File name:

WhaleSetupBeta.exe

Full analysis: https://app.any.run/tasks/14475e7e-7952-45c5-b444-2d0b32e2051c
Verdict: Malicious activity
Analysis date: December 26, 2023, 18:04:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5574DCD841A89FE208BCCFD1EBB9D1A8

SHA1:

A91DA5E64B5E9A853D9A44DFA430C37898AD2A02

SHA256:

E63DAE17F846C0D49FAB4F51C4A083E121C43B38B9179E52CB1DD95BA4AED574

SSDEEP:

98304:ZQe0s/qMUw3Onx+Yxx8GkwKeTxt7v3hyFvjF6aU2nE6JgWjlzj7unvArFiygVYhs:y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • wusvc.exe (PID: 2112)

    • Uses Task Scheduler to autorun other applications

      • wusvc.exe (PID: 2112)

    • Actions looks like stealing of personal data

      • whale.exe (PID: 3156)

    • Steals credentials from Web Browsers

      • whale.exe (PID: 3156)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • WhaleSetup.exe (PID: 492)

    • Reads Internet Explorer settings

      • WhaleSetup.exe (PID: 492)

    • Reads security settings of Internet Explorer

      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 996)

    • Reads settings of System Certificates

      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 996)
      • whale.exe (PID: 3156)

    • Checks Windows Trust Settings

      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 996)

    • Reads the Internet Settings

      • WhaleSetupBeta.exe (PID: 2408)
      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 996)
      • whale.exe (PID: 3156)

    • Reads Mozilla Firefox installation path

      • whale.exe (PID: 3156)

  • INFO

    • Drops the executable file immediately after the start

      • WhaleSetupBeta.exe (PID: 2408)
      • install1.exe (PID: 2592)
      • setup.exe (PID: 996)

    • Creates files or folders in the user directory

      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 2588)
      • setup.exe (PID: 996)
      • whale.exe (PID: 3156)
      • whale.exe (PID: 3188)

    • Reads the machine GUID from the registry

      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 996)
      • setup.exe (PID: 2588)
      • whale.exe (PID: 3156)
      • elevation_service.exe (PID: 3420)
      • chrmstp.exe (PID: 2372)
      • whale.exe (PID: 2876)
      • whale.exe (PID: 3952)
      • whale.exe (PID: 2644)
      • whale.exe (PID: 2800)

    • Create files in a temporary directory

      • WhaleSetup.exe (PID: 492)
      • install1.exe (PID: 2592)
      • WhaleSetupBeta.exe (PID: 2408)
      • whale.exe (PID: 3156)

    • Reads the computer name

      • install1.exe (PID: 2592)
      • WhaleSetupBeta.exe (PID: 2408)
      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 996)
      • setup.exe (PID: 2588)
      • wusvc.exe (PID: 2112)
      • whale.exe (PID: 3156)
      • whale.exe (PID: 604)
      • whale.exe (PID: 3188)
      • elevation_service.exe (PID: 3420)
      • whale.exe (PID: 1776)
      • chrmstp.exe (PID: 2896)
      • chrmstp.exe (PID: 2372)
      • whale.exe (PID: 2876)
      • whale.exe (PID: 3952)
      • whale.exe (PID: 2644)
      • whale.exe (PID: 2800)

    • Checks supported languages

      • install1.exe (PID: 2592)
      • WhaleSetupBeta.exe (PID: 2408)
      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 996)
      • setup.exe (PID: 1384)
      • setup.exe (PID: 2588)
      • setup.exe (PID: 552)
      • wusvc.exe (PID: 2112)
      • whale.exe (PID: 2824)
      • whale.exe (PID: 3156)
      • whale.exe (PID: 3012)
      • whale.exe (PID: 3188)
      • whale.exe (PID: 604)
      • whale.exe (PID: 3204)
      • whale.exe (PID: 3292)
      • whale.exe (PID: 3352)
      • whale.exe (PID: 3356)
      • elevation_service.exe (PID: 3420)
      • whale.exe (PID: 3636)
      • whale.exe (PID: 3532)
      • whale.exe (PID: 1776)
      • whale.exe (PID: 1056)
      • whale.exe (PID: 2072)
      • whale.exe (PID: 2480)
      • whale.exe (PID: 956)
      • whale.exe (PID: 1808)
      • whale.exe (PID: 1792)
      • whale.exe (PID: 3824)
      • whale.exe (PID: 4068)
      • whale.exe (PID: 3488)
      • whale.exe (PID: 3988)
      • whale.exe (PID: 3552)
      • whale.exe (PID: 3616)
      • whale.exe (PID: 2096)
      • whale.exe (PID: 3432)
      • whale.exe (PID: 3924)
      • whale.exe (PID: 2692)
      • whale.exe (PID: 2568)
      • whale.exe (PID: 1956)
      • whale.exe (PID: 2888)
      • whale.exe (PID: 1192)
      • whale.exe (PID: 2060)
      • chrmstp.exe (PID: 2896)
      • chrmstp.exe (PID: 2376)
      • chrmstp.exe (PID: 2372)
      • chrmstp.exe (PID: 2724)
      • whale.exe (PID: 3016)
      • whale.exe (PID: 2876)
      • whale.exe (PID: 1316)
      • whale.exe (PID: 1604)
      • whale.exe (PID: 532)
      • whale.exe (PID: 2564)
      • whale.exe (PID: 2940)
      • whale.exe (PID: 968)
      • whale.exe (PID: 1380)
      • whale.exe (PID: 296)
      • whale.exe (PID: 2340)
      • whale.exe (PID: 1736)
      • whale.exe (PID: 1728)
      • whale.exe (PID: 3952)
      • whale.exe (PID: 2644)
      • whale.exe (PID: 2156)
      • whale.exe (PID: 2800)
      • whale.exe (PID: 2900)

    • Checks proxy server information

      • WhaleSetup.exe (PID: 492)
      • setup.exe (PID: 996)

    • Application launched itself

      • setup.exe (PID: 996)
      • setup.exe (PID: 2588)
      • whale.exe (PID: 3156)
      • chrmstp.exe (PID: 2896)
      • chrmstp.exe (PID: 2372)

    • Creates files in the program directory

      • setup.exe (PID: 996)
      • setup.exe (PID: 2588)

    • Reads the Internet Settings

      • explorer.exe (PID: 3028)

    • Process checks computer location settings

      • whale.exe (PID: 3156)
      • whale.exe (PID: 3356)
      • whale.exe (PID: 3636)
      • whale.exe (PID: 3352)
      • whale.exe (PID: 3532)
      • whale.exe (PID: 3292)
      • whale.exe (PID: 2156)

