download:

lantern-installer.exe

Full analysis: https://app.any.run/tasks/26987493-ccf9-4bdc-a6cf-dc13f0da99b0
Verdict: Malicious activity
Analysis date: April 14, 2018, 16:04:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

8BDAE25AB952CD06FB31A3983F7DAEC2

SHA1:

B0BDE033BB783E0546151B7788E2AC70C0CA5DF4

SHA256:

BE5F67F532FDACAA09DBEABF4C7932278B873107849C74F0DAA2493B28E48B80

SSDEEP:

196608:4Hfc7vBNGhlK5z8smkGwLLwWYHdEqGPI3ThOr2:4Hfc7ZCc8JvwADyqGQ3tOq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • lantern.exe (PID: 2568)
      • lantern-installer.exe (PID: 2164)
      • lantern.exe (PID: 308)

    • Application loaded dropped or rewritten executable

      • lantern.exe (PID: 2568)

    • Application was dropped or rewritten from another process

      • lantern.exe (PID: 2568)
      • lantern.exe (PID: 308)
      • lantern.exe.exe (PID: 1768)
      • certimporter.exe (PID: 2736)
      • certimporter.exe (PID: 2440)
      • sysproxy-cmd.exe (PID: 1416)
      • sysproxy-cmd.exe (PID: 3180)
      • sysproxy-cmd.exe (PID: 3964)

    • Changes settings of System certificates

      • certimporter.exe (PID: 2440)
      • lantern.exe (PID: 2568)

    • Loads the Task Scheduler COM API

      • software_reporter_tool.exe (PID: 276)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • lantern.exe (PID: 2568)

    • Creates a software uninstall entry

      • lantern-installer.exe (PID: 2164)

    • Creates files in the user directory

      • lantern-installer.exe (PID: 2164)
      • lantern.exe (PID: 308)
      • lantern.exe (PID: 2568)
      • rundll32.exe (PID: 2032)
      • FlashUtil32_26_0_0_137_ActiveX.exe (PID: 1748)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • lantern.exe (PID: 2568)

    • Adds / modifies Windows certificates

      • lantern.exe (PID: 2568)

    • Reads Internet Cache Settings

      • rundll32.exe (PID: 2032)

    • Starts Internet Explorer

      • rundll32.exe (PID: 2496)

    • Application launched itself

      • software_reporter_tool.exe (PID: 276)

  • INFO

    • Loads rich edit control libraries

      • lantern-installer.exe (PID: 2164)
      • FlashUtil32_26_0_0_137_ActiveX.exe (PID: 1748)

    • Dropped object may contain URL's

      • lantern-installer.exe (PID: 2164)
      • lantern.exe (PID: 308)
      • lantern.exe (PID: 2568)
      • iexplore.exe (PID: 2660)
      • iexplore.exe (PID: 2704)
      • iexplore.exe (PID: 3604)
      • chrome.exe (PID: 3012)

    • Reads internet explorer settings

      • mshta.exe (PID: 2692)
      • iexplore.exe (PID: 2704)
      • iexplore.exe (PID: 3604)

    • Application launched itself

      • iexplore.exe (PID: 2660)
      • chrome.exe (PID: 3012)

    • Changes internet zones settings

      • iexplore.exe (PID: 2660)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2704)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2660)
      • iexplore.exe (PID: 3604)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2660)
      • iexplore.exe (PID: 3604)

    • Creates files in the user directory

      • iexplore.exe (PID: 2704)
      • iexplore.exe (PID: 2660)
      • iexplore.exe (PID: 3604)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3604)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:12:27 06:38:55+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 24576
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x310d
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 27-Dec-2015 05:38:55
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 27-Dec-2015 05:38:55
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005E3C
0x00006000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.4323
.rdata
0x00007000
0x0000126A
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.00589
.data
0x00009000
0x00025D38
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.29176
.ndata
0x0002F000
0x00009000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00038000
0x0005C280
0x0005C400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.64369

