analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
download:

ccsetup555.exe

Full analysis: https://app.any.run/tasks/e77d3c3a-1185-4594-b19d-5eb4f1b009d4
Verdict: Malicious activity
Analysis date: March 22, 2019, 07:13:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

91A978D95DD4323843DFE96586A0E506

SHA1:

BAFEDC2E383F4DDB222F9CE0C84CB012F7C9EE16

SHA256:

EA2B0FE19ACC526F8C634FE933F63B7F2A1911A27A74DC2D87A5EA6AC4A8F2B3

SSDEEP:

393216:tEZ1NtyS3zA+ljWgmEQEOsP+DkiR7887A+7vwOt+aYf91KOVK+G+:tEX9RmEb2f7A+Ftsf9/Vu+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • ccsetup555.exe (PID: 3584)

    • Changes settings of System certificates

      • ccsetup555.exe (PID: 3584)

  • SUSPICIOUS

    • Low-level read access rights to disk partition

      • ccsetup555.exe (PID: 3584)

    • Reads Internet Cache Settings

      • ccsetup555.exe (PID: 3584)

    • Reads internet explorer settings

      • ccsetup555.exe (PID: 3584)

    • Adds / modifies Windows certificates

      • ccsetup555.exe (PID: 3584)

    • Executable content was dropped or overwritten

      • ccsetup555.exe (PID: 3584)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

ProductName: CCleaner
LegalCopyright: Copyright © 2005-2019 Piriform Software Ltd
FileVersion: 5.55.0.7108
FileDescription: CCleaner Installer
CompanyName: Piriform Software Ltd
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 5.55.0.7108
FileVersionNumber: 5.55.0.7108
Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: 6
OSVersion: 5
EntryPoint: 0x3a1c
UninitializedDataSize: 16896
InitializedDataSize: 48128
CodeSize: 29696
LinkerVersion: 9
PEType: PE32
TimeStamp: 2015:12:29 22:34:49+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 29-Dec-2015 21:34:49
Detected languages:
  • English - United States
CompanyName: Piriform Software Ltd
FileDescription: CCleaner Installer
FileVersion: 5.55.0.7108
LegalCopyright: Copyright © 2005-2019 Piriform Software Ltd
ProductName: CCleaner

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 29-Dec-2015 21:34:49
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00007250
0x00007400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.46491
.rdata
0x00009000
0x00002B38
0x00002C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.41939
.data
0x0000C000
0x00067EDC
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
1.89689
.ndata
0x00074000
0x003A1000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00415000
0x00008D58
0x00008E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.9574

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.27868
1212
Latin 1 / Western European
English - United States
RT_MANIFEST
2
5.62687
4264
Latin 1 / Western European
English - United States
RT_ICON
3
4.7389
2216
Latin 1 / Western European
English - United States
RT_ICON
4
3.91559
1384
Latin 1 / Western European
English - United States
RT_ICON
5
5.97397
1128
Latin 1 / Western European
English - United States
RT_ICON
6
3.89369
744
Latin 1 / Western European
English - United States
RT_ICON
103
2.72033
90
Latin 1 / Western European
English - United States
RT_GROUP_ICON
105
2.704
688
Latin 1 / Western European
English - United States
RT_DIALOG
106
2.92897
344
Latin 1 / Western European
English - United States
RT_DIALOG
107
2.52183
160
Latin 1 / Western European
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start ccsetup555.exe no specs ccsetup555.exe

Process information

PID
CMD
Path
Indicators
Parent process
2432"C:\Users\admin\AppData\Local\Temp\ccsetup555.exe" C:\Users\admin\AppData\Local\Temp\ccsetup555.exe—explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
MEDIUM
Description:
CCleaner Installer
Exit code:
3221226540
Version:
5.55.0.7108
3584"C:\Users\admin\AppData\Local\Temp\ccsetup555.exe" C:\Users\admin\AppData\Local\Temp\ccsetup555.exe
explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner Installer
Version:
5.55.0.7108
Total events
454
Read events
428
Write events
23
Delete events
3

