| File name: | WsUninstallationTool.exe |
| Full analysis: | https://app.any.run/tasks/2fee5dc9-4bb7-47a7-aa69-1f03ac9e2a51 |
| Verdict: | Malicious activity |
| Analysis date: | September 03, 2024, 11:11:37 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 6D99C7DF4049CB64CB7A54C12E013626 |
| SHA1: | AD44445CB71C84755719253D942769AF86C9B1C7 |
| SHA256: | B34A0EE59096B8B468F8A3D908823E22F3E2032D6E0214B412800DA5941490A5 |
| SSDEEP: | 98304:qwoH7M5sgugDZtscPnjWgsWcGFclgp9gpo:j |
MALICIOUS
No malicious indicators.SUSPICIOUS
Searches for installed software
- FsUninstallationTool64.exe (PID: 5880)
Executable content was dropped or overwritten
- WsUninstallationTool.exe (PID: 6156)
The process verifies whether the antivirus software is installed
- FsUninstallationTool64.exe (PID: 5880)
INFO
Checks supported languages
- WsUninstallationTool.exe (PID: 6156)
- FsUninstallationTool64.exe (PID: 5880)
- identity_helper.exe (PID: 2080)
Creates files in the program directory
- WsUninstallationTool.exe (PID: 6156)
- FsUninstallationTool64.exe (PID: 5880)
Reads the computer name
- FsUninstallationTool64.exe (PID: 5880)
- WsUninstallationTool.exe (PID: 6156)
- identity_helper.exe (PID: 2080)
Create files in a temporary directory
- WsUninstallationTool.exe (PID: 6156)
- FsUninstallationTool64.exe (PID: 5880)
Reads Microsoft Office registry keys
- msedge.exe (PID: 3140)
Manual execution by a user
- msedge.exe (PID: 3140)
Reads Environment values
- identity_helper.exe (PID: 2080)
Application launched itself
- msedge.exe (PID: 3140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable (generic) (52.9) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (23.5) |
| .exe | | | DOS Executable Generic (23.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2022:12:16 16:12:45+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.34 |
| CodeSize: | 648704 |
| InitializedDataSize: | 1417728 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x6b830 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 18.9.43.0 |
| ProductVersionNumber: | 18.9.43.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | WithSecure Corporation |
| FileDescription: | WithSecure™ Uninstallation Tool |
| FileVersion: | 18.9.43 |
| InternalName: | uninstallation_tool_32 |
| LegalCopyright: | © WithSecure Corporation. All rights reserved. |
| LegalTrademarks: | WithSecure' and WithSecure-logo are either trademarks or registered trademarks of WithSecure Corporation. WithSecure product and technology names and WithSecure logos are either trademarks or registered trademarks of WithSecure Corporation. Other product names and logos referenced herein are trademarks or registered trademarks of their respective companies. |
| OriginalFileName: | uninstallation_tool_32.exe |
| ProductName: | WithSecure™ OneClient |
| ProductVersion: | 18.9.43 |
| Comments: | - |
Total processes
160
Monitored processes
31
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1164 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1828 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4104 --field-trial-handle=2384,i,17458046433047309682,17339800794729260220,262144 --variations-seed-version /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2016 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7344 --field-trial-handle=2384,i,17458046433047309682,17339800794729260220,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2040 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4692 --field-trial-handle=2384,i,17458046433047309682,17339800794729260220,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2080 | "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6220 --field-trial-handle=2384,i,17458046433047309682,17339800794729260220,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: PWA Identity Proxy Host Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2136 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7280 --field-trial-handle=2384,i,17458046433047309682,17339800794729260220,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2224 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7120 --field-trial-handle=2384,i,17458046433047309682,17339800794729260220,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2384 | "C:\WINDOWS\system32\fltmc.exe" unload fsni | C:\Windows\System32\fltMC.exe | — | FsUninstallationTool64.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Filter Manager Control Program Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2400 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=7276 --field-trial-handle=2384,i,17458046433047309682,17339800794729260220,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2468 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6644 --field-trial-handle=2384,i,17458046433047309682,17339800794729260220,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