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.23191
958
UNKNOWN
English - United States
RT_MANIFEST
2
4.71069
67624
UNKNOWN
English - United States
RT_ICON
3
4.98272
16936
UNKNOWN
English - United States
RT_ICON
4
5.06646
9640
UNKNOWN
English - United States
RT_ICON
5
5.36653
4264
UNKNOWN
English - United States
RT_ICON
6
5.65748
1128
UNKNOWN
English - United States
RT_ICON
7
0
296
UNKNOWN
English - United States
RT_ICON
103
2.71902
104
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.73893
514
UNKNOWN
English - United States
RT_DIALOG
106
2.91148
248
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
29
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start lantern-installer.exe lantern.exe lantern.exe cmd.exe no specs certimporter.exe no specs mshta.exe no specs lantern.exe.exe no specs certimporter.exe sysproxy-cmd.exe no specs rundll32.exe no specs sysproxy-cmd.exe no specs sysproxy-cmd.exe no specs rundll32.exe no specs iexplore.exe no specs iexplore.exe no specs flashutil32_26_0_0_137_activex.exe no specs iexplore.exe no specs rundll32.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs software_reporter_tool.exe no specs software_reporter_tool.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276"C:\Users\admin\AppData\Local\Google\Chrome\User Data\SwReporter\23.129.0\software_reporter_tool.exe" --session-id=w1iHbSLbkXkOW1hMc/GFeY7col1UqyIw594T6h1J --engine-experiment-group=Experiment2 --registry-suffix=URZAC:\Users\admin\AppData\Local\Google\Chrome\User Data\SwReporter\23.129.0\software_reporter_tool.exe—chrome.exe
User:
admin
Company:
Google
Integrity Level:
MEDIUM
Description:
Software Reporter Tool
Exit code:
2
Version:
23.129.0
Modules
Images
c:\users\admin\appdata\local\google\chrome\user data\swreporter\23.129.0\software_reporter_tool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
308"C:\Users\admin\AppData\Roaming\Lantern\lantern.exe" Û´ùÛC:\Users\admin\AppData\Roaming\Lantern\lantern.exe
lantern-installer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\lantern\lantern.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1580,654648496071000624,7692598086105742292,131072 --lang=en-US --no-sandbox --service-request-channel-token=20870DB501ADCC5413C6C317428CF34A --mojo-platform-channel-handle=1896 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
948"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=61.0.3163.100 --initial-client-data=0x78,0x7c,0x80,0x74,0x84,0x6c1f7d7c,0x6c1f7da4,0x6c1f7d8cC:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1060cmd verC:\Windows\system32\cmd.exe—lantern.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1084"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1580,654648496071000624,7692598086105742292,131072 --service-pipe-token=87E08A6138077A21D28E1C32C01535AB --lang=en-US --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --blink-settings=disallowFetchForDocWrittenScriptsInMainFrame=false,disallowFetchForDocWrittenScriptsInMainFrameOnSlowConnections=true --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=87E08A6138077A21D28E1C32C01535AB --renderer-client-id=5 --mojo-platform-channel-handle=3212 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1416C:\Users\admin\AppData\Roaming\byteexec\sysproxy-cmd.exe on 127.0.0.1 49379C:\Users\admin\AppData\Roaming\byteexec\sysproxy-cmd.exe—lantern.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\byteexec\sysproxy-cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1748C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_137_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_137_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,137
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_137_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1756"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1580,654648496071000624,7692598086105742292,131072 --lang=en-US --service-request-channel-token=AA24FBB08A1FBF7DFBA67215EE4AA104 --mojo-platform-channel-handle=3148 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
61.0.3163.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\61.0.3163.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1768C:\Users\admin\AppData\Roaming\byteexec\lantern.exe.exe -w C:\Users\admin\AppData\Roaming\byteexec\certimporter.exe add ROOT C:\Users\admin\AppData\Local\Temp\tempCert115993399C:\Users\admin\AppData\Roaming\byteexec\lantern.exe.exe—lantern.exe
User:
admin
Company:
code.kliu.org
Integrity Level:
MEDIUM
Description:
Command-Line UAC Elevation Utility
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\byteexec\lantern.exe.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
2 709
Read events
2 063
Write events
612
Delete events
34

Modification events

(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Lantern
Operation:writeName:
Value:
C:\Users\admin\AppData\Roaming\Lantern
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern
Operation:writeName:DisplayName
Value:
Lantern
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern
Operation:writeName:DisplayIcon
Value:
C:\Users\admin\AppData\Roaming\Lantern\lantern.ico
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern
Operation:writeName:Publisher
Value:
Brave New Software Project, Inc.
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern
Operation:writeName:URLInfoAbout
Value:
http://www.getlantern.org
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern
Operation:writeName:DisplayVersion
Value:
4.5.9
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Lantern
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Roaming\Lantern\uninstall.exe"
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Lantern
Value:
"C:\Users\admin\AppData\Roaming\Lantern\lantern.exe" -clear-proxy-settings
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2164) lantern-installer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
7
Suspicious files
80
Text files
128
Unknown types
24

