analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

Setup.exe

Full analysis: https://app.any.run/tasks/cf3ce250-4732-4879-85b2-4211e76f0f5b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 02, 2019, 20:46:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5B63A953AE3D2A0FA49FAC37829DD116

SHA1:

884514A856907B63DB5AB0E4683365A4BBDE5F17

SHA256:

B15BFF0CC2B5600ABACE0DDC795D824CD5863F856D43743A3182CBDCFD2E38F2

SSDEEP:

12288:p1OgLdaOv50/kxr3uzAo9k/3teNJlWcnizFZGULTdhDLHC8RW+dWDjU9Xh2:p1OYdaRPiEWcQBTdhDLLQDMk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SymCCISExe.exe (PID: 3000)
      • nssSetup.exe (PID: 3172)
      • NSS.exe (PID: 2432)
      • rundll32.exe (PID: 2956)
      • NSS.exe (PID: 584)
      • SymCCISExe.exe (PID: 2684)
      • SymHtmlRender.exe (PID: 3420)
      • rundll32.exe (PID: 444)
      • NSS.exe (PID: 2844)
      • NSS.exe (PID: 2928)
      • rundll32.exe (PID: 1520)
      • NSS.exe (PID: 1944)
      • rundll32.exe (PID: 1212)
      • NSS.exe (PID: 3016)

    • Application was dropped or rewritten from another process

      • SymInstallStub.exe (PID: 2988)
      • SymCCISExe.exe (PID: 3000)
      • nssSetup.exe (PID: 3172)
      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2432)
      • SymInstallStub.exe (PID: 2620)
      • SymCCISExe.exe (PID: 2684)
      • SymHtmlRender.exe (PID: 3420)
      • fsdSetup.exe (PID: 1416)
      • fsdSetup.exe (PID: 3776)
      • NSS.exe (PID: 2844)
      • NSS.exe (PID: 3016)
      • NSS.exe (PID: 2928)
      • NSS.exe (PID: 1944)

    • Loads the Task Scheduler DLL interface

      • SymCCISExe.exe (PID: 3000)
      • SymInstallStub.exe (PID: 2988)
      • SymInstallStub.exe (PID: 2620)

    • Downloads executable files from the Internet

      • SymCCISExe.exe (PID: 3000)
      • SymCCISExe.exe (PID: 2684)

    • Changes the autorun value in the registry

      • SymInstallStub.exe (PID: 2988)
      • nssSetup.exe (PID: 3172)
      • SymInstallStub.exe (PID: 2620)
      • fsdSetup.exe (PID: 1416)
      • fsdSetup.exe (PID: 3776)

    • Loads the Task Scheduler COM API

      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2432)
      • NSS.exe (PID: 3016)
      • NSS.exe (PID: 2928)

    • Changes settings of System certificates

      • NSS.exe (PID: 2928)

  • SUSPICIOUS

    • Reads internet explorer settings

      • SymCCISExe.exe (PID: 3000)
      • fsdSetup.exe (PID: 3776)

    • Executable content was dropped or overwritten

      • Setup.exe (PID: 1852)
      • SymCCISExe.exe (PID: 3000)
      • SymInstallStub.exe (PID: 2988)
      • SymCCISExe.exe (PID: 2684)
      • nssSetup.exe (PID: 3172)
      • SymInstallStub.exe (PID: 2620)
      • fsdSetup.exe (PID: 1416)

    • Creates files in the program directory

      • SymInstallStub.exe (PID: 2988)
      • NSS.exe (PID: 2432)
      • NSS.exe (PID: 584)
      • SymCCISExe.exe (PID: 2684)
      • nssSetup.exe (PID: 3172)
      • fsdSetup.exe (PID: 1416)
      • fsdSetup.exe (PID: 3776)
      • NSS.exe (PID: 3016)
      • NSS.exe (PID: 2928)

    • Creates a software uninstall entry

      • nssSetup.exe (PID: 3172)

    • Creates files in the Windows directory

      • nssSetup.exe (PID: 3172)

    • Creates files in the driver directory

      • nssSetup.exe (PID: 3172)

