Malware analysis Instalador Hidro Build 1.4.0.exe Malicious activity

Add for printing

File name:	Instalador Hidro Build 1.4.0.exe
Full analysis:	https://app.any.run/tasks/6dbd142d-ee56-45ee-bbb7-e1d31a9200d1
Verdict:	Malicious activity
Analysis date:	July 29, 2024, 16:48:30
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	installer
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	A4B8C10240293E31D4AA199610F78D89
SHA1:	76CDED2F78542EF691D73B6734EEBB33BACE731D
SHA256:	B1649A3EFBEB0F3F0D933BD9A8341FF952E97AFE8C98DF45C3EEEE6F7203C32A
SSDEEP:	98304:n6P4EyWqvpZTD2ilZP4caoZ852nL2q2dxr1Ps1ZqVWkCh21wqOvTkwmNZD/XV4Ix:xaBjDWiESaQauKO53

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - Instalador Hidro Build 1.4.0.exe (PID: 6656)
  - Instalador Hidro Build 1.4.0.tmp (PID: 6340)
  - Instalador Hidro Build 1.4.0.exe (PID: 5128)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - Instalador Hidro Build 1.4.0.tmp (PID: 2188)
- Executable content was dropped or overwritten
  - Instalador Hidro Build 1.4.0.exe (PID: 6656)
  - Instalador Hidro Build 1.4.0.tmp (PID: 6340)
  - Instalador Hidro Build 1.4.0.exe (PID: 5128)
- Reads the Windows owner or organization settings
  - Instalador Hidro Build 1.4.0.tmp (PID: 6340)
- There is functionality for taking screenshot (YARA)
  - Hidro 1.4.exe (PID: 3868)
- Reads the date of Windows installation
  - Instalador Hidro Build 1.4.0.tmp (PID: 2188)
INFO
- Create files in a temporary directory
  - Instalador Hidro Build 1.4.0.exe (PID: 5128)
  - Instalador Hidro Build 1.4.0.exe (PID: 6656)
  - Instalador Hidro Build 1.4.0.tmp (PID: 6340)
  - Hidro 1.4.exe (PID: 3868)
- Checks supported languages
  - Instalador Hidro Build 1.4.0.exe (PID: 5128)
  - Instalador Hidro Build 1.4.0.exe (PID: 6656)
  - Instalador Hidro Build 1.4.0.tmp (PID: 6340)
  - Hidro 1.4.exe (PID: 3868)
  - Instalador Hidro Build 1.4.0.tmp (PID: 2188)
- Process checks computer location settings
  - Instalador Hidro Build 1.4.0.tmp (PID: 2188)
- Reads the computer name
  - Instalador Hidro Build 1.4.0.tmp (PID: 6340)
  - Hidro 1.4.exe (PID: 3868)
  - Instalador Hidro Build 1.4.0.tmp (PID: 2188)
- Checks proxy server information
  - slui.exe (PID: 2736)
- Creates files in the program directory
  - Instalador Hidro Build 1.4.0.tmp (PID: 6340)
- Reads the software policy settings
  - slui.exe (PID: 2736)
- Creates files or folders in the user directory
  - Hidro 1.4.exe (PID: 3868)
- Creates a software uninstall entry
  - Instalador Hidro Build 1.4.0.tmp (PID: 6340)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Inno Setup installer (77.7)
.exe	\|	Win32 Executable Delphi generic (10)
.dll	\|	Win32 Dynamic Link Library (generic) (4.6)
.exe	\|	Win32 Executable (generic) (3.1)
.exe	\|	Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1992:06:19 22:22:17+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	41472
InitializedDataSize:	11776
UninitializedDataSize:	-
EntryPoint:	0xaa98
OSVersion:	1
ImageVersion:	6
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	0.0.0.0
ProductVersionNumber:	0.0.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	This installation was built with Inno Setup.
CompanyName:	Agência Nacional de Águas - ANA - Superintêndencia de Gestão
FileDescription:	Hidro 1.4 Setup
FileVersion:
LegalCopyright:
ProductName:	Hidro 1.4
ProductVersion:

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

147

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

2188

"C:\Users\admin\AppData\Local\Temp\is-7PUNT.tmp\Instalador Hidro Build 1.4.0.tmp" /SL5="$1B0180,13519603,54272,C:\Users\admin\AppData\Local\Temp\Instalador Hidro Build 1.4.0.exe"

