File name:

Setup.zip

Full analysis: https://app.any.run/tasks/3ee815c2-97bd-4442-8d6c-a8a6efe57a6a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 14, 2021, 00:45:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
loader
unwanted
netsupport
pua
ossproxy
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

BB080BC4E0204172E699A31052C91B99

SHA1:

C8691AF125E25DE8740217BC7A98954840036493

SHA256:

DB8B919ECB43B5C41CBB43600AE1275D89BDCE01D1A6EA1A05504357197731BC

SSDEEP:

393216:Qtm8O7sSzbomdOXZ7j28GEEUH9dSUpq7b/bJkjPgtvh:weom4BrbH9dSyq77bR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 2052)
      • WebCompanion.exe (PID: 2488)
      • WebCompanion.exe (PID: 3468)

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 2596)
      • Setup.exe (PID: 3648)
      • irsetup.exe (PID: 2088)
      • irsetup.exe (PID: 272)
      • Setup_8854.exe (PID: 3320)
      • installerapp.exe (PID: 856)
      • maskvpn.exe (PID: 1684)
      • tapinstall.exe (PID: 1840)
      • tapinstall.exe (PID: 1164)
      • InlogBrowser_74449.exe (PID: 2636)
      • WcInstaller.exe (PID: 2352)
      • surveyA.exe (PID: 1752)
      • mask_svc.exe (PID: 1128)
      • mask_svc.exe (PID: 2140)
      • mask_svc.exe (PID: 3016)
      • vdi_compiler.exe (PID: 2988)
      • svrwebui.exe (PID: 3040)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • WebCompanion.exe (PID: 2488)
      • WebCompanion.exe (PID: 3468)
      • MaskVPNUpdate.exe (PID: 2372)
      • poinstaller.exe (PID: 2212)
      • pmservice.exe (PID: 3888)
      • pmropn.exe (PID: 3952)

    • Drops executable file immediately after starts

      • Setup.exe (PID: 3648)
      • Setup_8854.exe (PID: 3320)
      • installerapp.exe (PID: 856)
      • maskvpn.exe (PID: 1684)
      • maskvpn.tmp (PID: 2308)
      • DrvInst.exe (PID: 2468)
      • InlogBrowser_74449.exe (PID: 2636)
      • expand.exe (PID: 3352)
      • InlogBrowser_74449.tmp (PID: 3840)
      • pmropn.exe (PID: 3952)

    • Loads dropped or rewritten executable

      • irsetup.exe (PID: 2088)
      • irsetup.exe (PID: 272)
      • installerapp.exe (PID: 856)
      • mask_svc.exe (PID: 3016)
      • vdi_compiler.exe (PID: 2988)
      • svrwebui.exe (PID: 3040)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • WebCompanion.exe (PID: 3468)
      • WebCompanion.exe (PID: 2488)
      • surveyA.exe (PID: 1752)
      • MaskVPNUpdate.exe (PID: 2372)
      • poinstaller.exe (PID: 2212)
      • pmropn.exe (PID: 3952)

    • Changes settings of System certificates

      • irsetup.exe (PID: 2088)
      • maskvpn.tmp (PID: 2308)
      • tapinstall.exe (PID: 1840)

    • Loads the Task Scheduler COM API

      • MsiExec.exe (PID: 2816)

    • Changes the login/logoff helper path in the registry

      • reg.exe (PID: 3280)

    • Changes the autorun value in the registry

      • DrvInst.exe (PID: 2532)
      • WebCompanion.exe (PID: 2488)

    • Connects to CnC server

      • svrwebui.exe (PID: 3040)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 3056)

    • Changes internet zones settings

      • WebCompanionInstaller.exe (PID: 340)

    • Steals credentials from Web Browsers

      • WebCompanion.exe (PID: 2488)
      • WebCompanion.exe (PID: 3468)

    • Starts Visual C# compiler

      • WebCompanion.exe (PID: 2488)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)

    • Loads the Task Scheduler DLL interface

      • installerapp.exe (PID: 856)

