File name:

0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N

Full analysis: https://app.any.run/tasks/4a7e56c8-7339-43b4-9f2d-c4d01718a10d
Verdict: Malicious activity
Analysis date: October 13, 2024, 08:32:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9DE18528C0DA222016080078BE0874A0

SHA1:

A8531BE5E12727E23DF8CEC0FC62A52ED3C11115

SHA256:

0DFEFFB1A485F778B5AC14B6CDF7F8887F622DABFB6D9DDED4F0D3D2D658FD71

SSDEEP:

768:3W102KGV1SdAdBvAwgSQs7sHIjFmAOQFpybvMyOoM5UfElPhCEG:3WqLdASLs7sHIjFLWjx5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • guefae.exe (PID: 5596)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe (PID: 6648)

    • Reads security settings of Internet Explorer

      • 0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe (PID: 6648)

  • INFO

    • Process checks computer location settings

      • 0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe (PID: 6648)

    • Checks supported languages

      • guefae.exe (PID: 5596)
      • 0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe (PID: 6648)

    • Reads the computer name

      • 0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe (PID: 6648)
      • guefae.exe (PID: 5596)

    • The process uses the downloaded file

      • 0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe (PID: 6648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2000:01:01 12:00:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 40960
InitializedDataSize: 4096
UninitializedDataSize: -
EntryPoint: 0x1184
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
Tag1: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71n.exe guefae.exe

Process information

PID
CMD
Path
Indicators
Parent process
5596"C:\Users\admin\guefae.exe" C:\Users\admin\guefae.exe
0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\guefae.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6648"C:\Users\admin\Desktop\0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe" C:\Users\admin\Desktop\0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71n.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
2 008
Read events
659
Write events
1 349
Delete events
0

Modification events

(PID) Process:(5596) guefae.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:guefae
Value:
C:\Users\admin\guefae.exe
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
66480dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N.exeC:\Users\admin\guefae.exeexecutable
MD5:DE0E46E9AAB4092710D746C7E04527FE
SHA256:55AFB31DF3DBB700816AF97B976B8D0BD54B1404B8F7D09024E4B7B4135C3B6A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5640
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5640
RUXIMICS.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5640
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.136:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5640
RUXIMICS.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5640
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
www.bing.com
  • 104.126.37.136
  • 104.126.37.137
  • 104.126.37.123
  • 104.126.37.161
  • 104.126.37.154
  • 104.126.37.128
  • 104.126.37.145
  • 104.126.37.153
  • 104.126.37.131
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ns1.theimageparlour.net
  • 206.189.185.75
whitelisted
self.events.data.microsoft.com
  • 40.79.173.41
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0dfeffb1a485f778b5ac14b6cdf7f8887f622dabfb6d9dded4f0d3d2d658fd71N