File name:

euc_win_2_00_025.exe

Full analysis: https://app.any.run/tasks/3dd6de03-c7bd-4898-96ed-8f2ebe3b6069
Verdict: Malicious activity
Analysis date: January 03, 2024, 21:01:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C148FED94CE37246B536BBCC64F11741

SHA1:

59335560CECF377387F0D59D4916B50CFE996DA0

SHA256:

F122D237705B1240C3E8E824ABBB110106C228D8DACB091280398C9DDB7B84C7

SSDEEP:

98304:5aeVqZfXZg+tApvzXkcPBQO3H84ibAESdnlYe/FOCVE97yK8w1n52WtMzdfU+k4G:tYmvA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 1316)

  • SUSPICIOUS

    • Reads the Internet Settings

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • mc2.exe (PID: 2560)

    • Drops a system driver (possible attempt to evade defenses)

      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)

    • Uses REG/REGEDIT.EXE to modify registry

      • euc_win_2_00_025.exe (PID: 548)

    • Creates files in the driver directory

      • drvinst.exe (PID: 1316)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 1316)

    • Reads Microsoft Outlook installation path

      • mc2.exe (PID: 2560)

    • Reads Internet Explorer settings

      • mc2.exe (PID: 2560)

  • INFO

    • Create files in a temporary directory

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)

    • Checks supported languages

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)
      • mc2.exe (PID: 2560)
      • mc2.exe (PID: 2468)
      • mc2.exe (PID: 148)

    • Reads the computer name

      • euc_win_2_00_025.exe (PID: 548)
      • euc_win_2_00_025.exe (PID: 116)
      • drvinst.exe (PID: 1316)
      • setusb32.exe (PID: 572)
      • mc2.exe (PID: 2560)
      • mc2.exe (PID: 2468)
      • mc2.exe (PID: 148)

    • Drops the executable file immediately after the start

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)

    • Application launched itself

      • euc_win_2_00_025.exe (PID: 116)

    • Creates files in the program directory

      • euc_win_2_00_025.exe (PID: 548)
      • mc2.exe (PID: 2468)
      • mc2.exe (PID: 148)

    • Checks proxy server information

      • euc_win_2_00_025.exe (PID: 548)
      • mc2.exe (PID: 2560)

    • Reads the machine GUID from the registry

      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)
      • mc2.exe (PID: 2560)

    • Creates files or folders in the user directory

      • mc2.exe (PID: 2560)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1576)
      • mc2.exe (PID: 148)

    • Starts itself from another location

      • euc_win_2_00_025.exe (PID: 548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:02:05 11:19:34+01:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 695808
InitializedDataSize: 329216
UninitializedDataSize: -
EntryPoint: 0x81020
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start euc_win_2_00_025.exe no specs euc_win_2_00_025.exe regedit.exe no specs setusb32.exe no specs drvinst.exe no specs vssvc.exe no specs mc2.exe no specs mc2.exe no specs mc2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\euc_win_2_00_025.exe" C:\Users\admin\AppData\Local\Temp\euc_win_2_00_025.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\euc_win_2_00_025.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
148"C:\Program Files\Eaton\UPSCompanion\mc2.exe"C:\Program Files\Eaton\UPSCompanion\mc2.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\eaton\upscompanion\mc2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
548"C:\Users\admin\AppData\Local\Temp\euc_win_2_00_025.exe" -runasC:\Users\admin\AppData\Local\Temp\euc_win_2_00_025.exe
euc_win_2_00_025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\euc_win_2_00_025.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
572bin\setusb32.exe -install bin\etn_libusb0.infC:\Program Files\Eaton\UPSCompanion\bin\setusb32.exe—euc_win_2_00_025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\eaton\upscompanion\bin\setusb32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1316DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{1e429df0-c19a-0029-83ce-d47ff09d421e}\etn_libusb0.inf" "0" "6a2a5eda3" "00000574" "WinSta0\Default" "00000338" "208" "C:\Program Files\Eaton\UPSCompanion\bin"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1576C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1588regedit.exe /s bin\etn_ca.regC:\Windows\regedit.exe—euc_win_2_00_025.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2468"C:\Program Files\Eaton\UPSCompanion\mc2.exe" -systrayC:\Program Files\Eaton\UPSCompanion\mc2.exe—euc_win_2_00_025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\eaton\upscompanion\mc2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2560"C:\Program Files\Eaton\UPSCompanion\mc2.exe" -openC:\Program Files\Eaton\UPSCompanion\mc2.exe—euc_win_2_00_025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\eaton\upscompanion\mc2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
6 656
Read events
6 583
Write events
73
Delete events
0

Modification events

(PID) Process:(116) euc_win_2_00_025.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) euc_win_2_00_025.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) euc_win_2_00_025.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) euc_win_2_00_025.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(572) setusb32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1316) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1316) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1316) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1316) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
73
(PID) Process:(1316) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008543C5D72FB0D90164030000840D0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
24
Suspicious files
30
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
116euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\install.logtext
MD5:E042BC3E57C0CD1BE47D40785B7AE2DE
SHA256:313B4AC46EA4D51F323FDE222B7B803CC89EED2A8FCA242C549FCFEE16EEE6FE
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\libusb0.sysexecutable
MD5:6918B62F73A2AA6AC5B01870C2EE4DD3
SHA256:39FD4912405F63D2DB1971FA8BF746F407635EDB1C5E3D2AE4D9CE97D46F5E1A
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\etn_libusb0.catbinary
MD5:876899EFC56E86912FEE64634E4BDE91
SHA256:7667B2571DC50264E05FC8C5425D0709111E68704062D748AC26D0444D804B83
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\musb.dllexecutable
MD5:AF6A4656DECAC129337E0AD0EABD10D0
SHA256:7771EB19766F74652D3ED6E9FD852BE87800355B2401D5B6DC6DC7AF9D1832ED
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\etn_ca.regtext
MD5:E29601F5CE38E7780AFCA1C13CE70F2D
SHA256:6B5B70608C03E8DE5A271533475946708949E68CCD01B36ED947466CBDDA0762
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\etn_libusb0_x64.catbinary
MD5:DC40F1C356DBDDFEE1E182114E3DB0B5
SHA256:2F0F636FB4EEE2399ACEBBFB516D160899C439A116D5C781FF78966458B33022
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\setusb32.exeexecutable
MD5:594B5A77F5A99448D57B6B227E1600B2
SHA256:05B3B080A38CF2FBB5B146B0F634054DB3FCF5FB60448312E221DFA5E0478436
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\setusb64.exeexecutable
MD5:341EF3CBF03559B829AAB87A269F90A9
SHA256:540C1F4404EBD4C1ABD85F79FC345E3FE92003528A4652EBDC2A1058EF93445E
548euc_win_2_00_025.exeC:\Program Files\Eaton\UPSCompanion\bin\libusb0.dllexecutable
MD5:535779909A40B42F4F3E48598F5778A5
SHA256:00CACA07869B19D10B370552AC7CC2F6F2EE246FC15DB11650F6CD3F4EF9B666
548euc_win_2_00_025.exeC:\Program Files\Eaton\UPSCompanion\bin\musb.dllexecutable
MD5:AF6A4656DECAC129337E0AD0EABD10D0
SHA256:7771EB19766F74652D3ED6E9FD852BE87800355B2401D5B6DC6DC7AF9D1832ED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown

DNS requests

Domain
IP
Reputation
pqsoftware.eaton.com
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
euc_win_2_00_025.exe