File name:

cpuz_a.exe

Full analysis: https://app.any.run/tasks/8b56e698-1e8d-43e5-83fa-3500349827cc
Verdict: Malicious activity
Analysis date: August 03, 2024, 15:05:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

01CA7C101C831DC68A2802EDB79E47F0

SHA1:

3BA1838E28011556AF1399C8143DA57BA1D3457C

SHA256:

06354FD486669C9E39E6C81929809BAD2F2764F5637CD4B4A043B9D328D53A09

SSDEEP:

98304:n1sAMI4v9IZWDU2ROSuBvOk8B73+KX9jSFGWTNKyDaAwlrz1Pw0nusVU5b0520uI:uI6h

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cpuz_a.exe (PID: 6352)
      • cpuz_a.exe (PID: 6428)
      • cpuz_x64k.exe (PID: 6676)
      • cpuz_x64k.exe (PID: 6552)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • cpuz_a.exe (PID: 6352)
      • cpuz_a.exe (PID: 6428)
      • cpuz_x64k.exe (PID: 6552)

    • Reads security settings of Internet Explorer

      • cpuz_a.exe (PID: 6428)
      • cpuz_a.exe (PID: 6352)
      • cpuz_x64k.exe (PID: 6552)
      • cpuz_x64k.exe (PID: 6676)

    • Application launched itself

      • cpuz_a.exe (PID: 6352)

    • Executing commands from ".cmd" file

      • cpuz_a.exe (PID: 6428)
      • cpuz_x64k.exe (PID: 6552)

    • Starts CMD.EXE for commands execution

      • cpuz_a.exe (PID: 6428)
      • cpuz_x64k.exe (PID: 6552)

    • Executable content was dropped or overwritten

      • cpuz_a.exe (PID: 6428)
      • cpuz_x64k.exe (PID: 6552)
      • cpuz_x64k.exe (PID: 6676)

    • Drops a system driver (possible attempt to evade defenses)

      • cpuz_x64k.exe (PID: 6676)

    • Checks Windows Trust Settings

      • cpuz_x64k.exe (PID: 6676)

  • INFO

    • Reads the computer name

      • cpuz_a.exe (PID: 6352)
      • cpuz_a.exe (PID: 6428)
      • cpuz_x64k.exe (PID: 6552)
      • cpuz_x64k.exe (PID: 6676)

    • Process checks computer location settings

      • cpuz_a.exe (PID: 6352)
      • cpuz_a.exe (PID: 6428)
      • cpuz_x64k.exe (PID: 6552)

    • Checks supported languages

      • cpuz_a.exe (PID: 6428)
      • cpuz_a.exe (PID: 6352)
      • cpuz_x64k.exe (PID: 6552)
      • cpuz_x64k.exe (PID: 6676)

    • Create files in a temporary directory

      • cpuz_a.exe (PID: 6428)
      • cpuz_x64k.exe (PID: 6552)

    • Creates files or folders in the user directory

      • cpuz_x64k.exe (PID: 6676)

    • Reads Environment values

      • cpuz_x64k.exe (PID: 6676)

    • Checks proxy server information

      • cpuz_x64k.exe (PID: 6676)

    • Reads the software policy settings

      • cpuz_x64k.exe (PID: 6676)

    • Reads the machine GUID from the registry

      • cpuz_x64k.exe (PID: 6676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:02 22:14:34+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 114176
InitializedDataSize: 39424
UninitializedDataSize: -
EntryPoint: 0x1c35f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.6.0
ProductVersionNumber: 2.0.6.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: CPUID
LegalCopyright: Copyright (C) 2004-2023
ProductName: CPU-Z Application
FileVersion: 2.0.6.0
OriginalFileName: cpuz.exe
FileDescription: CPU-Z Application
InternalName: cpuz.exe
ProductVersion: 2.0.6.0
Created: 7z SFX Constructor v4.5.0.0 (http://usbtor.ru/viewtopic.php?t=798)
Builder: q5515 21:37:50 27/05/2023
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
8
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cpuz_a.exe no specs cpuz_a.exe cmd.exe no specs conhost.exe no specs cpuz_x64k.exe cmd.exe no specs conhost.exe no specs cpuz_x64k.exe

Process information

PID
CMD
Path
Indicators
Parent process
6352"C:\Users\admin\AppData\Local\Temp\cpuz_a.exe" C:\Users\admin\AppData\Local\Temp\cpuz_a.exe—explorer.exe
User:
admin
Company:
CPUID
Integrity Level:
MEDIUM
Description:
CPU-Z Application
Version:
2.0.6.0
Modules
Images
c:\users\admin\appdata\local\temp\cpuz_a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6428"C:\Users\admin\AppData\Local\Temp\cpuz_a.exe" -sfxelevation C:\Users\admin\AppData\Local\Temp\cpuz_a.exe
cpuz_a.exe
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
CPU-Z Application
Version:
2.0.6.0
Modules
Images
c:\users\admin\appdata\local\temp\cpuz_a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6472"C:\Windows\System32\cmd.exe" /c ""C:\Users\admin\AppData\Local\Temp\cpu-z ko\KillDuplicate.cmd" "C:\Users\admin\AppData\Local\Temp\cpu-z ko" "cpuz_a.exe""C:\Windows\System32\cmd.exe—cpuz_a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6480\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6552"C:\Users\admin\AppData\Local\Temp\cpu-z ko\x64\cpuz_x64k.exe" C:\Users\admin\AppData\Local\Temp\cpu-z ko\x64\cpuz_x64k.exe
cpuz_a.exe
User:
admin
Company:
CPUID
Integrity Level:
HIGH
Description:
CPU-Z Application
Version:
2.0.6.0
Modules
Images
c:\users\admin\appdata\local\temp\cpu-z ko\x64\cpuz_x64k.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6592"C:\Windows\System32\cmd.exe" /c ""C:\Users\admin\AppData\Local\Temp\CPU-Z\KillDuplicate.cmd" "C:\Users\admin\AppData\Local\Temp\CPU-Z" "cpuz_x64k.exe""C:\Windows\System32\cmd.exe—cpuz_x64k.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
6600\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6676"C:\Users\admin\AppData\Local\Temp\CPU-Z\cpuz_x64k.exe" C:\Users\admin\AppData\Local\Temp\CPU-Z\cpuz_x64k.exe
cpuz_x64k.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\cpu-z\cpuz_x64k.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
11 988
Read events
11 953
Write events
35
Delete events
0

