| File name: | WinSCP-6.3.4-Setup.exe |
| Full analysis: | https://app.any.run/tasks/5d49bf36-535e-4335-95b6-b2dc44dfff82 |
| Verdict: | Malicious activity |
| Analysis date: | July 02, 2024, 15:13:17 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 9588F546119E6F4FB3EE39A0376D8D23 |
| SHA1: | 84C05149122A4A0A4D410EEC6B07F5EB84EDDB92 |
| SHA256: | D83E32F949F717E51E1A88A33F8EA23CBC0A4320BFF51F53E0859BCCA628CCF0 |
| SSDEEP: | 98304:2+cD4dnNpxcuwbdlYwxA6ob08dBNxwQQybmRdUslr+adjAAL6Qu/ZRK59ww132Mm:7ukmazVYhuEjWH75tfYS |
MALICIOUS
Drops the executable file immediately after the start
- WinSCP-6.3.4-Setup.exe (PID: 3344)
- WinSCP-6.3.4-Setup.exe (PID: 2748)
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
Registers / Runs the DLL via REGSVR32.EXE
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
SUSPICIOUS
Executable content was dropped or overwritten
- WinSCP-6.3.4-Setup.exe (PID: 3344)
- WinSCP-6.3.4-Setup.exe (PID: 2748)
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
Reads the Windows owner or organization settings
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
Reads settings of System Certificates
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
Creates/Modifies COM task schedule object
- regsvr32.exe (PID: 3176)
Reads the date of Windows installation
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 3132)
Searches for installed software
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 3132)
INFO
Checks supported languages
- WinSCP-6.3.4-Setup.exe (PID: 3344)
- WinSCP-6.3.4-Setup.exe (PID: 2748)
- WinSCP-6.3.4-Setup.tmp (PID: 3392)
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 3132)
- wmpnscfg.exe (PID: 1264)
Create files in a temporary directory
- WinSCP-6.3.4-Setup.exe (PID: 3344)
- WinSCP-6.3.4-Setup.exe (PID: 2748)
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
Reads the computer name
- WinSCP-6.3.4-Setup.tmp (PID: 3392)
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 3132)
- wmpnscfg.exe (PID: 1264)
Reads the software policy settings
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
Reads the machine GUID from the registry
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 3132)
Creates files in the program directory
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
Creates files or folders in the user directory
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 3132)
Creates a software uninstall entry
- WinSCP-6.3.4-Setup.tmp (PID: 2936)
Process checks Powershell version
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 3132)
Reads product name
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3132)
Reads Environment values
- WinSCP.exe (PID: 996)
- WinSCP.exe (PID: 2864)
- WinSCP.exe (PID: 3572)
- WinSCP.exe (PID: 3132)
Manual execution by a user
- wmpnscfg.exe (PID: 1264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:02:15 14:54:16+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 741888 |
| InitializedDataSize: | 187904 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xb5eec |
| OSVersion: | 6.1 |
| ImageVersion: | 6 |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 6.3.4.14955 |
| ProductVersionNumber: | 6.3.4.14955 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Martin Prikryl |
| FileDescription: | Setup for WinSCP 6.3.4 (SFTP, FTP, WebDAV and SCP client) |
| FileVersion: | 6.3.4 |
| LegalCopyright: | (c) 2000-2024 Martin Prikryl |
| OriginalFileName: | WinSCP-6.3.4-Setup.exe |
| ProductName: | WinSCP |
| ProductVersion: | 6.3.4 |
Total processes
50
Monitored processes
10
Malicious processes
4
Suspicious processes
4
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 996 | "C:\Program Files\WinSCP\WinSCP.exe" /RegisterForDefaultProtocols | C:\Program Files\WinSCP\WinSCP.exe | — | WinSCP-6.3.4-Setup.tmp | |||||||||||
User: admin Company: Martin Prikryl Integrity Level: HIGH Description: WinSCP: SFTP, FTP, WebDAV, S3 and SCP client Exit code: 0 Version: 6.3.4.14955 Modules
| |||||||||||||||
