob_osppv2(oobla).120705-1631)
Modules
Images
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1780"C:\Windows\explorer.exe" C:\Windows\explorer.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\usp10.dll
c:\windows\system32\gdi32.dll
1868"C:\Windows\system32\WBEM\mofcomp.exe" "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPWMI.MOF"C:\Windows\system32\WBEM\mofcomp.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
The Managed Object Format (MOF) Compiler
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1924integrator.exe /I /License PRIDName=PowerPointRetail PackageGUID="9AC08E99-230B-47e8-9721-4577B7F124EA" PackageRoot="C:\Program Files\Microsoft Office 15\root"C:\Program Files\Microsoft Office 15\root\integration\integrator.exe—OfficeClickToRun.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Click-To-Run Integrator
Exit code:
0
Version:
15.0.5337.1000
Modules
Images
c:\program files\microsoft office 15\root\integration\integrator.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1996C:\Windows\system32\MsiExec.exe -Embedding 0E1B56FCDB31DC27C7BB990371E905D0 E Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2992"C:\Program Files\Microsoft Office 15\root\office15\perfboost.exe" EnsureVEC:\Program Files\Microsoft Office 15\root\office15\perfboost.exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\microsoft office 15\root\office15\perfboost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft office 15\root\office15\appvisvsubsystems32.dll
c:\program files\microsoft office 15\root\office15\appvisvstream32.dll
c:\program files\microsoft office 15\root\office15\c2r32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3160"C:\Users\admin\AppData\Local\Temp\Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe" C:\Users\admin\AppData\Local\Temp\Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office クイック実行
Exit code:
0
Version:
15.0.4745.1000
Modules
Images
c:\users\admin\appdata\local\temp\setup.x86.ja-jp_powerpointretail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_tx_sg_ (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
24 188
Read events
22 735
Write events
1 419
Delete events
34

Modification events

(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Registration\USER-PC
Operation:writeName:PowerPointRetail.AttemptGetKey
Value:
1
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Licensing\OlsToken
Operation:writeName:powerpointretail
Value:
5286acb0-3ed7-49c1-8bcd-ad279ab00d45
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3160) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3996) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Registration\USER-PC
Operation:writeName:PowerPointRetail.AttemptGetKey
Value:
1
(PID) Process:(3996) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Common\Licensing\OlsToken
Operation:writeName:powerpointretail
Value:
5286acb0-3ed7-49c1-8bcd-ad279ab00d45
(PID) Process:(3996) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3996) Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
183
Suspicious files
66
Text files
89
Unknown types
73