    • Executes as Windows Service

      • elevation_service.exe (PID: 3420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (30.7)
.exe | UPX compressed Win32 Executable (30.1)
.exe | Win32 EXE Yoda's Crypter (29.5)
.exe | Win32 Executable (generic) (5)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:04:03 07:54:07+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 54784
InitializedDataSize: 2247680
UninitializedDataSize: -
EntryPoint: 0x253c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.2.0.0
ProductVersionNumber: 2.2.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Korean
CharacterSet: Unicode
CompanyName: Naver Corporation
FileDescription: Naver Whale Beta Installer
FileVersion: 2.2.0.0
InternalName: WhaleSetup.exe
LegalCopyright: Naver Corporation. All rights reserved.
OriginalFileName: WhaleSetup.exe
ProductName: Naver Whale Beta Installer
ProductVersion: 2.2.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
114
Monitored processes
69
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start whalesetupbeta.exe whalesetup.exe install1.exe no specs setup.exe setup.exe no specs setup.exe no specs setup.exe no specs wusvc.exe schtasks.exe no specs schtasks.exe no specs explorer.exe no specs explorer.exe no specs whale.exe no specs whale.exe whale.exe whale.exe no specs whale.exe whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs elevation_service.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs chrmstp.exe no specs whale.exe no specs whale.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whale.exe no specs whalesetupbeta.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5660 --field-trial-handle=1328,i,16741503011973261428,18068112652271907727,131072 /prefetch:8C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe—whale.exe
User:
admin
Company:
NAVER Corporation
Integrity Level:
LOW
Description:
Whale
Exit code:
0
Version:
3.18.154.13
Modules
Images
c:\program files\naver\naver whale beta\application\3.18.154.13\whale.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\naver\naver whale beta\application\3.18.154.13\whale_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
492"C:\Users\admin\AppData\Local\Temp\{392C3EDD-3456-45D4-9ECF-4E67D0745785}\WhaleSetup.exe" C:\Users\admin\AppData\Local\Temp\{392C3EDD-3456-45D4-9ECF-4E67D0745785}\WhaleSetup.exe
WhaleSetupBeta.exe
User:
admin
Company:
Naver Corporation
Integrity Level:
HIGH
Description:
Naver Whale Beta Installer
Exit code:
3221225547
Version:
2.2.0.0
Modules
Images
c:\users\admin\appdata\local\temp\{392c3edd-3456-45d4-9ecf-4e67d0745785}\whalesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
532"C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1328,i,16741503011973261428,18068112652271907727,131072 /prefetch:8C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe—whale.exe
User:
admin
Company:
NAVER Corporation
Integrity Level:
LOW
Description:
Whale
Exit code:
0
Version:
3.18.154.13
Modules
Images
c:\program files\naver\naver whale beta\application\3.18.154.13\whale.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\naver\naver whale beta\application\3.18.154.13\whale_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
552C:\Users\admin\AppData\Local\Temp\{3EC799E1-2EFE-42D9-BE94-B9E75CEB2B98}\CR_CE956.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://nelo2-col.navercorp.com:443/_store --annotation=channel=beta --annotation=clientid= --annotation=plat=Win32 --annotation=prod=Whale --annotation=ver=3.18.154.13 --initial-client-data=0x1ac,0x1b0,0x1b4,0x180,0x1b8,0x3b5468,0x3b5478,0x3b5484C:\Users\admin\AppData\Local\Temp\{3EC799E1-2EFE-42D9-BE94-B9E75CEB2B98}\CR_CE956.tmp\setup.exe—setup.exe