    • Uses RUNDLL32.EXE to load library

      • NSS.exe (PID: 2432)
      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2928)
      • NSS.exe (PID: 3016)

    • Starts itself from another location

      • fsdSetup.exe (PID: 1416)

    • Application launched itself

      • NSS.exe (PID: 2844)
      • NSS.exe (PID: 1944)

    • Adds / modifies Windows certificates

      • NSS.exe (PID: 2928)

  • INFO

    • Reads the hosts file

      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2928)

    • Dropped object may contain Bitcoin addresses

      • nssSetup.exe (PID: 3172)
      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2928)

    • Manual execution by user

      • NSS.exe (PID: 2844)
      • NSS.exe (PID: 1944)

    • Reads settings of System Certificates

      • NSS.exe (PID: 584)
      • NSS.exe (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

ProductVersion: 2.1.4
ProductName: Norton Product Installer
OriginalFileName: SymCCIS
LegalCopyright: Copyright © 2015 Symantec Corporation.
InternalName: SymCCIS
FileVersion: 2.1.4
FileDescription: SymCCIS
CompanyName: Symantec
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 9.20.0.0
FileVersionNumber: 2.1.4.19
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x14b04
UninitializedDataSize: -
InitializedDataSize: 178688
CodeSize: 104960
LinkerVersion: 6
PEType: PE32
TimeStamp: 2010:11:18 17:27:35+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 18-Nov-2010 16:27:35
Detected languages:
  • English - United States
CompanyName: Symantec
FileDescription: SymCCIS
FileVersion: 2.1.4
InternalName: SymCCIS
LegalCopyright: Copyright © 2015 Symantec Corporation.
OriginalFilename: SymCCIS
ProductName: Norton Product Installer
ProductVersion: 2.1.4

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 18-Nov-2010 16:27:35
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000199EA
0x00019A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.60849
.rdata
0x0001B000
0x00004494
0x00004600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.36802
.data
0x00020000
0x00005A48
0x00003200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.37054
.sxdata
0x00026000
0x00000004
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_LNK_INFO, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.0203931
.rsrc
0x00027000
0x00023F68
0x00024000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.08366

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.67679
1744
Latin 1 / Western European
English - United States
RT_MANIFEST
5
1.43775
52
Latin 1 / Western European
English - United States
RT_STRING
11
3.33114
1320
Latin 1 / Western European
UNKNOWN
RT_ICON
12
4.13046
2920
Latin 1 / Western European
UNKNOWN
RT_ICON
13
2.84238
5160
Latin 1 / Western European
UNKNOWN
RT_ICON
14
3.50025
11560
Latin 1 / Western European
UNKNOWN
RT_ICON
15
2.87659
81960
Latin 1 / Western European
UNKNOWN
RT_ICON
16
7.98642
40717
Latin 1 / Western European
UNKNOWN
RT_ICON
500
3.0766
166
Latin 1 / Western European
English - United States
RT_DIALOG
501
2.90863
90
Latin 1 / Western European
UNKNOWN
RT_GROUP_ICON

