analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Set-up.exe

Full analysis: https://app.any.run/tasks/b8c1b05c-840c-4404-9f3b-bd99ead6f62f
Verdict: Malicious activity
Threats:

WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.

Malware Trends Tracker     >>>
Analysis date: May 21, 2022, 06:45:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
stealer
avemaria
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

76C1DE0FE401C5203492CACF1F70713A

SHA1:

07F06894960BB202CF6A54D5A1B56E879BCA03BB

SHA256:

F551D90C542E9D4FDBBE23F0E78DDA7B0B5C230F106291F41866E9D02C23F918

SSDEEP:

49152:pAI+leWJWXNsSVDqA79TKnkjXeeSgadOq0oCtFV:pAI+leKNSxqZkj1Sgrqux

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Set-up.exe (PID: 3760)
      • svchost.exe (PID: 400)
      • cmd.exe (PID: 2100)
      • DllHost.exe (PID: 2612)
      • DllHost.exe (PID: 3456)
      • cmd.exe (PID: 3180)

    • Application was dropped or rewritten from another process

      • svchost.exe (PID: 400)
      • csrss.exe (PID: 3608)
      • csrss.exe (PID: 280)
      • csrss.exe (PID: 2672)
      • csrss.exe (PID: 3516)
      • csrss.exe (PID: 1828)
      • csrss.exe (PID: 1072)
      • csrss.exe (PID: 3688)
      • svchost.exe (PID: 3564)

    • Runs injected code in another process

      • csrss.exe (PID: 3608)
      • csrss.exe (PID: 280)
      • csrss.exe (PID: 2672)
      • csrss.exe (PID: 3516)

    • Application was injected by another process

      • Explorer.EXE (PID: 1376)

    • AVEMARIA was detected

      • csrss.exe (PID: 280)
      • csrss.exe (PID: 3516)

    • Runs app for hidden code execution

      • csrss.exe (PID: 280)
      • csrss.exe (PID: 3516)

    • Loads dropped or rewritten executable

      • dism.exe (PID: 1156)
      • dism.exe (PID: 3292)

  • SUSPICIOUS

    • Checks supported languages

      • Set-up.exe (PID: 3760)
      • Set-up.exe (PID: 3924)
      • svchost.exe (PID: 400)
      • powershell.exe (PID: 2776)
      • csrss.exe (PID: 3608)
      • powershell.exe (PID: 604)
      • csrss.exe (PID: 280)
      • cmd.exe (PID: 2100)
      • csrss.exe (PID: 2672)
      • csrss.exe (PID: 3516)
      • powershell.exe (PID: 2596)
      • cmd.exe (PID: 3180)
      • csrss.exe (PID: 1828)
      • svchost.exe (PID: 3564)
      • csrss.exe (PID: 3688)
      • csrss.exe (PID: 1072)

    • Reads the computer name

      • Set-up.exe (PID: 3760)
      • svchost.exe (PID: 400)
      • Set-up.exe (PID: 3924)
      • csrss.exe (PID: 3608)
      • powershell.exe (PID: 2776)
      • powershell.exe (PID: 604)
      • csrss.exe (PID: 280)
      • cmd.exe (PID: 2100)
      • csrss.exe (PID: 2672)
      • csrss.exe (PID: 3516)
      • powershell.exe (PID: 2596)
      • cmd.exe (PID: 3180)
      • csrss.exe (PID: 1828)
      • csrss.exe (PID: 1072)
      • csrss.exe (PID: 3688)
      • svchost.exe (PID: 3564)

    • Creates executable files which already exist in Windows

      • Set-up.exe (PID: 3760)

    • Creates files in the program directory

      • Set-up.exe (PID: 3760)
      • svchost.exe (PID: 400)

    • Creates a directory in Program Files

      • Set-up.exe (PID: 3760)
      • svchost.exe (PID: 400)

    • Creates files in the user directory

      • Set-up.exe (PID: 3760)
      • Explorer.EXE (PID: 1376)

    • Executable content was dropped or overwritten

      • Set-up.exe (PID: 3760)
      • svchost.exe (PID: 400)
      • cmd.exe (PID: 2100)
      • DllHost.exe (PID: 2612)
      • DllHost.exe (PID: 3456)
      • cmd.exe (PID: 3180)

    • Creates a software uninstall entry

      • Set-up.exe (PID: 3760)

