File name: | Tech Tool Installer.exe |
Full analysis: | https://app.any.run/tasks/6ce2204b-874c-45ce-bd6f-f56169568f4d |
Verdict: | Malicious activity |
Analysis date: | July 08, 2021, 18:28:45 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | application/x-dosexec |
File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
MD5: | 3AFBCF18F1D6E80CDE4A2B687EF8E718 |
SHA1: | 525FBAD8781BA9478315CBF34852D77A0DF94181 |
SHA256: | BC93348A5C8BABB34785662311012A1DFDE18093F55F77E15FC206847A82B1A8 |
SSDEEP: | 98304:OnwZv+8tgkWi22E9OpP979/SyRf7UHX8t:8D3Pi2PQlX7U3 |
.exe | | | Win64 Executable (generic) (64.6) |
---|---|---|
.dll | | | Win32 Dynamic Link Library (generic) (15.4) |
.exe | | | Win32 Executable (generic) (10.5) |
.exe | | | Generic Win/DOS Executable (4.6) |
.exe | | | DOS Executable Generic (4.6) |
ProductVersion: | 2.8.51.0 |
---|---|
ProductName: | Tech Tool |
OriginalFileName: | Launcher.exe |
LegalCopyright: | Copyright (C) 2014 Volvo IT |
InternalName: | Launcher.exe |
FileVersion: | 2.8.51.0 |
FileDescription: | Tech Tool Installer |
CompanyName: | Volvo IT |
CharacterSet: | Unicode |
LanguageCode: | Swedish |
FileSubtype: | - |
ObjectFileType: | Executable application |
FileOS: | Windows NT 32-bit |
FileFlags: | (none) |
FileFlagsMask: | 0x003f |
ProductVersionNumber: | 2.8.51.0 |
FileVersionNumber: | 2.8.51.0 |
Subsystem: | Windows GUI |
SubsystemVersion: | 6 |
ImageVersion: | - |
OSVersion: | 6 |
EntryPoint: | 0x6718 |
UninitializedDataSize: | - |
InitializedDataSize: | 5208064 |
CodeSize: | 106496 |
LinkerVersion: | 14 |
PEType: | PE32 |
TimeStamp: | 2021:06:02 15:27:20+02:00 |
MachineType: | Intel 386 or later, and compatibles |
Architecture: | IMAGE_FILE_MACHINE_I386 |
---|---|
Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
Compilation Date: | 02-Jun-2021 13:27:20 |
Detected languages: |
|
CompanyName: | Volvo IT |
FileDescription: | Tech Tool Installer |
FileVersion: | 2.8.51.0 |
InternalName: | Launcher.exe |
LegalCopyright: | Copyright (C) 2014 Volvo IT |
OriginalFilename: | Launcher.exe |
ProductName: | Tech Tool |
ProductVersion: | 2.8.51.0 |
Magic number: | MZ |
---|---|
Bytes on last page of file: | 0x0090 |
Pages in file: | 0x0003 |
Relocations: | 0x0000 |
Size of header: | 0x0004 |
Min extra paragraphs: | 0x0000 |
Max extra paragraphs: | 0xFFFF |
Initial SS value: | 0x0000 |
Initial SP value: | 0x00B8 |
Checksum: | 0x0000 |
Initial IP value: | 0x0000 |
Initial CS value: | 0x0000 |
Overlay number: | 0x0000 |
OEM identifier: | 0x0000 |
OEM information: | 0x0000 |
Address of NE header: | 0x00000110 |
Signature: | PE |
---|---|
Machine: | IMAGE_FILE_MACHINE_I386 |
Number of sections: | 7 |
Time date stamp: | 02-Jun-2021 13:27:20 |
Pointer to Symbol Table: | 0x00000000 |
Number of symbols: | 0 |
Size of Optional Header: | 0x00E0 |
Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
---|---|---|---|---|---|
.text | 0x00001000 | 0x00019E36 | 0x0001A000 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.6528 |
.rdata | 0x0001B000 | 0x0000CCC8 | 0x0000CE00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.74723 |
.data | 0x00028000 | 0x00001888 | 0x00000C00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 2.43138 |
.gfids | 0x0002A000 | 0x00000148 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 2.49728 |
.tls | 0x0002B000 | 0x00000009 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0203931 |
