File name:

procexp.exe

Full analysis: https://app.any.run/tasks/a8bd9eb9-4cf5-48d9-87ec-f70e3736c1e4
Verdict: Malicious activity
Analysis date: February 06, 2024, 10:39:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7289AA6C0F2C41C29C9B33CAF1C15779

SHA1:

96387AB157168B22111E3C70B22364C9B71639C4

SHA256:

0AB0116B34DB0E7168DD5C5B1C917BBB1D38235ECE4430348F068914B4AB87A6

SSDEEP:

49152:Kug+zejoF8v8F/nluLRpSct4whtfVKevv7m9gcQYPbH51a7y58SG:Nzeo80F/nQRMPbjAyKZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • procexp.exe (PID: 1264)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • procexp.exe (PID: 1264)

    • Executable content was dropped or overwritten

      • procexp.exe (PID: 1264)

    • Checks Windows Trust Settings

      • procexp.exe (PID: 1264)

    • Reads security settings of Internet Explorer

      • procexp.exe (PID: 1264)

    • Reads settings of System Certificates

      • procexp.exe (PID: 1264)

    • Reads the Internet Settings

      • procexp.exe (PID: 1264)

  • INFO

    • Reads product name

      • procexp.exe (PID: 1264)

    • Reads the computer name

      • procexp.exe (PID: 1264)

    • Checks supported languages

      • procexp.exe (PID: 1264)

    • Reads Environment values

      • procexp.exe (PID: 1264)

    • Create files in a temporary directory

      • procexp.exe (PID: 1264)

    • Reads Microsoft Office registry keys

      • procexp.exe (PID: 1264)

    • Creates files or folders in the user directory

      • procexp.exe (PID: 1264)

    • Reads the machine GUID from the registry

      • procexp.exe (PID: 1264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:13 17:01:39+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.35
CodeSize: 1020928
InitializedDataSize: 3743232
UninitializedDataSize: -
EntryPoint: 0xc42de
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 17.5.0.0
ProductVersionNumber: 17.5.0.0
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Sysinternals - www.sysinternals.com
FileDescription: Sysinternals Process Explorer
FileVersion: 17.05
InternalName: Process Explorer
LegalCopyright: Copyright © 1998-2023 Mark Russinovich
LegalTrademarks: Copyright © 1998-2023 Mark Russinovich
OriginalFileName: Procexp.exe
ProductName: Process Explorer
ProductVersion: 17.05
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start procexp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1264"C:\Users\admin\AppData\Local\Temp\procexp.exe" C:\Users\admin\AppData\Local\Temp\procexp.exe
explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Sysinternals Process Explorer
Exit code:
0
Version:
17.05
Modules
Images
c:\users\admin\appdata\local\temp\procexp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
7 148
Read events
7 134
Write events
14
Delete events
0

Modification events

(PID) Process:(1264) procexp.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
13
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2CD1F910DD5DC23C234E99A91DE345C0binary
MD5:55739FC8ACC6597BED94293D76B3EDB5
SHA256:64DEDEA70A95EC1CE4429CF754B6C5617F1770B4584BE2258985771346D270AB
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759ADbinary
MD5:AEC29F5A2D17DA7F88690411586401DE
SHA256:835AF958F714BB3AA1192EE51E2D7218FF8745B1F756F5CD561298F3F579EEF4
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:64ECEAF47C1CF99C8C0D54612BB484C5
SHA256:D82C309827912D60DD5002C8227A6E74A364188A025C7F6702CF98D734DDB446
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76binary
MD5:E95AF9B03513D729D28FD890CFF4EBE9
SHA256:B19F80A5970542F71E1728CDEEE5D4534598329BA22FABF5BBD2280EBD6BA629
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F90F18257CBB4D84216AC1E1F3BB2C76binary
MD5:000258FFC9ABB67A5ABBFFECA1D2586B
SHA256:6BD95C8AFCAE98FEDBEE49E507235B56540AE6D70F63AA7ECD982926D91214BA
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:BB4A853340557135BC2CB0BBE27A54AD
SHA256:FD5FE2BCCB5AEB89D438EC681F0E907AF9341F792D04B047854D149190DB7A5A
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C7F163ED126D5C3CB9457F68EC64E9Ebinary
MD5:61AB1473FBC513368F600E9A2A11FCC2
SHA256:DBD626CA50CFD577FD7587F8DAB283F77E9448AC92183537B7C08A748517AF16
1264procexp.exeC:\Users\admin\AppData\Local\Temp\PROCEXP152.SYSexecutable
MD5:D80A54CEECFF2B6598F24EC9F8901C97
SHA256:5492797019E99316E37AA77319DF912A4054B2E718FCA0A39F81D0E8965B0760
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:534DE5CA11E03F38AA3E967FFA48B2D9
SHA256:78E46DADD39F4E8E0312A2F2C91CC5981560FB6565EB6EE448F2F4FB6C15241E
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2CD1F910DD5DC23C234E99A91DE345C0binary
MD5:1BDAFFB704F9DB6C1D6499BDA2E22836
SHA256:B5A2C07C14A726414002E0054A01565C579CF24A11EC99443FBFCE6C3CC1F83C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/WinPCA.crl
unknown
binary
530 b
unknown
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
binary
824 b
unknown
1080
svchost.exe
GET
200
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3e412f7b4eff0943
unknown
compressed
65.2 Kb
unknown
1264
procexp.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
unknown
binary
564 b
unknown
1264
procexp.exe
GET
304
173.222.108.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?86672cb5c5abc5ee
unknown
—
—
unknown
1080
svchost.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0754c686571bd23f
unknown
compressed
65.2 Kb
unknown
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
binary
519 b
unknown
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
binary
767 b
unknown
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
binary
555 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1264
procexp.exe
173.222.108.249:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
1264
procexp.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
1264
procexp.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
1080
svchost.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 173.222.108.249
  • 173.222.108.147
  • 87.248.204.0
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.18
  • 2.16.164.51
  • 2.16.164.43
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
procexp.exe