| 1264 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2748 | "C:\Users\admin\AppData\Local\Temp\WinSCP-6.3.4-Setup.exe" /SPAWNWND=$80160 /NOTIFYWND=$6015A /ALLUSERS | C:\Users\admin\AppData\Local\Temp\WinSCP-6.3.4-Setup.exe | WinSCP-6.3.4-Setup.tmp | ||||||||||||
User: admin Company: Martin Prikryl Integrity Level: HIGH Description: Setup for WinSCP 6.3.4 (SFTP, FTP, WebDAV and SCP client) Exit code: 0 Version: 6.3.4 Modules
| |||||||||||||||
| 2864 | "C:\Program Files\WinSCP\WinSCP.exe" /ImportSitesIfAny | C:\Program Files\WinSCP\WinSCP.exe | — | WinSCP-6.3.4-Setup.tmp | |||||||||||
User: admin Company: Martin Prikryl Integrity Level: HIGH Description: WinSCP: SFTP, FTP, WebDAV, S3 and SCP client Exit code: 0 Version: 6.3.4.14955 Modules
| |||||||||||||||
| 2936 | "C:\Users\admin\AppData\Local\Temp\is-D0ULP.tmp\WinSCP-6.3.4-Setup.tmp" /SL5="$110168,10474196,930816,C:\Users\admin\AppData\Local\Temp\WinSCP-6.3.4-Setup.exe" /SPAWNWND=$80160 /NOTIFYWND=$6015A /ALLUSERS | C:\Users\admin\AppData\Local\Temp\is-D0ULP.tmp\WinSCP-6.3.4-Setup.tmp | WinSCP-6.3.4-Setup.exe | ||||||||||||
User: admin Company: Martin Prikryl Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 3132 | "C:\Program Files\WinSCP\WinSCP.exe" | C:\Program Files\WinSCP\WinSCP.exe | — | WinSCP-6.3.4-Setup.tmp | |||||||||||
User: admin Company: Martin Prikryl Integrity Level: MEDIUM Description: WinSCP: SFTP, FTP, WebDAV, S3 and SCP client Version: 6.3.4.14955 Modules
| |||||||||||||||
| 3176 | "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\WinSCP\DragExt.dll" | C:\Windows\System32\regsvr32.exe | — | WinSCP-6.3.4-Setup.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3344 | "C:\Users\admin\AppData\Local\Temp\WinSCP-6.3.4-Setup.exe" | C:\Users\admin\AppData\Local\Temp\WinSCP-6.3.4-Setup.exe | explorer.exe | ||||||||||||
User: admin Company: Martin Prikryl Integrity Level: MEDIUM Description: Setup for WinSCP 6.3.4 (SFTP, FTP, WebDAV and SCP client) Exit code: 0 Version: 6.3.4 Modules
| |||||||||||||||
| 3392 | "C:\Users\admin\AppData\Local\Temp\is-92ATU.tmp\WinSCP-6.3.4-Setup.tmp" /SL5="$6015A,10474196,930816,C:\Users\admin\AppData\Local\Temp\WinSCP-6.3.4-Setup.exe" | C:\Users\admin\AppData\Local\Temp\is-92ATU.tmp\WinSCP-6.3.4-Setup.tmp | — | WinSCP-6.3.4-Setup.exe | |||||||||||
User: admin Company: Martin Prikryl Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 3572 | "C:\Program Files\WinSCP\WinSCP.exe" /Usage=TypicalInstallation:1,InstallationsUser+,InstallationParentProcess@,InstallationsFirstTypical+,LastInstallationAutomaticUpgrade:0,InstallationsLaunch+, | C:\Program Files\WinSCP\WinSCP.exe | — | WinSCP-6.3.4-Setup.tmp | |||||||||||
User: admin Company: Martin Prikryl Integrity Level: MEDIUM Description: WinSCP: SFTP, FTP, WebDAV, S3 and SCP client Exit code: 0 Version: 6.3.4.14955 Modules
| |||||||||||||||
Total events
28 362
Read events
27 008
Write events
1 251
Delete events
103
Modification events
| (PID) Process: | (2936) WinSCP-6.3.4-Setup.tmp | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (2936) WinSCP-6.3.4-Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface |
| Operation: | write | Name: | Interface |
Value: 0 | |||
| (PID) Process: | (2936) WinSCP-6.3.4-Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Martin Prikryl\WinSCP 2 |
| Operation: | write | Name: | DefaultInterfaceInterface |
Value: 0 | |||
| (PID) Process: | (2936) WinSCP-6.3.4-Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface |
| Operation: | write | Name: | DDExtEnabled |
Value: 1 | |||
| (PID) Process: | (2936) WinSCP-6.3.4-Setup.tmp | Key: | HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Interface\Updates |
| Operation: | write | Name: | Period |
Value: 7 | |||
| (PID) Process: | (2936) WinSCP-6.3.4-Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Martin Prikryl\WinSCP 2 |
| Operation: | write | Name: | DefaultUpdatesPeriod |
Value: 7 | |||
| (PID) Process: | (2936) WinSCP-6.3.4-Setup.tmp | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Martin Prikryl\WinSCP 2 |