    • Drops a file with a compile date too recent

      • Set-up.exe (PID: 3760)
      • svchost.exe (PID: 400)
      • cmd.exe (PID: 2100)
      • DllHost.exe (PID: 2612)
      • DllHost.exe (PID: 3456)
      • cmd.exe (PID: 3180)

    • Changes IE settings (feature browser emulation)

      • Set-up.exe (PID: 3924)

    • Executes PowerShell scripts

      • svchost.exe (PID: 400)
      • csrss.exe (PID: 3608)
      • csrss.exe (PID: 2672)

    • Starts itself from another location

      • svchost.exe (PID: 400)

    • Reads default file associations for system extensions

      • Explorer.EXE (PID: 1376)
      • taskmgr.exe (PID: 3860)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2704)
      • iexplore.exe (PID: 2332)

    • Starts Internet Explorer

      • Explorer.EXE (PID: 1376)

    • Starts CMD.EXE for commands execution

      • csrss.exe (PID: 280)
      • csrss.exe (PID: 3516)

    • Executed via COM

      • DllHost.exe (PID: 2612)
      • DllHost.exe (PID: 1896)
      • DllHost.exe (PID: 3456)

    • Creates files in the Windows directory

      • pkgmgr.exe (PID: 3848)
      • makecab.exe (PID: 4012)

  • INFO

    • Checks Windows Trust Settings

      • Set-up.exe (PID: 3924)
      • powershell.exe (PID: 2776)
      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 3796)
      • iexplore.exe (PID: 2332)
      • powershell.exe (PID: 604)
      • powershell.exe (PID: 2596)

    • Reads settings of System Certificates

      • Set-up.exe (PID: 3924)
      • powershell.exe (PID: 2776)
      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 3796)
      • powershell.exe (PID: 604)
      • iexplore.exe (PID: 2332)
      • powershell.exe (PID: 2596)

    • Checks supported languages

      • WINWORD.EXE (PID: 1408)
      • Explorer.EXE (PID: 1376)
      • taskmgr.exe (PID: 3860)
      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 2704)
      • iexplore.exe (PID: 3796)
      • iexplore.exe (PID: 2332)
      • DllHost.exe (PID: 2612)
      • dism.exe (PID: 1156)
      • makecab.exe (PID: 4012)
      • pkgmgr.exe (PID: 3848)
      • DllHost.exe (PID: 1896)
      • DllHost.exe (PID: 3456)
      • dism.exe (PID: 3292)
      • pkgmgr.exe (PID: 2416)
      • makecab.exe (PID: 3604)

    • Manual execution by user

      • WINWORD.EXE (PID: 1408)
      • taskmgr.exe (PID: 3860)
      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 3796)
      • csrss.exe (PID: 280)
      • csrss.exe (PID: 3516)
      • csrss.exe (PID: 1072)
      • svchost.exe (PID: 3564)
      • csrss.exe (PID: 3688)

    • Reads the computer name

      • WINWORD.EXE (PID: 1408)
      • taskmgr.exe (PID: 3860)
      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 2704)
      • iexplore.exe (PID: 3796)
      • iexplore.exe (PID: 2332)
      • DllHost.exe (PID: 2612)
      • dism.exe (PID: 1156)
      • DllHost.exe (PID: 1896)
      • DllHost.exe (PID: 3456)
      • dism.exe (PID: 3292)

    • Starts Microsoft Office Application

      • Explorer.EXE (PID: 1376)

    • Reads Microsoft Office registry keys

      • Explorer.EXE (PID: 1376)
      • WINWORD.EXE (PID: 1408)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1408)
      • iexplore.exe (PID: 2332)

    • Changes internet zones settings

      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 3796)

    • Application launched itself

      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 3796)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2208)
      • iexplore.exe (PID: 3796)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3796)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2332)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (37.4)
.scr | Windows screen saver (34.5)
.exe | Win32 Executable (generic) (11.9)
.exe | Win16/32 Executable Delphi generic (5.4)
.exe | Generic Win/DOS Executable (5.2)

EXIF

EXE

LegalCopyright: Adobe Inc.
FileVersion: 4.8.2.478
FileDescription: Adobe Installer 4.8.2.478 Installation
CompanyName: Adobe Inc.
Comments: -
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 4.8.2.478
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x25468
UninitializedDataSize: -
InitializedDataSize: 94720
CodeSize: 148992
LinkerVersion: 2.25
PEType: PE32
TimeStamp: 1992:06:20 00:22:17+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-1992 22:22:17
Detected languages:
  • English - United States
  • Russian - Russia
Comments: -
CompanyName: Adobe Inc.
FileDescription: Adobe Installer 4.8.2.478 Installation
FileVersion: 4.8.2.478
LegalCopyright: Adobe Inc.

