analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://sensorstechforum.com/spyhunter-download-and-install-instructions/

Full analysis: https://app.any.run/tasks/d07718da-42ce-43a3-a210-a1a93bba44c5
Verdict: Malicious activity
Analysis date: November 14, 2018, 21:39:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8C04C349A43DF63D1AB1222FCFDF9D7A

SHA1:

EFD47A7F51D10E01C42B9A3BFC84F73C61AB4E62

SHA256:

C541853ADBB1CB9A89FE80DBACF1393223A8D382A0EC8A1EE35CE6A31B376D60

SSDEEP:

3:N8NYDKXIKIHzbBFkE1IDJMLWWCn:2arKIHfNQkCn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SpyHunter-Installer[1].exe (PID: 936)
      • SpyHunter-Installer[1].exe (PID: 3988)
      • ShKernel.exe (PID: 2204)
      • ShMonitor.exe (PID: 4080)
      • SpyHunter5.exe (PID: 2660)

    • Changes settings of System certificates

      • ShKernel.exe (PID: 2204)

    • Loads the Task Scheduler COM API

      • ShKernel.exe (PID: 2204)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3828)
      • iexplore.exe (PID: 3128)
      • SpyHunter-Installer[1].exe (PID: 3988)
      • ShKernel.exe (PID: 2204)

    • Starts SC.EXE for service management

      • SpyHunter-Installer[1].exe (PID: 3988)

    • Creates files in the program directory

      • ShKernel.exe (PID: 2204)
      • SpyHunter-Installer[1].exe (PID: 3988)
      • SpyHunter5.exe (PID: 2660)
      • ShMonitor.exe (PID: 4080)

    • Creates a software uninstall entry

      • SpyHunter-Installer[1].exe (PID: 3988)

    • Creates files in the driver directory

      • ShKernel.exe (PID: 2204)

    • Adds / modifies Windows certificates

      • ShKernel.exe (PID: 2204)

    • Creates or modifies windows services

      • ShKernel.exe (PID: 2204)

    • Removes files from Windows directory

      • ShKernel.exe (PID: 2204)

    • Creates files in the Windows directory

      • ShKernel.exe (PID: 2204)

    • Reads default file associations for system extensions

      • ShKernel.exe (PID: 2204)

    • Searches for installed software

      • ShKernel.exe (PID: 2204)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3128)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3128)
      • ShKernel.exe (PID: 2204)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3828)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2284)
      • iexplore.exe (PID: 3128)
      • iexplore.exe (PID: 3828)

    • Dropped object may contain TOR URL's

      • iexplore.exe (PID: 3828)

    • Application launched itself

      • iexplore.exe (PID: 3128)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
16
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs spyhunter-installer[1].exe no specs spyhunter-installer[1].exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs shkernel.exe sc.exe no specs shmonitor.exe no specs spyhunter5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3828"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3128 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2284C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
936"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SpyHunter-Installer[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SpyHunter-Installer[1].exe—iexplore.exe
User:
admin
Company:
EnigmaSoft Limited
Integrity Level:
MEDIUM
Description:
EnigmaSoft Installer
Exit code:
3221226540
Version:
2.0.573.2561
3988"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SpyHunter-Installer[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SpyHunter-Installer[1].exe
iexplore.exe
User:
admin
Company:
EnigmaSoft Limited
Integrity Level:
HIGH
Description:
EnigmaSoft Installer
Exit code:
0
Version:
2.0.573.2561
3544C:\Windows\System32\sc.exe create EsgShKernel start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe\"" DisplayName= "SpyHunter 5 Kernel"C:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3328C:\Windows\System32\sc.exe description EsgShKernel "SpyHunter 5 Kernel"C:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3772C:\Windows\System32\sc.exe create ShMonitor start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShMonitor.exe\"" DisplayName= "SpyHunter 5 Kernel Monitor"C:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4004C:\Windows\System32\sc.exe description ShMonitor "SpyHunter 5 Kernel Monitor"C:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3604C:\Windows\System32\sc.exe config ShMonitor start= autoC:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
51 832
Read events
51 692
Write events
0
Delete events
0

Modification events

No data
Executable files
9
Suspicious files
132
Text files
100
Unknown types
69

Dropped files

PID
Process
Filename
Type
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\spyhunter-download-and-install-instructions[1].txt —
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\font-awesome.min-1.0.2[1].csstext
MD5:CB6D1221523C96462DC645D8A4BA12BE
SHA256:EAFAFC7AAA7F4B8EA13225F0ADE0DCB05782EF8CCB45A9E9B2C4881974F51F16
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\spyhunter-download-and-install-instructions[1].htmhtml
MD5:5F3AD1D0804FA1505AF97C6EE4039268
SHA256:B0919386FC57AD5511E71D628639B415CE05E2C0F6275325FC24ADA0FD971DC4
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\font-awesome-1.0.2[1].csstext
MD5:E6530D413C620472E5E2E5D0EBABA5DE
SHA256:74F6B67D94F60117B79692261ECACAF5540BA6DF829E3359189D38CD11495934
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\html5[1].jshtml
MD5:3263ADF22A0F645766A726A951DE4175
SHA256:B2C24CC8285E206E50E27C76F4B12FB2B3D4B4D40C98273A7310590E57C6165F
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\style[1].csstext
MD5:C0BB899265EE748585110AD4C28123BA
SHA256:C23AF3FC7F64AC52AF8466717CC5C8AB6BFE4D3DE1F917DC9F71CDD645E38C3B
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\frontend-1.0.2[1].csstext
MD5:C9472FFD5D78BD457F86624F3E768A67
SHA256:D74829BA5DDE4C45D5EBD5E8508570CFFDADBCE035D9AF646AF968704293C5BF
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\fonts[1].csstext
MD5:6CCAA0A57EAFF36C06458020EBC15721
SHA256:87993F90E184FDA045F17FF5EF923D174366134C2B4450F6D9BA1363FB164632
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
83
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3988
SpyHunter-Installer[1].exe
HEAD
200
216.58.215.228:80
http://www.google.com/
US
—
—
whitelisted
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/def/latest_def.ecf
US
binary
256 b
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_x86_shkernel.exe.ecf
US
binary
3.23 Mb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/log_collect.cfg
US
text
46 b
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/filelist.ecf
US
binary
1.84 Kb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_croatian.lng.ecf
US
binary
21.8 Kb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_x86_spyhunter5.exe.ecf
US
pgc
4.23 Mb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/setup.ecf
US
binary
5.66 Kb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_chinese_(simplified).lng.ecf
US
binary
19.4 Kb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_x86_shmonitor.exe.ecf
US
binary
197 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3128
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3828
iexplore.exe
172.217.168.34:443
www.googleadservices.com
Google Inc.
US
whitelisted
3828
iexplore.exe
216.58.215.234:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3828
iexplore.exe
104.27.142.147:443
sensorstechforum.com
Cloudflare Inc
US
shared
3828
iexplore.exe
216.58.215.227:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3828
iexplore.exe
172.217.168.40:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3828
iexplore.exe
31.13.92.14:443
connect.facebook.net
Facebook, Inc.
IE
whitelisted
3828
iexplore.exe
216.58.215.228:443
www.google.com
Google Inc.
US
whitelisted
3828
iexplore.exe
216.58.215.232:443
ssl.google-analytics.com
Google Inc.
US
whitelisted
3828
iexplore.exe
216.58.215.226:443
googleads.g.doubleclick.net
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
sensorstechforum.com
  • 104.27.142.147
  • 104.27.143.147
whitelisted
fonts.googleapis.com
  • 216.58.215.234
whitelisted
www.googletagmanager.com
  • 172.217.168.40
whitelisted
fonts.gstatic.com
  • 216.58.215.227
whitelisted
connect.facebook.net
  • 31.13.92.14
whitelisted
www.googleadservices.com
  • 172.217.168.34
whitelisted
ssl.google-analytics.com
  • 216.58.215.232
whitelisted
static.hotjar.com
  • 147.75.101.25
  • 147.75.205.155
  • 147.75.33.155
  • 147.75.33.193
  • 147.75.33.209
  • 147.75.33.111
  • 147.75.100.185
  • 147.75.33.117
whitelisted
stats.g.doubleclick.net
  • 74.125.143.155
  • 74.125.143.157
  • 74.125.143.154
  • 74.125.143.156
whitelisted

Threats

No threats detected
Process
Message
ShKernel.exe
Main. Enter. Initializing logger...
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sensorstechforum.com/spyhunter-download-and-install-instructions/