File name:

Xbox360_64Eng.exe

Full analysis: https://app.any.run/tasks/c340bded-cfd3-4ec4-9e7b-201b76cfb4c1
Verdict: Malicious activity
Analysis date: March 19, 2024, 03:37:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4C7FBAD5BBEBC0D3807129092A1DE4B9

SHA1:

00F7246437C53F3ABA5516AC3FC572181C24C666

SHA256:

0E72ED6D89D9B89690FDE8122F46FA851740EF18E850D98D45E56F85A6682994

SSDEEP:

98304:BSUCTRhlUVz71eG+Ybiy/j+Hu9Oy5fNFDm9DOTJ7AHzJJRFlzHObR8AJrYE/0eeN:BYTFEnT0y/+SrK9+JMHFDzxpE/U

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Xbox360_64Eng.exe (PID: 3956)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Xbox360_64Eng.exe (PID: 3956)

    • Executable content was dropped or overwritten

      • Xbox360_64Eng.exe (PID: 3956)

    • Drops a system driver (possible attempt to evade defenses)

      • Xbox360_64Eng.exe (PID: 3956)

    • Starts a Microsoft application from unusual location

      • Xbox360_64Eng.exe (PID: 3956)

    • Reads the Internet Settings

      • setup.exe (PID: 1348)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 1348)

  • INFO

    • Checks supported languages

      • Xbox360_64Eng.exe (PID: 3956)
      • setup.exe (PID: 1348)
      • setupstb.exe (PID: 2256)

    • Reads the computer name

      • Xbox360_64Eng.exe (PID: 3956)
      • setup.exe (PID: 1348)

    • Reads Environment values

      • Xbox360_64Eng.exe (PID: 3956)

    • Reads the machine GUID from the registry

      • Xbox360_64Eng.exe (PID: 3956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (82.5)
.exe | Win32 Executable MS Visual C++ (generic) (7.3)
.exe | Win64 Executable (generic) (6.5)
.dll | Win32 Dynamic Link Library (generic) (1.5)
.exe | Win32 Executable (generic) (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2005:06:28 16:55:01+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 7.1
CodeSize: 31232
InitializedDataSize: 72704
UninitializedDataSize: -
EntryPoint: 0x5a45
OSVersion: 5.2
ImageVersion: 5.2
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.2.29.0
ProductVersionNumber: 6.2.29.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Self-Extracting Cabinet
FileVersion: 6.2.0029.0 (SRV03_QFE.031113-0918)
InternalName: SFXCAB.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: SFXCAB.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.2.0029.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start xbox360_64eng.exe setup.exe no specs setup.exe setupstb.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1348c:\7cb7b01788a796a77e6f8775ad\setup.exeC:\7cb7b01788a796a77e6f8775ad\setup.exe
Xbox360_64Eng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup.exe
Exit code:
1
Version:
1.20.146.0
Modules
Images
c:\7cb7b01788a796a77e6f8775ad\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2256"C:\7cb7b01788a796a77e6f8775ad\setupstb.exe" C:\7cb7b01788a796a77e6f8775ad\setupstb.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
setupstb.exe
Exit code:
0
Version:
1.20.146.0
Modules
Images
c:\7cb7b01788a796a77e6f8775ad\setupstb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2580c:\7cb7b01788a796a77e6f8775ad\setup.exeC:\7cb7b01788a796a77e6f8775ad\setup.exe—Xbox360_64Eng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Setup.exe
Exit code:
3221226540
Version:
1.20.146.0
Modules
Images
c:\7cb7b01788a796a77e6f8775ad\setup.exe
c:\windows\system32\ntdll.dll
3956"C:\Users\admin\AppData\Local\Temp\Xbox360_64Eng.exe" C:\Users\admin\AppData\Local\Temp\Xbox360_64Eng.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Self-Extracting Cabinet
Exit code:
1
Version:
6.2.0029.0 (SRV03_QFE.031113-0918)
Modules
Images
c:\users\admin\appdata\local\temp\xbox360_64eng.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
559
Read events
551
Write events
8
Delete events
0

Modification events

(PID) Process:(1348) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1348) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1348) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1348) setup.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
24
Suspicious files
11
Text files
8
Unknown types
1

Dropped files

PID
Process
Filename
Type
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\lang.initext
MD5:37EB4D739414162AB9B2DC924B9F88DA
SHA256:EBB498EC3498BE69FFCE90A25BA3B67AF4D518347B7E28181C7F97905101C6C5
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\setupstb.exeexecutable
MD5:1AFFB5275B299FF887B4783CDDD14992
SHA256:93D0AB42D292EA420915873B3EEE5146F798C8AC6859CB4C018613339AE4B4BC
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\directx\dxdllreg_x86.cabcompressed
MD5:7245FD3CA887A203A94F31FF49199AB1
SHA256:5539816B24E9BC43100055B542151A9103D8498553EEE69A3E46ABBA6C360568
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\directx\dxsetup.exeexecutable
MD5:F16F4669D34AEA8ABF85AE81AA6A785C
SHA256:49393CEB849E4BB59117E18B60A541D33CD30CA475AB32E300162D76A46CA907
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\directx\dxupdate.cabcompressed
MD5:C127CEEF3E5C3140074A6310F92C36E9
SHA256:D4C3AA13868906786DC81317843350D754A04E29B89198E1D51BD85D379E21CC
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\xbox360\setup64\files\difxapi.dllexecutable
MD5:F5558C67A3ADB662D43D40A1CBDE4160
SHA256:83C43D65084CD202AA9982AF6D87C963A05035F1E2CDAC48304FA299584E3242
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\xbox360\setup64\files\ausetting.exeexecutable
MD5:A02A804D76612CFEF64245145CD6AD6F
SHA256:A64C107A9B5ACFDE6C2EA21F55166D546893DAA314B6D5E4C5B3FCFD94D9A851
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\xbox360\setup64\files\xboxstat.exeexecutable
MD5:ED43758BF94B8A5221D69F1B7F63F13D
SHA256:F6E7418823E45085F4D4F50DD25A55ED517C0A335C6C2F69A1139B30677D3DA9
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\xbox360\setup64\files\checker.exeexecutable
MD5:BCD85EB22E163A1B48EEB2498509F699
SHA256:2D79646539E19EA835B26F25F35970A5C06BF865608FDE6C27B224D2B1743EB3
3956Xbox360_64Eng.exeC:\7cb7b01788a796a77e6f8775ad\setup.exeexecutable
MD5:4D5B5599F1CB63D895307F8DEA8B674C
SHA256:9D8F858CA3201B7B04CC0564D70D3E8A809C93C69170799854D0E949D46685FF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Xbox360_64Eng.exe