Dropped files

PID
Process
Filename
Type
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\Local\Temp\OfficeC2RCEA8D3D2-D702-4DB3-8BC8-3E885C15C463\v32.cabcompressed
MD5:88C1C9C5C94C1EC0C6F1E4BE552C8447
SHA256:CFF5E900FCF49C38F43428C6207920890E10F1CB4673EB4EEB54D84B7A51FDD2
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:BAED1C76055C9EBD39852A24643A3EE8
SHA256:3219F69997F9BDBECB85ACB965D1E0F2DF829F9121DFBCAB4EF58EB553A285A0
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759ADbinary
MD5:3CE9C1F0EEB460CCAD5C08AFFA4BBE5E
SHA256:F2C782B58DDB998EA11FF11776BF65E1EC8DFA07CEF70B02826871CB9FB7FF5A
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\36AC0BE60E1243344AE145F746D881FEbinary
MD5:5B0A0F8A56F2DAEF113337BF1383B596
SHA256:B78C536C72C636B88E0CF8C20E64E7F08302721051C988B1C60CE5FCFECD4BD9
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:343B8C1B52C5314D89B73F2519DB2A5B
SHA256:208C267A9137A2B79D4054CC29795B58BD93CBFE68ED56037DD3CFECA3427303
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\Local\Temp\OfficeC2R099292F8-1B3B-40FE-9513-5304589DC254\i321041.cabcompressed
MD5:95458A5956A3D38EB8A3FFC2B399AED6
SHA256:1B0D9F65A789EC6D1805BBDF1095F6E0D46384F3ADC8C134D273DA57256E76FC
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76binary
MD5:FC56469A3B76F39950D4452983D05707
SHA256:A37B02E1BA094466549DD215207AE8A7D36D983FBB75EB1EF987CE39609D9DFC
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\Local\Temp\OfficeC2RCEA8D3D2-D702-4DB3-8BC8-3E885C15C463\VersionDescriptor.xmltext
MD5:E4FB259E99E4CD5D8DC458576CEF3C9C
SHA256:AEEA8ADE6CF26F30896DA4B55A17E56A3466E89205862F160C643572F881BB31
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Program Files\Microsoft Office 15\ClientX86\apiclient.dllexecutable
MD5:CFCBA06308A6F8130229024AF282920A
SHA256:67BA2D1934B5887D807918D60EBEFE8B71676604105E9766391280C6305851AA
3996Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850der
MD5:041ADFDED19BA191143E2B0F109EA4ED
SHA256:51B55705D1D0FE0BA4AFCA69D5B0BD21AB51DD062314AA4D94717CF3AFDBAFD3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
846
TCP/UDP connections
53
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
206
67.26.137.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab
US
compressed
10.4 Kb
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
200
178.79.242.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9ebbf7f44f3268b3
DE
compressed
4.70 Kb
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
—
8.248.131.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/v32.cab
US
—
—
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
US
der
519 b
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
US
der
767 b
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
US
der
824 b
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
—
67.26.137.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/15.0.5467.1000/i321041.cab
US
—
—
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
US
der
557 b
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
200
2.18.233.62:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
der
813 b
whitelisted
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
GET
206
8.248.131.252:80
http://officecdn.microsoft.com/sg/39168D7E-077B-48E7-872C-B232C3E72675/Office/Data/15.0.5467.1000/i321041.cab
US
compressed
3.98 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
8.248.131.252:80
officecdn.microsoft.com
Level 3 Communications, Inc.
US
unknown
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
67.26.137.252:80
officecdn.microsoft.com
Level 3 Communications, Inc.
US
unknown
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
178.79.242.128:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
malicious
3996
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe
2.18.233.62:80
www.microsoft.com
Akamai International B.V.
—
whitelisted
3932
OfficeClickToRun.exe
8.248.131.252:80
officecdn.microsoft.com
Level 3 Communications, Inc.
US
unknown
3932
OfficeClickToRun.exe
2.18.233.62:80
www.microsoft.com
Akamai International B.V.
—
whitelisted
1096
svchost.exe
178.79.242.128:80
ctldl.windowsupdate.com
Limelight Networks, Inc.
DE
malicious
3932
OfficeClickToRun.exe
23.216.77.6:80
crl.microsoft.com
NTT DOCOMO, INC.
US
whitelisted
3344
firstrun.exe
52.109.89.13:80
o15.officeredir.microsoft.com
Microsoft Corporation
NL
unknown
3344
firstrun.exe
52.109.16.0:443
ols.officeapps.live.com
Microsoft Corporation
US
suspicious

DNS requests

Domain
IP
Reputation
officecdn.microsoft.com
  • 8.248.131.252
  • 67.26.137.252
  • 8.248.115.252
  • 8.241.11.252
whitelisted
ctldl.windowsupdate.com
  • 178.79.242.128
  • 95.140.236.0
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 2.18.233.62
whitelisted
o15.officeredir.microsoft.com
  • 52.109.89.13
whitelisted
clienttemplates.content.office.net
  • 23.6.112.160
  • 23.6.113.34
whitelisted
ols.officeapps.live.com
  • 52.109.16.0
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.X86.ja-JP_PowerPointRetail_5286acb0-3ed7-49c1-8bcd-ad279ab00d45_TX_SG_ (1).exe