File name:

Al Barid Bank Relevé de compte_Setup.exe

Full analysis: https://app.any.run/tasks/e248152a-5adc-429b-9737-118509085104
Verdict: Malicious activity
Analysis date: August 08, 2024, 11:49:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

95A5A5117656C75F3F9B679936255EE1

SHA1:

D52E1FE99B9E9F03D85996476FEE404E013044D5

SHA256:

241BDE54C54268F4D3398F2B8D8C501EB50D11BDF3F72F39F137B4379EEED92D

SSDEEP:

98304:m+cD4dnm0QhcpjdPokcVAcegYnzJaSLWu22l2+UDNm5E2ERHeTsxRbMuxhGstKVV:ZK4KoCit

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Al Barid Bank Relevé de compte_Setup.exe (PID: 2260)
      • Al Barid Bank Relevé de compte_Setup.exe (PID: 2088)
      • admin_microsoft_account.exe (PID: 3736)
      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)

    • Changes powershell execution policy (Bypass)

      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)
      • admin_microsoft_account.exe (PID: 3736)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4080)
      • powershell.exe (PID: 2552)

    • Adds path to the Windows Defender exclusion list

      • admin_microsoft_account.exe (PID: 3736)
      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)

    • Uses Task Scheduler to run other applications

      • admin_microsoft_account.exe (PID: 3736)

    • Changes the autorun value in the registry

      • admin_microsoft_account.exe (PID: 3736)

    • UAC/LUA settings modification

      • reg.exe (PID: 2156)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Al Barid Bank Relevé de compte_Setup.exe (PID: 2260)
      • Al Barid Bank Relevé de compte_Setup.exe (PID: 2088)
      • admin_microsoft_account.exe (PID: 3736)
      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)

    • Reads the Windows owner or organization settings

      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)

    • Starts POWERSHELL.EXE for commands execution

      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)
      • admin_microsoft_account.exe (PID: 3736)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 2552)
      • powershell.exe (PID: 4080)

    • Reads the Internet Settings

      • powershell.exe (PID: 2552)
      • powershell.exe (PID: 4080)

    • Starts CMD.EXE for commands execution

      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)

    • Process drops legitimate windows executable

      • admin_microsoft_account.exe (PID: 3736)

    • Uses REG/REGEDIT.EXE to modify registry

      • admin_microsoft_account.exe (PID: 3736)

    • The process executes via Task Scheduler

      • admin_microsoft_account.exe (PID: 3748)

    • The process drops C-runtime libraries

      • admin_microsoft_account.exe (PID: 3736)

    • Uses TASKKILL.EXE to kill process

      • admin_microsoft_account.exe (PID: 3736)

    • Script adds exclusion path to Windows Defender

      • admin_microsoft_account.exe (PID: 3736)
      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 1060)

    • Connects to unusual port

      • AlBaridBank_Relevé.exe (PID: 3672)
      • admin_microsoft_account.exe (PID: 3736)
      • Al Barid Bank - Relevé de compte.exe (PID: 2136)

  • INFO

    • Checks supported languages

      • Al Barid Bank Relevé de compte_Setup.exe (PID: 2260)
      • Al Barid Bank Relevé de compte_Setup.exe (PID: 2088)
      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 536)
      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)
      • wmpnscfg.exe (PID: 2632)
      • admin_microsoft_account.exe (PID: 3736)
      • admin_microsoft_account.exe (PID: 3748)
      • Al Barid Bank - Relevé de compte.exe (PID: 2136)
      • AlBaridBank_Relevé.exe (PID: 3672)

    • Reads the computer name

      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 536)
      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)
      • wmpnscfg.exe (PID: 2632)
      • admin_microsoft_account.exe (PID: 3736)
      • AlBaridBank_Relevé.exe (PID: 3672)
      • Al Barid Bank - Relevé de compte.exe (PID: 2136)

    • Create files in a temporary directory

      • Al Barid Bank Relevé de compte_Setup.exe (PID: 2260)
      • Al Barid Bank Relevé de compte_Setup.exe (PID: 2088)
      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2552)
      • powershell.exe (PID: 4080)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2632)
      • Al Barid Bank - Relevé de compte.exe (PID: 2136)

    • Creates files in the program directory

      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)

    • Creates a software uninstall entry

      • Al Barid Bank Relevé de compte_Setup.tmp (PID: 3448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:15 14:54:16+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 52224
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Al Barid Bank
FileDescription: Al Barid Bank - Application Relevé de compte Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: Al Barid Bank - Application Relevé de compte
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
17
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start al barid bank relevé de compte_setup.exe al barid bank relevé de compte_setup.tmp no specs al barid bank relevé de compte_setup.exe al barid bank relevé de compte_setup.tmp powershell.exe no specs wmpnscfg.exe no specs admin_microsoft_account.exe cmd.exe no specs powershell.exe no specs reg.exe no specs schtasks.exe no specs admin_microsoft_account.exe no specs taskkill.exe no specs taskkill.exe no specs svchost.exe albaridbank_relevé.exe al barid bank - relevé de compte.exe