User:
admin
Company:
NAVER Corporation
Integrity Level:
HIGH
Description:
Whale Browser Installer
Exit code:
0
Version:
3.18.154.13
Modules
Images
c:\users\admin\appdata\local\temp\{3ec799e1-2efe-42d9-be94-b9e75ceb2b98}\cr_ce956.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\shell32.dll
604"C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 --field-trial-handle=1328,i,16741503011973261428,18068112652271907727,131072 /prefetch:2C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe—whale.exe
User:
admin
Company:
NAVER Corporation
Integrity Level:
LOW
Description:
Whale
Exit code:
0
Version:
3.18.154.13
Modules
Images
c:\program files\naver\naver whale beta\application\3.18.154.13\whale.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\naver\naver whale beta\application\3.18.154.13\whale_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
952"C:\Windows\explorer.exe" C:\Users\admin\AppData\Local\Temp\{3EC799E1-2EFE-42D9-BE94-B9E75CEB2B98}\first_run.lnkC:\Windows\explorer.exe—WhaleSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
956"C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3056 --field-trial-handle=1328,i,16741503011973261428,18068112652271907727,131072 /prefetch:8C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe—whale.exe
User:
admin
Company:
NAVER Corporation
Integrity Level:
LOW
Description:
Whale
Exit code:
0
Version:
3.18.154.13
Modules
Images
c:\program files\naver\naver whale beta\application\3.18.154.13\whale.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\naver\naver whale beta\application\3.18.154.13\whale_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
968"C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5648 --field-trial-handle=1328,i,16741503011973261428,18068112652271907727,131072 /prefetch:8C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe—whale.exe
User:
admin
Company:
NAVER Corporation
Integrity Level:
LOW
Description:
Whale
Exit code:
0
Version:
3.18.154.13
Modules
Images
c:\program files\naver\naver whale beta\application\3.18.154.13\whale.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\naver\naver whale beta\application\3.18.154.13\whale_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
996"C:\Users\admin\AppData\Local\Temp\{3EC799E1-2EFE-42D9-BE94-B9E75CEB2B98}\CR_CE956.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\{3EC799E1-2EFE-42D9-BE94-B9E75CEB2B98}\CR_CE956.tmp\WHALE.PACKED.7Z" --install --verbose-logging --chrome-betaC:\Users\admin\AppData\Local\Temp\{3EC799E1-2EFE-42D9-BE94-B9E75CEB2B98}\CR_CE956.tmp\setup.exe
install1.exe
User:
admin
Company:
NAVER Corporation
Integrity Level:
HIGH
Description:
Whale Browser Installer
Exit code:
0
Version:
3.18.154.13
Modules
Images
c:\users\admin\appdata\local\temp\{3ec799e1-2efe-42d9-be94-b9e75ceb2b98}\cr_ce956.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\shell32.dll
1056"C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3768 --field-trial-handle=1328,i,16741503011973261428,18068112652271907727,131072 /prefetch:8C:\Program Files\Naver\Naver Whale Beta\Application\3.18.154.13\whale.exe—whale.exe
User:
admin
Company:
NAVER Corporation
Integrity Level:
LOW
Description:
Whale
Exit code:
0
Version:
3.18.154.13
Modules
Images
c:\program files\naver\naver whale beta\application\3.18.154.13\whale.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\naver\naver whale beta\application\3.18.154.13\whale_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
Total events
23 481
Read events
23 317
Write events
163
Delete events
1