C:\Users\admin\AppData\Local\Temp\is-7PUNT.tmp\Instalador Hidro Build 1.4.0.tmp

—

Instalador Hidro Build 1.4.0.exe

User:

admin

Integrity Level:

MEDIUM

Description:

Setup/Uninstall

Exit code:

Version:

51.52.0.0

Modules

Images
c:\users\admin\appdata\local\temp\is-7punt.tmp\instalador hidro build 1.4.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

2632

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

2736

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

3868

"C:\Program Files (x86)\Hidro 1.4\Hidro 1.4.exe" /LOG

C:\Program Files (x86)\Hidro 1.4\Hidro 1.4.exe

Instalador Hidro Build 1.4.0.tmp

User:

admin

Company:

SGH/ANA

Integrity Level:

MEDIUM

Description:

Sistema de Informações Hidrológicas

Version:

1.4.0.83

Modules

Images
c:\program files (x86)\hidro 1.4\hidro 1.4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

5128

"C:\Users\admin\AppData\Local\Temp\Instalador Hidro Build 1.4.0.exe"

C:\Users\admin\AppData\Local\Temp\Instalador Hidro Build 1.4.0.exe

explorer.exe

User:

admin

Company:

Agência Nacional de Águas - ANA - Superintêndencia de Gestão

Integrity Level:

MEDIUM

Description:

Hidro 1.4 Setup

Exit code:

Version:

Modules

Images
c:\users\admin\appdata\local\temp\instalador hidro build 1.4.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

6340

"C:\Users\admin\AppData\Local\Temp\is-HFKQH.tmp\Instalador Hidro Build 1.4.0.tmp" /SL5="$26023C,13519603,54272,C:\Users\admin\AppData\Local\Temp\Instalador Hidro Build 1.4.0.exe" /SPAWNWND=$1C02F4 /NOTIFYWND=$1B0180

C:\Users\admin\AppData\Local\Temp\is-HFKQH.tmp\Instalador Hidro Build 1.4.0.tmp

Instalador Hidro Build 1.4.0.exe

User:

admin

Integrity Level:

HIGH

Description:

Setup/Uninstall

Exit code:

Version:

51.52.0.0

Modules

Images
c:\users\admin\appdata\local\temp\is-hfkqh.tmp\instalador hidro build 1.4.0.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

6656

"C:\Users\admin\AppData\Local\Temp\Instalador Hidro Build 1.4.0.exe" /SPAWNWND=$1C02F4 /NOTIFYWND=$1B0180

C:\Users\admin\AppData\Local\Temp\Instalador Hidro Build 1.4.0.exe

Instalador Hidro Build 1.4.0.tmp

User:

admin

Company:

Agência Nacional de Águas - ANA - Superintêndencia de Gestão

Integrity Level:

HIGH

Description:

Hidro 1.4 Setup

Exit code:

Version:

Modules

Images
c:\users\admin\appdata\local\temp\instalador hidro build 1.4.0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

Add for printing

Total events

6 166

Read events

6 088

Write events

Delete events

Modification events


(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Owner
Value: C418000028440D2CD7E1DA01
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	SessionHash
Value: 57392D25EBD34EA88F016E4935E5F5306E8E7F0B35A30F7F8445F2F2F8D77AAB
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	Sequence
Value: 1
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	RegFiles0000
Value: C:\Program Files (x86)\Hidro 1.4\Hidro 1.4.exe
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:	write	Name:	RegFilesHash
Value: B6201F486F15C5E2EC5E7DD8CD63591B1F258810665CBAB294B952413E495B6C
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C4EE9CF3-A201-4D99-AD3C-728A27ECB828}_is1
Operation:	write	Name:	Inno Setup: Setup Version
Value: 5.5.9 (a)
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C4EE9CF3-A201-4D99-AD3C-728A27ECB828}_is1
Operation:	write	Name:	Inno Setup: App Path
Value: C:\Program Files (x86)\Hidro 1.4
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C4EE9CF3-A201-4D99-AD3C-728A27ECB828}_is1
Operation:	write	Name:	InstallLocation
Value: C:\Program Files (x86)\Hidro 1.4\
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C4EE9CF3-A201-4D99-AD3C-728A27ECB828}_is1
Operation:	write	Name:	Inno Setup: Icon Group
Value: Hidro 1.4
(PID) Process:	(6340) Instalador Hidro Build 1.4.0.tmp	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C4EE9CF3-A201-4D99-AD3C-728A27ECB828}_is1
Operation:	write	Name:	Inno Setup: User
Value: admin

