File name:

TrojanWin32.Duqu.Stuxnet.zip

Full analysis: https://app.any.run/tasks/d0faf5b0-4dd1-4935-b0b3-e91d198f9634
Verdict: Malicious activity
Analysis date: January 29, 2024, 06:43:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

03BB47F461C51203D6799919DBB37012

SHA1:

35F58153A7DDAFE0D7CCA6789EB1BB5C3AD9939E

SHA256:

152C64365B6224E065E18D9A3421ADBF94EB231AA93AC242675C6C45C7929C97

SSDEEP:

384:EwgbJqpyATfjVaWjpeHvkKEbp+A4g1Vza:E127VNjpC8bcfOG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3456)
      • csc.exe (PID: 2732)
      • csc.exe (PID: 3984)
      • csc.exe (PID: 900)
      • csc.exe (PID: 2424)
      • csc.exe (PID: 2544)

    • Starts Visual C# compiler

      • sdiagnhost.exe (PID: 1576)
      • sdiagnhost.exe (PID: 2824)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • msdt.exe (PID: 2908)

    • Reads settings of System Certificates

      • msdt.exe (PID: 2908)

    • Reads the Internet Settings

      • sdiagnhost.exe (PID: 1576)
      • msdt.exe (PID: 2908)
      • sdiagnhost.exe (PID: 2824)

    • Probably uses Microsoft diagnostics tool to execute malicious payload

      • pcwrun.exe (PID: 2756)

    • Uses .NET C# to load dll

      • sdiagnhost.exe (PID: 1576)
      • sdiagnhost.exe (PID: 2824)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2732)
      • csc.exe (PID: 3984)
      • csc.exe (PID: 2424)
      • csc.exe (PID: 900)
      • csc.exe (PID: 2544)

    • The process executes via Task Scheduler

      • win32.exe (PID: 3036)

    • Uses RUNDLL32.EXE to load library

      • msdt.exe (PID: 2908)

  • INFO

    • Manual execution by a user

      • win32.exe (PID: 680)
      • pcwrun.exe (PID: 2756)
      • win32.exe (PID: 2060)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3456)

    • Create files in a temporary directory

      • pcwrun.exe (PID: 2756)
      • sdiagnhost.exe (PID: 1576)
      • msdt.exe (PID: 2908)
      • csc.exe (PID: 2732)
      • cvtres.exe (PID: 3564)
      • csc.exe (PID: 3984)
      • cvtres.exe (PID: 1820)
      • csc.exe (PID: 900)
      • cvtres.exe (PID: 884)
      • sdiagnhost.exe (PID: 2824)
      • csc.exe (PID: 2424)
      • csc.exe (PID: 2544)
      • cvtres.exe (PID: 2528)
      • cvtres.exe (PID: 2492)

    • Reads security settings of Internet Explorer

      • sdiagnhost.exe (PID: 1576)
      • msdt.exe (PID: 2908)
      • sdiagnhost.exe (PID: 2824)

    • Drops the executable file immediately after the start

      • msdt.exe (PID: 2908)

    • Checks supported languages

      • csc.exe (PID: 2732)
      • csc.exe (PID: 3984)
      • cvtres.exe (PID: 1820)
      • csc.exe (PID: 900)
      • cvtres.exe (PID: 884)
      • cvtres.exe (PID: 3564)
      • csc.exe (PID: 2424)
      • cvtres.exe (PID: 2492)
      • cvtres.exe (PID: 2528)
      • csc.exe (PID: 2544)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 2732)
      • csc.exe (PID: 3984)
      • cvtres.exe (PID: 3564)
      • cvtres.exe (PID: 1820)
      • csc.exe (PID: 900)
      • cvtres.exe (PID: 884)
      • cvtres.exe (PID: 2492)
      • csc.exe (PID: 2424)
      • csc.exe (PID: 2544)
      • cvtres.exe (PID: 2528)

