File name:	2025-06-22_fbfbcb8719630f27d16c4e269ccfb625_elex_mafia
Full analysis:	https://app.any.run/tasks/5cc1e712-2511-40da-a010-ad5f5dd55900
Verdict:	Malicious activity
Analysis date:	June 22, 2025, 01:19:17
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	FBFBCB8719630F27D16C4E269CCFB625
SHA1:	7267A28A52AC3050547BD2465079642E4EACF39E
SHA256:	1D2D2C11E7DD6FCE1F3526DC1559E1F6968283B2D883E112C2810F2794B8F777
SSDEEP:	12288:GEY859yqwTEvcPdZnCxWgdyYCbH5tvS6PJdUuNskHVVh6yzD:GEY89WxCxWgyYCbH/NBdUuN9Myz

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1712	6B5C.tmp	C:\Users\admin\AppData\Local\Temp\6BBA.tmp		executable
		MD5:7CF56E0F1ADCECDF151D22F5E42E27C1	SHA256:0676369410209493BCC440FE70F380304637796215A0ADBC9FA00FD5CC648471
1164	6A33.tmp	C:\Users\admin\AppData\Local\Temp\6AA1.tmp		executable
		MD5:58296D3991C3CFCA314C2A75FB3E394A	SHA256:5DF7E4F56A5955822C5C6107A2D662BB7432F486947ACFBF8F1FE0AB0A239B8B
4884	6968.tmp	C:\Users\admin\AppData\Local\Temp\69D5.tmp		executable
		MD5:66063E7D4B37303FA75CFCD35B973AA0	SHA256:BFDC8E45CBE021863171BC3061432ED0EC0C135B19BC4CD11A9F4FD894044753
2952	2025-06-22_fbfbcb8719630f27d16c4e269ccfb625_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\689D.tmp		executable
		MD5:086CDE273B8637740F398F58068FC999	SHA256:095B107E3BDDBF1264FF9A43E0B252378132E0BBABF4E7E41427A0FD71BD7895
7140	6DFC.tmp	C:\Users\admin\AppData\Local\Temp\6E69.tmp		executable
		MD5:17F390BA600125182F71C0E1A13707FB	SHA256:2066C9D44AA60909D3A7F37F649A95681D299D9F2D5BD5AF6D052537125C5E3E
6584	690A.tmp	C:\Users\admin\AppData\Local\Temp\6968.tmp		executable
		MD5:1CD8A977FE5B37022A2EF6C088192A20	SHA256:9B381EBF7777AEA40478D3492AEDA05F0B4B6E6CEDB113E73CE0D987EE659413
7048	69D5.tmp	C:\Users\admin\AppData\Local\Temp\6A33.tmp		executable
		MD5:D121B69CF0AC2216C25B6CE2F5116EB1	SHA256:EFCC78DFC636146FCE1B787D82E98B74856AC5BFA87916DBC7DFB663923042AB
6368	6C08.tmp	C:\Users\admin\AppData\Local\Temp\6C56.tmp		executable
		MD5:57F7910DEE5F8B0909A4B8A9C358EB23	SHA256:BBA89E8895193E242C8E7D2C35927587CC8B86EEFC9A9067407006D92B01C3FC
5612	6C56.tmp	C:\Users\admin\AppData\Local\Temp\6CB4.tmp		executable
		MD5:4B354A25946241F57E3D764D26B5315F	SHA256:F3F63CA9A114EE52253F706A40FBD9A785FA50633A3F3AAA10FFF02AAC744675
4888	6AA1.tmp	C:\Users\admin\AppData\Local\Temp\6AFE.tmp		executable
		MD5:AC491D69563767FF89ACA79F95912E8B	SHA256:48E3C93432785D381D6CCB7B8263FB168F5E4FF851D06B229E95BA75B45A6C7F

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
888	RUXIMICS.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
888	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
888	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
888	RUXIMICS.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146	whitelisted
google.com	216.58.206.78	whitelisted
crl.microsoft.com	23.55.104.172 23.55.104.190	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	20.42.73.25	whitelisted

General Info

2025-06-22_fbfbcb8719630f27d16c4e269ccfb625_elex_mafia

FBFBCB8719630F27D16C4E269CCFB625

7267A28A52AC3050547BD2465079642E4EACF39E

1D2D2C11E7DD6FCE1F3526DC1559E1F6968283B2D883E112C2810F2794B8F777

12288:GEY859yqwTEvcPdZnCxWgdyYCbH5tvS6PJdUuNskHVVh6yzD:GEY89WxCxWgyYCbH/NBdUuN9Myz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the machine GUID from the registry

Checks supported languages

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings