File name:

xxx.exe

Full analysis: https://app.any.run/tasks/925decdc-6ad8-4a49-ab02-03ca0df03b63
Verdict: Malicious activity
Analysis date: March 21, 2025, 19:28:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

79E5ECFD1B4C47E993E492E4DFEB18E2

SHA1:

EB981081DBC1807BE1937DA09DC82000C1A932C3

SHA256:

0D9BD0D950AD2644E3231BCEF9CEB514F8126F805AC69E5444ABA00C807AB2EB

SSDEEP:

98304:r0hRYMMNwe1YuOZuLdnIBtFXrnSPN65lt9vgDIeyJYhHAmNYtmJ1Y7vvK1WynJiR:zwqI4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process creates executable files without a name

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Reads the date of Windows installation

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Executable content was dropped or overwritten

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Runs WScript without displaying logo

      • wscript.exe (PID: 6620)
      • wscript.exe (PID: 7620)
      • wscript.exe (PID: 8120)

    • The process executes VB scripts

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Uses ATTRIB.EXE to modify file attributes

      • wscript.exe (PID: 6620)
      • wscript.exe (PID: 7620)
      • wscript.exe (PID: 8120)

    • Reads security settings of Internet Explorer

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6620)
      • wscript.exe (PID: 7620)
      • wscript.exe (PID: 8120)

    • Access Product Name via WMI (SCRIPT)

      • wscript.exe (PID: 6620)
      • wscript.exe (PID: 7620)
      • wscript.exe (PID: 8120)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 6620)
      • wscript.exe (PID: 7620)
      • wscript.exe (PID: 8120)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6620)
      • wscript.exe (PID: 7620)
      • wscript.exe (PID: 8120)

  • INFO

    • The sample compiled with english language support

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Create files in a temporary directory

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Checks supported languages

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Reads the computer name

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Process checks computer location settings

      • xxx.exe (PID: 6108)
      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8076)

    • Checks proxy server information

      • mshta.exe (PID: 6184)
      • mshta.exe (PID: 7752)
      • slui.exe (PID: 7444)

    • Manual execution by a user

      • xxx.exe (PID: 7576)
      • xxx.exe (PID: 8028)
      • xxx.exe (PID: 8076)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6184)
      • mshta.exe (PID: 7752)
      • mshta.exe (PID: 7176)

    • Reads the software policy settings

      • slui.exe (PID: 6388)
      • slui.exe (PID: 7444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.2)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2018:02:01 20:47:38+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Large address aware
PEType: PE32+
LinkerVersion: 2.5
CodeSize: 86528
InitializedDataSize: 5585920
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 0.6.6.6
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: NotReal96
FileDescription: xxx
LegalCopyright: Copyright (c) 2021 NotReal96
ProductName: xxx
ProductVersion: 6.6.6
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
20
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xxx.exe wscript.exe no specs attrib.exe no specs conhost.exe no specs mshta.exe no specs sppextcomobj.exe no specs slui.exe xxx.exe wscript.exe no specs attrib.exe no specs conhost.exe no specs mshta.exe no specs xxx.exe no specs xxx.exe wscript.exe no specs attrib.exe no specs conhost.exe no specs mshta.exe no specs slui.exe xxx.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4120C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4560"C:\Windows\System32\attrib.exe" +s +h .C:\Windows\System32\attrib.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
5072"C:\Users\admin\Desktop\xxx.exe" C:\Users\admin\Desktop\xxx.exe—explorer.exe
User:
admin
Company:
NotReal96
Integrity Level:
MEDIUM
Description:
xxx
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\xxx.exe
c:\windows\system32\ntdll.dll
5988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—attrib.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6108"C:\Users\admin\Desktop\xxx.exe" C:\Users\admin\Desktop\xxx.exe
explorer.exe
User:
admin
Company:
NotReal96
Integrity Level:
HIGH
Description:
xxx
Exit code:
0
Modules
Images
c:\users\admin\desktop\xxx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
6184"C:\Windows\System32\mshta.exe" VBScript:MsgBox("The trust of the innocent is the liar's most useful tool.",16)(Close)C:\Windows\System32\mshta.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
6388"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6620"C:\WINDOWS\system32\wscript.exe" C:\Users\admin\AppData\Local\Temp\B5E4.tmp\B5E5.tmp\B5E6.vbs //Nologo C:\Windows\System32\wscript.exe—xxx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
7176"C:\Windows\System32\mshta.exe" VBScript:MsgBox("The trust of the innocent is the liar's most useful tool.",16)(Close)C:\Windows\System32\mshta.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
7444C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 492
Read events
5 486
Write events
6
Delete events
0

