File name:

Mari.exe.v

Full analysis: https://app.any.run/tasks/68d4aa63-d04b-48db-85ec-d4d29744ed8b
Verdict: Malicious activity
Analysis date: August 31, 2024, 17:16:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
websocket
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

DD3D5384657CD3890F8816B0A4B2F7D9

SHA1:

05A9047391140F9CEF70860F38137827D9FD63D1

SHA256:

118E7E258E4D9ADBC45ADDBE4E832933DCD8F728A398D3D8480E009EA11D4B95

SSDEEP:

98304:BUdB0OgQlKNKxxu7FXlgnPz/WcEJg28DFnZ1qo0bWxVo1tF+vm0+R99CqF59RCkt:od

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • reg.exe (PID: 236)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Mari.exe.v.exe (PID: 3728)
      • ShellExperienceHost.exe (PID: 2264)

    • Process uses IPCONFIG to discover network configuration

      • cmd.exe (PID: 5532)
      • cmd.exe (PID: 5516)

    • Mutex name with non-standard characters

      • Mari.exe.v.exe (PID: 3728)
      • uc_ctrl.exe (PID: 6824)

    • Starts CMD.EXE for commands execution

      • Mari.exe.v.exe (PID: 3728)
      • uc_ctrl.exe (PID: 6824)

    • Reads the date of Windows installation

      • Mari.exe.v.exe (PID: 3728)

    • Executing commands from a ".bat" file

      • Mari.exe.v.exe (PID: 3728)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 368)

    • Drops the executable file immediately after the start

      • Mari.exe.v.exe (PID: 3728)
      • uc_ctrl.exe (PID: 6824)
      • cmd.exe (PID: 4996)

    • Process drops legitimate windows executable

      • Mari.exe.v.exe (PID: 3728)
      • uc_ctrl.exe (PID: 6824)

    • Executable content was dropped or overwritten

      • Mari.exe.v.exe (PID: 3728)
      • cmd.exe (PID: 4996)
      • uc_ctrl.exe (PID: 6824)

    • The process drops C-runtime libraries

      • Mari.exe.v.exe (PID: 3728)
      • uc_ctrl.exe (PID: 6824)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 4996)
      • uc_ctrl.exe (PID: 6824)

    • There is functionality for taking screenshot (YARA)

      • uc_ctrl.exe (PID: 6824)

    • Connects to unusual port

      • uc_ctrl.exe (PID: 6824)

  • INFO

    • Reads the computer name

      • Mari.exe.v.exe (PID: 3728)
      • ShellExperienceHost.exe (PID: 2264)
      • uc_ctrl.exe (PID: 6824)

    • Checks supported languages

      • Mari.exe.v.exe (PID: 3728)
      • ShellExperienceHost.exe (PID: 2264)
      • uc_ctrl.exe (PID: 6824)

    • The process uses the downloaded file

      • Mari.exe.v.exe (PID: 3728)
      • mmc.exe (PID: 568)

    • Creates files or folders in the user directory

      • Mari.exe.v.exe (PID: 3728)

    • Process checks computer location settings

      • Mari.exe.v.exe (PID: 3728)

    • Reads security settings of Internet Explorer

      • mmc.exe (PID: 568)

    • UPX packer has been detected

      • Mari.exe.v.exe (PID: 3728)
      • uc_ctrl.exe (PID: 6824)

    • Reads CPU info

      • uc_ctrl.exe (PID: 6824)

    • Creates files in the program directory

      • uc_ctrl.exe (PID: 6824)

    • Attempting to connect via WebSocket

      • uc_ctrl.exe (PID: 6824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:29 14:59:49+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.34
CodeSize: 2002432
InitializedDataSize: 2785792
UninitializedDataSize: -
EntryPoint: 0x1b8fd8
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
18
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start THREAT mari.exe.v.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs shellexperiencehost.exe no specs cmd.exe conhost.exe no specs mmc.exe no specs THREAT uc_ctrl.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs mari.exe.v.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
368"C:\WINDOWS\System32\cmd.exe" /C "C:\Users\admin\AppData\Roaming\V49TG.bat" C:\Windows\System32\cmd.exe—Mari.exe.v.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
568C:\WINDOWS\system32\mmc.exe -EmbeddingC:\Windows\System32\mmc.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mmc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1656\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2056reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2264"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
2268ipconfig /allC:\Windows\System32\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
3728"C:\Users\admin\Desktop\Mari.exe.v.exe" C:\Users\admin\Desktop\Mari.exe.v.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\mari.exe.v.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4996"C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Documents\G0g6D\crP9L~i\p+C:\Users\Public\Documents\G0g6D\crP9L~i\w C:\Users\Public\Documents\G0g6D\crP9L~i\uc_guilib.dllC:\Windows\System32\cmd.exe
Mari.exe.v.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
5124\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 116
Read events
9 093
Write events
23
Delete events
0

