File name:

procexp.exe

Full analysis: https://app.any.run/tasks/a8bd9eb9-4cf5-48d9-87ec-f70e3736c1e4
Verdict: Malicious activity
Analysis date: February 06, 2024, 10:39:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7289AA6C0F2C41C29C9B33CAF1C15779

SHA1:

96387AB157168B22111E3C70B22364C9B71639C4

SHA256:

0AB0116B34DB0E7168DD5C5B1C917BBB1D38235ECE4430348F068914B4AB87A6

SSDEEP:

49152:Kug+zejoF8v8F/nluLRpSct4whtfVKevv7m9gcQYPbH51a7y58SG:Nzeo80F/nQRMPbjAyKZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • procexp.exe (PID: 1264)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • procexp.exe (PID: 1264)

    • Reads the Internet Settings

      • procexp.exe (PID: 1264)

    • Reads settings of System Certificates

      • procexp.exe (PID: 1264)

    • Executable content was dropped or overwritten

      • procexp.exe (PID: 1264)

    • Checks Windows Trust Settings

      • procexp.exe (PID: 1264)

    • Reads security settings of Internet Explorer

      • procexp.exe (PID: 1264)

  • INFO

    • Checks supported languages

      • procexp.exe (PID: 1264)

    • Reads the computer name

      • procexp.exe (PID: 1264)

    • Creates files or folders in the user directory

      • procexp.exe (PID: 1264)

    • Reads product name

      • procexp.exe (PID: 1264)

    • Create files in a temporary directory

      • procexp.exe (PID: 1264)

    • Reads Environment values

      • procexp.exe (PID: 1264)

    • Reads the machine GUID from the registry

      • procexp.exe (PID: 1264)

    • Reads Microsoft Office registry keys

      • procexp.exe (PID: 1264)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:13 17:01:39+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.35
CodeSize: 1020928
InitializedDataSize: 3743232
UninitializedDataSize: -
EntryPoint: 0xc42de
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 17.5.0.0
ProductVersionNumber: 17.5.0.0
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Sysinternals - www.sysinternals.com
FileDescription: Sysinternals Process Explorer
FileVersion: 17.05
InternalName: Process Explorer
LegalCopyright: Copyright © 1998-2023 Mark Russinovich
LegalTrademarks: Copyright © 1998-2023 Mark Russinovich
OriginalFileName: Procexp.exe
ProductName: Process Explorer
ProductVersion: 17.05
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start procexp.exe

Process information

PID
CMD
Path
Indicators
Parent process
1264"C:\Users\admin\AppData\Local\Temp\procexp.exe" C:\Users\admin\AppData\Local\Temp\procexp.exe
explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Sysinternals Process Explorer
Exit code:
0
Version:
17.05
Modules
Images
c:\users\admin\appdata\local\temp\procexp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
7 148
Read events
7 134
Write events
14
Delete events
0

Modification events

(PID) Process:(1264) procexp.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
1
Suspicious files
13
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B8CC409ACDBF2A2FE04C56F2875B1FD6binary
MD5:5E275DB761AA5A23AC651AF8F6C4A000
SHA256:3B9B2F75B724FE5354D24A0EF729B8A2AAA8A9313166EAFB1F73B07CF1A745EF
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C7F163ED126D5C3CB9457F68EC64E9Ebinary
MD5:754CACAA3205EC933DDF141AB7CDE4AB
SHA256:0E1A248BCA90E5F99EC83DFD151287B507F85D501556ED00A1D30689C55350A6
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:534DE5CA11E03F38AA3E967FFA48B2D9
SHA256:78E46DADD39F4E8E0312A2F2C91CC5981560FB6565EB6EE448F2F4FB6C15241E
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B8CC409ACDBF2A2FE04C56F2875B1FD6binary
MD5:86AB0554F84F2684CA6B9E7B90C1FEF5
SHA256:7E8C1E2497A3AACB0696CEECB2D96D71E2BD27A63B4B44D8AF040A39DF32354D
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76binary
MD5:E95AF9B03513D729D28FD890CFF4EBE9
SHA256:B19F80A5970542F71E1728CDEEE5D4534598329BA22FABF5BBD2280EBD6BA629
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:BB4A853340557135BC2CB0BBE27A54AD
SHA256:FD5FE2BCCB5AEB89D438EC681F0E907AF9341F792D04B047854D149190DB7A5A
1264procexp.exeC:\Users\admin\AppData\Local\Temp\PROCEXP152.SYSexecutable
MD5:D80A54CEECFF2B6598F24EC9F8901C97
SHA256:5492797019E99316E37AA77319DF912A4054B2E718FCA0A39F81D0E8965B0760
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759ADbinary
MD5:6872FAE8288DB34207D9E7EE350157F4
SHA256:50795B027E2BC566D3B7ACB89913F8EFD23B70615C9DB9BF5B23323AD3132A7D
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2CD1F910DD5DC23C234E99A91DE345C0binary
MD5:1BDAFFB704F9DB6C1D6499BDA2E22836
SHA256:B5A2C07C14A726414002E0054A01565C579CF24A11EC99443FBFCE6C3CC1F83C
1264procexp.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:64ECEAF47C1CF99C8C0D54612BB484C5
SHA256:D82C309827912D60DD5002C8227A6E74A364188A025C7F6702CF98D734DDB446
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
8
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
binary
767 b
unknown
1264
procexp.exe
GET
304
173.222.108.249:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?86672cb5c5abc5ee
unknown
—
—
unknown
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/WinPCA.crl
unknown
binary
530 b
unknown
1080
svchost.exe
GET
200
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3e412f7b4eff0943
unknown
compressed
65.2 Kb
unknown
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
binary
824 b
unknown
1264
procexp.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicWinProPCA2011_2011-10-19.crl
unknown
binary
564 b
unknown
1080
svchost.exe
GET
304
87.248.204.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?0754c686571bd23f
unknown
compressed
65.2 Kb
unknown
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
binary
519 b
unknown
1264
procexp.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
binary
555 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1264
procexp.exe
173.222.108.249:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
1264
procexp.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
1264
procexp.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
1080
svchost.exe
87.248.204.0:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 173.222.108.249
  • 173.222.108.147
  • 87.248.204.0
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.18
  • 2.16.164.51
  • 2.16.164.43
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
procexp.exe