Imports

KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
USER32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
20
Malicious processes
18
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start drop and start drop and start setup.exe no specs setup.exe symccisexe.exe syminstallstub.exe nsssetup.exe nss.exe rundll32.exe no specs nss.exe rundll32.exe no specs symhtmlrender.exe symccisexe.exe syminstallstub.exe fsdsetup.exe fsdsetup.exe nss.exe no specs nss.exe rundll32.exe no specs nss.exe no specs nss.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1972"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe—explorer.exe
User:
admin
Company:
Symantec
Integrity Level:
MEDIUM
Description:
SymCCIS
Exit code:
3221226540
Version:
2.1.4
1852"C:\Users\admin\Desktop\Setup.exe" C:\Users\admin\Desktop\Setup.exe
explorer.exe
User:
admin
Company:
Symantec
Integrity Level:
HIGH
Description:
SymCCIS
Exit code:
0
Version:
2.1.4
3000.\SymCCISExe.exe /partnerid=symantecC:\Users\admin\AppData\Local\Temp\7zSB64A.tmp\SymCCISExe.exe
Setup.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
SymCCIS
Exit code:
0
Version:
2.1.4.19
2988"C:\Users\admin\AppData\Local\Temp\7zSB64A.tmp\SymInstallStub.exe" /partnerid=symantec /productlist=nss /staging=falseC:\Users\admin\AppData\Local\Temp\7zSB64A.tmp\SymInstallStub.exe
SymCCISExe.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
SymInstallStub
Exit code:
0
Version:
3.8.3.55
3172"C:\Users\admin\AppData\Local\Temp\nssSetup.exe" C:\Users\admin\AppData\Local\Temp\nssSetup.exe
SymInstallStub.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
Norton Security Scan
Exit code:
0
Version:
4.7.0.181
2432"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe" action=run mode=fmui fmui="C:\Program Files\Norton Security Scan\Branding\Config.dll" setup=LITE start=Install ptkdata="C:\ProgramData\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS_4.7.0.181"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe
nssSetup.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
Norton Security Scan
Exit code:
0
Version:
4.7.0.181
2956"C:\Windows\System32\rundll32.exe" "C:\Program Files\Norton Security Scan\Engine\4.7.0.181\pePIDyn.dll" _RunServer@16C:\Windows\System32\rundll32.exe—NSS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
584"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe" action=run mode=fmui fmui="C:\Program Files\Norton Security Scan\Branding\Config.dll" setup=CORE start=FirstLaunch ptkdata="C:\ProgramData\Norton\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS_4.7.0.181"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\NSS.exe
nssSetup.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
Norton Security Scan
Exit code:
0
Version:
4.7.0.181
444"C:\Windows\System32\rundll32.exe" "C:\Program Files\Norton Security Scan\Engine\4.7.0.181\pePIDyn.dll" _RunServer@16C:\Windows\System32\rundll32.exe—NSS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3420"C:\Program Files\Norton Security Scan\Engine\4.7.0.181\SymHtmlRender.exe" /channel 2092C:\Program Files\Norton Security Scan\Engine\4.7.0.181\SymHtmlRender.exe
NSS.exe
User:
admin
Company:
Symantec Corporation
Integrity Level:
HIGH
Description:
Norton Security Scan
Exit code:
0
Version:
4.7.0.181
Total events
3 374
Read events
3 011
Write events
0
Delete events
0

