Malware analysis DL_SCEWIN.exe Malicious activity | ANY.RUN

Add for printing

File name:	DL_SCEWIN.exe
Full analysis:	https://app.any.run/tasks/e3901fc3-6246-4b4f-8302-22c400ab2fac
Verdict:	Malicious activity
Analysis date:	January 10, 2025, 20:32:19
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	arch-exec arch-doc python pyinstaller
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:	445A4C7C7B2E18875E341EFF378C5705
SHA1:	6868D678D71D7EE94599C6637E9FC821F99A4DBB
SHA256:	1664C92A10909A2C137ED33B05973CF4986EFAB96A7BD3E6004E8DFE80815292
SSDEEP:	98304:8VIyDMgksEGc3bXnZwhAxcaLfl5m1LY0gw5jnywT0Kri0GKVYIbjQrfmpfaQvpnT:0PrMuyVqUfN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
Client LanguagePack Package
DotNetRollup
DotNetRollup 481
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
Hello Face Package
InternetExplorer Optional Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MSPaint FoD Package
MSPaint FoD Package
MSPaint FoD Package
MSPaint FoD Package
MSPaint FoD Package
MediaPlayer Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
Notepad FoD Package
Notepad FoD Package
Notepad FoD Package
Notepad FoD Package
OpenSSH Client Package
OpenSSH Client Package
PowerShell ISE FOD Package
PowerShell ISE FOD Package
PowerShell ISE FOD Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing PMCPPC FoD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
Printing WFS FoD Package
Printing WFS FoD Package
Printing WFS FoD Package
ProfessionalEdition
ProfessionalEdition
QuickAssist Package
QuickAssist Package
RollupFix
RollupFix
ServicingStack
ServicingStack
ServicingStack 3989
StepsRecorder Package
StepsRecorder Package
StepsRecorder Package
StepsRecorder Package
StepsRecorder Package
TabletPCMath Package
TabletPCMath Package
UserExperience Desktop Package
UserExperience Desktop Package
WordPad FoD Package
WordPad FoD Package
WordPad FoD Package
WordPad FoD Package
WordPad FoD Package

Add for printing

MALICIOUS
No malicious indicators.
SUSPICIOUS
- Executable content was dropped or overwritten
  - DL_SCEWIN.exe (PID: 6296)
  - DL_SCEWIN.exe (PID: 6448)
- Process drops python dynamic module
  - DL_SCEWIN.exe (PID: 6296)
- Process drops legitimate windows executable
  - DL_SCEWIN.exe (PID: 6296)
- Application launched itself
  - DL_SCEWIN.exe (PID: 6296)
- The process drops C-runtime libraries
  - DL_SCEWIN.exe (PID: 6296)
- Loads Python modules
  - DL_SCEWIN.exe (PID: 6448)
INFO
- Checks supported languages
  - DL_SCEWIN.exe (PID: 6296)
  - DL_SCEWIN.exe (PID: 6448)
- Create files in a temporary directory
  - DL_SCEWIN.exe (PID: 6296)
- Reads the computer name
  - DL_SCEWIN.exe (PID: 6296)
  - DL_SCEWIN.exe (PID: 6448)
- The sample compiled with english language support
  - DL_SCEWIN.exe (PID: 6296)
- PyInstaller has been detected (YARA)
  - DL_SCEWIN.exe (PID: 6296)
- Checks proxy server information
  - DL_SCEWIN.exe (PID: 6448)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	InstallShield setup (57.6)
.exe	\|	Win64 Executable (generic) (36.9)
.exe	\|	Generic Win/DOS Executable (2.6)
.exe	\|	DOS Executable Generic (2.6)

EXIF

EXE

Subsystem:	Windows command line
SubsystemVersion:	6
ImageVersion:	-
OSVersion:	6
EntryPoint:	0xc320
UninitializedDataSize:	-
InitializedDataSize:	152576
CodeSize:	176640
LinkerVersion:	14.4
PEType:	PE32+
ImageFileCharacteristics:	Executable, Large address aware
TimeStamp:	2024:08:10 19:30:47+00:00
MachineType:	AMD AMD64

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

127

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

6296

"C:\Users\admin\AppData\Local\Temp\DL_SCEWIN.exe"

C:\Users\admin\AppData\Local\Temp\DL_SCEWIN.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\appdata\local\temp\dl_scewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

6336

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

DL_SCEWIN.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

6448

"C:\Users\admin\AppData\Local\Temp\DL_SCEWIN.exe"

C:\Users\admin\AppData\Local\Temp\DL_SCEWIN.exe

DL_SCEWIN.exe

User:

admin

Integrity Level:

MEDIUM

Modules

Images
c:\users\admin\appdata\local\temp\dl_scewin.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