    • OSSPROXY was detected

      • pmropn.exe (PID: 3952)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2052)
      • Setup.exe (PID: 3648)
      • irsetup.exe (PID: 2088)
      • Setup_8854.exe (PID: 3320)
      • irsetup.exe (PID: 272)
      • installerapp.exe (PID: 856)
      • msiexec.exe (PID: 2168)
      • maskvpn.tmp (PID: 2308)
      • maskvpn.exe (PID: 1684)
      • tapinstall.exe (PID: 1840)
      • DrvInst.exe (PID: 2468)
      • InlogBrowser_74449.exe (PID: 2636)
      • InlogBrowser_74449.tmp (PID: 3840)
      • expand.exe (PID: 3352)
      • WebCompanionInstaller.exe (PID: 340)
      • surveyA.exe (PID: 1752)
      • poinstaller.exe (PID: 2212)
      • pmropn.exe (PID: 3952)

    • Checks supported languages

      • WinRAR.exe (PID: 2052)
      • Setup.exe (PID: 3648)
      • irsetup.exe (PID: 2088)
      • Setup_8854.exe (PID: 3320)
      • irsetup.exe (PID: 272)
      • installerapp.exe (PID: 856)
      • maskvpn.exe (PID: 1684)
      • maskvpn.tmp (PID: 2308)
      • tapinstall.exe (PID: 1164)
      • cmd.exe (PID: 360)
      • cmd.exe (PID: 1416)
      • tapinstall.exe (PID: 1840)
      • DrvInst.exe (PID: 2468)
      • InlogBrowser_74449.exe (PID: 2636)
      • InlogBrowser_74449.tmp (PID: 3840)
      • cmd.exe (PID: 2084)
      • cmd.exe (PID: 1520)
      • svrwebui.exe (PID: 3040)
      • cmd.exe (PID: 3160)
      • vdi_compiler.exe (PID: 2988)
      • DrvInst.exe (PID: 2532)
      • WcInstaller.exe (PID: 2352)
      • WebCompanionInstaller.exe (PID: 340)
      • surveyA.exe (PID: 1752)
      • mask_svc.exe (PID: 2140)
      • mask_svc.exe (PID: 1128)
      • mask_svc.exe (PID: 3016)
      • cmd.exe (PID: 3056)
      • cmd.exe (PID: 2164)
      • WebCompanion.exe (PID: 2488)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • cmd.exe (PID: 3952)
      • csc.exe (PID: 1088)
      • cvtres.exe (PID: 2884)
      • csc.exe (PID: 3000)
      • cvtres.exe (PID: 2640)
      • WebCompanion.exe (PID: 3468)
      • PresentationFontCache.exe (PID: 3032)
      • csc.exe (PID: 2372)
      • cvtres.exe (PID: 384)
      • MaskVPNUpdate.exe (PID: 2372)
      • poinstaller.exe (PID: 2212)
      • pmropn.exe (PID: 3952)
      • pmservice.exe (PID: 3888)

    • Reads the computer name

      • WinRAR.exe (PID: 2052)
      • Setup.exe (PID: 3648)
      • irsetup.exe (PID: 2088)
      • Setup_8854.exe (PID: 3320)
      • irsetup.exe (PID: 272)
      • installerapp.exe (PID: 856)
      • maskvpn.tmp (PID: 2308)
      • tapinstall.exe (PID: 1164)
      • tapinstall.exe (PID: 1840)
      • DrvInst.exe (PID: 2468)
      • InlogBrowser_74449.tmp (PID: 3840)
      • svrwebui.exe (PID: 3040)
      • DrvInst.exe (PID: 2532)
      • WebCompanionInstaller.exe (PID: 340)
      • surveyA.exe (PID: 1752)
      • mask_svc.exe (PID: 1128)
      • mask_svc.exe (PID: 2140)
      • mask_svc.exe (PID: 3016)
      • vdi_compiler.exe (PID: 2988)
      • WebCompanion.exe (PID: 2488)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • WebCompanion.exe (PID: 3468)
      • PresentationFontCache.exe (PID: 3032)
      • MaskVPNUpdate.exe (PID: 2372)
      • poinstaller.exe (PID: 2212)
      • pmropn.exe (PID: 3952)
      • pmservice.exe (PID: 3888)