Modification events

(PID) Process:(6352) cpuz_a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6352) cpuz_a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6352) cpuz_a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6352) cpuz_a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6428) cpuz_a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6428) cpuz_a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6428) cpuz_a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6428) cpuz_a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6552) cpuz_x64k.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6552) cpuz_x64k.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
4
Suspicious files
2
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
6676cpuz_x64k.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A4EEE1B0550754EDC37DCC5F80FA19DFbinary
MD5:8C6F0E289F3C7DC240053C164455A826
SHA256:BF6A0C70307031AFBC9B3393D267153254EDA863B17BD1AABFA48FE3B94E8D9C
6676cpuz_x64k.exeC:\Windows\Temp\cpuz_driver_6676.logtext
MD5:F984605BE6B69FF678CAAE40B1FE0E0A
SHA256:55F8D9530CB14690868D406B3078DE8625E22FF8F225CEFBD237B080B35AAB31
6428cpuz_a.exeC:\Users\admin\AppData\Local\Temp\cpu-z ko\x86\cpuz_x32k.exeexecutable
MD5:E639F724F01204C5B1DD1FAE7D46E9A9
SHA256:C232EAD84F4EEF765071086790D667DC99E19AB145D697D9E7FE1D223E336C8C
6552cpuz_x64k.exeC:\Users\admin\AppData\Local\Temp\CPU-Z\cpuz_x64k.exeexecutable
MD5:93F4F42BB71D00DEE94D8B6B2602F236
SHA256:047666F43DC6FABECC9752884968B7AC56E98D9E10AFDC7C2AFF944D22755605
6428cpuz_a.exeC:\Users\admin\AppData\Local\Temp\cpu-z ko\x64\cpuz_x64k.exeexecutable
MD5:CCF1D884822724E63E765A6BADD54A50
SHA256:DFA3955124320F121561FD59B7ED240DFCD8468D7CBBCD832AE643BD6E6816AF
6676cpuz_x64k.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A4EEE1B0550754EDC37DCC5F80FA19DFder
MD5:B0EF5B7F1482916C34B2FA83F1DD1452
SHA256:F02CF25C15089DE192F8EEA83D0C390C88FDB883A6553A113733832D3ED546CA
6552cpuz_x64k.exeC:\Users\admin\AppData\Local\Temp\CPU-Z\cpuz.initext
MD5:FC5837F33CD8BE49305340319C34526A
SHA256:57CE62D214A96DCC38044C45510B07A0EFDF0E2822AF455A2791B2BBFCBB7503
6676cpuz_x64k.exeC:\Windows\Temp\cpuz157\cpuz157_x64.sysexecutable
MD5:8FF0F73158EC15DE8E548B00608C5822
SHA256:58CB5439E34BE4EDE6D93C463CB0433C99A100A1C06FCA777EDA751FD72C07BF
6676cpuz_x64k.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\cpuid[1].vertext
MD5:004BFA2894DBE6DD62B015B3E2CECD1B
SHA256:DE73B539E869A34A3AB54A83642284EC5CB067F12846A90AA8247F62B9B2CAA9
6552cpuz_x64k.exeC:\Users\admin\AppData\Local\Temp\CPU-Z\KillDuplicate.cmdtext
MD5:68CECDF24AA2FD011ECE466F00EF8450
SHA256:64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
41
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6676
cpuz_x64k.exe
GET
200
184.24.77.67:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgSTi%2FCGxZ2Esn2oh5KTXh7Xlg%3D%3D
unknown
—
—
whitelisted
2064
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7080
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2064
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2968
svchost.exe
GET
304
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7156
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4708
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6676
cpuz_x64k.exe
195.154.81.43:443
download.cpuid.com
Online S.a.s.
FR
unknown
6676
cpuz_x64k.exe
184.24.77.67:80
r11.o.lencr.org
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
5112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5336
SearchApp.exe
184.86.251.24:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.110
whitelisted
download.cpuid.com
  • 195.154.81.43
whitelisted
r11.o.lencr.org
  • 184.24.77.67
  • 184.24.77.48
  • 184.24.77.71
  • 184.24.77.77
  • 184.24.77.45
whitelisted
www.bing.com
  • 184.86.251.24
  • 184.86.251.30
  • 184.86.251.14
  • 184.86.251.9
  • 184.86.251.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.68
  • 20.190.160.22
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.138
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 184.86.251.20
  • 184.86.251.9
  • 184.86.251.14
  • 184.86.251.30
  • 184.86.251.24
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
cpuz_a.exe