File name:

ChromeSetup.exe

Full analysis: https://app.any.run/tasks/96da740b-f19c-417f-ac0a-e8ee09369a3f
Verdict: Malicious activity
Threats:

HijackLoader is a modular malware acting as a vehicle for distributing different types of malicious software on compromised systems. It gained prominence during the summer of 2023 and has since been used in multiple attacks against organizations from various sectors, including hospitality businesses.

Malware Trends Tracker     >>>
Analysis date: September 25, 2023, 14:45:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
hijackloader
loader
stealer
raccoon
recordbreaker
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A68C75B2C8FB10543207FFD80C44F9E1

SHA1:

CBC7606AC79549705793A24ECDCA329EB4CAF368

SHA256:

F8428D6C7D75839C0E9F922021EE2E08CB3091D2BBD700E40D63F69A0AA4CCCA

SSDEEP:

24576:FovgwKyJEvHf3NITM1f2sJ5wxmkOJdPPARoxV79uvBtGhG0xTavOH:FoowKyOv/3NITM1f2sJ5wxXOJZA+QZtM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • HIJACKLOADER detected by memory dumps

      • cmd.exe (PID: 1384)
      • AarSvc.exe (PID: 2608)

    • Application was dropped or rewritten from another process

      • AarSvc.exe (PID: 2608)

    • RACCOON detected by memory dumps

      • AarSvc.exe (PID: 2608)

    • RACCOON was detected

      • AarSvc.exe (PID: 2608)

    • Connects to the CnC server

      • AarSvc.exe (PID: 2608)

    • Loads dropped or rewritten executable

      • AarSvc.exe (PID: 2608)

    • Steals credentials

      • AarSvc.exe (PID: 2608)

    • Actions looks like stealing of personal data

      • AarSvc.exe (PID: 2608)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • ChromeSetup.exe (PID: 788)

    • Starts CMD.EXE for commands execution

      • ChromeSetup.exe (PID: 788)

    • Reads the Internet Settings

      • ChromeSetup.exe (PID: 788)
      • AarSvc.exe (PID: 2608)

    • Connects to the server without a host name

      • AarSvc.exe (PID: 2608)

    • Searches for installed software

      • AarSvc.exe (PID: 2608)

    • Reads browser cookies

      • AarSvc.exe (PID: 2608)

    • Process requests binary or script from the Internet

      • AarSvc.exe (PID: 2608)

  • INFO

    • Reads the computer name

      • ChromeSetup.exe (PID: 788)
      • AarSvc.exe (PID: 2608)

    • Reads the machine GUID from the registry

      • ChromeSetup.exe (PID: 788)
      • AarSvc.exe (PID: 2608)

    • Checks supported languages

      • ChromeSetup.exe (PID: 788)
      • AarSvc.exe (PID: 2608)

    • Create files in a temporary directory

      • ChromeSetup.exe (PID: 788)

    • The executable file from the user directory is run by the CMD process

      • AarSvc.exe (PID: 2608)

    • Checks proxy server information

      • AarSvc.exe (PID: 2608)

    • Creates files or folders in the user directory

      • AarSvc.exe (PID: 2608)

    • Reads Environment values

      • AarSvc.exe (PID: 2608)

    • Reads product name

      • AarSvc.exe (PID: 2608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Raccoon

(PID) Process(2608) AarSvc.exe
C2 (1)http://65.109.2.42:80
Keys
xor5e2505d8647542f05843f89ae7cd18e7
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

InternalBuildNumber: 203014
ProductVersion: 27
ProductName: InstallShield
OriginalFileName: Compile.exe
LegalCopyright: Copyright (c) 2021 Flexera. All Rights Reserved.
InternalName: CompileEXE
FileVersion: 27.0.58
FileDescription: InstallShield (R) Command Line Compile Utility
CompanyName: Flexera
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Dynamic link library
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 27.0.0.0
FileVersionNumber: 27.0.0.58
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 6
EntryPoint: 0x496d3
UninitializedDataSize: -
InitializedDataSize: 770048
CodeSize: 636416
LinkerVersion: 14
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2021:08:30 14:38:27+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
3
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start chromesetup.exe #HIJACKLOADER cmd.exe no specs #RACCOON aarsvc.exe

Process information

PID
CMD
Path
Indicators
Parent process
788"C:\Users\admin\AppData\Local\Temp\ChromeSetup.exe" C:\Users\admin\AppData\Local\Temp\ChromeSetup.exe
explorer.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) Command Line Compile Utility
Exit code:
1
Version:
27.0.58
Modules
Images
c:\users\admin\appdata\local\temp\chromesetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\user32.dll
1384C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe
ChromeSetup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\syswow64\ntdll.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2608C:\Users\admin\AppData\Local\Temp\AarSvc.exeC:\Users\admin\AppData\Local\Temp\AarSvc.exe
cmd.exe
User:
admin
Company:
Info-ZIP
Integrity Level:
MEDIUM
Description:
Info-ZIP Zip for Win32 console
Exit code:
0
Version:
3.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\aarsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernel32.dll
Raccoon
(PID) Process(2608) AarSvc.exe
C2 (1)http://65.109.2.42:80
Keys
xor5e2505d8647542f05843f89ae7cd18e7
Total events
1 530
Read events
1 513
Write events
17
Delete events
0

Modification events

(PID) Process:(788) ChromeSetup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2608) AarSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2608) AarSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2608) AarSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2608) AarSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000B1000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2608) AarSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2608) AarSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2608) AarSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2608) AarSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
8
Suspicious files
15
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1384cmd.exeC:\Users\admin\AppData\Local\Temp\nwnrhq —
MD5:—
SHA256:—
788ChromeSetup.exeC:\Users\admin\AppData\Local\Temp\CabD5E.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
2608AarSvc.exeC:\Users\admin\AppData\LocalLow\8lZT738L7KTSbinary
MD5:CEEDD8AE976601F9C9365EBEC5CFD997
SHA256:0B1A7E634F5B8A88211685983E83E7739359ACE5F26CA99746F46BB81507A42E
788ChromeSetup.exeC:\Users\admin\AppData\Local\Temp\b6bbb0d1binary
MD5:72AA01357182A681706D1166BD080811
SHA256:3D65ABC16BA8B7F7AC44578F83C91B80C5855B600D12136DDB64557FC5582714
2608AarSvc.exeC:\Users\admin\AppData\LocalLow\softokn3.dllexecutable
MD5:63A1FE06BE877497C4C2017CA0303537
SHA256:44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
2608AarSvc.exeC:\Users\admin\AppData\LocalLow\freebl3.dllexecutable
MD5:15B61E4A910C172B25FB7D8CCB92F754
SHA256:B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
2608AarSvc.exeC:\Users\admin\AppData\LocalLow\vcruntime140.dllexecutable
MD5:1B171F9A428C44ACF85F89989007C328
SHA256:9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
2608AarSvc.exeC:\Users\admin\AppData\LocalLow\1lG75At8RTLjbinary
MD5:CEB39527E05115BBE0227EA14D897374
SHA256:D3406398F5A7D00D94E1F36065ACC5C63DBF27FB4026D75FB09129DDD05C2D20
2608AarSvc.exeC:\Users\admin\AppData\LocalLow\mozglue.dllexecutable
MD5:F07D9977430E762B563EAADC2B94BBFA
SHA256:4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
2608AarSvc.exeC:\Users\admin\AppData\LocalLow\f90LHK20i6SDbinary
MD5:8ED59ABBE343BC945E3A9F4801075399
SHA256:97E62577149EB459A713FCBE09C5C73A1ADDF230042F53B2CA9E256E695EA7A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
9
DNS requests
3
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
788
ChromeSetup.exe
GET
200
8.238.206.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/D69B561148F01C77C54578C10926DF5B856976AD.crt?d43ca4f947f04c6d
unknown
der
867 b
unknown
788
ChromeSetup.exe
GET
200
8.238.206.126:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3df2147b21750b02
unknown
compressed
61.6 Kb
unknown
2608
AarSvc.exe
GET
200
65.109.2.42:80
http://65.109.2.42/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
unknown
executable
438 Kb
unknown
2608
AarSvc.exe
POST
200
65.109.2.42:80
http://65.109.2.42/
unknown
text
6.89 Kb
unknown
2608
AarSvc.exe
GET
200
65.109.2.42:80
http://65.109.2.42/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
unknown
executable
78.2 Kb
unknown
2608
AarSvc.exe
GET
200
65.109.2.42:80
http://65.109.2.42/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
unknown
executable
668 Kb
unknown
2608
AarSvc.exe
GET
200
65.109.2.42:80
http://65.109.2.42/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
unknown
executable
1.95 Mb
unknown
2608
AarSvc.exe
GET
200
65.109.2.42:80
http://65.109.2.42/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
unknown
executable
612 Kb
unknown
2608
AarSvc.exe
POST
200
65.109.2.42:80
http://65.109.2.42/0d6527bfaa1c97aa3c29bc5a145edff8
unknown
text
8 b
unknown
2608
AarSvc.exe
POST
200
65.109.2.42:80
http://65.109.2.42/0d6527bfaa1c97aa3c29bc5a145edff8
unknown
text
8 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1208
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
332
svchost.exe
224.0.0.252:5355
—
—
—
unknown
788
ChromeSetup.exe
178.248.238.19:443
kommersant.ru
HLL LLC
RU
unknown
788
ChromeSetup.exe
8.238.206.126:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
2608
AarSvc.exe
65.109.2.42:80
—
Hetzner Online GmbH
FI
unknown

DNS requests

Domain
IP
Reputation
kommersant.ru
  • 178.248.238.19
whitelisted
ctldl.windowsupdate.com
  • 8.238.206.126
  • 8.248.137.254
  • 8.238.191.126
  • 8.238.189.126
  • 8.60.136.62
whitelisted
www.kommersant.ru
  • 178.248.238.19
unknown

Threats

PID
Process
Class
Message
2608
AarSvc.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin M1
2608
AarSvc.exe
A Network Trojan was detected
ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response
2608
AarSvc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2608
AarSvc.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for nss3.dll - Possible Infostealer Activity
2608
AarSvc.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2608
AarSvc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2608
AarSvc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2608
AarSvc.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for vcruntime140.dll - Possible Infostealer Activity
2608
AarSvc.exe
Potentially Bad Traffic
ET INFO Dotted Quad Host DLL Request
2608
AarSvc.exe
A suspicious filename was detected
ET HUNTING HTTP GET Request for mozglue.dll - Possible Infostealer Activity
3 ETPRO signatures available at the full report
Process
Message
AarSvc.exe
log: 2wh3jior
AarSvc.exe
log: wzqp6c4u
AarSvc.exe
log: wzqp6c4u
AarSvc.exe
log: wzqp6c4u
AarSvc.exe
log: xa8skody
AarSvc.exe
log: 10ac5g0i
AarSvc.exe
log: cm74tasm
AarSvc.exe
log: h5fxqpln
AarSvc.exe
log: rkizjfza
AarSvc.exe
log: 5qvdjrlo
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ChromeSetup.exe