.rsrc | 0x0002C000 | 0x004E7120 | 0x004E7200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 7.10629 |
.reloc | 0x00514000 | 0x000019CC | 0x00001A00 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 6.55407 |
Title | Entropy | Size | Codepage | Language | Type |
---|---|---|---|---|---|
1 | 5.31786 | 833 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 4.24513 | 744 | UNKNOWN | Swedish - Sweden | RT_ICON |
3 | 4.01335 | 488 | UNKNOWN | Swedish - Sweden | RT_ICON |
4 | 3.50105 | 296 | UNKNOWN | Swedish - Sweden | RT_ICON |
5 | 5.1398 | 3752 | UNKNOWN | Swedish - Sweden | RT_ICON |
6 | 5.41085 | 2216 | UNKNOWN | Swedish - Sweden | RT_ICON |
7 | 4.90973 | 1736 | UNKNOWN | Swedish - Sweden | RT_ICON |
8 | 3.85294 | 1384 | UNKNOWN | Swedish - Sweden | RT_ICON |
9 | 3.98575 | 396840 | UNKNOWN | Swedish - Sweden | RT_ICON |
10 | 3.99721 | 270376 | UNKNOWN | Swedish - Sweden | RT_ICON |
ADVAPI32.dll |
KERNEL32.dll |
SHELL32.dll |
USER32.dll |
VERSION.dll |
urlmon.dll |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3812 | "C:\Users\admin\AppData\Local\Temp\Tech Tool Installer.exe" | C:\Users\admin\AppData\Local\Temp\Tech Tool Installer.exe | — | Explorer.EXE |
User: admin Company: Volvo IT Integrity Level: MEDIUM Description: Tech Tool Installer Exit code: 3221226540 Version: 2.8.51.0 | ||||
2756 | "C:\Users\admin\AppData\Local\Temp\Tech Tool Installer.exe" | C:\Users\admin\AppData\Local\Temp\Tech Tool Installer.exe | Explorer.EXE | |
User: admin Company: Volvo IT Integrity Level: HIGH Description: Tech Tool Installer Version: 2.8.51.0 | ||||
2744 | Path="C:\Users\admin\AppData\Local\Temp" | C:\ProgramData\TechToolInstaller\VolvoIt.Installer.Bundle.exe | — | Tech Tool Installer.exe |
User: admin Company: Volvo Information Technology AB Integrity Level: HIGH Description: Tech Tool Version: 2.8.51.0 | ||||
3036 | "C:\ProgramData\TechToolInstaller\VolvoIt.Installer.Bundle.exe" -burn.unelevated BurnPipe.{0335ED48-B903-47CD-BDF6-DFB16BE7A1D0} {4EE8D131-9A69-4844-8672-C37B68C852A5} 2744 Path="C:\Users\admin\AppData\Local\Temp" | C:\ProgramData\TechToolInstaller\VolvoIt.Installer.Bundle.exe | VolvoIt.Installer.Bundle.exe | |
User: admin Company: Volvo Information Technology AB Integrity Level: HIGH Description: Tech Tool Version: 2.8.51.0 |
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | IntranetName |
Value: 1 | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
Operation: | write | Name: | AutoDetect |
Value: 0 | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings |
Operation: | write | Name: | ProxyEnable |
Value: 0 | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections |
Operation: | write | Name: | SavedLegacySettings |
Value: 460000003B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
Operation: | write | Name: | CachePrefix |
Value: | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
(PID) Process: | (2756) Tech Tool Installer.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D98F514A-8ED4-4E8D-BE59-0148865AFC65} |
Operation: | write | Name: | WpadDecisionReason |
Value: 1 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2756 | Tech Tool Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27 | der | |
MD5:21F7453EDF255BF6E48D3769CED70B78 | SHA256:7124925D96F714B32EB7F602C5A877645050743495F417A02CF444F0CD55C9EA | |||
2756 | Tech Tool Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2543B5AF7D46D42E6CEED21F85143F6A_A42DDE2FA9E471DEED5D375797B95543 | der | |