    • Reads the Windows organization settings

      • irsetup.exe (PID: 2088)
      • irsetup.exe (PID: 272)
      • installerapp.exe (PID: 856)
      • msiexec.exe (PID: 2168)
      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)

    • Reads Windows owner or organization settings

      • irsetup.exe (PID: 2088)
      • irsetup.exe (PID: 272)
      • installerapp.exe (PID: 856)
      • msiexec.exe (PID: 2168)
      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)

    • Adds / modifies Windows certificates

      • irsetup.exe (PID: 2088)

    • Reads Microsoft Outlook installation path

      • irsetup.exe (PID: 272)
      • iexplore.exe (PID: 3672)

    • Checks for external IP

      • irsetup.exe (PID: 272)

    • Drops a file that was compiled in debug mode

      • irsetup.exe (PID: 272)
      • installerapp.exe (PID: 856)
      • msiexec.exe (PID: 2168)
      • maskvpn.tmp (PID: 2308)
      • tapinstall.exe (PID: 1840)
      • DrvInst.exe (PID: 2468)
      • InlogBrowser_74449.tmp (PID: 3840)
      • expand.exe (PID: 3352)
      • WebCompanionInstaller.exe (PID: 340)
      • surveyA.exe (PID: 1752)

    • Reads Environment values

      • installerapp.exe (PID: 856)
      • MsiExec.exe (PID: 3144)
      • MsiExec.exe (PID: 3844)
      • vssvc.exe (PID: 3972)
      • DrvInst.exe (PID: 2532)
      • WebCompanionInstaller.exe (PID: 340)
      • netsh.exe (PID: 4000)
      • WebCompanion.exe (PID: 2488)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • netsh.exe (PID: 2768)
      • maskvpn.tmp (PID: 2308)
      • WebCompanion.exe (PID: 3468)
      • netsh.exe (PID: 3916)

    • Reads internet explorer settings

      • irsetup.exe (PID: 272)

    • Creates files in the user directory

      • installerapp.exe (PID: 856)
      • MsiExec.exe (PID: 3844)
      • WebCompanionInstaller.exe (PID: 340)
      • WebCompanion.exe (PID: 2488)
      • WebCompanion.exe (PID: 3468)
      • pmropn.exe (PID: 3952)

    • Executed as Windows Service

      • msiexec.exe (PID: 2168)
      • vssvc.exe (PID: 3972)
      • mask_svc.exe (PID: 3016)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • PresentationFontCache.exe (PID: 3032)
      • pmservice.exe (PID: 3888)

    • Application launched itself

      • msiexec.exe (PID: 2168)

    • Starts Microsoft Installer

      • installerapp.exe (PID: 856)

    • Uses TASKKILL.EXE to kill process

      • MsiExec.exe (PID: 3844)

    • Creates files in the program directory

      • msiexec.exe (PID: 2168)
      • expand.exe (PID: 3352)
      • WebCompanionInstaller.exe (PID: 340)
      • WebCompanion.exe (PID: 2488)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • WebCompanion.exe (PID: 3468)
      • poinstaller.exe (PID: 2212)
      • pmropn.exe (PID: 3952)

    • Creates a directory in Program Files

      • msiexec.exe (PID: 2168)
      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)
      • poinstaller.exe (PID: 2212)
      • WebCompanionInstaller.exe (PID: 340)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2168)
      • WebCompanionInstaller.exe (PID: 340)
      • pmropn.exe (PID: 3952)
      • poinstaller.exe (PID: 2212)

    • Drops a file with too old compile date

      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)
      • irsetup.exe (PID: 272)
      • surveyA.exe (PID: 1752)

    • Starts CMD.EXE for commands execution

      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)
      • vdi_compiler.exe (PID: 2988)
      • WebCompanionInstaller.exe (PID: 340)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)

    • Executed via COM

      • DrvInst.exe (PID: 2468)
      • DrvInst.exe (PID: 2532)