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Users\admin\AppData\Local\Temp\is-KMGDT.tmp\Al Barid Bank Relevé de compte_Setup.tmp" /SL5="$30214,3687585,795136,C:\Users\admin\AppData\Local\Temp\Al Barid Bank Relevé de compte_Setup.exe" C:\Users\admin\AppData\Local\Temp\is-KMGDT.tmp\Al Barid Bank Relevé de compte_Setup.tmp—Al Barid Bank Relevé de compte_Setup.exe
User:
admin
Company:
Al Barid Bank
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-kmgdt.tmp\al barid bank relevé de compte_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mpr.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1060C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1076"taskkill" /f /im securitysvc.exeC:\Windows\System32\taskkill.exe—admin_microsoft_account.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
2088"C:\Users\admin\AppData\Local\Temp\Al Barid Bank Relevé de compte_Setup.exe" /SPAWNWND=$D016C /NOTIFYWND=$30214 C:\Users\admin\AppData\Local\Temp\Al Barid Bank Relevé de compte_Setup.exe
Al Barid Bank Relevé de compte_Setup.tmp
User:
admin
Company:
Al Barid Bank
Integrity Level:
HIGH
Description:
Al Barid Bank - Application Relevé de compte Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\al barid bank relevé de compte_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2136"C:\Users\admin\Desktop\Al Barid Bank - Relevé de compte.exe" C:\Users\admin\Desktop\Al Barid Bank - Relevé de compte.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\al barid bank - relevé de compte.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
2156"REG" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /fC:\Windows\System32\reg.exe—admin_microsoft_account.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2260"C:\Users\admin\AppData\Local\Temp\Al Barid Bank Relevé de compte_Setup.exe" C:\Users\admin\AppData\Local\Temp\Al Barid Bank Relevé de compte_Setup.exe
explorer.exe
User:
admin
Company:
Al Barid Bank
Integrity Level:
MEDIUM
Description:
Al Barid Bank - Application Relevé de compte Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\appdata\local\temp\al barid bank relevé de compte_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2552"powershell" -ex bypass -C "Add-MpPreference -ExclusionPath 'C:\Windows\Security\updateagent','c:','d:','e:','f:','g:','h:','i:'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Al Barid Bank Relevé de compte_Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2632"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3260"cmd.exe" /c mklink /h "C:\Users\admin\Desktop\Al Barid Bank - Relevé de compte.exe" "C:\Program Files\Al Barid Bank\AlBaridBank_Relevé.exe"C:\Windows\System32\cmd.exe—Al Barid Bank Relevé de compte_Setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
7 955
Read events
7 851
Write events
98
Delete events
6

Modification events

(PID) Process:(3448) Al Barid Bank Relevé de compte_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
780D0000B64D8B1C89E9DA01
(PID) Process:(3448) Al Barid Bank Relevé de compte_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
CE709383BD970BAE23833272983F06D3E2A6A6C3340C04C5A0B6B59E96C1A9FB
(PID) Process:(3448) Al Barid Bank Relevé de compte_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(2552) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2552) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2552) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2552) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1060) svchost.exeKey:HKEY_USERS\S-1-5-21-1302019708-1500728564-335382590-1000\Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Operation:writeName:DisallowedCertLastSyncTime
Value:
7229492689E9DA01
(PID) Process:(3448) Al Barid Bank Relevé de compte_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\Al Barid Bank\AlBaridBank_Relevé.exe
(PID) Process:(3448) Al Barid Bank Relevé de compte_Setup.tmpKey:HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
1097E513B566A0406EA925168A23E432EC07F5DF5BDA9524F209DA8AC9E330E4
Executable files
11
Suspicious files
10
Text files
2
Unknown types
3

Dropped files

PID
Process
Filename
Type
2260Al Barid Bank Relevé de compte_Setup.exeC:\Users\admin\AppData\Local\Temp\is-KMGDT.tmp\Al Barid Bank Relevé de compte_Setup.tmpexecutable
MD5:4B9FD952A26896609E0D2380E7A40712
SHA256:02FB145C6C3BA0E33791148CFE5B80B065A0359121038347BC4FFDC60F4AE07F
3448Al Barid Bank Relevé de compte_Setup.tmpC:\Users\admin\AppData\Local\Temp\is-RDOL3.tmp\_isetup\_iscrypt.dllexecutable
MD5:A69559718AB506675E907FE49DEB71E9
SHA256:2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
1060svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Tar6935.tmpcat
MD5:78785956AB4E54D6116D673C3491EDFF
SHA256:C514DBDBB13632CBB378C59086C1EBB0BC9B25FFB0A349F2B052B065C0D913E6
2552powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivedbf
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
2552powershell.exeC:\Users\admin\AppData\Local\Temp\ufsho0vy.5ih.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1060svchost.exeC:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\Cab6934.tmpcompressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2088Al Barid Bank Relevé de compte_Setup.exeC:\Users\admin\AppData\Local\Temp\is-FJP4U.tmp\Al Barid Bank Relevé de compte_Setup.tmpexecutable
MD5:4B9FD952A26896609E0D2380E7A40712
SHA256:02FB145C6C3BA0E33791148CFE5B80B065A0359121038347BC4FFDC60F4AE07F
2552powershell.exeC:\Users\admin\AppData\Local\Temp\404uwrkq.u1u.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3736admin_microsoft_account.exeC:\Windows\security\updateagent\Common\xml.xmlxml
MD5:9A485E578020E3C8382DA378522D0E57
SHA256:8FD037D654D4719910667707A2559AE5A888251A7B105C3BDC6912117CCCE12F
3736admin_microsoft_account.exeC:\Windows\security\updateagent\Common\bundlecompressed
MD5:F34AA5938AB898F964C4F50D49DDC05A
SHA256:A6CD84730FA0AE73CC2298EA6D259656B34AFF4E0F2C606B55982AAFED7225D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
7
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
23.50.131.200:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?8f69642324cc87bd
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:3702
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1372
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1372
svchost.exe
23.50.131.200:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.110
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
ctldl.windowsupdate.com
  • 23.50.131.200
  • 23.50.131.216
  • 199.232.214.172
  • 199.232.210.172
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
albaridbank.freedynamicdns.org
  • 105.99.113.97
unknown

Threats

PID
Process
Class
Message
1060
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.freedynamicdns .org
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Al Barid Bank Relevé de compte_Setup.exe