File name:

065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118

Full analysis: https://app.any.run/tasks/d6121a99-b771-4427-8113-e0361bd296bb
Verdict: Malicious activity
Analysis date: May 17, 2025, 08:07:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

8002C4A887D8AA7EA682309D9948DBEC

SHA1:

D8462F04B8F4EF257C06C74182ED7C2E84B62D6A

SHA256:

065F0645B544AF518C93089F20FA9912D13BF37C27A3643359596F5B3D064118

SSDEEP:

98304:/hUhnNhNcJ7d1xgKdZHUbCawsTrmvNIUccUAshlK7+iPdSd0J6YATdOqXQqeoGqN:lu3tJf8peEIz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 8144)

    • Uses Task Scheduler to run other applications

      • Install.exe (PID: 7388)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Install.exe (PID: 7296)
      • 065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe (PID: 7268)
      • Install.exe (PID: 7388)

    • Found strings related to reading or modifying Windows Defender settings

      • forfiles.exe (PID: 7680)
      • forfiles.exe (PID: 7640)

    • Drops 7-zip archiver for unpacking

      • 065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe (PID: 7268)

    • Starts itself from another location

      • 065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe (PID: 7268)

    • Reads the BIOS version

      • Install.exe (PID: 7388)

    • Searches and executes a command on selected files

      • forfiles.exe (PID: 7640)
      • forfiles.exe (PID: 7680)

    • Reads security settings of Internet Explorer

      • Install.exe (PID: 7388)

    • Starts CMD.EXE for commands execution

      • forfiles.exe (PID: 7680)
      • forfiles.exe (PID: 7640)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7768)
      • cmd.exe (PID: 7780)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 8144)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 7316)

  • INFO

    • Checks supported languages

      • 065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe (PID: 7268)
      • Install.exe (PID: 7296)
      • Install.exe (PID: 7388)

    • The sample compiled with english language support

      • 065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe (PID: 7268)
      • Install.exe (PID: 7296)
      • Install.exe (PID: 7388)

    • Create files in a temporary directory

      • 065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe (PID: 7268)
      • Install.exe (PID: 7296)
      • Install.exe (PID: 7388)

    • Reads the computer name

      • Install.exe (PID: 7388)

    • Process checks computer location settings

      • Install.exe (PID: 7388)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:11:18 16:27:35+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 104960
InitializedDataSize: 45056
UninitializedDataSize: -
EntryPoint: 0x14b04
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.20.0.0
ProductVersionNumber: 9.20.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Igor Pavlov
FileDescription: 7z Setup SFX
FileVersion: 9.2
InternalName: 7zS.sfx
LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
OriginalFileName: 7zS.sfx.exe
ProductName: 7-Zip
ProductVersion: 9.2
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
167
Monitored processes
28
Malicious processes
1
Suspicious processes
5

Behavior graph

Click at the process to see the details
start 065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe install.exe sppextcomobj.exe no specs slui.exe no specs install.exe forfiles.exe no specs conhost.exe no specs forfiles.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs gpupdate.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs 065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4008"C:\Users\admin\AppData\Local\Temp\065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe" C:\Users\admin\AppData\Local\Temp\065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe—explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7z Setup SFX
Exit code:
3221226540
Version:
9.20
Modules
Images
c:\users\admin\appdata\local\temp\065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—gpupdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6372"C:\WINDOWS\system32\gpupdate.exe" /force C:\Windows\System32\gpupdate.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Group Policy Update Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\gpupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7268"C:\Users\admin\AppData\Local\Temp\065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe" C:\Users\admin\AppData\Local\Temp\065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe
explorer.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Setup SFX
Version:
9.20
Modules
Images
c:\users\admin\appdata\local\temp\065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7296.\Install.exeC:\Users\admin\AppData\Local\Temp\7zSC92E.tmp\Install.exe
065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Setup SFX
Version:
9.20
Modules
Images
c:\users\admin\appdata\local\temp\7zsc92e.tmp\install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7312\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7316schtasks /DELETE /F /TN "gKiQGiAoJ"C:\Windows\SysWOW64\schtasks.exe—Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7324C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7380"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7388.\Install.exe /qjzdidjEsk "525403" /SC:\Users\admin\AppData\Local\Temp\7zSCA57.tmp\Install.exe
Install.exe
User:
admin
Company:
Defence Remain Research
Integrity Level:
HIGH
Description:
Marine band fleet shark tame midst
Version:
193.810.112.768
Modules
Images
c:\users\admin\appdata\local\temp\7zsca57.tmp\install.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
5 650
Read events
5 644
Write events
6
Delete events
0