    • Creates files in the Windows directory

      • DrvInst.exe (PID: 2468)
      • DrvInst.exe (PID: 2532)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • WebCompanion.exe (PID: 2488)
      • WebCompanionInstaller.exe (PID: 340)
      • csc.exe (PID: 2372)
      • pmropn.exe (PID: 3952)

    • Removes files from Windows directory

      • DrvInst.exe (PID: 2468)
      • DrvInst.exe (PID: 2532)
      • WebCompanionInstaller.exe (PID: 340)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • csc.exe (PID: 2372)

    • Creates files in the driver directory

      • DrvInst.exe (PID: 2468)
      • DrvInst.exe (PID: 2532)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 1520)

    • Starts Internet Explorer

      • cmd.exe (PID: 3160)

    • Drops a file with a compile date too recent

      • irsetup.exe (PID: 272)
      • WebCompanionInstaller.exe (PID: 340)
      • poinstaller.exe (PID: 2212)
      • pmropn.exe (PID: 3952)

    • Starts SC.EXE for service management

      • WebCompanionInstaller.exe (PID: 340)

    • Starts CMD.EXE for self-deleting

      • vdi_compiler.exe (PID: 2988)

    • Searches for installed software

      • vdi_compiler.exe (PID: 2988)
      • WebCompanion.exe (PID: 2488)
      • pmropn.exe (PID: 3952)
      • pmservice.exe (PID: 3888)
      • poinstaller.exe (PID: 2212)
      • WebCompanion.exe (PID: 3468)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2164)
      • cmd.exe (PID: 3952)
      • pmropn.exe (PID: 3952)

  • INFO

    • Reads settings of System Certificates

      • irsetup.exe (PID: 2088)
      • irsetup.exe (PID: 272)
      • installerapp.exe (PID: 856)
      • msiexec.exe (PID: 2168)
      • MsiExec.exe (PID: 3844)
      • maskvpn.tmp (PID: 2308)
      • tapinstall.exe (PID: 1840)
      • DrvInst.exe (PID: 2468)
      • DrvInst.exe (PID: 2532)
      • WebCompanionInstaller.exe (PID: 340)
      • iexplore.exe (PID: 3672)
      • surveyA.exe (PID: 1752)
      • iexplore.exe (PID: 544)
      • WebCompanion.exe (PID: 2488)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • WebCompanion.exe (PID: 3468)
      • mask_svc.exe (PID: 3016)
      • pmropn.exe (PID: 3952)

    • Checks Windows Trust Settings

      • irsetup.exe (PID: 2088)
      • installerapp.exe (PID: 856)
      • irsetup.exe (PID: 272)
      • msiexec.exe (PID: 2168)
      • MsiExec.exe (PID: 3844)
      • tapinstall.exe (PID: 1840)
      • DrvInst.exe (PID: 2468)
      • DrvInst.exe (PID: 2532)
      • WebCompanionInstaller.exe (PID: 340)
      • iexplore.exe (PID: 3672)
      • iexplore.exe (PID: 544)
      • surveyA.exe (PID: 1752)
      • WebCompanion.exe (PID: 2488)
      • Lavasoft.WCAssistant.WinService.exe (PID: 2368)
      • WebCompanion.exe (PID: 3468)
      • pmropn.exe (PID: 3952)

    • Checks supported languages

      • msiexec.exe (PID: 2168)
      • MsiExec.exe (PID: 3144)
      • msiexec.exe (PID: 2388)
      • MsiExec.exe (PID: 3844)
      • taskkill.exe (PID: 2356)
      • MsiExec.exe (PID: 2816)
      • vssvc.exe (PID: 3972)
      • expand.exe (PID: 3352)
      • iexplore.exe (PID: 544)
      • iexplore.exe (PID: 3672)
      • sc.exe (PID: 3140)
      • sc.exe (PID: 3728)
      • sc.exe (PID: 324)
      • PING.EXE (PID: 3584)
      • reg.exe (PID: 3280)
      • netsh.exe (PID: 4000)
      • netsh.exe (PID: 2768)
      • netsh.exe (PID: 3916)

