File name:

AWC-PYS.exe

Full analysis: https://app.any.run/tasks/a9c1d9f7-13f1-42cd-a17c-2e2b7bf93422
Verdict: Malicious activity
Analysis date: May 25, 2024, 18:53:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

EE9B4D95EC87B1CAB9677C4EFABF4D08

SHA1:

FB2AA23912C8CFAADDACA7A53C739AC0001D6A30

SHA256:

D4B98B9BAAB4C8FC3EFA3B48E39C494AC2ED7BEAEAFF7E0A9F7748BD437ABFA2

SSDEEP:

98304:Izc5VwvIOvQZsB5bt7FM1hfqUPOWLtEFZwGRsspGJLVOQqsKiLFJk3D4L71PnuiF:41cbhi8Q+t+JUQsIoY/Pt4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AWC-PYS.exe (PID: 4084)
      • WebCam.exe (PID: 1872)

    • Registers / Runs the DLL via REGSVR32.EXE

      • AWC-PYS.exe (PID: 4084)

    • Creates a writable file in the system directory

      • WebCam.exe (PID: 1872)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • AWC-PYS.exe (PID: 4084)

    • Process drops legitimate windows executable

      • AWC-PYS.exe (PID: 4084)
      • WebCam.exe (PID: 1872)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 748)
      • regsvr32.exe (PID: 1036)

    • Creates a software uninstall entry

      • AWC-PYS.exe (PID: 4084)

    • Executing commands from a ".bat" file

      • AWC-PYS.exe (PID: 4084)

    • Executable content was dropped or overwritten

      • AWC-PYS.exe (PID: 4084)
      • WebCam.exe (PID: 1872)

    • Starts CMD.EXE for commands execution

      • AWC-PYS.exe (PID: 4084)

    • Reads the Internet Settings

      • WebCam.exe (PID: 1872)

  • INFO

    • Checks supported languages

      • AWC-PYS.exe (PID: 4084)
      • WebCam.exe (PID: 1872)
      • CompParams.exe (PID: 336)
      • AudioCaptureDemon.exe (PID: 2304)
      • wmpnscfg.exe (PID: 2760)

    • Reads the computer name

      • AWC-PYS.exe (PID: 4084)
      • WebCam.exe (PID: 1872)
      • AudioCaptureDemon.exe (PID: 2304)
      • CompParams.exe (PID: 336)
      • wmpnscfg.exe (PID: 2760)

    • Create files in a temporary directory

      • AWC-PYS.exe (PID: 4084)

    • Creates files in the program directory

      • AWC-PYS.exe (PID: 4084)
      • WebCam.exe (PID: 1872)

    • Reads CPU info

      • CompParams.exe (PID: 336)

    • Application launched itself

      • msedge.exe (PID: 304)
      • msedge.exe (PID: 1932)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2760)
      • msedge.exe (PID: 1932)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (49.2)
.exe | Win32 Executable Delphi generic (16.2)
.scr | Windows screen saver (14.9)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 280064
InitializedDataSize: 56320
UninitializedDataSize: -
EntryPoint: 0x453a8
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.3.0.57
ProductVersionNumber: 2.3.0.57
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: PY Software, Inc.
FileDescription: Installer
FileVersion: 2.3.0.57
InternalName: Installer
LegalCopyright: PY Software, Inc. (www.pysoft.com)
LegalTrademarks: PY Software, Inc.
OriginalFileName: unpacker.ovl
ProductName: Installer
ProductVersion: 2.3.0.0
Comments: Support: www.pysoft.com
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
29
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start awc-pys.exe regsvr32.exe no specs regsvr32.exe no specs cmd.exe no specs webcam.exe compparams.exe no specs audiocapturedemon.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs awc-pys.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
112C:\Windows\system32\cmd.exe /c ""C:\Program Files\Active WebCam\del_prev_lang_files.bat" "C:\Program Files\Active WebCam\""C:\Windows\System32\cmd.exe—AWC-PYS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
304"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.pysoft.com/ActiveWebCamSelectSubscr.htmlC:\Program Files\Microsoft\Edge\Application\msedge.exe—WebCam.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
316"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0x170,0x174,0x178,0x144,0x180,0x6c48f598,0x6c48f5a8,0x6c48f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
336"C:\Program Files\Active WebCam\CompParams.exe" CompParams1086472C:\Program Files\Active WebCam\CompParams.exe—WebCam.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\program files\active webcam\compparams.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
748"C:\Windows\system32\REGSVR32.EXE" /s "C:\Program Files\Active WebCam\G700decoder.dll"C:\Windows\System32\regsvr32.exe—AWC-PYS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
992"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1584 --field-trial-handle=1376,i,12430451936266892160,6379834013080732275,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1008"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2240 --field-trial-handle=1376,i,12430451936266892160,6379834013080732275,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1036"C:\Windows\system32\REGSVR32.EXE" /s "C:\Program Files\Active WebCam\PushSource.dll"C:\Windows\System32\regsvr32.exe—AWC-PYS.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1240"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1376,i,12430451936266892160,6379834013080732275,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1248"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3716 --field-trial-handle=1376,i,12430451936266892160,6379834013080732275,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
8 207
Read events
7 544
Write events
656
Delete events
7

Modification events

(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Name
Value:
Active WebCam
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Location
Value:
C:\Program Files\Active WebCam\
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:InstallerFile
Value:
C:\Users\admin\AppData\Local\Temp\AWC-PYS.exe
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Prog0
Value:
C:\Program Files\Active WebCam\AudioCaptureDemon.exe
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Prog1
Value:
C:\Program Files\Active WebCam\CompParams.exe
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Prog2
Value:
C:\Program Files\Active WebCam\FTPUploader.exe
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Prog3
Value:
C:\Program Files\Active WebCam\GS4000.dll
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Prog4
Value:
C:\Program Files\Active WebCam\IP207W.dll
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Prog5
Value:
C:\Program Files\Active WebCam\IPCamReceiver.exe
(PID) Process:(4084) AWC-PYS.exeKey:HKEY_CURRENT_USER\Software\PySoft\Act_WebCam\install
Operation:writeName:Prog6
Value:
C:\Program Files\Active WebCam\MOBI70170IPCAM.dll
Executable files
41
Suspicious files
74
Text files
192
Unknown types
2

Dropped files

PID
Process
Filename
Type
4084AWC-PYS.exeC:\Program Files\Active WebCam\GS4000.dllexecutable
MD5:C3793DF441989C40BCCFED80849CB05C
SHA256:DE4C66592B08ECCE75ECF964EC92AFDEAF047D46F08053F7DAC89C33D0B31BC9
4084AWC-PYS.exeC:\Users\admin\AppData\Local\Temp\License.txttext
MD5:077801CECF0179CFA4DC723E6842B89F
SHA256:D24D189755721B620BD60967A5982A0889C78E4A6C32904B5525F31308D55578
4084AWC-PYS.exeC:\Program Files\Active WebCam\OfflineAds\Adv8.htmlhtml
MD5:4DA2B5114548E227C618FA909BD9CFAC
SHA256:296AA1F12CE0653D6C4CF23F79985CDDDE94711E9DAB3BB1E09673E64833A88A
4084AWC-PYS.exeC:\Program Files\Active WebCam\OfflineAds\Adv12.htmlhtml
MD5:8BD46AC81EC375EE449934582209668B
SHA256:819BE9B52DD37D46A03967DE922BE469AF1814FB9FB698A6B3D00A0DBE6B7F28
4084AWC-PYS.exeC:\Program Files\Active WebCam\OfflineAds\Adv6.htmlhtml
MD5:6C7F20ED8FB45680FEF1FA512A4D958E
SHA256:68004A73EA06CB584BFA84B2493D7D19527B5A8CF4CCFBBB799BE2FA147A8BCC
4084AWC-PYS.exeC:\Program Files\Active WebCam\OfflineAds\banner_affiliate.gifimage
MD5:46C457465B5E3652FDF9210A6735621A
SHA256:3DA8E9266CBA7B0F72E1AEA85A18B75B248FFFB1F50017C26345C6EC2E274545
4084AWC-PYS.exeC:\Program Files\Active WebCam\OfflineAds\Adv9.htmlhtml
MD5:5172CEFE58612B5DBD9279426A9128AD
SHA256:48D98EA9A627B8077E53B440B954985818D770F43D55E7BFE97999BE180D72FD
4084AWC-PYS.exeC:\Program Files\Active WebCam\OfflineAds\banner_lts.gifimage
MD5:E340D1B280F1C46529DDBAB3D4C71874
SHA256:03304E6EC8F79C84AA473F7E91AC0D74A93534CA9216DD19CE182811813E70F6
4084AWC-PYS.exeC:\Program Files\Active WebCam\FTPUploader.exeexecutable
MD5:744255140F7CC3EE19403C88A4192D45
SHA256:01EA41438130A1564148996F3B1660B535CA423348C3D68CA46D98026BFFEC76
4084AWC-PYS.exeC:\Program Files\Active WebCam\IP207W.dllexecutable
MD5:29F5B28AF449B84EFD2C24343CAC49A3
SHA256:1719AA89A58F9F55BE5750A8F02468F7B7CFF6C1DD7E37070AB0BF126A71F64A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
16
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2516
msedge.exe
GET
301
108.138.7.116:80
http://www.pysoft.com/ActiveWebCamSelectSubscr.html
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
1932
msedge.exe
239.255.255.250:1900
—
—
—
unknown
2516
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2516
msedge.exe
108.138.7.116:80
www.pysoft.com
AMAZON-02
US
unknown
2516
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2516
msedge.exe
108.138.7.64:443
www.pysoft.com
AMAZON-02
US
unknown
2516
msedge.exe
2.20.142.154:443
www.bing.com
Akamai International B.V.
DE
unknown
1932
msedge.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.pysoft.com
  • 108.138.7.116
  • 108.138.7.31
  • 108.138.7.12
  • 108.138.7.64
malicious
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
www.bing.com
  • 2.20.142.154
  • 2.20.142.187
  • 2.20.142.3
  • 2.20.142.251
  • 92.122.215.53
  • 92.122.215.57
  • 92.122.215.65
  • 2.20.142.180
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 152.199.21.175
whitelisted

Threats

No threats detected
Process
Message
WebCam.exe
SetThreadDesktopThe requested resource is in use
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AWC-PYS.exe