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 19-Jun-1992 22:22:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
0x00001000
0x000244CC
0x00024600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.59443
DATA
0x00026000
0x00002894
0x00002A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.79376
BSS
0x00029000
0x000010F5
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x0002B000
0x00001798
0x00001800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.88555
.tls
0x0002D000
0x00000008
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x0002E000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
0.204488
.reloc
0x0002F000
0x00001884
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.58665
.rsrc
0x00031000
0x00011228
0x00011400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
4.4827

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.93923
886
UNKNOWN
Russian - Russia
RT_MANIFEST
50
4.35889
67624
UNKNOWN
UNKNOWN
RT_ICON
DVCLAL
4
16
UNKNOWN
UNKNOWN
RT_RCDATA
PACKAGEINFO
5.28362
272
UNKNOWN
UNKNOWN
RT_RCDATA
MAINICON
2.01924
20
UNKNOWN
UNKNOWN
RT_GROUP_ICON

Imports

advapi32.dll
cabinet.dll
comctl32.dll
gdi32.dll
kernel32.dll
ole32.dll
oleaut32.dll
shell32.dll
user32.dll
winmm.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
98
Monitored processes
35
Malicious processes
10
Suspicious processes
9

Behavior graph

Click at the process to see the details
drop and start start drop and start inject set-up.exe no specs set-up.exe set-up.exe no specs svchost.exe winword.exe no specs powershell.exe no specs csrss.exe taskmgr.exe no specs iexplore.exe iexplore.exe no specs iexplore.exe iexplore.exe powershell.exe no specs #AVEMARIA csrss.exe cmd.exe Copy/Move/Rename/Delete/Link Object pkgmgr.exe no specs pkgmgr.exe makecab.exe no specs dism.exe no specs csrss.exe #AVEMARIA csrss.exe PhotoViewer.dll no specs powershell.exe no specs explorer.exe cmd.exe Copy/Move/Rename/Delete/Link Object pkgmgr.exe no specs pkgmgr.exe makecab.exe no specs dism.exe no specs csrss.exe csrss.exe csrss.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2908"C:\Users\admin\AppData\Local\Temp\Set-up.exe" C:\Users\admin\AppData\Local\Temp\Set-up.exe—Explorer.EXE
User:
admin
Company:
Adobe Inc.
Integrity Level:
MEDIUM
Description:
Adobe Installer 4.8.2.478 Installation
Exit code:
3221226540
Version:
4.8.2.478
Modules
Images
c:\users\admin\appdata\local\temp\set-up.exe
c:\windows\system32\ntdll.dll
3760"C:\Users\admin\AppData\Local\Temp\Set-up.exe" C:\Users\admin\AppData\Local\Temp\Set-up.exe
Explorer.EXE
User:
admin
Company:
Adobe Inc.
Integrity Level:
HIGH
Description:
Adobe Installer 4.8.2.478 Installation
Exit code:
0
Version:
4.8.2.478
Modules
Images
c:\users\admin\appdata\local\temp\set-up.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3924"C:\Program Files\Adobe Inc.\Adobe Installer\Set-up.exe" C:\Program Files\Adobe Inc.\Adobe Installer\Set-up.exe—Set-up.exe
User:
admin
Company:
Adobe Inc.
Integrity Level:
HIGH
Description:
Adobe Installer
Exit code:
1
Version:
4.8.2.478
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\adobe inc\adobe installer\set-up.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
400"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
Set-up.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1408"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\safetyurl.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
2776powershell Add-MpPreference -ExclusionPath C:\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\atl.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3608"C:\ProgramData\csrss.exe"C:\ProgramData\csrss.exe
svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3860"C:\Windows\system32\taskmgr.exe" C:\Windows\system32\taskmgr.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2208"C:\Program Files\Internet Explorer\iexplore.exe" -nohomeC:\Program Files\Internet Explorer\iexplore.exe
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2704"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2208 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
66 624
Read events
63 607
Write events
0
Delete events
0

