File name:

AeroAdmin.exe

Full analysis: https://app.any.run/tasks/d915a5e6-2a6b-4601-a09e-2bba1e2e0d75
Verdict: Malicious activity
Analysis date: December 14, 2023, 19:49:25
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FA6AD2E8EEF98ABC0BBB252FF994A38D

SHA1:

B54CC9383C67A5C90F74E07D0A3203CC4DC1756C

SHA256:

EE54577067550559C4711C9E5E10435807F9DEEE9A5ADB4409CB60A6B0108700

SSDEEP:

49152:OxuXwMnQUnvoA4N1015+pTAg6NTkGCgOOxQTYywC8PSJzNBUkpijZMI9n3:xg2Qw4PCNT49eBGQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • AeroAdmin.exe (PID: 2860)

  • SUSPICIOUS

    • Reads the Internet Settings

      • AeroAdmin.exe (PID: 2464)

    • Executes as Windows Service

      • AeroAdmin.exe (PID: 2336)

    • Application launched itself

      • AeroAdmin.exe (PID: 2464)
      • AeroAdmin.exe (PID: 2336)

    • Checks Windows Trust Settings

      • AeroAdmin.exe (PID: 2860)

    • Connects to unusual port

      • AeroAdmin.exe (PID: 2860)

  • INFO

    • Reads the computer name

      • AeroAdmin.exe (PID: 2464)
      • AeroAdmin.exe (PID: 2336)
      • AeroAdmin.exe (PID: 2868)
      • wmpnscfg.exe (PID: 3680)
      • AeroAdmin.exe (PID: 2860)
      • wmpnscfg.exe (PID: 2896)

    • Checks supported languages

      • AeroAdmin.exe (PID: 2464)
      • AeroAdmin.exe (PID: 2336)
      • AeroAdmin.exe (PID: 2860)
      • AeroAdmin.exe (PID: 2868)
      • wmpnscfg.exe (PID: 3680)
      • wmpnscfg.exe (PID: 2896)

    • Creates files in the program directory

      • AeroAdmin.exe (PID: 2464)
      • AeroAdmin.exe (PID: 2336)
      • AeroAdmin.exe (PID: 2860)

    • Process checks computer location settings

      • AeroAdmin.exe (PID: 2860)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3680)
      • wmpnscfg.exe (PID: 2896)

    • Reads the machine GUID from the registry

      • AeroAdmin.exe (PID: 2860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:09:07 10:49:40+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.32
CodeSize: 1871872
InitializedDataSize: 1304576
UninitializedDataSize: -
EntryPoint: 0x184096
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 3.6.1.2
ProductVersionNumber: 4.9.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: AeroAdmin LLC
FileDescription: AeroAdmin
FileVersion: 3.6.1.2
InternalName: AeroAdmin.exe
LegalCopyright: AeroAdmin LLC
LegalTrademarks: AeroAdmin
OriginalFileName: AeroAdmin.exe
ProductName: AeroAdmin
ProductVersion: v4.9
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start aeroadmin.exe aeroadmin.exe aeroadmin.exe aeroadmin.exe wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2336"C:\Users\admin\Downloads\AeroAdmin.exe" s -sid 1 C:\Users\admin\Downloads\AeroAdmin.exe
services.exe
User:
SYSTEM
Company:
AeroAdmin LLC
Integrity Level:
SYSTEM
Description:
AeroAdmin
Exit code:
0
Version:
3.6.1.2
Modules
Images
c:\users\admin\downloads\aeroadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2464"C:\Users\admin\Downloads\AeroAdmin.exe" C:\Users\admin\Downloads\AeroAdmin.exe
explorer.exe
User:
admin
Company:
AeroAdmin LLC
Integrity Level:
MEDIUM
Description:
AeroAdmin
Exit code:
0
Version:
3.6.1.2
Modules
Images
c:\users\admin\downloads\aeroadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2860"C:\Users\admin\Downloads\AeroAdmin.exe" a -sid 1 C:\Users\admin\Downloads\AeroAdmin.exe
AeroAdmin.exe
User:
SYSTEM
Company:
AeroAdmin LLC
Integrity Level:
SYSTEM
Description:
AeroAdmin
Exit code:
0
Version:
3.6.1.2
Modules
Images
c:\users\admin\downloads\aeroadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2868"C:\Users\admin\Downloads\AeroAdmin.exe" z z C:\Users\admin\Downloads\AeroAdmin.exe
AeroAdmin.exe
User:
admin
Company:
AeroAdmin LLC
Integrity Level:
HIGH
Description:
AeroAdmin
Exit code:
0
Version:
3.6.1.2
Modules
Images
c:\users\admin\downloads\aeroadmin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2896"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3680"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
5 695
Read events
5 666
Write events
29
Delete events
0

