File name:

11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897

Full analysis: https://app.any.run/tasks/abf50c2c-44c9-405e-a015-920b8cb33055
Verdict: Malicious activity
Analysis date: November 23, 2024, 19:51:54
OS: Windows 11 Professional (build: 22000, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

4731AFCED628BE06B59B1DB8C919129E

SHA1:

DD4E6A90C25C5DF5BEF864A0C00AE7DC609E91F8

SHA256:

11BD90FBDA02E466CD3615D5930FA5EAFF12EB7306155F5A60FFEAB6F6B5B897

SSDEEP:

6144:oQunJsKxb4/NFTI9ACa7k/GGjoRsBLp4WP7GOAtBW8:oQEjxb4nI9fa7k/Xjf3P7ELW8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

    • Changes the login/logoff helper path in the registry

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

  • SUSPICIOUS

    • The process checks if it is being run in the virtual environment

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

    • Reads the date of Windows installation

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

    • Reads the Internet Settings

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

    • Reads security settings of Internet Explorer

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

    • There is functionality for taking screenshot (YARA)

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

  • INFO

    • Reads the computer name

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

    • Checks supported languages

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)

    • Checks proxy server information

      • 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe (PID: 1492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1998:02:03 07:29:08+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 5.11
CodeSize: 10240
InitializedDataSize: 223232
UninitializedDataSize: -
EntryPoint: 0x154c
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.2
ProductVersionNumber: 5.0.7.9
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileVersion: 3.0.0.2
ProductVersion: 5.0.7.9
FileDescription: Unbasedness
CompanyName: FRISK Software International
LegalCopyright: textilist
ProductName: dropflower
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
113
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe

Process information

PID
CMD
Path
Indicators
Parent process
1492"C:\Users\admin\Desktop\11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe" C:\Users\admin\Desktop\11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe
explorer.exe
User:
admin
Company:
FRISK Software International
Integrity Level:
MEDIUM
Description:
Unbasedness
Version:
3.0.0.2
Modules
Images
c:\users\admin\desktop\11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64base.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64con.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
Total events
3 805
Read events
3 791
Write events
14
Delete events
0

Modification events

(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:dc123c8a
Value:
C:\Users\admin\Desktop\11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exe
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:userinit
Value:
C:\Windows\system32\userinit.exe,,
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1492) 11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897.exeKey:HKEY_CURRENT_USER\Software\Microsoft
Operation:writeName:dc123c1ca
Value:
2225875
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
31
DNS requests
35
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4928
MoUsoCoreWorker.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?74b7d417c4f58613
unknown
—
—
whitelisted
—
—
GET
200
88.221.110.147:80
http://www.msftconnecttest.com/connecttest.txt
unknown
—
—
whitelisted
6368
firefox.exe
POST
200
2.16.241.15:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
6368
firefox.exe
POST
200
192.229.221.95:80
http://ocsp.digicert.com/
unknown
—
—
whitelisted
6368
firefox.exe
POST
200
2.16.241.8:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
—
—
HEAD
200
23.52.182.8:443
https://fs.microsoft.com/fs/windows/config.json
unknown
—
—
—
6368
firefox.exe
POST
200
2.16.241.15:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
2860
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3e134dd2738d4661
unknown
—
—
whitelisted
2860
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/pinrulesstl.cab?8a3f5205275d40c7
unknown
—
—
whitelisted
2860
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2356e5d8e5bd8b39
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6368
firefox.exe
34.149.100.209:443
firefox.settings.services.mozilla.com
GOOGLE
US
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
6368
firefox.exe
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
3420
rundll32.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1996
OfficeC2RClient.exe
52.109.28.46:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
GB
unknown
5052
OfficeC2RClient.exe
52.109.28.46:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
GB
unknown
5552
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
88.221.110.147:80
—
Akamai International B.V.
DE
unknown
4928
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4928
MoUsoCoreWorker.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
firefox.settings.services.mozilla.com
  • 34.149.100.209
whitelisted
incoming.telemetry.mozilla.org
  • 34.120.208.123
whitelisted
prod.remote-settings.prod.webservices.mozgcp.net
  • 34.149.100.209
whitelisted
telemetry-incoming.r53-2.services.mozilla.com
  • 34.120.208.123
whitelisted
google.com
  • 142.250.185.174
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
www.bing.com
  • 2.19.96.19
  • 2.19.96.128
  • 2.19.96.130
  • 2.19.96.16
  • 2.19.96.42
  • 2.19.96.8
  • 2.19.96.9
  • 2.19.96.25
  • 2.19.96.11
whitelisted
nonasthmatic.com
  • —
unknown
ecs.office.com
  • 52.113.194.132
whitelisted
mrodevicemgr.officeapps.live.com
  • 52.109.89.117
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Microsoft Connection Test
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
11bd90fbda02e466cd3615d5930fa5eaff12eb7306155f5a60ffeab6f6b5b897