Modification events

No data
Executable files
282
Suspicious files
41
Text files
31
Unknown types
7

Dropped files

PID
Process
Filename
Type
2988SymInstallStub.exeC:\Users\admin\AppData\Local\Temp\SymInstallStub\symantec\ISD51D.tmp —
MD5:—
SHA256:—
2988SymInstallStub.exeC:\Users\admin\AppData\Local\Temp\IS3232.tmp —
MD5:—
SHA256:—
3172nssSetup.exeC:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\4.7.0.181\04\01\InsMUI.locexecutable
MD5:D5A4162C98DF08F37527E94D13D748A8
SHA256:A8FF67CFF003943E9D3EA9477B441218CAD1ECF56BBA06DFF91E0D1620F5AF98
3172nssSetup.exeC:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\4.7.0.181\04\02\InsBrand.locexecutable
MD5:56F9CEE4EEB4F191B3DC50812B2A774B
SHA256:81FE3C040E1016DFA6D090B30D4F11A102F7427DB61CAB43C99DCA6F6BE4F016
1852Setup.exeC:\Users\admin\AppData\Local\Temp\7zSB64A.tmp\SymCCISExe.exeexecutable
MD5:A7F944D0E2E13B6CE1608D2CBFDC1257
SHA256:5D39F74BE3F0B98567CB2C5BD70F2DF5D7D97BDBAB30D5ED68340E9318C97D68
2988SymInstallStub.exeC:\Users\admin\AppData\Local\Temp\nssSetup.exeexecutable
MD5:8E63F162B254A27B49153D414E6D5CF0
SHA256:B28130F3B72B8E51DA99DE7CB563A375D5BF66440DB90CD96C68D8704EC372C4
3172nssSetup.exeC:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\4.7.0.181\InstStub.exeexecutable
MD5:51F31A92CEBD8847F4C22E37904327FF
SHA256:21D1B0826884081FE2214D0E10B82815205A65B174002672FE8BFC4684EC6384
2988SymInstallStub.exeC:\Users\admin\AppData\Local\Temp\SymInstallStub\symantec\SymInstallStub.state.dattext
MD5:3DB568F49571C7FCF32A3E325ECF6762
SHA256:A1C421FDCEB2AE6802519B83357D96DD4F9455B1D225E8C88D90A3F65564570F
2988SymInstallStub.exeC:\ProgramData\Norton\{086A63F0-6B13-4F29-9695-134E7A01E963}\LC.INItext
MD5:A831DA7B386A293CCBC23DB7EC79B912
SHA256:09EE9BD0A0A88F702AADBAD31FB472B129B44854866A4F5EA8A6E640DB3883C1
3172nssSetup.exeC:\Program Files\NortonInstaller\{397E31AA-0D78-4649-A01C-339D73A2ED35}\NSS\LicenseType\4.7.0.181\05\01\InsMUI.locexecutable
MD5:9130AF6C6FBD444EE7BF431DBF8A9E3D
SHA256:0E1741F678A2EAD57FA8A52732C78F2923015D283D46E6AAA1C5F59C4C129E94
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
40
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2684
SymCCISExe.exe
GET
400
40.118.201.45:80
http://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.4.3&language=09.01&os=6.1.7601.1.0&y=1033&a=SymCCISExe&b=symantecnss&d=false&f=-1&m="C:\Program%20Files\Norton%20Security%20Scan\Engine\4.7.0.181\SymCCISExe.exe"%20/downloadis%20/staging=false%20/uimode=silent%20/partnerid=symantecnss&n=0&o=0x0
US
—
—
malicious
3776
fsdSetup.exe
HEAD
200
152.195.132.120:80
http://liveupdate.symantec.com/upgrade/NSS/SymCCIS/Production/IS/fsd/MUI/symantecnss/FSDPlugin.dll
US
—
—
suspicious
3776
fsdSetup.exe
HEAD
200
152.195.132.156:80
http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/IS/ns/MUI/symantecnss/Setup.exe
US
—
—
whitelisted
3172
nssSetup.exe
POST
—
52.234.215.129:80
http://stats.norton.com/n/p?module=9000&error=100&MID=AC9B36B1-F0DA-4C70-BEBD-E3A5983BBD3E&build=90AE26E0CFF34AC9BFC3B2B1A3B45084&d=0&f=6.1.7601.1.0.0.0&g=AC9B36B1-F0DA-4C70-BEBD-E3A5983BBD3E&i=0&l=0&language=09.01&product=Norton%20Security%20Scan&t=0&u=00000000&upgrade=0&v=11.10.1.47&version=4.7.0.181&w=2&x=0&z=0&zzz=0fa45dec457a28828
US
—
—
whitelisted
3776
fsdSetup.exe
GET
—
152.195.132.156:80
http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/IS/ns/MUI/symantecnss/Setup.exe
US
—
—
whitelisted
3000
SymCCISExe.exe
GET
200
52.234.215.129:80
http://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.4.19&language=09.01&os=6.1.7601.1.0&y=1033&b=symantec&a=CallCriteriaChecker&f=10&c=false&d=false&e=0x0&error=0&j=nss=install&k=nss=1000&g=0.174&l=4.670&q=&t=&u=
US
text
13 b
whitelisted
3776
fsdSetup.exe
GET
200
40.118.201.45:80
http://stats.norton.com/n/p?module=9090&language=09.01&product=Norton%20Download%20Manager&version=5.9.0.16&OS=6.1.7601.1.0.0&error=00000000&e=00000000&b=%7BNSSYM-B201-4abb-B07C-C084B04B4F12%7D&c=%7BNSB2254-2EED-40d2-8F41-EA92D16DCE3B%7D&MID=AC9B36B1-F0DA-4C70-BEBD-E3A5983BBD3E&y=0&z=0&zzz=01815defc57738f89
US
text
13 b
malicious
3000
SymCCISExe.exe
GET
200
52.234.215.129:80
http://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.4.19&language=09.01&os=6.1.7601.1.0&y=1033&b=symantec&a=RunInstallStub&f=nss&c=false&d=false&e=0x0&error=0&m=0
US
text
13 b
whitelisted
3000
SymCCISExe.exe
GET
400
52.234.215.129:80
http://stats.norton.com/n/p?module=9151&product=SymCCIS&version=2.1.4.19&language=09.01&os=6.1.7601.1.0&y=1033&a=SymCCISExe&b=symantec&d=&f=-1&m=.\SymCCISExe.exe%20/partnerid=symantec&n=0&o=0x0
US
text
13 b
whitelisted
2684
SymCCISExe.exe
GET
200
152.195.132.156:80
http://liveupdate.symantecliveupdate.com/upgrade/NSS/SymCCIS/Production/SymInstallStub.exe
US
executable
1.76 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3000
SymCCISExe.exe
52.234.215.129:443
stats.norton.com
Microsoft Corporation
US
whitelisted
3000
SymCCISExe.exe
152.195.132.156:80
liveupdate.symantecliveupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2432
NSS.exe
152.195.132.156:443
liveupdate.symantecliveupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2988
SymInstallStub.exe
152.195.132.156:443
liveupdate.symantecliveupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3172
nssSetup.exe
52.234.215.129:80
stats.norton.com
Microsoft Corporation
US
whitelisted
584
NSS.exe
23.96.34.208:443
nss-shasta-rrs.symantec.com
Microsoft Corporation
US
unknown
3000
SymCCISExe.exe
52.234.215.129:80
stats.norton.com
Microsoft Corporation
US
whitelisted
584
NSS.exe
205.185.216.42:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
3000
SymCCISExe.exe
152.195.132.156:443
liveupdate.symantecliveupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2988
SymInstallStub.exe
40.118.201.45:443
stats.norton.com
Microsoft Corporation
US
malicious