Modification events

(PID) Process:(3728) Mari.exe.v.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3728) Mari.exe.v.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3728) Mari.exe.v.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3728) Mari.exe.v.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3728) Mari.exe.v.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(3728) Mari.exe.v.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(2056) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:ConsentPromptBehaviorAdmin
Value:
0
(PID) Process:(236) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(7108) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:PromptOnSecureDesktop
Value:
0
(PID) Process:(2264) ShellExperienceHost.exeKey:\REGISTRY\A\{cdc231bb-663a-6536-6dc4-52d67b64887f}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D000000E6170AA0C9FBDA01
Executable files
9
Suspicious files
3
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3728Mari.exe.v.exeC:\Users\admin\AppData\Roaming\V49TG.battext
MD5:30D6EB22D6AEEC10347239B17B023BF4
SHA256:659DF6B190A0B92FC34E3A4457B4A8D11A26A4CAF55DE64DFE79EB1276181F08
3728Mari.exe.v.exeC:\Users\Public\Documents\G0g6D\crP9L~i\pexecutable
MD5:35BE128BD588225161C645A210E4F0E2
SHA256:EA4795AFBDFE57E69E180A76C141055C1E5620C0B28D53448362E540C721F721
4996cmd.exeC:\Users\Public\Documents\G0g6D\crP9L~i\uc_guilib.dllexecutable
MD5:5730626B6EB0DDAEAF62989207C47F92
SHA256:CF967D3E57770AABCB718D723D3625A1A3ADC9F5291E5C668CF8DB4E35110B3C
6824uc_ctrl.exeC:\Users\admin\Videos\B55AED17~i\NH.TXTbinary
MD5:4CD521A33C5F5086BB684174E76979B9
SHA256:3F00C8140ED52EA66B0E0F645A4680752324381C4959472B7D61830AB035D59D
3728Mari.exe.v.exeC:\Users\Public\Documents\G0g6D\crP9L~i\wbinary
MD5:F7EA5667EC13663B2C82808E553D862C
SHA256:CC1C96CA2F1F329D79D09E3E7F0BA29CCF6A80567ED58435AB4696371A12E694
6824uc_ctrl.exeC:\Users\admin\Videos\B55AED17~i\msvcp140.dllexecutable
MD5:1D8C79F293CA86E8857149FB4EFE4452
SHA256:C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
6824uc_ctrl.exeC:\Users\admin\Videos\B55AED17~i\uc_guilib.dllexecutable
MD5:5730626B6EB0DDAEAF62989207C47F92
SHA256:CF967D3E57770AABCB718D723D3625A1A3ADC9F5291E5C668CF8DB4E35110B3C
6824uc_ctrl.exeC:\Users\admin\Videos\B55AED17~i\vcruntime140.dllexecutable
MD5:B77EEAEAF5F8493189B89852F3A7A712
SHA256:B7C13F8519340257BA6AE3129AFCE961F137E394DDE3E4E41971B9F912355F5E
3728Mari.exe.v.exeC:\Users\Public\Documents\G0g6D\crP9L~i\NH.TXTbinary
MD5:4CD521A33C5F5086BB684174E76979B9
SHA256:3F00C8140ED52EA66B0E0F645A4680752324381C4959472B7D61830AB035D59D
3728Mari.exe.v.exeC:\Users\Public\Documents\G0g6D\crP9L~i\msvcp140.dllexecutable
MD5:1D8C79F293CA86E8857149FB4EFE4452
SHA256:C09B126E7D4C1E6EFB3FFCDA2358252CE37383572C78E56CA97497A7F7C793E4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
16
DNS requests
4
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6824
uc_ctrl.exe
GET
101
143.92.57.75:15628
http://143.92.57.75:15628/\
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6516
svchost.exe
20.49.150.241:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
6412
RUXIMICS.exe
20.49.150.241:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
2120
MoUsoCoreWorker.exe
20.49.150.241:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
2120
MoUsoCoreWorker.exe
52.167.249.196:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6516
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6824
uc_ctrl.exe
143.92.57.75:15628
—
BGPNET Global ASN
HK
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.49.150.241
  • 52.167.249.196
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.110
whitelisted

Threats

PID
Process
Class
Message
6824
uc_ctrl.exe
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
6824
uc_ctrl.exe
Generic Protocol Command Decode
SURICATA HTTP Request line incomplete
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Mari.exe.v