    • Reads the computer name

      • msiexec.exe (PID: 2168)
      • MsiExec.exe (PID: 3144)
      • msiexec.exe (PID: 2388)
      • MsiExec.exe (PID: 3844)
      • taskkill.exe (PID: 2356)
      • MsiExec.exe (PID: 2816)
      • vssvc.exe (PID: 3972)
      • iexplore.exe (PID: 3672)
      • sc.exe (PID: 3140)
      • sc.exe (PID: 324)
      • sc.exe (PID: 3728)
      • iexplore.exe (PID: 544)
      • PING.EXE (PID: 3584)
      • netsh.exe (PID: 4000)
      • netsh.exe (PID: 2768)
      • netsh.exe (PID: 3916)

    • Check for Java to be installed

      • MsiExec.exe (PID: 3144)
      • MsiExec.exe (PID: 3844)

    • Reads Microsoft Office registry keys

      • MsiExec.exe (PID: 3144)
      • MsiExec.exe (PID: 3844)

    • Application was dropped or rewritten from another process

      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)

    • Loads dropped or rewritten executable

      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)

    • Creates files in the program directory

      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)

    • Creates a software uninstall entry

      • maskvpn.tmp (PID: 2308)
      • InlogBrowser_74449.tmp (PID: 3840)

    • Searches for installed software

      • DrvInst.exe (PID: 2468)

    • Drop NetSupport executable file

      • expand.exe (PID: 3352)

    • Dropped object may contain Bitcoin addresses

      • expand.exe (PID: 3352)
      • WebCompanionInstaller.exe (PID: 340)

    • Changes internet zones settings

      • iexplore.exe (PID: 544)

    • Application launched itself

      • iexplore.exe (PID: 544)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3672)

    • Creates files in the user directory

      • iexplore.exe (PID: 3672)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 544)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: data.dat
ZipUncompressedSize: 11819661
ZipCompressedSize: 11626643
ZipCRC: 0xd63727b9
ZipModifyDate: 2021:07:03 14:27:12
ZipCompression: Deflated
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
63
Malicious processes
26
Suspicious processes
8

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe setup.exe no specs setup.exe irsetup.exe setup_8854.exe irsetup.exe installerapp.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe taskkill.exe no specs msiexec.exe no specs maskvpn.exe maskvpn.tmp cmd.exe no specs tapinstall.exe no specs cmd.exe no specs tapinstall.exe drvinst.exe vssvc.exe no specs inlogbrowser_74449.exe inlogbrowser_74449.tmp cmd.exe no specs expand.exe cmd.exe no specs reg.exe svrwebui.exe cmd.exe no specs vdi_compiler.exe no specs iexplore.exe iexplore.exe drvinst.exe wcinstaller.exe no specs webcompanioninstaller.exe surveya.exe mask_svc.exe no specs mask_svc.exe no specs mask_svc.exe sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs netsh.exe no specs webcompanion.exe lavasoft.wcassistant.winservice.exe cmd.exe no specs netsh.exe no specs csc.exe no specs cvtres.exe no specs csc.exe no specs cvtres.exe no specs webcompanion.exe presentationfontcache.exe no specs csc.exe cvtres.exe no specs maskvpnupdate.exe poinstaller.exe #OSSPROXY pmropn.exe netsh.exe no specs pmservice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
272"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe" __IRAOFF:1796642 "__IRAFN:C:\Users\admin\AppData\Local\Temp\Setup_8854.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1302019708-1500728564-335382590-1000"C:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.exe
Setup_8854.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
9.5.1.0
Modules
Images
c:\users\admin\appdata\local\temp\_ir_sf_temp_1\irsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
324"sc.exe" failure WCAssistantService reset= 30 actions= restart/60000C:\Windows\system32\sc.exe—WebCompanionInstaller.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
340.\WebCompanionInstaller.exe --partner=AE190201 --campaign=494 --version=7.0.2417.4248 --prod --silent --partner=AE190201 --homepage=1 --search=1 --campaign=494C:\Users\admin\AppData\Local\Temp\7zS039B47E7\WebCompanionInstaller.exe
WcInstaller.exe
User:
admin
Company:
Lavasoft
Integrity Level:
HIGH
Description:
Web Companion
Exit code:
0
Version:
7.0.2417.4248
Modules
Images
c:\users\admin\appdata\local\temp\7zs039b47e7\webcompanioninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
360C:\Windows\system32\cmd.exe /c ""C:\Program Files\MaskVPN\driver\win732\uninstall.bat" "C:\Windows\system32\cmd.exe—maskvpn.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
384C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Windows\TEMP\RES5D91.tmp" "c:\Windows\Temp\CSC5D90.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
544"C:\Program Files\Internet Explorer\iexplore.exe" http://dariasdoors.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq&cid=74449&param=534C:\Program Files\Internet Explorer\iexplore.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
856"C:\Users\admin\AppData\Local\Temp\installerapp.exe" /qn CAMPAIGN="1981"C:\Users\admin\AppData\Local\Temp\installerapp.exe
irsetup.exe
User:
admin
Company:
AW Manager
Integrity Level:
HIGH
Description:
Windows Manager Installer
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\installerapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
1088"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\acgvi4j_.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe—WebCompanion.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1128"C:\Program Files\MaskVPN\mask_svc.exe" uninstallC:\Program Files\MaskVPN\mask_svc.exe—maskvpn.tmp
User:
admin
Company:
Global Media (Thailand) Co., Ltd
Integrity Level:
HIGH
Description:
MaskVPN Service
Exit code:
0
Version:
1.1.0.12
Modules
Images
c:\program files\maskvpn\mask_svc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winmm.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ws2_32.dll
1164tapinstall.exe remove tap0901C:\Program Files\MaskVPN\driver\win732\tapinstall.exe—cmd.exe
User:
admin
Company:
Windows (R) Win 7 DDK provider
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
6.1.7600.16385 built by: WinDDK
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\maskvpn\driver\win732\tapinstall.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
Total events
102 145
Read events
100 509
Write events
1 550
Delete events
86

