File name:

euc_win_2_00_025.exe

Full analysis: https://app.any.run/tasks/3dd6de03-c7bd-4898-96ed-8f2ebe3b6069
Verdict: Malicious activity
Analysis date: January 03, 2024, 21:01:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C148FED94CE37246B536BBCC64F11741

SHA1:

59335560CECF377387F0D59D4916B50CFE996DA0

SHA256:

F122D237705B1240C3E8E824ABBB110106C228D8DACB091280398C9DDB7B84C7

SSDEEP:

98304:5aeVqZfXZg+tApvzXkcPBQO3H84ibAESdnlYe/FOCVE97yK8w1n52WtMzdfU+k4G:tYmvA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 1316)

  • SUSPICIOUS

    • Reads the Internet Settings

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • mc2.exe (PID: 2560)

    • Drops a system driver (possible attempt to evade defenses)

      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)

    • Uses REG/REGEDIT.EXE to modify registry

      • euc_win_2_00_025.exe (PID: 548)

    • Checks Windows Trust Settings

      • drvinst.exe (PID: 1316)

    • Creates files in the driver directory

      • drvinst.exe (PID: 1316)

    • Reads Microsoft Outlook installation path

      • mc2.exe (PID: 2560)

    • Reads Internet Explorer settings

      • mc2.exe (PID: 2560)

  • INFO

    • Checks supported languages

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)
      • mc2.exe (PID: 2468)
      • mc2.exe (PID: 148)
      • mc2.exe (PID: 2560)

    • Drops the executable file immediately after the start

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)

    • Reads the computer name

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)
      • mc2.exe (PID: 2468)
      • mc2.exe (PID: 148)
      • mc2.exe (PID: 2560)

    • Application launched itself

      • euc_win_2_00_025.exe (PID: 116)

    • Create files in a temporary directory

      • euc_win_2_00_025.exe (PID: 116)
      • euc_win_2_00_025.exe (PID: 548)
      • setusb32.exe (PID: 572)

    • Checks proxy server information

      • euc_win_2_00_025.exe (PID: 548)
      • mc2.exe (PID: 2560)

    • Creates files in the program directory

      • euc_win_2_00_025.exe (PID: 548)
      • mc2.exe (PID: 2468)
      • mc2.exe (PID: 148)

    • Reads the machine GUID from the registry

      • setusb32.exe (PID: 572)
      • drvinst.exe (PID: 1316)
      • mc2.exe (PID: 2560)

    • Executes as Windows Service

      • VSSVC.exe (PID: 1576)
      • mc2.exe (PID: 148)

    • Starts itself from another location

      • euc_win_2_00_025.exe (PID: 548)

    • Creates files or folders in the user directory

      • mc2.exe (PID: 2560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:02:05 11:19:34+01:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 695808
InitializedDataSize: 329216
UninitializedDataSize: -
EntryPoint: 0x81020
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start euc_win_2_00_025.exe no specs euc_win_2_00_025.exe regedit.exe no specs setusb32.exe no specs drvinst.exe no specs vssvc.exe no specs mc2.exe no specs mc2.exe no specs mc2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\euc_win_2_00_025.exe" C:\Users\admin\AppData\Local\Temp\euc_win_2_00_025.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\euc_win_2_00_025.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
148"C:\Program Files\Eaton\UPSCompanion\mc2.exe"C:\Program Files\Eaton\UPSCompanion\mc2.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\program files\eaton\upscompanion\mc2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
548"C:\Users\admin\AppData\Local\Temp\euc_win_2_00_025.exe" -runasC:\Users\admin\AppData\Local\Temp\euc_win_2_00_025.exe
euc_win_2_00_025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\euc_win_2_00_025.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
572bin\setusb32.exe -install bin\etn_libusb0.infC:\Program Files\Eaton\UPSCompanion\bin\setusb32.exe—euc_win_2_00_025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\eaton\upscompanion\bin\setusb32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1316DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{1e429df0-c19a-0029-83ce-d47ff09d421e}\etn_libusb0.inf" "0" "6a2a5eda3" "00000574" "WinSta0\Default" "00000338" "208" "C:\Program Files\Eaton\UPSCompanion\bin"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1576C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1588regedit.exe /s bin\etn_ca.regC:\Windows\regedit.exe—euc_win_2_00_025.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2468"C:\Program Files\Eaton\UPSCompanion\mc2.exe" -systrayC:\Program Files\Eaton\UPSCompanion\mc2.exe—euc_win_2_00_025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\eaton\upscompanion\mc2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2560"C:\Program Files\Eaton\UPSCompanion\mc2.exe" -openC:\Program Files\Eaton\UPSCompanion\mc2.exe—euc_win_2_00_025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\eaton\upscompanion\mc2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
6 656
Read events
6 583
Write events
73
Delete events
0