Modification events

No data
Executable files
8
Suspicious files
31
Text files
11
Unknown types
21

Dropped files

PID
Process
Filename
Type
1408WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR697A.tmp.cvr —
MD5:—
SHA256:—
3760Set-up.exeC:\Users\admin\AppData\Local\Temp\$inst\temp_0.tmpcompressed
MD5:5D3AD2701750A56CF8BD3CDED45895B3
SHA256:E6C97A6ABAED02287F6EF7D3EADCCF584881D704DFCEE808C50CC002E2BEF139
1376Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:FBEB89BCEEFC0F6756A3CC9728940D3A
SHA256:7C306FDAC6E1EF3688A003FC5AD9269145A2C1A6DA118D24705D3599BB158AF3
1408WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{97CBCF80-CAC0-4FF5-9FC0-2EDA50768E36}.tmpbinary
MD5:A5CAA3955B710E4C03B1A9FA82BFA2CE
SHA256:EDC9E7ABB4420EFA246582090DF1F04F024BEC2405E2EC517027D09ABE4DBE00
3760Set-up.exeC:\Program Files\Adobe Inc\Adobe Installer\Set-up.exeexecutable
MD5:9515612E2A09281A002F1B18A5D1284A
SHA256:4922744669C6EC432EA39647821CDB071E21A66F77210F709C838B2B5F460DA9
1376Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\a7bd71699cd38d1c.automaticDestinations-msautomaticdestinations-ms
MD5:71C4A84E577837B673030AB11AD7C6F6
SHA256:DECC9BAE0B7ABBDF62C39B637A283990C9EEC003FE733B4B4FF851E158DA1E0E
1408WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\safetyurl.rtf.LNKlnk
MD5:D9243B39E5480FC5502F43E874116075
SHA256:0874309344543123007AFD515AB19B33FE6B9745B85BCD2AFAC32CCFC49CE6E1
3760Set-up.exeC:\Program Files\Adobe Inc\Adobe Installer\Uninstall.iniini
MD5:41CD2EAB77AF646A1825374055758D42
SHA256:0DFDC88E9FEC77183A71948CF9136BC481F0147C5C3950A6CAEE628D8C0F6D73
1376Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\safetyurl.rtf.lnklnk
MD5:687430C278B089E23A309023F9ECED34
SHA256:F3CDC7C764F8AC81F6B9907D94285960BD2AAF0BFCA627B7C2FCA554525CBCAA
1408WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmpgc
MD5:D7F442D9C48150354A7021FCDC97882D
SHA256:7E56C2D1B7585DDC05A09F00A61C4B71CCDCBF7450ADE37B76018D8315FDD73B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
40
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2332
iexplore.exe
GET
302
142.250.186.100:80
http://www.google.com/
US
html
231 b
whitelisted
2332
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
2208
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
2332
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2332
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDExSUZ712qmxLhqE9UUaDV
US
der
472 b
whitelisted
2332
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEFsL8ccV6MRJElibH7RYju4%3D
US
der
471 b
whitelisted
2332
iexplore.exe
GET
301
142.250.185.142:80
http://google.com/
US
html
219 b
whitelisted
2208
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?049d242f32d7aaae
US
compressed
4.70 Kb
whitelisted
2332
iexplore.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEG3aTvFLTYzNCmxS2fUJutw%3D
US
der
471 b
whitelisted
2208
iexplore.exe
GET
200
23.216.77.69:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6ba41c051313144d
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2208
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
400
svchost.exe
142.250.185.142:80
google.com
Google Inc.
US
whitelisted
2208
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2208
iexplore.exe
23.216.77.69:80
ctldl.windowsupdate.com
NTT DOCOMO, INC.
US
suspicious
3608
csrss.exe
142.250.185.142:80
google.com
Google Inc.
US
whitelisted
3796
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
2332
iexplore.exe
13.107.5.80:443
api.bing.com
Microsoft Corporation
US
whitelisted
2332
iexplore.exe
142.250.185.142:80
google.com
Google Inc.
US
whitelisted
2332
iexplore.exe
142.250.186.100:80
www.google.com
Google Inc.
US
whitelisted
2332
iexplore.exe
142.250.185.67:80
ocsp.pki.goog
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
  • 142.250.184.206
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ctldl.windowsupdate.com
  • 23.216.77.69
  • 23.216.77.80
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
mangomanga.ddns.net
  • —
unknown
www.google.com
  • 142.250.186.100
whitelisted
ocsp.pki.goog
  • 142.250.185.67
whitelisted
ssl.gstatic.com
  • 142.250.186.35
whitelisted
clients1.google.com
  • 172.217.23.110
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Set-up.exe