DNS requests

Domain
IP
Reputation
liveupdate.symantecliveupdate.com
  • 152.195.132.156
unknown
stats.norton.com
  • 52.234.215.129
  • 40.118.201.45
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
stats.qalabs.symantec.com
  • —
unknown
nss-shasta-rrs.symantec.com
  • 23.96.34.208
unknown
www.download.windowsupdate.com
  • 205.185.216.42
  • 205.185.216.10
whitelisted
liveupdate.symantec.com
  • 152.195.132.120
suspicious

Threats

PID
Process
Class
Message
3000
SymCCISExe.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3000
SymCCISExe.exe
A Network Trojan was detected
ET POLICY Norton Update User-Agent (Install Stub)
3000
SymCCISExe.exe
Misc activity
ADWARE [PTsecurity] NSIS.DealPly.xiazai
3000
SymCCISExe.exe
A Network Trojan was detected
ET POLICY Norton Update User-Agent (Install Stub)
3000
SymCCISExe.exe
Misc activity
ADWARE [PTsecurity] NSIS.DealPly.xiazai
3000
SymCCISExe.exe
A Network Trojan was detected
ET POLICY Norton Update User-Agent (Install Stub)
3000
SymCCISExe.exe
Misc activity
ADWARE [PTsecurity] NSIS.DealPly.xiazai
2684
SymCCISExe.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2684
SymCCISExe.exe
A Network Trojan was detected
ET POLICY Norton Update User-Agent (Install Stub)
2684
SymCCISExe.exe
Misc activity
ADWARE [PTsecurity] NSIS.DealPly.xiazai
Process
Message
nssSetup.exe
Information at self.ready (C:\Users\CM\AppData\Local\Temp\c67f1a42-6de6-4272-b137-585ccac44d3d\CLOUD_CONNECT.tis(867)) self.ready
NSS.exe
wrong @const declaration at (res:std_colors.css(20))
NSS.exe
wrong @const declaration at (res:std_colors.css(20))
NSS.exe
unknown property 'table-layout' at (res:MainUISecurity.css(63))
NSS.exe
unknown property 'table-layout' at (res:MainUICookies.css(138))
NSS.exe
prevbutton: <button#scan_feature>
NSS.exe
Element to open: <details#scan_details/ScanDetails>
NSS.exe
x, w, imageWidth: 0 198 32
NSS.exe
in class ScanDetails::on_open() ...
NSS.exe
in class Details::on_open() ...
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.exe