Modification events

(PID) Process:(6184) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6184) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6184) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7752) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
3
Suspicious files
0
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
7576xxx.exeC:\Users\admin\AppData\Local\Temp\ED21.tmp\ED22.tmp\ED23.vbstext
MD5:EB5BA5C6E50727650E165051BF9C8B96
SHA256:8CDD5BDEB3A202F04649D734CC0E2D4E331F10C2374F726FAF9563CAC8C539DD
8076xxx.exeC:\Users\admin\AppData\Local\Temp\2344.tmp\.exeexecutable
MD5:F0685D8B92BF1AA12B4E8C09E1B0746B
SHA256:64DAF44B60287D84D4D3586F71CE336A853D9DAE4F373A1CC28957FD0ED4D3FF
7576xxx.exeC:\Users\admin\AppData\Local\Temp\ED21.tmp\.exeexecutable
MD5:F0685D8B92BF1AA12B4E8C09E1B0746B
SHA256:64DAF44B60287D84D4D3586F71CE336A853D9DAE4F373A1CC28957FD0ED4D3FF
8076xxx.exeC:\Users\admin\AppData\Local\Temp\2344.tmp\2345.tmp\2356.vbstext
MD5:EB5BA5C6E50727650E165051BF9C8B96
SHA256:8CDD5BDEB3A202F04649D734CC0E2D4E331F10C2374F726FAF9563CAC8C539DD
8076xxx.exeC:\Users\admin\AppData\Local\Temp\2344.tmp\.cmdtext
MD5:CB31B25771CBA4E635CD995E0F370F54
SHA256:3AB1CCAF4E8BB02A4BF2EB39AB2435466527CF22922E27AE4DB75B6D09F3FF73
6108xxx.exeC:\Users\admin\AppData\Local\Temp\B5E4.tmp\B5E5.tmp\B5E6.vbstext
MD5:EB5BA5C6E50727650E165051BF9C8B96
SHA256:8CDD5BDEB3A202F04649D734CC0E2D4E331F10C2374F726FAF9563CAC8C539DD
7576xxx.exeC:\Users\admin\AppData\Local\Temp\ED21.tmp\.cmdtext
MD5:CB31B25771CBA4E635CD995E0F370F54
SHA256:3AB1CCAF4E8BB02A4BF2EB39AB2435466527CF22922E27AE4DB75B6D09F3FF73
6108xxx.exeC:\Users\admin\AppData\Local\Temp\B5E4.tmp\.exeexecutable
MD5:F0685D8B92BF1AA12B4E8C09E1B0746B
SHA256:64DAF44B60287D84D4D3586F71CE336A853D9DAE4F373A1CC28957FD0ED4D3FF
6108xxx.exeC:\Users\admin\AppData\Local\Temp\B5E4.tmp\.cmdtext
MD5:CB31B25771CBA4E635CD995E0F370F54
SHA256:3AB1CCAF4E8BB02A4BF2EB39AB2435466527CF22922E27AE4DB75B6D09F3FF73
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.110.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7952
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7952
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6712
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
88.221.110.114:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6712
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6712
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7952
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 88.221.110.114
  • 88.221.110.122
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 20.197.71.89
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.22
  • 20.190.160.132
  • 40.126.32.74
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.72
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
xxx.exe