File name:

0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5

Full analysis: https://app.any.run/tasks/8b1e08c5-bbea-4d3a-9a78-9f8088e012c8
Verdict: Malicious activity
Analysis date: November 18, 2023, 13:42:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

1D6B11F85DEBDDA27E873662E721289E

SHA1:

7F249736EFC0C31C44E96FB72C1EFCC028857AC7

SHA256:

0B74282D9C03AFFB25BBECF28D5155C582E246F0CE21BE27B75504F1779707F5

SSDEEP:

49152:8aZ/GDiBbO4PRiz3y+HsBGzR7ECV+0Ztl+oaeulzPWz7jZT156ZgkEE2/EflPbBI:n1GOBnPMzC+HsBGzJZZz+oXNv51oZgSQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe (PID: 3384)

    • Application was injected by another process

      • explorer.exe (PID: 1388)

    • Runs injected code in another process

      • rundll32.exe (PID: 3212)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe (PID: 3384)

    • Reads the Internet Settings

      • 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe (PID: 3384)

    • Uses RUNDLL32.EXE to load library

      • 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe (PID: 3384)

    • The process creates files with name similar to system file names

      • 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe (PID: 3384)

  • INFO

    • Checks supported languages

      • 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe (PID: 3384)
      • mbCHECK.exe (PID: 3204)
      • wmpnscfg.exe (PID: 3512)

    • Reads the computer name

      • 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe (PID: 3384)
      • mbCHECK.exe (PID: 3204)
      • wmpnscfg.exe (PID: 3512)

    • Create files in a temporary directory

      • 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe (PID: 3384)
      • rundll32.exe (PID: 3212)

    • Drops the executable file immediately after the start

      • rundll32.exe (PID: 3212)

    • Creates files in the program directory

      • rundll32.exe (PID: 3212)

    • Reads the Internet Settings

      • explorer.exe (PID: 1388)

    • Checks proxy server information

      • explorer.exe (PID: 1388)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:07:14 22:09:51+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x310b
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.1.1.0
ProductVersionNumber: 1.1.1.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: German
CharacterSet: Windows, Latin1
FileDescription: mbCHECK
FileVersion: 1.1.1.0
LegalCopyright: MB Connect Line GmbH
LegalLanguage: German (Germany)
OriginalFileName: mbCHECK
ProductName: mbCHECK
ProductVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
38
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe no specs rundll32.exe no specs mbcheck.exe no specs explorer.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1388C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3204"C:\Users\admin\AppData\Local\Temp\mbcheck.exe" C:\Users\admin\AppData\Local\Temp\mbCHECK.exe—0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe
User:
admin
Company:
MB Connect Line GmbH
Integrity Level:
MEDIUM
Description:
mbCHECK
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\users\admin\appdata\local\temp\mbcheck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3212C:\Windows\system32\rundll32.exe C:\Users\admin\AppData\Local\Temp\mbcheck.dll,RunDllEntryC:\Windows\System32\rundll32.exe—0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3384"C:\Users\admin\AppData\Local\Temp\0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe" C:\Users\admin\AppData\Local\Temp\0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
mbCHECK
Exit code:
0
Version:
1.1.1.0
Modules
Images
c:\users\admin\appdata\local\temp\0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3512"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
1 021
Read events
988
Write events
30
Delete events
3