Modification events

(PID) Process:(3584) ccsetup555.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\CCleaner
Operation:delete valueName:GUID
Value:
00000000-0000-4000-8000-d6f7f2be5127
(PID) Process:(3584) ccsetup555.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3584) ccsetup555.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
Operation:writeName:Blob
Value:
0F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE09000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030353000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C01400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB5748501D00000001000000100000005B3B67000EEB80022E42605B6B3B72400B000000010000000E000000740068006100770074006500000003000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B812000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68
(PID) Process:(3584) ccsetup555.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81
Operation:writeName:Blob
Value:
190000000100000010000000DC73F9B71E16D51D26527D32B11A6A3D03000000010000001400000091C6D6EE3E8AC86384E548C299295C756C817B810B000000010000000E00000074006800610077007400650000001D00000001000000100000005B3B67000EEB80022E42605B6B3B72401400000001000000140000007B5B45CFAFCECB7AFD31921A6AB6F346EB57485053000000010000002500000030233021060B6086480186F8450107300130123010060A2B0601040182373C0101030200C009000000010000002A000000302806082B0601050507030106082B0601050507030206082B0601050507030406082B060105050703030F000000010000001400000085FEF11B4F47FE3952F98301C9F98976FEFEE0CE2000000001000000240400003082042030820308A0030201020210344ED55720D5EDEC49F42FCE37DB2B6D300D06092A864886F70D01010505003081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F74204341301E170D3036313131373030303030305A170D3336303731363233353935395A3081A9310B300906035504061302555331153013060355040A130C7468617774652C20496E632E31283026060355040B131F43657274696669636174696F6E205365727669636573204469766973696F6E31383036060355040B132F2863292032303036207468617774652C20496E632E202D20466F7220617574686F72697A656420757365206F6E6C79311F301D06035504031316746861777465205072696D61727920526F6F7420434130820122300D06092A864886F70D01010105000382010F003082010A0282010100ACA0F0FB8059D49CC7A4CF9DA159730910450C0D2C6E68F16C5B4868495937FC0B3319C2777FCC102D95341CE6EB4D09A71CD2B8C9973602B789D4245F06C0CC4494948D02626FEB5ADD118D289A5C8490107A0DBD74662F6A38A0E2D55444EB1D079F07BA6FEEE9FD4E0B29F53E84A001F19CABF81C7E89A4E8A1D871650DA3517BEEBCD222600DB95B9DDFBAFC515B0BAF98B2E92EE904E86287DE2BC8D74EC14C641EDDCF8758BA4A4FCA68071D1C9D4AC6D52F91CC7C71721CC5C067EB32FDC9925C94DA85C09BBF537D2B09F48C9D911F976A52CBDE0936A477D87B875044D53E6E2969FB3949261E09A5807B402DEBE82785C9FE61FD7EE67C971DD59D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E041604147B5B45CFAFCECB7AFD31921A6AB6F346EB574850300D06092A864886F70D010105050003820101007911C04BB391B6FCF0E967D40D6E45BE55E893D2CE033FEDDA25B01D57CB1E3A76A04CEC5076E864720CA4A9F1B88BD6D68784BB32E54111C077D9B3609DEB1BD5D16E4444A9A601EC55621D77B85C8E48497C9C3B5711ACAD73378E2F785C906847D96060E6FC073D222017C4F716E9C4D872F9C8737CDF162F15A93EFD6A27B6A1EB5ABA981FD5E34D640A9D13C861BAF5391C87BAB8BD7B227FF6FEAC4079E5AC106F3D8F1B79768BC437B3211884E53600EB632099B9E9FE3304BB41C8C102F94463209E81CE42D3D63F2C76D3639C59DD8FA6E10EA02E41F72E9547CFBCFD33F3F60B617E7E912B8147C22730EEA7105D378F5C392BE404F07B8D568C68
(PID) Process:(3584) ccsetup555.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Toolbar
Operation:writeName:test
Value:
test
(PID) Process:(3584) ccsetup555.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Toolbar
Operation:delete valueName:test
Value:
test
(PID) Process:(3584) ccsetup555.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Google Toolbar
Operation:delete keyName:
Value:
(PID) Process:(3584) ccsetup555.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3584) ccsetup555.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3584) ccsetup555.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012019032220190323
Operation:writeName:CachePath
Value:
%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019032220190323
Executable files
64
Suspicious files
0
Text files
42
Unknown types
2

Dropped files

PID
Process
Filename
Type
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\p\pfBL.dllexecutable
MD5:D5CDEF7E02CCB2BF3471C9B01C53613C
SHA256:28016C3B6D6E8D67E6A6B77D7DA0F8C708FC3326AD5A6538F7E57E82F63005A8
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1032.htmlhtml
MD5:476E0798D7B4DBA63F7C005C206054C6
SHA256:381E1C7B12A1A57ACAC15AB098524B8280F4E72BFF35C8DA6E12543EF04E40AF
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1036.htmlhtml
MD5:CE1D077B7D02E861A5402CB91173F823
SHA256:3AF4DDD4CA97D12388974EA242EAA2A96926931F9B31CB47E6242337D67F5946
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1037.htmlhtml
MD5:EE42106F17419521F9ACE2B4B0CB85DC
SHA256:89F6375C0BB29BBDB3D3B71A4F51A225213F6B6B986787D4C0C8DC551D912B58
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1026.htmlhtml
MD5:CB0100874F54422FB725217B1D236286
SHA256:01348B374C395F1BC39A22BEE0420C55C6E04A132E1585A4D1611D79FA72C539
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1030.htmlhtml
MD5:A89B0AEF38FE342C61A9A279FD5CD353
SHA256:DA764054C0D91A5C211CAEADAF53554ECA739BAC4B3569401832EE69A05BB9B0
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1038.htmlhtml
MD5:9634C48CFDA7288AD4B8D396D868B5EF
SHA256:3B0DEBFB1B4BAE3853FEA4B1690542DAE11DFD339597222641DC012170704749
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1035.htmlhtml
MD5:F41A8621EB9602A2FACE60F8D5C6D245
SHA256:4434E64C7FF8D9802ACC036582FA32CE3750D6F4077DB270980976105A89F778
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1034.htmlhtml
MD5:37D69003A7618805ED371E1860E2C5BF
SHA256:A628568EBE42DC85EB67C4768DF3B595C5D38DA9F436CE7BCC04DA74C4665C8A
3584ccsetup555.exeC:\Users\admin\AppData\Local\Temp\nsz34EF.tmp\g\gtb\toolbar_1028.htmlhtml
MD5:9AF281EB46C48A0C2799920B0BC311A2
SHA256:EEB623E4D2B83FC754147F78E45F5CF4A602B6D3FDA2DC96998407C374FAA63E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3584
ccsetup555.exe
5.62.40.204:443
analytics.ff.avast.com
AVAST Software s.r.o.
DE
malicious

DNS requests

Domain
IP
Reputation
analytics.ff.avast.com
  • 5.62.40.204
  • 77.234.45.53
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ccsetup555.exe