URL:

https://download.filezilla-project.org/client/FileZilla_3.66.5_win64_sponsored2-setup.exe

Full analysis: https://app.any.run/tasks/3b50b360-6135-4bde-9f5a-4199d3b88c9f
Verdict: Malicious activity
Analysis date: February 12, 2024, 16:45:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

069670C93F460AB45BB9EC089DD508D7

SHA1:

0B039E37FF8DCB2C00CDA4BDD775CB80C1601D6B

SHA256:

E324510081EA2B0B9E63520874983E3EB2EE1055FC2B00B41093FF1480D5F934

SSDEEP:

3:N8SElQw0EIVEjR+XKdpJEpjXLd6Wg5kXr0QaA:2SKHJRhKNXnOekA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2644)
      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2244)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2644)
      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2244)

    • Executable content was dropped or overwritten

      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2644)
      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2244)

    • Application launched itself

      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2644)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2244)
      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2644)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3864)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3952)
      • iexplore.exe (PID: 3864)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3864)

    • Reads the computer name

      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2644)
      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2244)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3952)
      • iexplore.exe (PID: 3864)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3864)

    • Create files in a temporary directory

      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2244)
      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2644)

    • Checks supported languages

      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2644)
      • FileZilla_3.66.5_win64_sponsored2-setup (1).exe (PID: 2244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe filezilla_3.66.5_win64_sponsored2-setup (1).exe filezilla_3.66.5_win64_sponsored2-setup (1).exe

Process information

PID
CMD
Path
Indicators
Parent process
2244"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\FileZilla_3.66.5_win64_sponsored2-setup (1).exe" /UAC:2301AC /NCRC C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\FileZilla_3.66.5_win64_sponsored2-setup (1).exe
FileZilla_3.66.5_win64_sponsored2-setup (1).exe
User:
admin
Company:
Tim Kosse
Integrity Level:
HIGH
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.66.5
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\78rfyb7z\filezilla_3.66.5_win64_sponsored2-setup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2644"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\FileZilla_3.66.5_win64_sponsored2-setup (1).exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\FileZilla_3.66.5_win64_sponsored2-setup (1).exe
iexplore.exe
User:
admin
Company:
Tim Kosse
Integrity Level:
MEDIUM
Description:
FileZilla FTP Client
Exit code:
0
Version:
3.66.5
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\78rfyb7z\filezilla_3.66.5_win64_sponsored2-setup (1).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3864"C:\Program Files\Internet Explorer\iexplore.exe" "https://download.filezilla-project.org/client/FileZilla_3.66.5_win64_sponsored2-setup.exe"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3952"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3864 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
30 670
Read events
30 401
Write events
144
Delete events
125

Modification events

(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31088082
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
182150182
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31088083
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3864) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
10
Suspicious files
10
Text files
16
Unknown types
5

Dropped files

PID
Process
Filename
Type
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:47A0B5EBA9D81FD4B10385DAF27CFBB8
SHA256:15E8D4BEE3EEC6A40C77D98CAD587E59748CD6E2AC4E57392E76F1BD6EE5194D
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:CA82A10DC56354A0BC1FA63198493F50
SHA256:B8B17843F1A565DCA86CF91846990DDBA078EAD795D6A20E673A991420CF0569
3864iexplore.exeC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:32418AAD6A59377813B0DCA5B0B79EDB
SHA256:D9E699252C740D93344BCC332D739B13FB6B5261F3430ACB75D5E19ED7638D06
3864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:5E4032E14AB550065B8A6EDEABF10674
SHA256:79DF5464B92EFB7ABAAC5447F34755CEA082FF2CD4FB3A9FD853178C093A1292
3864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:81720B6988E4B066DCB989F7E1F463F3
SHA256:95F17776DB2FA1B716ED079BD82378BA0830357E162D1113084FB3CEEC31CF84
3864iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
3952iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
3864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:18C9F560FAEF02B66C49E7F4EF328123
SHA256:51B571B7CEB68E649DB9790604DCF28B04FEF1F55F786CEE1FBBFED598A25588
3864iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
34
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3952
iexplore.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5b0325f31ae0f9b6
unknown
—
—
unknown
3952
iexplore.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?927e0d673a39dd41
unknown
—
—
unknown
3864
iexplore.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bdc5ae628aaf0bd4
unknown
—
—
unknown
3864
iexplore.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?18014fff35250a83
unknown
—
—
unknown
3952
iexplore.exe
GET
200
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0302b3af7cdfdbed
unknown
compressed
65.2 Kb
unknown
1080
svchost.exe
GET
304
184.24.77.202:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6776476d79efed94
unknown
—
—
unknown
3952
iexplore.exe
GET
200
72.246.169.163:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
3864
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3952
iexplore.exe
49.12.121.47:443
download.filezilla-project.org
Hetzner Online GmbH
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
3952
iexplore.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3864
iexplore.exe
92.122.215.57:443
www.bing.com
Akamai International B.V.
DE
unknown
3864
iexplore.exe
184.24.77.202:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3952
iexplore.exe
72.246.169.163:80
x1.c.lencr.org
AKAMAI-AS
DE
unknown
3864
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3864
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
download.filezilla-project.org
  • 49.12.121.47
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.202
  • 184.24.77.194
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 92.122.215.56
  • 92.122.215.57
  • 92.122.215.55
  • 92.122.215.72
  • 92.122.215.58
  • 92.122.215.74
  • 92.122.215.65
  • 92.122.215.98
  • 92.122.215.95
whitelisted
x1.c.lencr.org
  • 72.246.169.163
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.filezilla-project.org/client/FileZilla_3.66.5_win64_sponsored2-setup.exe