Modification events

(PID) Process:(3384) 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3384) 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3384) 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3384) 0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000B00100001203000047FA76013F0000004A0000008E0F0D004D006900630072006F0073006F00660074002E0049006E007400650072006E00650074004500780070006C006F007200650072002E00440065006600610075006C007400000028003E004000A4E75102B8E651020000000000000000000000000000080274E45102000008026CE25102000000000000D26CFFFFFFFF705911750000000000000000A4E251027C900D75000400000000000008E35102FFFFFFFF38EA7000FFFFFFFF080A7400D80E740030EA7000D4E25102F7AF3D7680D0707614F05102081D3E76E4613E766820700008E351020000000071000000BBF2CB00E8E25102A1693E766820700008E351020000000014E551023F613E766820700008E3510200000400000000800400000026E4510298E351025DA5147726E45102D26E147779A51477D6794D7526E4510210E65102000100006400610072E3510226E451026F0061006D0069006E0067005C006D006900630072006F0073006F0066007400CCE351023400000080E35102DE70310033003300350033003800310030003000F8E551025A000000A0E351021DA71477D6610E02D4E351025A00000010E651025C00000011000000104F7000084F7000F8E55102C4E3510220E40000D7F3CB00D0E351025E903E7620E45102D4E3510203943E760000000064561802FCE35102A9933E7664561802A8E45102D8511802BD933E7600000000D8511802A8E4510204E4510202000000840000003D3567004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000059004C61EF75A022590063003A005C00770069006E0064006F00770073005C00730079007300740065006D00330032005C0069006D006100670065007200650073002E0064006C006C000000570069006E0064006F00770073005C00730079007300740065006D00330032005C0069006D006100670065007200650073002E0064006C006C00000032020000000007000000E4E332021400000000000000000056007896210845D397750C12000000000000FA279C777896210814E432025F389C7764389C772279967578962108FA279C770000000000000000FFFFFFFF0000000000000000A21000004CE432023B600D77087C7C000000000047600D773F09C3B300000000A21000000000000024E432026C006C0050E4320200000000E8E43202A2100000081C09086CE43202B0FE5F74081C0908E8E43202A2100000000000000000004098E4320237C30D77C4000300A210000000000000F0E93202A2100000CDABBADC11000000485159004051590010E53202C4E4320270FE5F7414E500008809C3B3C4E432025E90EF7514E53202C8E432020394EF750000000044454402F0E43202A993EF75444544029CE53202B8404402BD93EF7500000000B84044029CE53202F8E4320202000000840000003D3567004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000059004C61EF75A022590063003A005C00770069006E0064006F00770073005C00730079007300740065006D00330032005C0069006D006100670065007200650073002E0064006C006C000000570069006E0064006F00770073005C00730079007300740065006D00330032005C0069006D006100670065007200650073002E0064006C006C00000032020000000007000000E4E332021400000000000000000056007896210845D397750C12000000000000FA279C777896210814E432025F389C7764389C772279967578962108FA279C770000000000000000FFFFFFFF0000000000000000A21000004CE432023B600D77087C7C000000000047600D773F09C3B300000000A21000000000000024E432026C006C0050E4320200000000E8E43202A2100000081C09086CE43202B0FE5F74081C0908E8E43202A2100000000000000000004098E4320237C30D77C4000300A210000000000000F0E93202A2100000CDABBADC11000000485159004051590010E53202C4E4320270FE5F7414E500008809C3B3C4E432025E90EF7514E53202C8E432020394EF750000000044454402F0E43202A993EF75444544029CE53202B8404402BD93EF7500000000B84044029CE53202F8E43202
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000F6D6788197A75D498472ACE88906AC8D000000000200000000001066000000010000200000007F0C5AFCF1AE7F71286A81A9B86E67A7BE47980777E154AD953E683E2064784E000000000E8000000002000020000000C547D0854BEA52CCDED7859B79990A863903B335001ED826D40C3D8E323F237F30000000DF0FBC24E15CFF4FE438F74D8486DFB808CBF3EC9160BD0CF16731298F2800053F0DC9D2737FB85ABF81EDB882A089A94000000011BAC043EAAF96F8497DEE93A36C7829C97427DA018BC7750377DAC2CC3CE4D64139784732F789D57202D54D80C3AAC2B4B5EE990B65AEF23416199647916AD4
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
4
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
33840b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exeC:\Users\admin\AppData\Local\Temp\nsi716D.tmp\System.dllexecutable
MD5:CF85183B87314359488B850F9E97A698
SHA256:3B6A5CB2A3C091814FCE297C04FB677F72732FB21615102C62A195FDC2E7DFAC
3212rundll32.exeC:\ProgramData\svcprocess043.dllexecutable
MD5:51502D7D6D188AD87213CA5942F232CF
SHA256:D5687B5C5CEC11C851E84A1D40AF3EF52607575487A70224F63458C24481076C
33840b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exeC:\Users\admin\AppData\Local\Temp\mbCHECK.dllexecutable
MD5:51502D7D6D188AD87213CA5942F232CF
SHA256:D5687B5C5CEC11C851E84A1D40AF3EF52607575487A70224F63458C24481076C
33840b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5.exeC:\Users\admin\AppData\Local\Temp\mbCHECK.exeexecutable
MD5:AF52245A09B7FAA30E5FF00375CBCCED
SHA256:34254C2DECC973DBD8F28B47690F233F5C5D3E1735EE20A6B8DD1DBE80D16D81
3212rundll32.exeC:\Users\admin\AppData\Local\Temp\qln.dbxtext
MD5:17E62166FC8586DFA4D1BC0E1742C08B
SHA256:44CB730C420480A0477B505AE68AF508FB90F96CF0EC54C6AD16949DD427F13A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
5
DNS requests
1
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1388
explorer.exe
POST
403
85.17.156.37:80
http://sinfulcelebs.freesexycomics.com/wp05/wp-admin/includes/tmp/tmp.php?id=304295033012926164930087FD10-c8a7af419640516616c342b13efab&v1=043&v2=498139398&q=45474bca5c3a10c8e94e56543c2bd
unknown
html
548 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1388
explorer.exe
85.17.156.37:80
sinfulcelebs.freesexycomics.com
LeaseWeb Netherlands B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
sinfulcelebs.freesexycomics.com
  • 85.17.156.37
unknown

Threats

PID
Process
Class
Message
1388
explorer.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT LightsOut EK POST Compromise POST
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0b74282d9c03affb25bbecf28d5155c582e246f0ce21be27b75504f1779707f5