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\is-88GH4.tmp		—
		MD5:—	SHA256:—
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\Hidro.mdb		—
		MD5:—	SHA256:—
6340	Instalador Hidro Build 1.4.0.tmp	C:\Users\admin\AppData\Local\Temp\is-SEP5A.tmp\_isetup\_setup64.tmp		executable
		MD5:E4211D6D009757C078A9FAC7FF4F03D4	SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\is-UU3LL.tmp		text
		MD5:E50867916E15E1C8290E81BCE0CC6687	SHA256:9DBA0BF43ED700B73EDD6BE0A8BFD8509F3E48844BD710152B6EDD307A2A31AA
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\Hidro 1.0 - Manual do Usuário.pdf		pdf
		MD5:43638C138DC4847182C3801F414F4698	SHA256:45C4BAC86BC584A9F4926ACF18B878CFEC3B48BDCDC7594CB194FDFC94E16C37
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\is-JM3I2.tmp		pdf
		MD5:C2CBD4A85AFE680E17533781BE2AD716	SHA256:E81C3A8731AF6B38AD6C15BED2420F4BC868D36F9DEF121ADBE36B619101CE34
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\is-B0O6Q.tmp		pdf
		MD5:DD5BC01F827CA92AF7C89E03AA03B569	SHA256:D098FE733740299C25EF3FC33AC7E96D6B21FF01925150D6B1D74791914E24F8
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\is-TRD8O.tmp		text
		MD5:ACBC40F6104AF6BD4C196060317C7264	SHA256:6136DD163BA52D5863FFD6B70C9F3AACE5D5551ABDD1599C5F2972F0A4F9FB98
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\is-20L3P.tmp		—
		MD5:—	SHA256:—
6340	Instalador Hidro Build 1.4.0.tmp	C:\Program Files (x86)\Hidro 1.4\Hidro.hlp		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5368	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
4424	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
4132	OfficeClickToRun.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
3676	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
5368	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D	unknown	—	—	whitelisted
5428	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2348	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
—	—	131.253.33.254:443	a-ring-fallback.msedge.net	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
6012	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
4580	slui.exe	40.91.76.224:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
—	—	104.126.37.170:443	www.bing.com	Akamai International B.V.	DE	unknown
996	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	unknown
4	System	192.168.100.255:138	—	—	—	whitelisted
3952	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	40.91.76.224:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 4.231.128.59	whitelisted
t-ring-fdv2.msedge.net	13.107.237.254	unknown
a-ring-fallback.msedge.net	131.253.33.254	unknown
www.bing.com	104.126.37.170 104.126.37.130 104.126.37.171 104.126.37.185 104.126.37.131 104.126.37.152 104.126.37.137 104.126.37.146 104.126.37.145 2.23.209.149 2.23.209.189 2.23.209.133 2.23.209.179 2.23.209.130 2.23.209.182 2.23.209.140 2.23.209.187	whitelisted
google.com	142.250.185.238	whitelisted
login.live.com	40.126.32.76 20.190.160.14 40.126.32.140 40.126.32.72 20.190.160.17 40.126.32.134 20.190.160.22 40.126.32.74	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
fp-afd-nocache-ccp.azureedge.net	13.107.246.45	whitelisted
client.wns.windows.com	40.113.103.199	whitelisted
fd.api.iris.microsoft.com	20.103.156.88	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

Instalador Hidro Build 1.4.0.exe

A4B8C10240293E31D4AA199610F78D89

76CDED2F78542EF691D73B6734EEBB33BACE731D

B1649A3EFBEB0F3F0D933BD9A8341FF952E97AFE8C98DF45C3EEEE6F7203C32A

98304:n6P4EyWqvpZTD2ilZP4caoZ852nL2q2dxr1Ps1ZqVWkCh21wqOvTkwmNZD/XV4Ix:xaBjDWiESaQauKO53

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

SUSPICIOUS

Reads security settings of Internet Explorer

Executable content was dropped or overwritten

Reads the Windows owner or organization settings

There is functionality for taking screenshot (YARA)

Reads the date of Windows installation

INFO

Create files in a temporary directory

Checks supported languages

Process checks computer location settings

Reads the computer name

Checks proxy server information

Creates files in the program directory

Reads the software policy settings

Creates files or folders in the user directory

Creates a software uninstall entry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings