File name:

MBR.exe

Full analysis: https://app.any.run/tasks/15982ed2-66a1-45a9-915f-b8aaabb4b131
Verdict: Malicious activity
Analysis date: October 20, 2024, 01:36:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
pyinstaller
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

5BDD45711A7CE8C011868C2808B8ED6A

SHA1:

04A697DBF4552005515996CBDD6CCD66D9B74884

SHA256:

2517F29CEFD8BE982BA6DA58757B3D82F157D834E08C2401829151DF3C61427C

SSDEEP:

98304:m6CqN6LFA9Sor3UFML7ndwwvYUAxi9N8bcx2THsiAU9NPPW9OPLTdTIQZ9dkEfB1:fz1k7ZpeRPAoFTy6wnG/t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds extension to the Windows Defender exclusion list

      • cmd.exe (PID: 4072)
      • MBR.exe (PID: 6736)

    • Windows Defender preferences modified via 'Set-MpPreference'

      • cmd.exe (PID: 4072)

  • SUSPICIOUS

    • Application launched itself

      • MBR.exe (PID: 5400)

    • Process drops legitimate windows executable

      • MBR.exe (PID: 5400)

    • Starts CMD.EXE for commands execution

      • MBR.exe (PID: 6736)

    • Executable content was dropped or overwritten

      • MBR.exe (PID: 5400)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 4072)

    • Loads Python modules

      • MBR.exe (PID: 6736)

    • The process drops C-runtime libraries

      • MBR.exe (PID: 5400)

    • Process drops python dynamic module

      • MBR.exe (PID: 5400)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 2628)

    • Script adds exclusion extension to Windows Defender

      • cmd.exe (PID: 4072)

  • INFO

    • Checks supported languages

      • MBR.exe (PID: 5400)
      • MBR.exe (PID: 6736)

    • Reads the computer name

      • MBR.exe (PID: 5400)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5592)

    • Create files in a temporary directory

      • MBR.exe (PID: 5400)

    • PyInstaller has been detected (YARA)

      • MBR.exe (PID: 5400)
      • MBR.exe (PID: 6736)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:20 01:33:51+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 172032
InitializedDataSize: 95744
UninitializedDataSize: -
EntryPoint: 0xcdb0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
304
Monitored processes
7
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start THREAT mbr.exe THREAT mbr.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs plugscheduler.exe no specs mbr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1176"C:\Users\admin\AppData\Local\Temp\MBR.exe" C:\Users\admin\AppData\Local\Temp\MBR.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\mbr.exe
c:\windows\system32\ntdll.dll
2380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2628"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4072C:\WINDOWS\system32\cmd.exe /c Powershell -Command "Set-MpPreference -ExclusionExtension exe"C:\Windows\System32\cmd.exe—MBR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5400"C:\Users\admin\AppData\Local\Temp\MBR.exe" C:\Users\admin\AppData\Local\Temp\MBR.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
Modules
Images
c:\users\admin\appdata\local\temp\mbr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5592Powershell -Command "Set-MpPreference -ExclusionExtension exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6736"C:\Users\admin\AppData\Local\Temp\MBR.exe" C:\Users\admin\AppData\Local\Temp\MBR.exe
MBR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
Modules
Images
c:\users\admin\appdata\local\temp\mbr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
5 433
Read events
5 433
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
33
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
5400MBR.exeC:\Users\admin\AppData\Local\Temp\_MEI54002\_hashlib.pydexecutable
MD5:32D76C9ABD65A5D2671AEEDE189BC290
SHA256:838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
5400MBR.exeC:\Users\admin\AppData\Local\Temp\_MEI54002\VCRUNTIME140.dllexecutable
MD5:862F820C3251E4CA6FC0AC00E4092239
SHA256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
5400MBR.exeC:\Users\admin\AppData\Local\Temp\_MEI54002\_decimal.pydexecutable
MD5:F3377F3DE29579140E2BBAEEFD334D4F
SHA256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
5400MBR.exeC:\Users\admin\AppData\Local\Temp\_MEI54002\base_library.zipcompressed
MD5:A9CBD0455B46C7D14194D1F18CA8719E
SHA256:DF6C19637D239BFEDC8CD13D20E0938C65E8FDF340622FF334DB533F2D30FA19
5400MBR.exeC:\Users\admin\AppData\Local\Temp\_MEI54002\_socket.pydexecutable
MD5:FE896371430BD9551717EF12A3E7E818
SHA256:35246B04C6C7001CA448554246445A845CE116814A29B18B617EA38752E4659B
5400MBR.exeC:\Users\admin\AppData\Local\Temp\_MEI54002\python313.dllexecutable
MD5:B9DE917B925DD246B709BB4233777EFD
SHA256:0C0A66505093B6A4BB3475F716BD3D9552095776F6A124709C13B3F9552C7D99
5400MBR.exeC:\Users\admin\AppData\Local\Temp\_MEI54002\select.pydexecutable
MD5:20831703486869B470006941B4D996F2
SHA256:78E5994C29D8851F28B5B12D59D742D876683AEA58ECEEA1FB895B2036CDCDEB
5592powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:83197C96F576FC043D2E2480B4FB6517
SHA256:A1ACD2B7032EA13C9D9F870EB1C4EB4405D9111D01EFFA2E183ED7FBDFE4BD0E
5592powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_krfxqcdw.kj5.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5400MBR.exeC:\Users\admin\AppData\Local\Temp\_MEI54002\unicodedata.pydexecutable
MD5:0902D299A2A487A7B0C2D75862B13640
SHA256:2693C7EE4FBA55DC548F641C0CB94485D0E18596FFEF16541BD43A5104C28B20
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
108
DNS requests
41
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5604
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6768
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2364
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
2364
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5604
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
52.185.211.133:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5640
RUXIMICS.exe
52.185.211.133:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5488
MoUsoCoreWorker.exe
52.185.211.133:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2364
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2364
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4360
SearchApp.exe
2.23.209.133:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4360
SearchApp.exe
2.23.209.130:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 52.185.211.133
  • 40.127.240.158
whitelisted
google.com
  • 172.217.23.110
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.138
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.2
  • 20.190.159.64
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.bing.com
  • 2.23.209.133
  • 2.23.209.130
  • 2.23.209.187
  • 104.126.37.145
  • 104.126.37.131
  • 2.23.209.182
  • 2.23.209.149
whitelisted
th.bing.com
  • 2.23.209.130
  • 2.23.209.187
  • 2.23.209.133
  • 2.23.209.182
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MBR.exe