Add for printing

Total events

352

Read events

352

Write events

Delete events

Modification events

No data

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\_ctypes.pyd		executable
		MD5:BBD5533FC875A4A075097A7C6ABA865E	SHA256:BE9828A877E412B48D75ADDC4553D2D2A60AE762A3551F9731B50CAE7D65B570
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\_bz2.pyd		executable
		MD5:223FD6748CAE86E8C2D5618085C768AC	SHA256:F81DC49EAC5ECC528E628175ADD2FF6BDA695A93EA76671D7187155AA6326ABB
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\_ssl.pyd		executable
		MD5:5B9B3F978D07E5A9D701F832463FC29D	SHA256:D568B3C99BF0FC35A1F3C5F66B4A9D3B67E23A1D3CF0A4D30499D924D805F5AA
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\api-ms-win-core-heap-l1-1-0.dll		executable
		MD5:E58BAF7E437354716BE8BFF0495F9BFE	SHA256:6DEE9C5652E2858FBFDD50C5175127108D227B7E90F575B2E6C33F1C8F5A0976
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\api-ms-win-core-file-l2-1-0.dll		executable
		MD5:80AB22C6D0250257B61B217822AA5D7C	SHA256:D56B63AEFEDC21372A5D75918032E98F3E4C564733D4838A5B442351E32A300B
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\_decimal.pyd		executable
		MD5:3055EDF761508190B576E9BF904003AA	SHA256:E4104E47399D3F635A14D649F61250E9FD37F7E65C81FFE11F099923F8532577
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\_hashlib.pyd		executable
		MD5:EEDB6D834D96A3DFFFFB1F65B5F7E5BE	SHA256:79C4CDE23397B9A35B54A3C2298B3C7A844454F4387CB0693F15E4FACD227DD2
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\_socket.pyd		executable
		MD5:DC06F8D5508BE059EAE9E29D5BA7E9EC	SHA256:7DAFF6AA3851A913ED97995702A5DFB8A27CB7CF00FB496597BE777228D7564A
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\api-ms-win-core-console-l1-1-0.dll		executable
		MD5:6746E9CBC897101FD8CA22E42490614F	SHA256:81310FD7AAF3A8A280E6EFDDECD5A682C871FC6F5595A3BA131C9E60B58C80E1
6296	DL_SCEWIN.exe	C:\Users\admin\AppData\Local\Temp\_MEI62962\api-ms-win-core-libraryloader-l1-1-0.dll		executable
		MD5:650ECBE45BE7506075F93351BB0389F5	SHA256:406E80902211D987EF0260D9DB08821460E0702E90AE47165A727E0CA6B7C325

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4712	MoUsoCoreWorker.exe	GET	200	23.48.23.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
1176	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
—	—	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4712	MoUsoCoreWorker.exe	23.48.23.139:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
4712	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5064	SearchApp.exe	104.126.37.123:443	www.bing.com	Akamai International B.V.	DE	whitelisted
—	—	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
6448	DL_SCEWIN.exe	140.82.121.6:443	api.github.com	GITHUB	US	whitelisted
6448	DL_SCEWIN.exe	140.82.121.3:443	github.com	GITHUB	US	shared
6448	DL_SCEWIN.exe	185.199.109.133:443	objects.githubusercontent.com	FASTLY	US	shared
6448	DL_SCEWIN.exe	2.17.100.176:443	download.msi.com	Akamai International B.V.	DE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 40.127.240.158	whitelisted
crl.microsoft.com	23.48.23.139 23.48.23.146 23.48.23.157 23.48.23.145 23.48.23.140 23.48.23.137 23.48.23.141 23.48.23.150 23.48.23.138	whitelisted
google.com	216.58.206.46	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
www.bing.com	104.126.37.123 104.126.37.128 104.126.37.178 104.126.37.145 104.126.37.130 104.126.37.154 104.126.37.163 104.126.37.185 104.126.37.144	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
api.github.com	140.82.121.6	whitelisted
github.com	140.82.121.3	shared
objects.githubusercontent.com	185.199.109.133 185.199.110.133 185.199.111.133 185.199.108.133	shared
download.msi.com	2.17.100.176 2.17.100.232	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

DL_SCEWIN.exe

445A4C7C7B2E18875E341EFF378C5705

6868D678D71D7EE94599C6637E9FC821F99A4DBB

1664C92A10909A2C137ED33B05973CF4986EFAB96A7BD3E6004E8DFE80815292

98304:8VIyDMgksEGc3bXnZwhAxcaLfl5m1LY0gw5jnywT0Kri0GKVYIbjQrfmpfaQvpnT:0PrMuyVqUfN

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Executable content was dropped or overwritten

Process drops python dynamic module

Process drops legitimate windows executable

Application launched itself

The process drops C-runtime libraries

Loads Python modules

INFO

Checks supported languages

Create files in a temporary directory

Reads the computer name

The sample compiled with english language support

PyInstaller has been detected (YARA)

Checks proxy server information

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings