| File name: | CCleaner-Pro-6.35.11488-x64-Plus.7z |
| Full analysis: | https://app.any.run/tasks/a0bf1c66-e5aa-4667-bb3f-c413430ecff3 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | April 17, 2025, 12:26:52 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-7z-compressed |
| File info: | 7-zip archive data, version 0.4 |
| MD5: | C0B1EC7BFE7366FAA2C21F3DB9F2B4EC |
| SHA1: | B52917721B0B05EB2BB4E9A3D421A929FC142A64 |
| SHA256: | BA25262824B369C4BDAEDAE2A8219DFB5F406A76BC6A31E9E4596633B8E4F9F3 |
| SSDEEP: | 196608:n4P2VfxCyowkFynLQlORU2H3XlW0mtOD3ac:MAfwZRFytRU2XVWHc |
MALICIOUS
Steals credentials from Web Browsers
- CCleaner.exe (PID: 8176)
Actions looks like stealing of personal data
- CCleaner.exe (PID: 8176)
SUSPICIOUS
Reads the date of Windows installation
- CCleaner.exe (PID: 8096)
- CCleaner.exe (PID: 8176)
Application launched itself
- CCleaner.exe (PID: 8096)
Reads Internet Explorer settings
- CCleaner.exe (PID: 8176)
Searches for installed software
- CCleaner.exe (PID: 8176)
The process checks if it is being run in the virtual environment
- CCleaner.exe (PID: 8176)
Reads security settings of Internet Explorer
- CCleaner.exe (PID: 8176)
- CCleaner.exe (PID: 8096)
The process verifies whether the antivirus software is installed
- CCleaner.exe (PID: 8176)
Query current time using 'w32tm.exe'
- CCleaner.exe (PID: 8176)
INFO
Reads the computer name
- CCleaner.exe (PID: 8096)
- CCleaner.exe (PID: 8176)
The sample compiled with english language support
- WinRAR.exe (PID: 7284)
Checks supported languages
- CCleaner.exe (PID: 8176)
- CCleaner.exe (PID: 8096)
Reads Environment values
- CCleaner.exe (PID: 8176)
- CCleaner.exe (PID: 8096)
Checks proxy server information
- CCleaner.exe (PID: 8176)
Reads product name
- CCleaner.exe (PID: 8176)
Reads CPU info
- CCleaner.exe (PID: 8176)
Reads the machine GUID from the registry
- CCleaner.exe (PID: 8176)
Process checks computer location settings
- CCleaner.exe (PID: 8176)
- CCleaner.exe (PID: 8096)
Reads Microsoft Office registry keys
- CCleaner.exe (PID: 8176)
TEAMVIEWER has been detected
- CCleaner.exe (PID: 8176)
Creates files or folders in the user directory
- CCleaner.exe (PID: 8176)
Create files in a temporary directory
- CCleaner.exe (PID: 8176)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 7284)
Manual execution by a user
- CCleaner.exe (PID: 8096)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .7z | | | 7-Zip compressed archive (v0.4) (57.1) |
|---|---|---|
| .7z | | | 7-Zip compressed archive (gen) (42.8) |
EXIF
ZIP
| FileVersion: | 7z v0.04 |
|---|---|
| ModifyDate: | 2025:04:16 12:25:37+00:00 |
| ArchivedFileName: | CCleaner |
Total processes
137
Monitored processes
9
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 960 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | w32tm.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1672 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | reg.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4380 | w32tm /query /status /verbose | C:\Windows\System32\w32tm.exe | — | CCleaner.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Time Service Diagnostic Tool Exit code: 2147943462 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5116 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5256 | reg query HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Parameters | C:\Windows\System32\reg.exe | — | CCleaner.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7284 | "C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\CCleaner-Pro-6.35.11488-x64-Plus.7z | C:\Program Files\WinRAR\WinRAR.exe | explorer.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 8056 | C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding | C:\Windows\System32\rundll32.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows host process (Rundll32) Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 8096 | "C:\Users\admin\Desktop\CCleaner\CCleaner.exe" | C:\Users\admin\Desktop\CCleaner\CCleaner.exe | — | explorer.exe | |||||||||||