Dropped files

PID
Process
Filename
Type
2164lantern-installer.exeC:\Users\admin\AppData\Local\Temp\nsq951.tmp\ShellExecAsUser.dll —
MD5:—
SHA256:—
2568lantern.exeC:\Users\admin\AppData\Roaming\Lantern\lanternlist.txt.gz_temp —
MD5:—
SHA256:—
2164lantern-installer.exeC:\Users\admin\AppData\Roaming\Lantern\lantern.exeexecutable
MD5:—
SHA256:—
308lantern.exeC:\Users\admin\AppData\Roaming\systray\systray386.dllexecutable
MD5:—
SHA256:—
2568lantern.exeC:\Users\admin\AppData\Roaming\Lantern\mitmkey.pemtext
MD5:—
SHA256:—
2568lantern.exeC:\Users\admin\AppData\Roaming\byteexec\lantern.exe.exeexecutable
MD5:—
SHA256:—
2164lantern-installer.exeC:\Users\admin\AppData\Roaming\Lantern\uninstall.exeexecutable
MD5:—
SHA256:—
2568lantern.exeC:\Users\admin\AppData\Roaming\Lantern\lanternlist.txt.gzcompressed
MD5:—
SHA256:—
2164lantern-installer.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lantern\Uninstall Lantern.lnklnk
MD5:—
SHA256:—
2568lantern.exeC:\Users\admin\AppData\Roaming\Lantern\mitmcert.pem_05285f8701d7bbc824664c73ff48fc9c1eac29387ac7d2af86d7727343a491b9text
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
165
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.37.43.27:80
http://g.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACEAEAISWIsPpZp3fvBXtmJ98%3D
NL
der
1.36 Kb
whitelisted
—
—
GET
200
23.37.37.163:80
http://crl.geotrust.com/crls/secureca.crl
NL
der
310 b
whitelisted
—
—
GET
200
68.232.34.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
52.7 Kb
whitelisted
—
—
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D
US
der
471 b
whitelisted
—
—
GET
200
172.217.18.174:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjqTAc%2FHIGOD%2BaUx0%3D
US
der
468 b
whitelisted
—
—
GET
200
192.35.177.64:80
http://apps.identrust.com/roots/dstrootcax3.p7c
US
cat
893 b
shared
—
—
GET
200
172.217.18.174:80
http://ocsp.pki.goog/GTSGIAG3/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCFq%2F%2BulBDARk
US
der
463 b
whitelisted
—
—
GET
200
172.217.18.174:80
http://ocsp.pki.goog/GTSGIAG3/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCBJEIaRLinSJ
US
der
463 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
138.197.104.175:443
—
Digital Ocean, Inc.
US
unknown
—
—
45.76.111.116:6754
—
Choopa, LLC
JP
unknown
—
—
45.76.215.7:10421
—
Choopa, LLC
JP
unknown
—
—
45.76.98.148:10525
—
Choopa, LLC
JP
unknown
—
—
198.13.54.255:443
—
—
US
unknown
—
—
165.227.185.69:29277
—
Digital Ocean, Inc.
US
unknown
—
—
144.76.100.145:443
easylist-downloads.adblockplus.org
Hetzner Online GmbH
DE
unknown
—
—
52.84.7.161:443
—
Amazon.com, Inc.
US
unknown
—
—
54.230.7.236:443
—
Amazon.com, Inc.
US
unknown
—
—
52.84.10.72:443
—
Amazon.com, Inc.
US
unknown

DNS requests

Domain
IP
Reputation
teredo.ipv6.microsoft.com
  • —
whitelisted
raw.githubusercontent.com
  • 151.101.0.133
  • 151.101.64.133
  • 151.101.128.133
  • 151.101.192.133
shared
easylist-downloads.adblockplus.org
  • 144.76.100.145
  • 144.76.20.58
  • 94.130.73.104
  • 94.130.73.107
  • 94.130.76.59
  • 144.76.153.101
  • 78.46.27.186
  • 148.251.66.238
  • 178.63.70.146
  • 88.99.186.150
  • 94.130.73.101
  • 46.4.68.226
suspicious
s3.amazonaws.com
  • 52.216.132.165
shared
ssl.google-analytics.com
  • 172.217.16.168
whitelisted
apps.identrust.com
  • 192.35.177.64
shared
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
www.download.windowsupdate.com
  • 68.232.34.240
whitelisted
www.google-analytics.com
  • 172.217.21.206
whitelisted

Threats

No threats detected
Process
Message
lantern-installer.exe
ExecShellAsUser: process is not elevated, will fallback to ShellExecute
lantern-installer.exe
ExecShellAsUser: process is not elevated, will fallback to ShellExecute
lantern-installer.exe
ExecShellAsUser: DLL_PROCESS_DETACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lantern-installer.exe