Modification events

(PID) Process:(7832) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions
Operation:writeName:exe
Value:
0
(PID) Process:(7388) Install.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A78039010000FB9A790967ADD111ABCD00C04FC30936A0020000
(PID) Process:(7800) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions
Operation:writeName:exe
Value:
0
(PID) Process:(7808) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet
Operation:writeName:SpyNetReporting
Value:
0
(PID) Process:(7868) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet
Operation:writeName:SpyNetReporting
Value:
0
Executable files
3
Suspicious files
3
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
7268065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exeC:\Users\admin\AppData\Local\Temp\7zSC92E.tmp\Install.exeexecutable
MD5:3165EF425F13D96BCBB8968555B2BE74
SHA256:FF02CC826C9753FBD3E49CFC078503226AC115D468B105C3BAFEB6AD5FD79F1E
8144powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ojgp4osn.3vx.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7388Install.exeC:\Windows\System32\GroupPolicy\gpt.initext
MD5:A62CE44A33F1C05FC2D340EA0CA118A4
SHA256:9F2CD4ACF23D565BC8498C989FCCCCF59FD207EF8925111DC63E78649735404A
8144powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bbi22yhn.ay2.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7268065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118.exeC:\Users\admin\AppData\Local\Temp\7zSC92E.tmp\__data__\config.txtbinary
MD5:760B6BAD62E32EEA56386BBD9C82B33A
SHA256:347F2CA02C605944C163E3E9735A0AAC8FDF97D5392B2386FF15F4A15AA5B58A
7296Install.exeC:\Users\admin\AppData\Local\Temp\7zSCA57.tmp\Install.exeexecutable
MD5:C829347559B79A90FF17D469597019EB
SHA256:8E7AE371E3BEEED3EAD43D9B38B282E8F7ACEE72BC7896B678A80E32952B3EAE
7388Install.exeC:\Users\admin\AppData\Local\Temp\hXKHkjCicvfxprsjy\sHtkawKEfKJtGow\GtNuSVq.exeexecutable
MD5:C829347559B79A90FF17D469597019EB
SHA256:8E7AE371E3BEEED3EAD43D9B38B282E8F7ACEE72BC7896B678A80E32952B3EAE
7800schtasks.exeC:\Windows\Tasks\bKLMEGDlLowuowYRyH.jobbinary
MD5:3C25F280DDD1837593DDFAA3ADD000E0
SHA256:E374C42054B8605419C6C912EFDACF30013F191DBF70A83CB59F46CF0BFC9ADA
8144powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:6B3BCD79E5A2F9A255D2F67CF12B039A
SHA256:B804A3C390B063E54A5D43E8E188B4BA5379122763A22452D34BC3297FE331C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7876
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7876
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4784
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.21:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.23
  • 23.216.77.30
  • 23.216.77.25
  • 23.216.77.20
  • 23.216.77.29
  • 23.216.77.13
  • 23.216.77.19
  • 23.216.77.18
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.2
  • 40.126.31.0
  • 20.190.159.71
  • 20.190.159.68
  • 40.126.31.1
  • 20.190.159.0
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
065f0645b544af518c93089f20fa9912d13bf37c27a3643359596f5b3d064118