Modification events

(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2052) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Setup.zip
(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
208
Suspicious files
73
Text files
214
Unknown types
38

Dropped files

PID
Process
Filename
Type
2052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2052.40790\data.dat —
MD5:—
SHA256:—
2052WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2052.40790\Setup.exeexecutable
MD5:—
SHA256:—
2088irsetup.exeC:\Users\admin\AppData\Local\Temp\Setup_8854.exeexecutable
MD5:—
SHA256:—
2088irsetup.exeC:\Users\admin\AppData\Local\Temp\data.datbinary
MD5:—
SHA256:—
2088irsetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_8AF12CCCEA7B166E05AA3A3A6D2A2BA3binary
MD5:—
SHA256:—
2088irsetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2088irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.datbinary
MD5:—
SHA256:—
272irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_1\irsetup.datbinary
MD5:—
SHA256:—
2088irsetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Eder
MD5:—
SHA256:—
2088irsetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
81
TCP/UDP connections
141
DNS requests
57
Threats
26

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3672
iexplore.exe
GET
301
185.102.136.153:80
http://dariasdoors.xyz/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq&cid=74449&param=534
RU
—
—
suspicious
272
irsetup.exe
GET
200
13.225.84.66:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
der
1.70 Kb
whitelisted
2088
irsetup.exe
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRyyuDOSqb8BtprWZSAvBT9kFoYdwQU%2BftQxItnu2dk%2FoMhpqnOP1WEk5kCEQDdVs2lraG7N4ogwDjWaBIG
US
der
472 b
whitelisted
272
irsetup.exe
GET
200
46.101.214.246:80
http://www.findmemolite.com/installer.exe
DE
executable
3.45 Mb
whitelisted
272
irsetup.exe
GET
200
5.182.39.129:80
http://inlgfiles.com/windows/storage/IBInstaller_74449.exe
unknown
executable
11.5 Mb
suspicious
3040
svrwebui.exe
POST
200
5.252.179.5:1203
http://5.252.179.5/fakeurl.htm
unknown
binary
160 b
suspicious
3040
svrwebui.exe
GET
200
62.172.138.35:80
http://geo.netsupportsoftware.com/location/loca.asp
GB
text
16 b
suspicious
272
irsetup.exe
GET
200
143.204.101.124:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
der
1.51 Kb
whitelisted
3040
svrwebui.exe
POST
200
5.252.179.5:1203
http://5.252.179.5/fakeurl.htm
unknown
binary
61 b
suspicious
272
irsetup.exe
GET
200
143.204.101.42:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwZ%2FlFeFh%2Bisd96yUzJbvJmLVg0%3D
US
der
1.39 Kb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2088
irsetup.exe
23.55.58.106:80
ctldl.windowsupdate.com
Akamai International B.V.
NL
unknown
272
irsetup.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
2088
irsetup.exe
151.139.128.14:80
ocsp.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
272
irsetup.exe
46.101.214.246:80
www.findmemolite.com
Digital Ocean, Inc.
DE
suspicious
272