| Operation: | write | Name: | DefaultCollectUsage |
Value: 1 | |||
| (PID) Process: | (3176) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E15E1D68-0D1C-49F7-BEB8-812B1E00FA60}\InProcServer32 |
| Operation: | write | Name: | ThreadingModel |
Value: Apartment | |||
| (PID) Process: | (3176) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Martin Prikryl\WinSCP 2\DragExt |
| Operation: | write | Name: | Enable |
Value: 1 | |||
| (PID) Process: | (3176) regsvr32.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | GlobalAssocChangedCounter |
Value: 116 | |||
Executable files
94
Suspicious files
22
Text files
26
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2936 | WinSCP-6.3.4-Setup.tmp | C:\Program Files\WinSCP\is-KQ0I1.tmp | — | |
MD5:— | SHA256:— | |||
| 2936 | WinSCP-6.3.4-Setup.tmp | C:\Program Files\WinSCP\WinSCP.map | — | |
MD5:— | SHA256:— | |||
| 3344 | WinSCP-6.3.4-Setup.exe | C:\Users\admin\AppData\Local\Temp\is-92ATU.tmp\WinSCP-6.3.4-Setup.tmp | executable | |
MD5:FF5691AE66E38D091043B4CD9CADCEC3 | SHA256:0A2694E353C0CDC1153FB6B041A7FB0745C942AD25A54B8CD4D1E8009936384A | |||
| 2936 | WinSCP-6.3.4-Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-QMGUJ.tmp\Opened bookmark folder-stored session folder 32.bmp | image | |
MD5:69781E031A3B7680DA24D1E77F191E5A | SHA256:1F2CFDD302A212C294AF4405EE87074646748E2AEB2944E0CE90784A82DEA686 | |||
| 2748 | WinSCP-6.3.4-Setup.exe | C:\Users\admin\AppData\Local\Temp\is-D0ULP.tmp\WinSCP-6.3.4-Setup.tmp | executable | |
MD5:FF5691AE66E38D091043B4CD9CADCEC3 | SHA256:0A2694E353C0CDC1153FB6B041A7FB0745C942AD25A54B8CD4D1E8009936384A | |||
| 2936 | WinSCP-6.3.4-Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-QMGUJ.tmp\Commander 32.bmp | image | |
MD5:ED0CECA857638AF320FE2C20F0DC1DCE | SHA256:EB99C2308934AACE1DF867C688408FB1D86D97FBB2569DEDEC95531BF382BE6B | |||
| 2936 | WinSCP-6.3.4-Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-QMGUJ.tmp\PayPalCard.bmp | image | |
MD5:C0A9AAEE7E65AA99A6C9DB4E981199A2 | SHA256:DCEB71E552236BBB7AAEDDA6837AD8C617C6917634485EC08CEB79164911B1B7 | |||
| 2936 | WinSCP-6.3.4-Setup.tmp | C:\Users\admin\AppData\Local\Temp\is-QMGUJ.tmp\Explorer 32.bmp | image | |
MD5:60FEF0251FD2BBA6A7B5EE01803C9D6B | SHA256:835EEED939B943D302E481372ACA0A5205C7D3C82BD5B23249AE964155ECF700 | |||
| 2936 | WinSCP-6.3.4-Setup.tmp | C:\Program Files\WinSCP\unins000.exe | executable | |
MD5:FF5691AE66E38D091043B4CD9CADCEC3 | SHA256:0A2694E353C0CDC1153FB6B041A7FB0745C942AD25A54B8CD4D1E8009936384A | |||
| 2936 | WinSCP-6.3.4-Setup.tmp | C:\Program Files\WinSCP\license.txt | text | |
MD5:24FFAE2252489568A61967B669EEE5CC | SHA256:38493E2A77946BB116831C1A394B5F9D073B8490BE20EBC6B5E42DF64237DBAA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
11
DNS requests
6
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1372 | svchost.exe | GET | 304 | 217.20.57.38:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33 | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
1372 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | unknown |
1060 | svchost.exe | GET | 304 | 217.20.57.43:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?fbe613066ac7852b | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
1372 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1060 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
2936 | WinSCP-6.3.4-Setup.tmp | 88.198.21.111:443 | winscp.net | Hetzner Online GmbH | DE | unknown |
1372 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
1372 | svchost.exe | 217.20.57.38:80 | ctldl.windowsupdate.com | — | US | unknown |
1372 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | unknown |
1372 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | unknown |
1060 | svchost.exe | 217.20.57.43:80 | ctldl.windowsupdate.com | — | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
winscp.net |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
ctldl.windowsupdate.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |