File name:

Internet Explorer Portable By TutorialesMatut258.exe

Full analysis: https://app.any.run/tasks/f48f8565-7a7a-4046-936d-8c20f0feaae6
Verdict: Malicious activity
Analysis date: May 19, 2023, 07:43:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

6467A8CFD36D8F5BE1D93A70756650E3

SHA1:

B9BA8A931BB3247ED2DCC8C1B043E6DE62E1DB7E

SHA256:

0EA1AF923F15D14AA268F4556F0879CDD7B090C94589720AF93ED3D3F9DC80B8

SSDEEP:

49152:Q83FNRTCE2/tQb3IsKMJia64WuQ4axKFXwhF0HkifdC:R72/tHMJiayuQkwh8kifdC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

    • Reads Microsoft Outlook installation path

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

    • Reads Internet Explorer settings

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

    • Executable content was dropped or overwritten

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

    • Creates executable files that already exist in Windows

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

  • INFO

    • Checks supported languages

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

    • Reads the computer name

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

    • Checks proxy server information

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

    • The process checks LSA protection

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)
      • explorer.exe (PID: 2756)

    • Reads the machine GUID from the registry

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)

    • Manual execution by a user

      • explorer.exe (PID: 2756)

    • Create files in a temporary directory

      • Internet Explorer Portable By TutorialesMatut258.exe (PID: 3988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | WinRAR Self Extracting archive (94.8)
.scr | Windows screen saver (2.3)
.dll | Win32 Dynamic Link Library (generic) (1.2)
.exe | Win32 Executable (generic) (0.8)
.exe | Generic Win/DOS Executable (0.3)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x1000
UninitializedDataSize: -
InitializedDataSize: 218112
CodeSize: 81920
LinkerVersion: 5
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2007:09:20 12:34:46+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 20-Sep-2007 12:34:46
Detected languages:
  • Process Default Language
  • Russian - Russia

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000200

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 20-Sep-2007 12:34:46
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00014000
0x00013800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.46548
.data
0x00015000
0x00007000
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.90968
.idata
0x0001C000
0x00001000
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.12446
.rsrc
0x0001D000
0x00033930
0x00033A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.683

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.06643
831
Latin 1 / Western European
Russian - Russia
RT_MANIFEST
2
3.37095
296
Latin 1 / Western European
Process Default Language
RT_ICON
3
5.81329
3752
Latin 1 / Western European
Process Default Language
RT_ICON
4
6.39217
2216
Latin 1 / Western European
Process Default Language
RT_ICON
5
5.47785
1384
Latin 1 / Western European
Process Default Language
RT_ICON
6
7.88292
50469
Latin 1 / Western European
Process Default Language
RT_ICON
7
3.24143
556
Latin 1 / Western European
Russian - Russia
RT_STRING
8
3.28574
946
Latin 1 / Western European
Russian - Russia
RT_STRING
9
3.04375
530
Latin 1 / Western European
Russian - Russia
RT_STRING
10
3.15563
638
Latin 1 / Western European
Russian - Russia
RT_STRING

Imports

ADVAPI32.DLL
COMCTL32.DLL
COMDLG32.DLL
GDI32.DLL
KERNEL32.DLL
OLE32.DLL
SHELL32.DLL
USER32.DLL
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start internet explorer portable by tutorialesmatut258.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2756"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3988"C:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258.exe" C:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\internet explorer portable by tutorialesmatut258.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
628
Read events
614
Write events
14
Delete events
0

Modification events

(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003D010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000003E010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A80164000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3988) Internet Explorer Portable By TutorialesMatut258.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
39
Suspicious files
0
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\icwhelp.dllexecutable
MD5:DB5370284B6EB48674457146A757950E
SHA256:07C46F37D4130531F2878605E12CAD6B3AA25ECC679C467DB14C6C0E18C69FC5
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\icwip.duntext
MD5:E8D666CE68D8EBB426D53F50B7CA7161
SHA256:89ADF014AB49918703AA826D51668E6972179EAD2A25C51FF46121312F025A41
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\icwdl.dllexecutable
MD5:69620428BE1EBF9A96AC1E0DFE699577
SHA256:A9FFA209E8460C0AC05E2D6567BBE9745690AFBEBAF07DAFD69F5E625518CCB1
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\icwtutor.exeexecutable
MD5:2AC323944743808A30253497A92B1488
SHA256:1327EA7CCBF9E88D1B2C7B2620624972733BF780F30FC8F1A33082E74F8D8C66
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\icwutil.dllexecutable
MD5:6B60CB4ADC4F9756AB926FECA838DA67
SHA256:D655FDD0994AB058D7DFA39944518825F4FDFB9B068A0FC084D730DFB3E7D5DB
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\icwconn1.exeexecutable
MD5:17BD501D2819CF8597AEA931955B5541
SHA256:CE6C580F5992554157DCAFD795F86A4D9B06923F48FE3C0E8890CB8E0A16490C
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\icwconn.dllexecutable
MD5:84299BB8BD1902C02D36D09D6CA84225
SHA256:96B1AA826485E444BF62B8ADAAD947762C45A0686794D18CB414786AD47A68C2
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\inetwiz.exeexecutable
MD5:2B25A6F80B102520DCF9E338B448C328
SHA256:8D74215E14CE7B68138AEAE7CC159BA3208C01375E3E4BE4958288568304B189
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\msicw.isptext
MD5:2509C20A5DEC3B841A04E063DD75BD22
SHA256:E89FB4784D095FF7BC7F48B3149727EDBB340F332934EE5DA311553987F6CC42
3988Internet Explorer Portable By TutorialesMatut258.exeC:\Users\admin\AppData\Local\Temp\Internet Explorer Portable By TutorialesMatut258\Connection Wizard\msn.isptext
MD5:40388A39185A640FB544123001F0F161
SHA256:B9F00F322F8234BDCCE0CFC46DD8FFF6C6370EAF6B03F873C2131CCA845F175A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3252
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1076
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Internet Explorer Portable By TutorialesMatut258.exe