irsetup.exe
52.84.193.75:443
duzlwewk2uk96.cloudfront.net
Amazon.com, Inc.
US
unknown
272
irsetup.exe
13.225.84.66:80
o.ss2.us
—
US
suspicious
2088
irsetup.exe
23.109.93.100:443
filedn.com
—
NL
unknown
272
irsetup.exe
143.204.101.124:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
272
irsetup.exe
143.204.101.42:80
ocsp.rootg2.amazontrust.com
—
US
whitelisted
3844
MsiExec.exe
54.226.29.2:443
collect.installeranalytics.com
Amazon.com, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
filedn.com
  • 23.109.93.100
suspicious
ctldl.windowsupdate.com
  • 23.55.58.106
  • 2.17.115.18
whitelisted
ocsp.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ip-api.com
  • 208.95.112.1
malicious
www.findmemolite.com
  • 46.101.214.246
whitelisted
duzlwewk2uk96.cloudfront.net
  • 52.84.193.75
  • 52.84.193.146
  • 52.84.193.109
  • 52.84.193.105
whitelisted
o.ss2.us
  • 13.225.84.66
  • 13.225.84.42
  • 13.225.84.68
  • 13.225.84.97
whitelisted
ocsp.rootg2.amazontrust.com
  • 143.204.101.124
  • 143.204.101.42
  • 143.204.101.190
  • 143.204.101.74
whitelisted
ocsp.rootca1.amazontrust.com
  • 143.204.101.42
  • 143.204.101.74
  • 143.204.101.190
  • 143.204.101.124
shared

Threats

PID
Process
Class
Message
272
irsetup.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
272
irsetup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
272
irsetup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
272
irsetup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
272
irsetup.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3672
iexplore.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
272
irsetup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
272
irsetup.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3952
pmropn.exe
Potential Corporate Privacy Violation
ET INFO Suspected PUP/PUA User-Agent (OSSProxy)
3952
pmropn.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
15 ETPRO signatures available at the full report
Process
Message
WebCompanionInstaller.exe
Detecting windows culture
WebCompanionInstaller.exe
7/14/2021 1:47:04 AM :-> Starting installer 7.0.2417.4248 with: .\WebCompanionInstaller.exe --partner=AE190201 --campaign=494 --version=7.0.2417.4248 --prod --silent --partner=AE190201 --homepage=1 --search=1 --campaign=494, Run as admin: True
WebCompanionInstaller.exe
Preparing for installing Web Companion
WebCompanionInstaller.exe
7/14/2021 1:47:05 AM :-> Generating Machine and Install Id ...
WebCompanionInstaller.exe
7/14/2021 1:47:05 AM :-> Machine Id and Install Id has been generated
WebCompanionInstaller.exe
7/14/2021 1:47:05 AM :-> Checking prerequisites ...
WebCompanionInstaller.exe
7/14/2021 1:47:05 AM :-> Antivirus not detected
WebCompanionInstaller.exe
7/14/2021 1:47:06 AM :-> vm_check False
WebCompanionInstaller.exe
7/14/2021 1:47:06 AM :-> reg_check :False
WebCompanionInstaller.exe
7/14/2021 1:47:06 AM :-> Installed .Net framework is V40
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup.zip