URL:

https://ultraviewer.net/en/

Full analysis: https://app.any.run/tasks/71bf2dc8-2abe-4054-89ca-5f8f658da0f2
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 04, 2019, 12:13:35
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

229E642E90079702697D3EA0EE95A291

SHA1:

CF655C8494C5C0D787CEF3AB195FF2ACF3D19F5E

SHA256:

CE91777CD604F8D5CEE740AD95AE73BBDE72835CB42BFDA7A50BC8CDED141778

SSDEEP:

3:N83zvs+n:23I+n

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • UltraViewer_setup_6.2_en[1].exe (PID: 3316)
      • UltraViewer_setup_6.2_en[1].exe (PID: 2068)
      • UltraViewer_Desktop.exe (PID: 3700)
      • UltraViewer_Desktop.exe (PID: 2488)
      • UltraViewer_Service.exe (PID: 3764)
      • UltraViewer_Desktop.exe (PID: 2564)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3092)

    • Starts NET.EXE for service management

      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)

    • Loads dropped or rewritten executable

      • regasm.exe (PID: 2872)
      • regasm.exe (PID: 3488)
      • UltraViewer_Desktop.exe (PID: 2488)
      • UltraViewer_Desktop.exe (PID: 3700)
      • UltraViewer_Desktop.exe (PID: 2564)
      • dwm.exe (PID: 1972)
      • iexplore.exe (PID: 1700)
      • explorer.exe (PID: 2036)
      • iexplore.exe (PID: 3092)

  • SUSPICIOUS

    • Starts Internet Explorer

      • explorer.exe (PID: 2036)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3092)
      • UltraViewer_setup_6.2_en[1].exe (PID: 2068)
      • iexplore.exe (PID: 1700)
      • UltraViewer_setup_6.2_en[1].exe (PID: 3316)
      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)

    • Reads Windows owner or organization settings

      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)

    • Reads the Windows organization settings

      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)

    • Starts SC.EXE for service management

      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)
      • UltraViewer_Desktop.exe (PID: 2488)

    • Creates COM task schedule object

      • regasm.exe (PID: 2872)

    • Creates files in the program directory

      • regasm.exe (PID: 2872)
      • regasm.exe (PID: 3488)
      • UltraViewer_Service.exe (PID: 3764)

    • Low-level read access rights to disk partition

      • UltraViewer_Service.exe (PID: 3764)

    • Creates files in the Windows directory

      • UltraViewer_Desktop.exe (PID: 2564)

    • Creates files in the user directory

      • UltraViewer_Desktop.exe (PID: 3700)

    • Reads Environment values

      • UltraViewer_Desktop.exe (PID: 3700)

    • Reads internet explorer settings

      • UltraViewer_Desktop.exe (PID: 3700)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1700)

    • Changes internet zones settings

      • iexplore.exe (PID: 1700)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1700)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3092)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 1700)

    • Changes settings of System certificates

      • iexplore.exe (PID: 1700)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3092)

    • Application was dropped or rewritten from another process

      • UltraViewer_setup_6.2_en[1].tmp (PID: 3840)
      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)

    • Creates files in the user directory

      • iexplore.exe (PID: 3092)

    • Loads dropped or rewritten executable

      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)

    • Creates files in the program directory

      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)

    • Creates a software uninstall entry

      • UltraViewer_setup_6.2_en[1].tmp (PID: 2512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
20
Malicious processes
12
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start iexplore.exe iexplore.exe ultraviewer_setup_6.2_en[1].exe ultraviewer_setup_6.2_en[1].tmp no specs ultraviewer_setup_6.2_en[1].exe ultraviewer_setup_6.2_en[1].tmp net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs sc.exe no specs regasm.exe no specs regasm.exe no specs ultraviewer_desktop.exe no specs sc.exe no specs ultraviewer_service.exe no specs ultraviewer_desktop.exe ultraviewer_desktop.exe dwm.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
948C:\Windows\system32\net1 stop UltraViewServiceC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
964"sc" delete UltraViewServiceC:\Windows\system32\sc.exe—UltraViewer_setup_6.2_en[1].tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1484sc failure "UltraViewService" reset= 0 actions= restart/60000C:\Windows\system32\sc.exe—UltraViewer_Desktop.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1700"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1972"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
2036C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
2068"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\UltraViewer_setup_6.2_en[1].exe" /SPAWNWND=$201F0 /NOTIFYWND=$301FC C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\UltraViewer_setup_6.2_en[1].exe
UltraViewer_setup_6.2_en[1].tmp
User:
admin
Company:
DucFabulous
Integrity Level:
HIGH
Description:
UltraViewer Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\jgrr2oyx\ultraviewer_setup_6.2_en[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2488"C:\Program Files\UltraViewer\UltraViewer_Desktop.exe" installC:\Program Files\UltraViewer\UltraViewer_Desktop.exe—UltraViewer_setup_6.2_en[1].tmp
User:
admin
Company:
DucFabulous Co,ltd
Integrity Level:
HIGH
Exit code:
0
Version:
6.02.0010
Modules
Images
c:\program files\ultraviewer\ultraviewer_desktop.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ultraviewer\msvbvm60.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
2512"C:\Users\admin\AppData\Local\Temp\is-FU7F4.tmp\UltraViewer_setup_6.2_en[1].tmp" /SL5="$301EE,2248177,121344,C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JGRR2OYX\UltraViewer_setup_6.2_en[1].exe" /SPAWNWND=$201F0 /NOTIFYWND=$301FC C:\Users\admin\AppData\Local\Temp\is-FU7F4.tmp\UltraViewer_setup_6.2_en[1].tmp
UltraViewer_setup_6.2_en[1].exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-fu7f4.tmp\ultraviewer_setup_6.2_en[1].tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2564UltraViewer_Desktop.exe -pid:3700 -debughwnd:-1C:\Program Files\UltraViewer\UltraViewer_Desktop.exe
UltraViewer_Service.exe
User:
SYSTEM
Company:
DucFabulous Co,ltd
Integrity Level:
SYSTEM
Exit code:
0
Version:
6.02.0010
Modules
Images
c:\program files\ultraviewer\ultraviewer_desktop.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\ultraviewer\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
5 655
Read events
3 719
Write events
1 925
Delete events
11