Modification events

(PID) Process:(2408) WhaleSetupBeta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2408) WhaleSetupBeta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2408) WhaleSetupBeta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2408) WhaleSetupBeta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(492) WhaleSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(492) WhaleSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(492) WhaleSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(492) WhaleSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(492) WhaleSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(492) WhaleSetup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
14
Suspicious files
232
Text files
195
Unknown types
0

Dropped files

PID
Process
Filename
Type
492WhaleSetup.exeC:\Users\admin\AppData\Local\Temp\{3EC799E1-2EFE-42D9-BE94-B9E75CEB2B98}\install1.exe —
MD5:—
SHA256:—
2408WhaleSetupBeta.exeC:\Users\admin\AppData\Local\Temp\{392C3EDD-3456-45D4-9ECF-4E67D0745785}\WhaleSetup.exeexecutable
MD5:324BA828E3B49C6CE8BF54BA5BAB9106
SHA256:655A2A9C99FC4735229CD19E18E29BBF8E50ADD4527973FEA97E6998596ED9BC
492WhaleSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4344B8AF97AF3A423D9EE52899963CDE_D8F72C791F8434481C8D9FCC9921D88Ebinary
MD5:77C676EBDFED0AC83E374A679BD70F46
SHA256:1ACF75BF3FD6F8A745C82037C8C78B93DA391E832F5E9926D0BCD5B75AB94788
492WhaleSetup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\installer_wave[1].gifimage
MD5:849255A52C0A759FB768BAB0CE07BF3D
SHA256:515B848F7C505C4F13135EFE2D1AFE3A5E8FABD0752015886836F6BFDC703108
2592install1.exeC:\Users\admin\AppData\Local\Temp\{3EC799E1-2EFE-42D9-BE94-B9E75CEB2B98}\CR_CE956.tmp\WHALE.PACKED.7Z —
MD5:—
SHA256:—
492WhaleSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_2543588302FC0B794CE8BD7EF1AD49CFbinary
MD5:6641373E37E0DD35188104F2F7F15F72
SHA256:F457A0193EA67B0F01DCE42A45F52801DD3E5892A3716BE67495F5BD021DDAE6
492WhaleSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:B931C451FDCD7F50E79D7483F532D66A
SHA256:509307E04B25F7FC25CC941070FD3BDFCCCC547EEFE5EBFDEF05EA04DAF65FA2
492WhaleSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:52C443AE8449ED225A1307D903AFB2D7
SHA256:7A80699E418354EBBEAC90EDA1DFBAF4A264FA39B7FEDC08D061A306B5C09F42
492WhaleSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:7C7B6FE91A2E398EDEA7719676347CAD
SHA256:3BD14F06AC7155650545EECA07C3C1767B117D6FD5E780D56D5ECD4CF6E90410
492WhaleSetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:E72712F868FE973458BC935B7501F248
SHA256:33AC6D088122CA9A273EA0C685F1FEEB89D222E0FC981F47D9A13A7E7E27DFC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
60
DNS requests
30
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
492
WhaleSetup.exe
GET
200
183.111.26.20:80
http://static.whale.naver.net/installer/installer_wave.gif
KR
image
687 Kb
unknown
492
WhaleSetup.exe
GET
200
183.111.26.20:80
http://static.whale.naver.net/installer/installer_logo.gif
KR
image
739 Kb
unknown
492
WhaleSetup.exe
GET
200
183.111.26.20:80
http://static.whale.naver.net/installer/installer_logo_loop.gif
KR
image
240 Kb
unknown
—
—
GET
200
184.24.77.174:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f1445f5c4ca66596
DE
compressed
4.66 Kb
unknown
492
WhaleSetup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEA8cICc7HjNCLWczgReJ3Vo%3D
US
binary
471 b
unknown
492
WhaleSetup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAc2N7ckVHzYR6z9KGYqXls%3D
US
binary
727 b
unknown
492
WhaleSetup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTjzY2p9Pa8oibmj%2BNSMWsz63kmWgQUuhbZbU2FL3MpdpovdYxqII%2BeyG8CEAxNaXJLlPo8Kko9KQeAPVo%3D
US
binary
727 b
unknown
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
US
binary
471 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?59639bb2975de3ae
GB
compressed
65.2 Kb
unknown
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/jw7bfnkdv467whgbszo2h4ksf4_8445/hfnkpimlhhgieaddgfemjhofmfblmnib_8445_all_ogi3rbsyg2hrrswarv3f2tjos4.crx3
US
binary
5.28 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
492
WhaleSetup.exe
183.111.26.20:80
static.whale.naver.net
Korea Telecom
KR
unknown
492
WhaleSetup.exe
125.209.226.155:443
beta-update.whale.naver.com
NAVER Cloud Corp.
KR
unknown
492
WhaleSetup.exe
184.24.77.174:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
492
WhaleSetup.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
492
WhaleSetup.exe
125.209.207.11:443
installer-whale.pstatic.net
NAVER Cloud Corp.
KR
unknown
996
setup.exe
210.89.168.78:443
wbs.naver.com
NAVER Cloud Corp.
KR
unknown
996
setup.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
static.whale.naver.net
  • 183.111.26.20
  • 211.47.29.87
  • 101.79.137.172
unknown
beta-update.whale.naver.com
  • 125.209.226.155
unknown
ctldl.windowsupdate.com
  • 184.24.77.174
  • 184.24.77.210
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
status.geotrust.com
  • 192.229.221.95
whitelisted
installer-whale.pstatic.net
  • 125.209.207.11
  • 125.209.207.38
  • 211.47.29.200
unknown
wbs.naver.com
  • 210.89.168.78
  • 210.89.168.53
unknown
nelo2-col.navercorp.com
  • 110.93.157.96
unknown
event.whale.naver.com
  • —
unknown
service.whale.naver.com
  • 125.209.234.187
unknown

Threats

No threats detected
Process
Message
whale.exe
[1226/180655.552:ERROR:crash_report_database_win.cc(614)] CreateDirectory C:\Users\admin\AppData\Local\Naver\Naver Whale Beta\User Data\Crashpad: The system cannot find the path specified. (0x3)
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WhaleSetupBeta.exe