File name:

UC232A_Windows_Setup_V1.0.075.exe

Full analysis: https://app.any.run/tasks/6cbfc46f-5c3c-4564-80ba-0b59da7016bd
Verdict: Malicious activity
Analysis date: March 28, 2024, 09:45:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5:

23D16FEEF91123EF868AA5CE6BECDEA9

SHA1:

428493062669DBA46E46E29B9F83CC1CFC8C2E23

SHA256:

D1D231D49394F4C48C194290802D4DA906AE64BEA7AA8395F758B7C913A7B0B0

SSDEEP:

98304:1aJZf4ANvUxCNajjtt2p47pcDgoC29yrVc8hI7APSkvESL3G2DMgmue65YedQmPx:GrMuKRFu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • UC232A_Windows_Setup_V1.0.075.exe (PID: 2420)
      • Win7_x86.exe (PID: 956)
      • DPInst.exe (PID: 2320)
      • drvinst.exe (PID: 880)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 880)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • UC232A_Windows_Setup_V1.0.075.exe (PID: 2420)

    • Reads the Internet Settings

      • UC232A_Windows_Setup_V1.0.075.exe (PID: 2420)

    • Searches for installed software

      • Win7_x86.exe (PID: 956)

    • Process drops legitimate windows executable

      • Win7_x86.exe (PID: 956)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2440)

    • Reads the Windows owner or organization settings

      • Win7_x86.exe (PID: 956)

    • Creates files in the driver directory

      • drvinst.exe (PID: 880)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 880)

    • Creates a software uninstall entry

      • Win7_x86.exe (PID: 956)

  • INFO

    • Checks supported languages

      • UC232A_Windows_Setup_V1.0.075.exe (PID: 2420)
      • Win7_x86.exe (PID: 956)
      • DPInst.exe (PID: 2320)
      • drvinst.exe (PID: 880)

    • Reads the computer name

      • UC232A_Windows_Setup_V1.0.075.exe (PID: 2420)
      • Win7_x86.exe (PID: 956)
      • DPInst.exe (PID: 2320)
      • drvinst.exe (PID: 880)

    • Create files in a temporary directory

      • UC232A_Windows_Setup_V1.0.075.exe (PID: 2420)
      • Win7_x86.exe (PID: 956)
      • DPInst.exe (PID: 2320)

    • Reads the machine GUID from the registry

      • Win7_x86.exe (PID: 956)
      • DPInst.exe (PID: 2320)
      • drvinst.exe (PID: 880)

    • Creates files in the program directory

      • Win7_x86.exe (PID: 956)

    • Reads the software policy settings

      • drvinst.exe (PID: 880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:01:21 05:49:30+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 45056
InitializedDataSize: 27238400
UninitializedDataSize: -
EntryPoint: 0x265c
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.75.0
ProductVersionNumber: 1.0.75.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Aten International Co., Ltd.
FileDescription: UC232A_Windows_Setup
FileVersion: 1.0.075
InternalName: Win32
LegalCopyright: Copyright (R) 2010 Aten International Co., Ltd. All rights reserved.
OriginalFileName: UC232A_Windows_Setup
ProductName: UC232A
ProductVersion: 1.0.075
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start uc232a_windows_setup_v1.0.075.exe win7_x86.exe no specs vssvc.exe no specs dpinst.exe no specs drvinst.exe no specs uc232a_windows_setup_v1.0.075.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
880DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{5c6f31d5-fc35-1864-2925-681e81436525}\ser2at.inf" "0" "69341ca17" "000003F8" "WinSta0\Default" "000004BC" "208" "c:\program files\aten international co., ltd\uc232a_win 7_32bit"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
956"C:\Users\admin\AppData\Local\Temp\Win7_x86.exe" C:\Users\admin\AppData\Local\Temp\Win7_x86.exe—UC232A_Windows_Setup_V1.0.075.exe
User:
admin
Company:
Acresso Software Inc.
Integrity Level:
HIGH
Description:
Setup.exe
Exit code:
0
Version:
15.0.498
Modules
Images
c:\users\admin\appdata\local\temp\win7_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2320"C:\Program Files\Aten International Co., Ltd\UC232A_Win 7_32bit\DPInst.exe" C:\Program Files\Aten International Co., Ltd\UC232A_Win 7_32bit\DPInst.exe—Win7_x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
256
Version:
2.1
Modules
Images
c:\program files\aten international co., ltd\uc232a_win 7_32bit\dpinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2420"C:\Users\admin\AppData\Local\Temp\UC232A_Windows_Setup_V1.0.075.exe" C:\Users\admin\AppData\Local\Temp\UC232A_Windows_Setup_V1.0.075.exe
explorer.exe
User:
admin
Company:
Aten International Co., Ltd.
Integrity Level:
HIGH
Description:
UC232A_Windows_Setup
Exit code:
1
Version:
1.0.075
Modules
Images
c:\users\admin\appdata\local\temp\uc232a_windows_setup_v1.0.075.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
2440C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3936"C:\Users\admin\AppData\Local\Temp\UC232A_Windows_Setup_V1.0.075.exe" C:\Users\admin\AppData\Local\Temp\UC232A_Windows_Setup_V1.0.075.exe—explorer.exe
User:
admin
Company:
Aten International Co., Ltd.
Integrity Level:
MEDIUM
Description:
UC232A_Windows_Setup
Exit code:
3221226540
Version:
1.0.075
Modules
Images
c:\users\admin\appdata\local\temp\uc232a_windows_setup_v1.0.075.exe
c:\windows\system32\ntdll.dll
Total events
8 265
Read events
8 057
Write events
202
Delete events
6

Modification events

(PID) Process:(2420) UC232A_Windows_Setup_V1.0.075.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2420) UC232A_Windows_Setup_V1.0.075.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2420) UC232A_Windows_Setup_V1.0.075.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2420) UC232A_Windows_Setup_V1.0.075.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(956) Win7_x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000003034B9C7F480DA01BC0300006C0C0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(956) Win7_x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000003034B9C7F480DA01BC0300006C0C0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(956) Win7_x86.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(956) Win7_x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000004C82C7C7F480DA01BC0300006C0C0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(956) Win7_x86.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000000047CCC7F480DA01BC03000018080000E80300000100000000000000000000005E4837323C7C6B429DC695F214045E8C0000000000000000
(PID) Process:(2440) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000C232D8C7F480DA0188090000C8070000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
38
Suspicious files
13
Text files
18
Unknown types
25

Dropped files

PID
Process
Filename
Type
2420UC232A_Windows_Setup_V1.0.075.exeC:\Users\admin\AppData\Local\Temp\Win7_x86.exeexecutable
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\Disk1\data1.cabcompressed
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\Disk1\data1.hdrcompressed
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\Disk1\ISSetup.dllexecutable
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\Disk1\layout.binbinary
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\Disk1\setup.exeexecutable
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\Disk1\setup.initext
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\Disk1\setup.inxbinary
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\Disk1\_Setup.dllexecutable
MD5:—
SHA256:—
956Win7_x86.exeC:\Users\admin\AppData\Local\Temp\{536AB61E-23EA-4D32-B215-D6D2EA4B22E0}\_Setup.dllexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
UC232A_Windows_Setup_V1.0.075.exe
PEC2DbgMsg: 0: LoaderStart
UC232A_Windows_Setup_V1.0.075.exe
----- keyreturnvalue : 2 ----
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UC232A_Windows_Setup_V1.0.075.exe