Modification events

(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000071000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{19FC775B-56D3-11E9-B63D-5254004A04AF}
Value:
0
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
1
(PID) Process:(1700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E3070400040004000C000D0032004900
Executable files
16
Suspicious files
3
Text files
188
Unknown types
15

Dropped files

PID
Process
Filename
Type
1700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].ico —
MD5:—
SHA256:—
1700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MNRUODO\en[1].txt —
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\1MNRUODO\style[1].csstext
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BNFNNO9N\css[1].txttext
MD5:—
SHA256:—
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7IPB1VME\responsive-leyouts[1].csstext
MD5:—
SHA256:—
1700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H6QNMHE9\favicon[1].pngimage
MD5:9FB559A691078558E77D6848202F6541
SHA256:6D8A01DC7647BC218D003B58FE04049E24A9359900B7E0CEBAE76EDF85B8B914
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\desktop.iniini
MD5:4A3DEB274BB5F0212C2419D3D8D08612
SHA256:2842973D15A14323E08598BE1DFB87E54BF88A76BE8C7BC94C56B079446EDF38
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BNFNNO9N\topmenu[1].jstext
MD5:597C33E93F152B6CD4EA705FF053BB26
SHA256:6F9B2D87B30EF2717353CACBA8082632E6E1376310E18C3F3428933BC9FBBB53
3092iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\7IPB1VME\styleselector[1].jstext
MD5:34101C08F7B77D180E259EE958CCC493
SHA256:F235B9414E5386FEF71B6F51BCAAA8B84139BF7C9BFD17DB17905252464C56CA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
15
DNS requests
11
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3092
iexplore.exe
GET
200
52.172.53.45:80
http://dlus3.ultraviewer.net/UltraViewer_setup_6.2_en.exe
IN
executable
2.53 Mb
suspicious
1700
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1700
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3092
iexplore.exe
103.74.123.128:443
ultraviewer.net
The Corporation for Financing & Promoting Technology
VN
unknown
3092
iexplore.exe
172.217.16.170:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3092
iexplore.exe
216.58.207.67:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3092
iexplore.exe
64.233.166.82:443
html5shim.googlecode.com
Google Inc.
US
whitelisted
3092
iexplore.exe
185.60.216.19:443
connect.facebook.net
Facebook, Inc.
IE
whitelisted
3092
iexplore.exe
185.60.216.35:443
www.facebook.com
Facebook, Inc.
IE
whitelisted
1700
iexplore.exe
103.74.123.128:443
ultraviewer.net
The Corporation for Financing & Promoting Technology
VN
unknown
3092
iexplore.exe
52.172.53.45:80
dlus3.ultraviewer.net
Microsoft Corporation
IN
suspicious
3700
UltraViewer_Desktop.exe
103.35.65.130:443
functions3.ultraviewer.net
The Corporation for Financing & Promoting Technology
VN
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ultraviewer.net
  • 103.74.123.128
  • 123.30.240.133
whitelisted
fonts.googleapis.com
  • 172.217.16.170
whitelisted
fonts.gstatic.com
  • 216.58.207.67
whitelisted
html5shim.googlecode.com
  • 64.233.166.82
whitelisted
connect.facebook.net
  • 185.60.216.19
whitelisted
www.facebook.com
  • 185.60.216.35
whitelisted
dlus3.ultraviewer.net
  • 52.172.53.45
  • 123.30.240.133
suspicious
functions3.ultraviewer.net
  • 103.35.65.130
  • 123.30.240.134
  • 103.74.123.129
suspicious

Threats

PID
Process
Class
Message
3092
iexplore.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
3092
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3092
iexplore.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3092
iexplore.exe
Generic Protocol Command Decode
SURICATA STREAM excessive retransmissions
Process
Message
UltraViewer_Desktop.exe
uvh - 3700 - 66206
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://ultraviewer.net/en/