Total events
8 931
Read events
8 891
Write events
39
Delete events
1
Modification events
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge |
| Operation: | write | Name: | UsageStatsInSample |
Value: 1 | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | usagestats |
Value: 0 | |||
| (PID) Process: | (3140) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | urlstats |
Value: 0 | |||
Executable files
18
Suspicious files
287
Text files
93
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\ess\uninstall_self_signed_certificate.ps1 | text | |
MD5:334560ED2CC339DFFB68250706FA8D32 | SHA256:54CCC90BDE518768C28005CC1D39E01E431E885F3D44AA561C9082029ECEEC95 | |||
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\freedome.lua | text | |
MD5:66E5F931F01DF282A3814F3AA559F3DA | SHA256:7C365709A7E7E1EFA2815A692C332C7FEB82816D47F2DC1E19B4228488125B6C | |||
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\elements_connector_db.lua | text | |
MD5:B7360AA2AE3A7B80B32E86615EC2C97A | SHA256:7B364485E3D1874F16CE15614EB7787D358170E04E2C5F4C43046341AC404E0B | |||
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\elements_connector.lua | text | |
MD5:AB476037C86A9BBFE7EC1B728AABCFA1 | SHA256:8A873BB6CB6D2088C0402FD4C104D5FB26E9D28B46A927AD7C9AA7D442A15037 | |||
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\lib_daas2.lua | text | |
MD5:72F83DFF56F8920375ABAB6ABC5F842D | SHA256:9FA53321233FE712A37C1BB7A8025B436C21759E6C8EFD896F7E0469AEC1F2C9 | |||
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\ess_quarantine.lua | text | |
MD5:B75A97E77A3293B511F0E0468436E64A | SHA256:722EF0AD0078ACF09F239D6F4A24E0C44C0E2AE1E9CCBF1AC00BD8AEA56433D1 | |||
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\lib_common.lua | text | |
MD5:A51DEE569A5FF481FD8B72566B82569C | SHA256:91812C8263FCCF0904830209BE3DBC86DFF71A76DBA0E222BB56CF3BB534C79A | |||
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\lib_ess_quarantine.lua | text | |
MD5:77010746643BC687DE32866CE01D731B | SHA256:FF97D54F269E6E4DE4117F217C41318B729AB886E5B669F1B06DFB25DC092043 | |||
| 6156 | WsUninstallationTool.exe | C:\Users\admin\AppData\Local\Temp\fs12210780.tmp\FsUninstallationTool64.exe | executable | |
MD5:DE5697384418ABA71BFBF683A0902811 | SHA256:E1845723CB4B68F411DE762FCC3AEB345C35D4A65F1552B7323DB2052FDD8D22 | |||
| 5880 | FsUninstallationTool64.exe | C:\Users\admin\AppData\Local\Temp\fs12211560.tmp\lib_service_enabler.lua | text | |
MD5:E29B85DFDF0BBCB93FC5279EDE4AE1ED | SHA256:8B295B420F5BA2ACB214B9F2FC28792B512D7BD469C021B3695CA15288A67A91 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
92
DNS requests
107
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1992 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
3328 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
3328 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5064 | msedge.exe | GET | 304 | 23.32.238.48:80 | http://apps.identrust.com/roots/dstrootcax3.p7c | unknown | — | — | whitelisted |
5064 | msedge.exe | GET | 304 | 23.192.153.142:80 | http://x1.i.lencr.org/ | unknown | — | — | whitelisted |
5064 | msedge.exe | GET | 304 | 23.192.153.142:80 | http://r3.i.lencr.org/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6252 | RUXIMICS.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4760 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4760 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3260 | svchost.exe | 40.113.110.67:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1992 | svchost.exe | 20.190.159.4:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1992 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
3328 | SIHClient.exe | 40.68.123.157:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
ntp.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5064 | msedge.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
5064 | msedge.exe | Potentially Bad Traffic | ET DNS Query for .cc TLD |
5064 | msedge.exe | Misc activity | SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc) |
5064 | msedge.exe | Misc activity | SUSPICIOUS [ANY.RUN] Tracking Service (.popin .cc) |