Modification events

(PID) Process:(116) euc_win_2_00_025.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) euc_win_2_00_025.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) euc_win_2_00_025.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) euc_win_2_00_025.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(572) setusb32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1316) drvinst.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1316) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1316) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009F5A7BD72FB0D90164030000840D0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1316) drvinst.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
73
(PID) Process:(1316) drvinst.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
40000000000000008543C5D72FB0D90164030000840D0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
24
Suspicious files
30
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\msocket.dllexecutable
MD5:AD329BE27AB7F1D871712F8E506FEA8B
SHA256:D05C89E9FAA2984F7790DF6D72AAD942FDFAE78990FC35E4CDA4A3C4318595AB
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\etn_libusb0.infbinary
MD5:367962DC1995630775A466B67894D92F
SHA256:41B2D680763B8A0A9C2D76CB5B6FC6DAB044AF4A9D9BF1B2BAA8297B9C70A8C3
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\musb.dllexecutable
MD5:AF6A4656DECAC129337E0AD0EABD10D0
SHA256:7771EB19766F74652D3ED6E9FD852BE87800355B2401D5B6DC6DC7AF9D1832ED
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\etn_libusb0.catbinary
MD5:876899EFC56E86912FEE64634E4BDE91
SHA256:7667B2571DC50264E05FC8C5425D0709111E68704062D748AC26D0444D804B83
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\mserial.dllexecutable
MD5:E409F37D00C148F5562891A555B5C5A2
SHA256:3A9BD87FA1CB1459EF66C09E1EDA95CFF76A51CA204511A0EB2B8AD08D8E997C
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\libusb0.dllexecutable
MD5:535779909A40B42F4F3E48598F5778A5
SHA256:00CACA07869B19D10B370552AC7CC2F6F2EE246FC15DB11650F6CD3F4EF9B666
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\mwidget.dllexecutable
MD5:C3D08DEAF14A04CB938451D26646F11C
SHA256:1DCDCB18586A5F3672F1181B77E5A85DEC6A9B41F28D071366D5A7C44CEBDFEE
116euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\install.logtext
MD5:E042BC3E57C0CD1BE47D40785B7AE2DE
SHA256:313B4AC46EA4D51F323FDE222B7B803CC89EED2A8FCA242C549FCFEE16EEE6FE
548euc_win_2_00_025.exeC:\Program Files\Eaton\UPSCompanion\bin\msocket.dllexecutable
MD5:AD329BE27AB7F1D871712F8E506FEA8B
SHA256:D05C89E9FAA2984F7790DF6D72AAD942FDFAE78990FC35E4CDA4A3C4318595AB
548euc_win_2_00_025.exeC:\Users\admin\AppData\Local\Temp\emc2Install\bin\setusb64.exeexecutable
MD5:341EF3CBF03559B829AAB87A269F90A9
SHA256:540C1F4404EBD4C1ABD85F79FC345E3FE92003528A4652EBDC2A1058EF93445E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
2
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
pqsoftware.eaton.com
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
euc_win_2_00_025.exe