| File name: | MicrosoftPrt.exe |
| Full analysis: | https://app.any.run/tasks/3885e98b-9cfe-496e-a694-c4b6d7e9fd02 |
| Verdict: | Malicious activity |
| Analysis date: | November 11, 2024, 20:08:11 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, 7 sections |
| MD5: | 02484A615E581A9A431E20DF300FAED4 |
| SHA1: | D855E2C9338B1508577B3E831CC89838C2768647 |
| SHA256: | 16D2F6194D1B1989FBEF4572055DBF62A0D6A2570B316AC15722192F1C559A50 |
| SSDEEP: | 393216:2Vdk1RubL9nIs9bLPvwE7gTaj5SECY2t:ykDubL+kLPvHgTI5V4t |
MALICIOUS
No malicious indicators.SUSPICIOUS
The process drops C-runtime libraries
- MicrosoftPrt.exe (PID: 2724)
Process drops python dynamic module
- MicrosoftPrt.exe (PID: 2724)
Application launched itself
- MicrosoftPrt.exe (PID: 2724)
Process drops legitimate windows executable
- MicrosoftPrt.exe (PID: 2724)
Executable content was dropped or overwritten
- MicrosoftPrt.exe (PID: 2724)
Starts CMD.EXE for commands execution
- MicrosoftPrt.exe (PID: 6720)
There is functionality for taking screenshot (YARA)
- MicrosoftPrt.exe (PID: 6720)
Found regular expressions for crypto-addresses (YARA)
- MicrosoftPrt.exe (PID: 6720)
Possible usage of Discord/Telegram API has been detected (YARA)
- MicrosoftPrt.exe (PID: 6720)
INFO
Checks supported languages
- MicrosoftPrt.exe (PID: 2724)
Reads the computer name
- MicrosoftPrt.exe (PID: 2724)
PyInstaller has been detected (YARA)
- MicrosoftPrt.exe (PID: 2724)
- MicrosoftPrt.exe (PID: 6720)
Checks operating system version
- MicrosoftPrt.exe (PID: 6720)
Create files in a temporary directory
- MicrosoftPrt.exe (PID: 2724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
ims-api
(PID) Process(6720) MicrosoftPrt.exe
Telegram-Tokens (1)6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI
Telegram-Info-Links
6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI
Get info about bothttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/getMe
Get incoming updateshttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/getUpdates
Get webhookhttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/deleteWebhook?drop_pending_updates=true
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2023:11:18 03:04:34+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.33 |
| CodeSize: | 165888 |
| InitializedDataSize: | 93184 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xafd0 |
| OSVersion: | 5.2 |
| ImageVersion: | - |
| SubsystemVersion: | 5.2 |
| Subsystem: | Windows GUI |
Total processes
124
Monitored processes
4
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2692 | C:\WINDOWS\system32\cmd.exe /c "ver" | C:\Windows\System32\cmd.exe | — | MicrosoftPrt.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2724 | "C:\Users\admin\AppData\Local\Temp\MicrosoftPrt.exe" | C:\Users\admin\AppData\Local\Temp\MicrosoftPrt.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
| |||||||||||||||
| 3844 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6720 | "C:\Users\admin\AppData\Local\Temp\MicrosoftPrt.exe" | C:\Users\admin\AppData\Local\Temp\MicrosoftPrt.exe | MicrosoftPrt.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
ims-api(PID) Process(6720) MicrosoftPrt.exe Telegram-Tokens (1)6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI Telegram-Info-Links 6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI Get info about bothttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/getMe Get incoming updateshttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/getUpdates Get webhookhttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/getWebhookInfo Delete webhookhttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/deleteWebhook Drop incoming updateshttps://api.telegram.org/bot6114976417:AAELsO_lvdyvXRw-Fwj5RmwJFc81WkgJOYI/deleteWebhook?drop_pending_updates=true | |||||||||||||||
Total events
24 634
Read events
24 634
Write events
0
Delete events
0
Modification events
Executable files
60
Suspicious files
3
Text files
944
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\_asyncio.pyd | executable | |
MD5:B988A4DE700D7016B472534990FB91C7 | SHA256:91D9BF73B360BA801BA595E90DBFF182EF9C682331E2D39D210999A63D4BDE54 | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\_decimal.pyd | executable | |
MD5:6B07F5C49AE2AF116E4D41CE7D552451 | SHA256:04AFE789EAB63D204337E9EDABEF1E1CD003DB69D66DC2CF0FC9E9E7A47304A6 | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\_hashlib.pyd | executable | |
MD5:F883652E056FF4882E1BC900D382EDAB | SHA256:583F6D20998E45FF94400EFAEECC4E17204449A0CC7BA68A20D1E8D13617F27B | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\PIL\_webp.cp310-win_amd64.pyd | executable | |
MD5:4225D8FDB913D314538AB8E95D248694 | SHA256:8C62BCCF01BEFA1F30592E18201B9ACFF9C09E38F900270F48488CD19DF4A9CA | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\_ctypes.pyd | executable | |
MD5:9872A3AEEE09CF796A1190B610CF0A54 | SHA256:147B080CEB8DFD6DF865570ADDBA3864659ADEF4B85A20B750F3CA6735C4BF1B | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\_elementtree.pyd | executable | |
MD5:8B889978E9CF98745FA561FCEAB0BDDC | SHA256:A775AC6121472CEF0505629F99FE17E46334FD453DEF61162D3DEBA679E58BAF | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\PIL\_imagingft.cp310-win_amd64.pyd | executable | |
MD5:4FD79F7BD1642638C547A240854D8848 | SHA256:F0845A8C00C6ECE2F58B1088FC09F3AF0E6A1EA783B4922497C8675212685F23 | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\PIL\_imaging.cp310-win_amd64.pyd | executable | |
MD5:C7C53CDE4D02ACE0BF9D777103160BD9 | SHA256:F8BCBC54B58E2A224E67DF52C210B698CC3A7C49F8E63E58D3D253BCAF4BEFEE | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\_lzma.pyd | executable | |
MD5:FD4C7582BEE16436BB3F790E1273EB22 | SHA256:8AA5CD82D775EA718D3DDD270F0B28985D8711EF937447EE2168318200F0EB80 | |||
| 2724 | MicrosoftPrt.exe | C:\Users\admin\AppData\Local\Temp\_MEI27242\libopenblas.FB5AE2TYXYH2IJRDKGDGQ3XBKLKTF43H.gfortran-win_amd64.dll | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
45
DNS requests
19
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 173.223.117.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.53.40.176:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 173.223.117.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3960 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1952 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1952 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.53.40.176:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 173.223.117.131:80 | www.microsoft.com | AKAMAI-AS | US | whitelisted |
— | — | 2.19.80.17:443 | — | Akamai International B.V. | DE | unknown |
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
4360 | SearchApp.exe | 2.19.80.8:443 | — | Akamai International B.V. | DE | unknown |
— | — | 2.19.80.8:443 | — | Akamai International B.V. | DE | unknown |
4904 | svchost.exe | 20.190.159.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
th.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |