URL:

https://sensorstechforum.com/spyhunter-download-and-install-instructions/

Full analysis: https://app.any.run/tasks/d07718da-42ce-43a3-a210-a1a93bba44c5
Verdict: Malicious activity
Analysis date: November 14, 2018, 21:39:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

8C04C349A43DF63D1AB1222FCFDF9D7A

SHA1:

EFD47A7F51D10E01C42B9A3BFC84F73C61AB4E62

SHA256:

C541853ADBB1CB9A89FE80DBACF1393223A8D382A0EC8A1EE35CE6A31B376D60

SSDEEP:

3:N8NYDKXIKIHzbBFkE1IDJMLWWCn:2arKIHfNQkCn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SpyHunter-Installer[1].exe (PID: 936)
      • SpyHunter-Installer[1].exe (PID: 3988)
      • ShKernel.exe (PID: 2204)
      • ShMonitor.exe (PID: 4080)
      • SpyHunter5.exe (PID: 2660)

    • Changes settings of System certificates

      • ShKernel.exe (PID: 2204)

    • Loads the Task Scheduler COM API

      • ShKernel.exe (PID: 2204)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3828)
      • iexplore.exe (PID: 3128)
      • SpyHunter-Installer[1].exe (PID: 3988)
      • ShKernel.exe (PID: 2204)

    • Creates files in the program directory

      • SpyHunter-Installer[1].exe (PID: 3988)
      • ShKernel.exe (PID: 2204)
      • ShMonitor.exe (PID: 4080)
      • SpyHunter5.exe (PID: 2660)

    • Starts SC.EXE for service management

      • SpyHunter-Installer[1].exe (PID: 3988)

    • Creates a software uninstall entry

      • SpyHunter-Installer[1].exe (PID: 3988)

    • Creates files in the Windows directory

      • ShKernel.exe (PID: 2204)

    • Removes files from Windows directory

      • ShKernel.exe (PID: 2204)

    • Creates files in the driver directory

      • ShKernel.exe (PID: 2204)

    • Adds / modifies Windows certificates

      • ShKernel.exe (PID: 2204)

    • Reads default file associations for system extensions

      • ShKernel.exe (PID: 2204)

    • Creates or modifies windows services

      • ShKernel.exe (PID: 2204)

    • Searches for installed software

      • ShKernel.exe (PID: 2204)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3128)

    • Changes internet zones settings

      • iexplore.exe (PID: 3128)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3828)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3828)

    • Dropped object may contain TOR URL's

      • iexplore.exe (PID: 3828)

    • Creates files in the user directory

      • FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2284)
      • iexplore.exe (PID: 3828)
      • iexplore.exe (PID: 3128)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3128)
      • ShKernel.exe (PID: 2204)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
16
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
drop and start drop and start start iexplore.exe iexplore.exe flashutil32_26_0_0_131_activex.exe no specs spyhunter-installer[1].exe no specs spyhunter-installer[1].exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs shkernel.exe sc.exe no specs shmonitor.exe no specs spyhunter5.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
688C:\Windows\System32\sc.exe start EsgShKernel -tt_onC:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
936"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SpyHunter-Installer[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SpyHunter-Installer[1].exe—iexplore.exe
User:
admin
Company:
EnigmaSoft Limited
Integrity Level:
MEDIUM
Description:
EnigmaSoft Installer
Exit code:
3221226540
Version:
2.0.573.2561
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\0uu90r59\spyhunter-installer[1].exe
c:\systemroot\system32\ntdll.dll
1744C:\Windows\System32\sc.exe config EsgShKernel start= autoC:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1768C:\Windows\System32\sc.exe start ShMonitorC:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2204"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe
services.exe
User:
SYSTEM
Company:
EnigmaSoft Limited
Integrity Level:
SYSTEM
Description:
SpyHunter product.
Exit code:
0
Version:
5.0.30.51
Modules
Images
c:\program files\enigmasoft\spyhunter\shkernel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\fltlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
2284C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -EmbeddingC:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe—svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe® Flash® Player Installer/Uninstaller 26.0 r0
Exit code:
0
Version:
26,0,0,131
Modules
Images
c:\windows\system32\macromed\flash\flashutil32_26_0_0_131_activex.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2660"C:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe" /hideC:\Program Files\EnigmaSoft\SpyHunter\SpyHunter5.exe—ShKernel.exe
User:
admin
Company:
EnigmaSoft Limited
Integrity Level:
MEDIUM
Description:
SpyHunter product.
Exit code:
0
Version:
5.0.30.51
Modules
Images
c:\program files\enigmasoft\spyhunter\spyhunter5.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
3128"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3328C:\Windows\System32\sc.exe description EsgShKernel "SpyHunter 5 Kernel"C:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3544C:\Windows\System32\sc.exe create EsgShKernel start= demand binPath= "\"C:\Program Files\EnigmaSoft\SpyHunter\ShKernel.exe\"" DisplayName= "SpyHunter 5 Kernel"C:\Windows\System32\sc.exe—SpyHunter-Installer[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
51 832
Read events
51 692
Write events
136
Delete events
4

Modification events

(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{D9E50CF5-E855-11E8-BFAB-5254004AAD11}
Value:
0
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(3128) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E2070B0003000E00150028000700E601
Executable files
9
Suspicious files
132
Text files
100
Unknown types
69

Dropped files

PID
Process
Filename
Type
3128iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\favicon[1].ico —
MD5:—
SHA256:—
3128iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\spyhunter-download-and-install-instructions[1].txt —
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BWPPCY0O\style[1].csstext
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\spyhunter-download-and-install-instructions[1].htmhtml
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\fonts[1].csstext
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\font-awesome.min-1.0.2[1].csstext
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\U2ZG9DE0\html5[1].jshtml
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\PP6KS563\wplinkpreview-20120208[1].csstext
MD5:—
SHA256:—
3828iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\frontend-1.0.2[2].csstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
83
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/latest.ecf
US
binary
224 b
shared
3988
SpyHunter-Installer[1].exe
HEAD
200
216.58.215.228:80
http://www.google.com/
US
—
—
malicious
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/log_collect.cfg
US
text
46 b
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/setup.ecf
US
binary
5.66 Kb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/filelist.ecf
US
binary
1.84 Kb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/def/latest_def.ecf
US
binary
256 b
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_x86_native.exe.ecf
US
binary
24.7 Kb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_x86_shkernel.exe.ecf
US
binary
3.23 Mb
shared
—
—
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_english.lng.ecf
US
binary
19.2 Kb
shared
3988
SpyHunter-Installer[1].exe
GET
200
143.204.208.114:80
http://installer.enigmasoftware.com/sh5/5.0.30.51/sh5_croatian.lng.ecf
US
binary
21.8 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3828
iexplore.exe
216.58.215.226:443
googleads.g.doubleclick.net
Google Inc.
US
whitelisted
3128
iexplore.exe
104.27.142.147:443
sensorstechforum.com
Cloudflare Inc
US
shared
3828
iexplore.exe
216.58.215.228:443
www.google.com
Google Inc.
US
whitelisted
3828
iexplore.exe
143.204.214.76:443
download.enigmasoftware.com
—
US
suspicious
3128
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3828
iexplore.exe
104.27.142.147:443
sensorstechforum.com
Cloudflare Inc
US
shared
3828
iexplore.exe
216.58.215.234:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3828
iexplore.exe
172.217.168.40:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3828
iexplore.exe
216.58.215.227:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3828
iexplore.exe
31.13.92.14:443
connect.facebook.net
Facebook, Inc.
IE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
sensorstechforum.com
  • 104.27.142.147
  • 104.27.143.147
whitelisted
fonts.googleapis.com
  • 216.58.215.234
whitelisted
www.googletagmanager.com
  • 172.217.168.40
whitelisted
fonts.gstatic.com
  • 216.58.215.227
whitelisted
connect.facebook.net
  • 31.13.92.14
whitelisted
www.googleadservices.com
  • 172.217.168.34
whitelisted
ssl.google-analytics.com
  • 216.58.215.232
whitelisted
static.hotjar.com
  • 147.75.101.25
  • 147.75.205.155
  • 147.75.33.155
  • 147.75.33.193
  • 147.75.33.209
  • 147.75.33.111
  • 147.75.100.185
  • 147.75.33.117
whitelisted
stats.g.doubleclick.net
  • 74.125.143.155
  • 74.125.143.157
  • 74.125.143.154
  • 74.125.143.156
whitelisted

Threats

No threats detected
Process
Message
ShKernel.exe
Main. Enter. Initializing logger...
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sensorstechforum.com/spyhunter-download-and-install-instructions/