Modification events

(PID) Process:(2464) AeroAdmin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2464) AeroAdmin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2464) AeroAdmin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2464) AeroAdmin.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2860) AeroAdmin.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2860) AeroAdmin.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2860) AeroAdmin.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2860) AeroAdmin.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000000900000009000000000000000000000000000000040000000000000000000000000000000000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2860) AeroAdmin.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2860) AeroAdmin.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
9
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2336AeroAdmin.exeC:\ProgramData\Aeroadmin\log.jsontext
MD5:64F3F052027D72E1286B8CAAB6B65202
SHA256:E2E8281F48DC224D3BDF53DE144FF13F242CA7BB233F6B71394BE6E1212A088A
2464AeroAdmin.exeC:\ProgramData\Aeroadmin\log.txttext
MD5:38B00EE7645796C316DDE1ABC5196985
SHA256:6C84242AD6C1D59D84BF797F378567C4420F42603F77CDA90B17D47637088964
2860AeroAdmin.exeC:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\build_number[1]text
MD5:B266519BF5A3CFFC52BE8833E07AF962
SHA256:092A1A2C444350CA665C63D737FB0058AD61036F37E8EBD894720D1421A9685F
2860AeroAdmin.exeC:\ProgramData\Aeroadmin\guid.binbinary
MD5:25FADA4FAABCE1E3A6DBF4DADA4A627A
SHA256:1E71DE4778F3AD5A6713E2087B8A3F0A19E127AAA9698B9EEA4AAA725979F5FB
2860AeroAdmin.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:84DE9CE604F4AB8AD2AE912BAC178021
SHA256:3F610CEAA3C19051B24D9A915B68DC21F9A74C8559670D3FD05B372B7FCD76AD
2860AeroAdmin.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:9282A6351FAEA4311B563E3941ECEB8D
SHA256:9AFBA22DE00AF217A2633085DF9D9724E4AAF62DDF57AA908FCF6E09375345C0
2860AeroAdmin.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464der
MD5:8202A1CD02E7D69597995CABBE881A12
SHA256:58F381C3A0A0ACE6321DA22E40BD44A597BD98B9C9390AB9258426B5CF75A7A5
2860AeroAdmin.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:3D6C184507B7EA8483115DF19BA3915A
SHA256:C382DE54DFEE2BD5F186E1E3F54A1F69DD9B15F36FC18532EBC2F1F94C676291
2860AeroAdmin.exeC:\ProgramData\Aeroadmin\settings.binbinary
MD5:B0B60BCEFFE59F43CAAC44AA55EB9FB4
SHA256:58901B95DD5B6FAA4A8A7BB96A0E3FEDED2385ED72B34F6CDDC71697F9913063
2860AeroAdmin.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3D03E5744C8B296489E7B80948EE57D0
SHA256:516A45C62DA2739C556B1C65CB7AA3D2D6F2763C421A58B9A17EFDE11BB15F05
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
8
DNS requests
4
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2860
AeroAdmin.exe
GET
200
23.53.40.35:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7cad2552c2a07960
unknown
compressed
4.66 Kb
unknown
2860
AeroAdmin.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
2860
AeroAdmin.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2860
AeroAdmin.exe
188.114.97.3:443
ulm.aeroadmin.com
CLOUDFLARENET
NL
unknown
2860
AeroAdmin.exe
89.40.115.70:5665
auth11.aeroadmin.com
Aruba SAS
FR
unknown
2860
AeroAdmin.exe
23.53.40.35:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2860
AeroAdmin.exe
172.217.18.99:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
ulm.aeroadmin.com
  • 188.114.97.3
  • 188.114.96.3
unknown
auth11.aeroadmin.com
  • 89.40.115.70
unknown
ctldl.windowsupdate.com
  • 23.53.40.35
whitelisted
ocsp.pki.goog
  • 172.217.18.99
whitelisted

Threats

PID
Process
Class
Message
2860
AeroAdmin.exe
Misc activity
ET POLICY PTsecurity Remote Desktop AeroAdmin Server Hello
2860
AeroAdmin.exe
Misc activity
ET POLICY PTsecurity Remote Desktop AeroAdmin handshake
Process
Message
AeroAdmin.exe
Info: [19:49:40 / AeroAdmin.cpp 1010] Start
AeroAdmin.exe
Info: [19:49:40 / AeroAdmin.cpp 1120] mode: 0
AeroAdmin.exe
20231214 19:49:40 [2464 / Service.cpp:735] RestartAsAdmin: z , res = 1
AeroAdmin.exe
20231214 19:49:40 [2868 / Service.cpp:597] !hService
AeroAdmin.exe
20231214 19:49:40 [2868 / Service.cpp:529] Installing service: "C:\Users\admin\Downloads\AeroAdmin.exe" s -sid 1
AeroAdmin.exe
Info: [19:49:40 / AeroAdmin.cpp 1010] Start
AeroAdmin.exe
20231214 19:49:40 [2336 / Service.cpp:384] server started
AeroAdmin.exe
Info: [19:49:40 / AeroAdmin.cpp 1010] Start
AeroAdmin.exe
20231214 19:49:40 [2336 / Service.cpp:319] ACTIVE: 1, 2163
AeroAdmin.exe
20231214 19:49:40 [2336 / Service.cpp:413] RUN APP
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AeroAdmin.exe