User: admin Company: Gen Digital Inc. Integrity Level: MEDIUM Description: CCleaner Exit code: 0 Version: 6.35.0.11488 Modules
| |||||||||||||||
| 8176 | "C:\Users\admin\Desktop\CCleaner\CCleaner.exe" /uac | C:\Users\admin\Desktop\CCleaner\CCleaner.exe | CCleaner.exe | ||||||||||||
User: admin Company: Gen Digital Inc. Integrity Level: HIGH Description: CCleaner Version: 6.35.0.11488 Modules
| |||||||||||||||
Total events
9 863
Read events
9 812
Write events
38
Delete events
13
Modification events
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\AppData\Local\Temp\CCleaner-Pro-6.35.11488-x64-Plus.7z | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin |
| Operation: | write | Name: | Placement |
Value: 2C00000000000000010000000083FFFF0083FFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000 | |||
| (PID) Process: | (7284) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths |
| Operation: | write | Name: | name |
Value: 256 | |||
Executable files
1
Suspicious files
89
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7284 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7284.16118\CCleaner\CCleaner.exe | — | |
MD5:— | SHA256:— | |||
| 8176 | CCleaner.exe | — | ||
MD5:— | SHA256:— | |||
| 7284 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7284.16118\CCleaner\CCleaner.ini | text | |
MD5:FA3CCED70E682363EB8DEDD369F1952D | SHA256:E40414FD30CE3D69771D3FE4DA271E2EE32424BB27FD435A3F9794D69C26E6C3 | |||
| 7284 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7284.16118\CCleaner\CCleaner.dat | binary | |
MD5:26557ECE29393618C2EA9E8A68C522E4 | SHA256:6EBC6735C40AB36BCD33F461B5B1AC1CB20D06D481F901700F0C2501BEE9908C | |||
| 7284 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DRa7284.16118\CCleaner\branding.dll | executable | |
MD5:624CC97B1A59CEF7496378F35B2C80DC | SHA256:214BB96E33FAC6FA19F5C33F950267BF5D25507D0F78EEE1707F16442EAECB5D | |||
| 8176 | CCleaner.exe | C:\Users\admin\Desktop\CCleaner\Setup\temp.def | text | |
MD5:05927E894C81EB42C3B4DAE5A5A6C937 | SHA256:09C65B39BC891E12956AB7BB30FAE147EF7C8FA37542B6F040613436B566E7F8 | |||
| 8176 | CCleaner.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000013 | binary | |
MD5:25A64AB9623818215C4BEBE3440B49A5 | SHA256:4AB2B524A82C284184CA75153605F830A01842E8B3624D38C898EAD6AD48C04D | |||
| 8176 | CCleaner.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000013.dbtmp | text | |
MD5:A6813B63372959D9440379E29A2B2575 | SHA256:E6325E36F681074FCCD2B1371DBF6F4535A6630E5B95C9DDFF92C48EC11CE312 | |||
| 8176 | CCleaner.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1W1DIQ9JES6O3S5FPB6K.temp | binary | |
MD5:614A9662318D7948A277693A748182C8 | SHA256:AC6CD0EDD94142181EC4C901B6C40BD44882CE9E0ADC411C1CF38AC1F1DD8A04 | |||
| 8176 | CCleaner.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7884 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
8176 | CCleaner.exe | GET | 200 | 2.16.168.113:80 | http://ncc.avast.com/ncc.txt | unknown | — | — | whitelisted |
7884 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.53.40.178:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.53.40.178:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.22:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7884 | SIHClient.exe | 20.109.210.53:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
ncc.avast.com |
| whitelisted |