    • Creates files or folders in the user directory

      • sdiagnhost.exe (PID: 1576)
      • msdt.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2010:10:19 11:39:50
ZipCRC: 0xe2d1e9bb
ZipCompressedSize: 13135
ZipUncompressedSize: 24960
ZipFileName: win32.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
61
Monitored processes
19
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe win32.exe no specs win32.exe pcwrun.exe no specs msdt.exe no specs sdiagnhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs rundll32.exe no specs win32.exe no specs sdiagnhost.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\Users\admin\Desktop\win32.exe" C:\Users\admin\Desktop\win32.exe—explorer.exe
User:
admin
Company:
IBM Corporation ©
Integrity Level:
MEDIUM
Description:
IBM ServeRAID Controller Driver
Exit code:
0
Version:
4.33.0.12
Modules
Images
c:\users\admin\desktop\win32.exe
c:\windows\system32\ntdll.dll
884C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESB93.tmp" "c:\Users\admin\AppData\Local\Temp\CSCB92.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
900"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\kqhduwtw.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
948"C:\Windows\System32\rundll32.exe" C:\Windows\system32\pcwutl.dll,CreateAndRunTask -path "C:\Users\admin\Desktop\win32.exe"C:\Windows\System32\rundll32.exe—msdt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1576C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sdiagnhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1820C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESAB9.tmp" "c:\Users\admin\AppData\Local\Temp\CSCAB8.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2060"C:\Users\admin\Desktop\win32.exe" C:\Users\admin\Desktop\win32.exe
explorer.exe
User:
admin
Company:
IBM Corporation ©
Integrity Level:
HIGH
Description:
IBM ServeRAID Controller Driver
Exit code:
0
Version:
4.33.0.12
Modules
Images
c:\users\admin\desktop\win32.exe
c:\windows\system32\ntdll.dll
2424"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ogmoenuq.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2492C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES4D01.tmp" "c:\Users\admin\AppData\Local\Temp\CSC4D00.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
2528C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES4D7E.tmp" "c:\Users\admin\AppData\Local\Temp\CSC4D7D.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
Total events
8 762
Read events
8 697
Write events
65
Delete events
0

Modification events

(PID) Process:(3456) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3456) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2908) msdt.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
10
Suspicious files
27
Text files
43
Unknown types
0

Dropped files

PID
Process
Filename
Type
2908msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_7abfc923-603d-471d-a8c1-18d4bf3c72dd\TS_ProgramCompatibilityWizard.ps1text
MD5:46E22C2582B54BE56D80D7A79FEC9BB5
SHA256:459AF2960B08E848573D45A7350223657ADB2115F24A3C37E69FFE61DEA647F9
2732csc.exeC:\Users\admin\AppData\Local\Temp\CSCA3B.tmpbinary
MD5:C1A296DD84BA09DAD3B804E287630947
SHA256:ED0B3BB118E02E6D9F714AEE95FFDBE40BCCB4241C2EFDD81453CF1ED10C0775
2908msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_7abfc923-603d-471d-a8c1-18d4bf3c72dd\en-US\DiagPackage.dll.muiexecutable
MD5:C31BD28AB34E75BC65A5458AC8D37539
SHA256:5FB9E280013D58043C5689478F9DCFAD3212F4681534627EB33998DDD6F63308
2908msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_7abfc923-603d-471d-a8c1-18d4bf3c72dd\RS_ProgramCompatibilityWizard.ps1text
MD5:367FE5F4C6DB87E1600F46687E5AAC54
SHA256:177625AC9B07BBFFCBBB47101C2D1121F47B03B42226861BFD7974B9CEBC0C98
2908msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_7abfc923-603d-471d-a8c1-18d4bf3c72dd\VF_ProgramCompatibilityWizard.ps1text
MD5:C219205ABF50BB950B93D0824D483780
SHA256:5284D805B918F161565150EC64B787E4EA681DE69B1AD832F316F94DB6DBCB75
2908msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_7abfc923-603d-471d-a8c1-18d4bf3c72dd\result\results.xslxml
MD5:310E1DA2344BA6CA96666FB639840EA9
SHA256:67401342192BABC27E62D4C1E0940409CC3F2BD28F77399E71D245EAE8D3F63C
1576sdiagnhost.exeC:\Users\admin\AppData\Local\Temp\oxvr6yxz.cmdlinetext
MD5:4AC719C24463D4B075BE56AE95F7965D
SHA256:6A4870B80FA2FC824396963294B09C910E62D8D3C967053C31EB2D625F65726A
1576sdiagnhost.exeC:\Users\admin\AppData\Local\Temp\oxvr6yxz.0.cstext
MD5:B0DC59B099CA7C12FB8AD72D3C50C82C
SHA256:E75EAAA3D7908FB05000C0A957048D20091A0D2575E87D091D11CDB3A5B562E5
2908msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_7abfc923-603d-471d-a8c1-18d4bf3c72dd\en-US\CL_LocalizationData.psd1text
MD5:863DC7FD9D5E14BB639EAAF596D64416
SHA256:97EB6F256A278FF10B200FA6E248B7A89BA956D9F533D138302C7F3721A95D8E
2756pcwrun.exeC:\Users\admin\AppData\Local\Temp\PCW4DC.xmlxml
MD5:80681B26E76818EC8BB3F99F3C1B1D97
SHA256:B32857E34DD8099890EC37E3D642C8738D942DEBA5FB85C0EDCB09FADCB7F0C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TrojanWin32.Duqu.Stuxnet.zip