MD5:98BF764B1D2DF56C2FCC732FC93830CB | SHA256:624B8BC8CE96020DCEC2A1BA7C9AAEBE74EB342A6553F5C35FD85A7ECF4925D5 | |||
2756 | Tech Tool Installer.exe | C:\ProgramData\TechToolInstaller\BaldoLocalSynchronization.exe.config | xml | |
MD5:07FC3C54A79C92197FDA08EC024E78DD | SHA256:C592F467DEC4356F36951E836644DE11A1AE58828CBF041846CC571F8E6209BD | |||
2756 | Tech Tool Installer.exe | C:\ProgramData\TechToolInstaller\VolvoIt.Installer.Bundle.exe | executable | |
MD5:AF3D5A048B0F9680198DBEB420E91DC4 | SHA256:AFC311AD339E874E80CD47240940BFD49991FB4DFB04A6DF5D50EF7B53E57B29 | |||
2756 | Tech Tool Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_A30EA9B4E1BC5DBF09A8EF399E086D27 | binary | |
MD5:EC6CD79729F155BE3490E54BAFAD360C | SHA256:6310F5496F1B9DAF46FE65D64A3BB783BC40BE47C140ABF476D3474C8B959680 | |||
2756 | Tech Tool Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:1E4DB9BBA4E6EE435CE3880E46571743 | SHA256:741BDDB9CB96E7B66BE51898EF0A01808FE55B4E5E1FC2B54CAAF6D07D29F5A8 | |||
2756 | Tech Tool Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2543B5AF7D46D42E6CEED21F85143F6A_A42DDE2FA9E471DEED5D375797B95543 | binary | |
MD5:FF9C9386604DE44ECED4802A0F263A76 | SHA256:04FD5EB73AFB5E0C0E2D8B389B36CF419DF036D3979E8027667C47F77939EDF9 | |||
2756 | Tech Tool Installer.exe | C:\ProgramData\TechToolInstaller\BaldoLocalSynchronization.exe | executable | |
MD5:9E16F6DD330B67DF5F50F2BB5AFFEBAF | SHA256:8E2D57DCC37A4CD095CB08E25BA4D79AD3B844097BEBB6722AEDC60BD72CD0C4 | |||
2756 | Tech Tool Installer.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | compressed | |
MD5:F7DCB24540769805E5BB30D193944DCE | SHA256:6B88C6AC55BBD6FEA0EBE5A760D1AD2CFCE251C59D0151A1400701CB927E36EA | |||
3036 | VolvoIt.Installer.Bundle.exe | C:\Users\admin\AppData\Local\Temp\{78a9e223-fb0c-4816-981e-0f8dd9e06d46}\.ba1\BootstrapperCore.dll | executable | |
MD5:1B8381576459579F95FE7E59B4CE880A | SHA256:D29529B4DD79B9A099EE4AFCE78A647D0C065C9BF20D302CC181AF9ECCECDE44 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
2756 | Tech Tool Installer.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1.crl | US | binary | 19.7 Mb | whitelisted |
2756 | Tech Tool Installer.exe | GET | 200 | 93.184.220.29:80 | http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1.crl | US | binary | 19.7 Mb | whitelisted |
2756 | Tech Tool Installer.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAo1CNVcKSsBffitZcAP9%2BQ%3D | US | der | 471 b | whitelisted |
2756 | Tech Tool Installer.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEA5PGABfJaS9uojAA3DSI3E%3D | US | der | 471 b | whitelisted |
2756 | Tech Tool Installer.exe | GET | 200 | 205.185.216.10:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8bdbbcdefe63ae13 | US | compressed | 4.70 Kb | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2756 | Tech Tool Installer.exe | 205.185.216.10:80 | ctldl.windowsupdate.com | Highwinds Network Group, Inc. | US | whitelisted |
2756 | Tech Tool Installer.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2756 | Tech Tool Installer.exe | 153.112.162.194:443 | networkupdatefilespublic.it.volvo.com | Volvo Information Technology AB | SE | unknown |
Domain | IP | Reputation |
---|---|---|
networkupdatefilespublic.it.volvo.com |
| unknown |
ctldl.windowsupdate.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
crl3.digicert.com |
| whitelisted |
crl4.digicert.com |
| whitelisted |