File name:

1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2

Full analysis: https://app.any.run/tasks/564824ec-67a0-4347-bb5a-88e47cdde1bb
Verdict: Malicious activity
Analysis date: January 10, 2025, 21:08:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
expiro
sinkhole
m0yv
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

690A2CBB7F785F6F90A0B510F31D40DE

SHA1:

624E1B8B472706E33E7D9B90AC1626153854433F

SHA256:

1273E390EAB2F69AA5ED380F296A7CD6C8FF01142367FE5DD76EAE5F515947E2

SSDEEP:

49152:ZHlGA9WQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZR:mA4QX21RBt7QjTmcaTH/vU4do9Pcjq1d

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • EXPIRO has been detected (SURICATA)

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Connects to the CnC server

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Request for a sinkholed resource

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Expiro has been found (SURICATA)

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • M0YV has been detected (YARA)

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

  • SUSPICIOUS

    • Executes application which crashes

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Process drops legitimate windows executable

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Executable content was dropped or overwritten

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Contacting a server suspected of hosting an CnC

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

  • INFO

    • Creates files or folders in the user directory

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)
      • WerFault.exe (PID: 6760)

    • Reads mouse settings

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • The sample compiled with english language support

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Checks proxy server information

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)
      • WerFault.exe (PID: 6760)

    • Checks supported languages

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Reads the computer name

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • The process uses AutoIt

      • 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe (PID: 6576)

    • Reads the software policy settings

      • WerFault.exe (PID: 6760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x27dcd
UninitializedDataSize: -
InitializedDataSize: 598528
CodeSize: 581120
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:09 11:30:17+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #EXPIRO 1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe svchost.exe no specs werfault.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6576"C:\Users\admin\AppData\Local\Temp\1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe" C:\Users\admin\AppData\Local\Temp\1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6636"C:\Users\admin\AppData\Local\Temp\1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe" C:\Windows\SysWOW64\svchost.exe—1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6760C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6576 -s 1164C:\Windows\SysWOW64\WerFault.exe
1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 432
Read events
3 432
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
10
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6760WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_1273e390eab2f69a_967ca6f8733017553c5c345b228b3a52191_734e1a3f_d3dac231-61ce-40c8-9bb2-4bfaf4273386\Report.wer —
MD5:—
SHA256:—
6760WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6760WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6760WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:ECD071CEE31139E6643C441B9183FF63
SHA256:D6AA48DE59501586E64F83ADED7FC982BBF0EDCEE93401644D5D715D15408E84
6760WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:A4653BFAC36CE19844C505FF52DA54DE
SHA256:6537149E571004E8FD3C6E8BB9E0DF75FC0B789D4319C3D71A4475703389954E
6760WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe.6576.dmpbinary
MD5:A229D8496DB01F3CFB7DDF3660B1E540
SHA256:D8ABEB7A7B7A1F1115348A1B080B0B66A50D024241E93369B285F50A9743104B
65761273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exeC:\Users\admin\AppData\Local\Temp\aut5CF9.tmpbinary
MD5:EA210CBB3DB8B138FB96C70BFA3F2452
SHA256:2C964FC828D78F33A0C823FBD610B1BCF74C801A09EDE5E82EEC0572928C423E
65761273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exeC:\Users\admin\AppData\Local\Temp\Thebitbinary
MD5:2E632CF2FD60FCFDA595613C1DDA8C83
SHA256:808E1F6C73AE2292BD8F99298F685B1A07E601892E6278397E36F97A9CEFCAFB
65761273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exeC:\Users\admin\AppData\Local\Temp\teertext
MD5:5EEC4E88617FFE9EBD1D4051C4E3DBDE
SHA256:658153BEC837A54A63CA3F65082A60455C0C58CFD891BECB00467E306F26748C
65761273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeexecutable
MD5:1DF4999AEC6F66C9960243BC1E1B77A0
SHA256:E68A87A749D7755EA289AA00A0EDE6EBAA049B71E41CD9BA35D0A768BD9D3471
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
24
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2736
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5460
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6760
WerFault.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2736
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6576
1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe
POST
200
54.244.188.177:80
http://pywolwnvd.biz/mklhdetwbsetrtho
unknown
—
—
malicious
6760
WerFault.exe
GET
200
23.48.23.154:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6576
1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe
POST
200
18.141.10.107:80
http://ssbzmoy.biz/fihhrmreskweta
unknown
—
—
malicious
6280
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5460
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2736
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
2736
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6576
1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2.exe
54.244.188.177:80
pywolwnvd.biz
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 4.231.128.59
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 23.48.23.154
  • 23.48.23.155
  • 23.48.23.157
  • 23.48.23.168
  • 23.48.23.162
  • 23.48.23.161
  • 23.48.23.151
  • 23.48.23.153
  • 23.48.23.167
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.37.237.227
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.68
  • 40.126.31.73
whitelisted
pywolwnvd.biz
  • 54.244.188.177
malicious
go.microsoft.com
  • 2.23.242.9
whitelisted
ssbzmoy.biz
  • 18.141.10.107
malicious

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
—
—
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
—
—
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
—
—
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
1273e390eab2f69aa5ed380f296a7cd6c8ff01142367fe5dd76eae5f515947e2