File name:

Stand.Launchpad.exe

Full analysis: https://app.any.run/tasks/c4591b78-aad5-45e1-ac6b-1e14a1a19c19
Verdict: Malicious activity
Analysis date: August 04, 2024, 13:54:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

807C001BE05D0E835337CC366AABA56D

SHA1:

FCC4FAE0461DA8F17F8EE274E338BCEE97762C4C

SHA256:

265D3E48E4A72AFDACA712AA3BDEE4A6A8676E4080FBA1A0920546A14A6100BE

SSDEEP:

768:iTI0poX93G4zlI55xXGSNmndydf3CZKgiweh1aeeae5tc5tul5scYhb:l0gi5xWSNmnQCZKguahayLl5scmb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Stand.Launchpad.exe (PID: 6664)

    • Scans artifacts that could help determine the target

      • Stand.Launchpad.exe (PID: 6664)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Stand.Launchpad.exe (PID: 6664)

    • Executable content was dropped or overwritten

      • Stand.Launchpad.exe (PID: 6664)

    • Checks Windows Trust Settings

      • Stand.Launchpad.exe (PID: 6664)

    • Reads Internet Explorer settings

      • Stand.Launchpad.exe (PID: 6664)

    • Reads Microsoft Outlook installation path

      • Stand.Launchpad.exe (PID: 6664)

  • INFO

    • Checks supported languages

      • Stand.Launchpad.exe (PID: 6664)

    • Reads the machine GUID from the registry

      • Stand.Launchpad.exe (PID: 6664)

    • Reads the computer name

      • Stand.Launchpad.exe (PID: 6664)

    • Reads Environment values

      • Stand.Launchpad.exe (PID: 6664)

    • Creates files or folders in the user directory

      • Stand.Launchpad.exe (PID: 6664)

    • Disables trace logs

      • Stand.Launchpad.exe (PID: 6664)

    • Checks proxy server information

      • Stand.Launchpad.exe (PID: 6664)

    • Reads the software policy settings

      • Stand.Launchpad.exe (PID: 6664)

    • Process checks Internet Explorer phishing filters

      • Stand.Launchpad.exe (PID: 6664)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2092:01:22 07:39:25+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 51200
InitializedDataSize: 24064
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.9.1.0
ProductVersionNumber: 1.9.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Calamity, Inc.
FileDescription: Stand Launchpad
FileVersion: 1.9.1.0
InternalName: Stand Launchpad.exe
LegalCopyright: No Rights Reserved
LegalTrademarks: -
OriginalFileName: Stand Launchpad.exe
ProductName: Stand Launchpad
ProductVersion: 1.9.1.0
AssemblyVersion: 1.9.1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start stand.launchpad.exe

Process information

PID
CMD
Path
Indicators
Parent process
6664"C:\Users\admin\AppData\Local\Temp\Stand.Launchpad.exe" C:\Users\admin\AppData\Local\Temp\Stand.Launchpad.exe
explorer.exe
User:
admin
Company:
Calamity, Inc.
Integrity Level:
MEDIUM
Description:
Stand Launchpad
Version:
1.9.1.0
Modules
Images
c:\users\admin\appdata\local\temp\stand.launchpad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
2 251
Read events
2 224
Write events
27
Delete events
0

Modification events

(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stand_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stand_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stand_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stand_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stand_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6664) Stand.Launchpad.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Stand_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
2
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6664Stand.Launchpad.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_5E65FCDD03110BA05402E762877D780Ebinary
MD5:8FD483332833B8D66A6E29CECE58D7FE
SHA256:984DDE4616A11A5B09E0E1C85076FC999556D3DD56660C42DCDE18EDAF3673D7
6664Stand.Launchpad.exeC:\Users\admin\AppData\Local\Calamity,_Inc\Stand.Launchpad.exe_Url_rz0v4fzocioy3g23muw4v53aivui0hlg\1.9.1.0\user.configxml
MD5:B4AE24F20E59E454D57443D663A7581E
SHA256:8409DD0AA292B3BF50903A7CA1A1A0D6697D5C7B0ED3D1C5E43EBDF6F82DB074
6664Stand.Launchpad.exeC:\Users\admin\AppData\Roaming\Stand\Bin\Stand 24.8.3.dllexecutable
MD5:81E1D8EE4F5F9B88730A19FBAFC74931
SHA256:DC4CE70EADC92C5BA50019A94C4A9F994F0DE7135579B1206BAA66E519C0BD8D
6664Stand.Launchpad.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:8C6412B5250CB83722C398F807E9EC34
SHA256:0F6F22361C35B0EF1AD5ACB4C5AF3CC910E2ADBEB9560871F5A5AFA7A4C980B5
6664Stand.Launchpad.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_5E65FCDD03110BA05402E762877D780Ebinary
MD5:E49079FDF1FECA6F6E26EB0CEE9CAAF3
SHA256:DC0223212F0A7D617FB8EDF8EF306E0E1862BB30FA3BA3F8D3FEBCCD23B595F6
6664Stand.Launchpad.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\changelog-launchpad[1].htmhtml
MD5:B4F2113221D8D586DD91A8EDD7E8A0A6
SHA256:ED4188B45999C84B76E07DD67B37E0D2964532EFA0C53C4A453FBD72BCF9F11C
6664Stand.Launchpad.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:7FB5FA1534DCF77F2125B2403B30A0EE
SHA256:33A39E9EC2133230533A686EC43760026E014A3828C703707ACBC150FE40FD6F
6664Stand.Launchpad.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8der
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
6664Stand.Launchpad.exeC:\Users\admin\AppData\Roaming\Stand\Bin\Stand 24.8.3.dll.tmpexecutable
MD5:81E1D8EE4F5F9B88730A19FBAFC74931
SHA256:DC4CE70EADC92C5BA50019A94C4A9F994F0DE7135579B1206BAA66E519C0BD8D
6664Stand.Launchpad.exeC:\Users\admin\AppData\Local\Calamity,_Inc\Stand.Launchpad.exe_Url_rz0v4fzocioy3g23muw4v53aivui0hlg\1.9.1.0\zai5y5fh.newcfgxml
MD5:B4AE24F20E59E454D57443D663A7581E
SHA256:8409DD0AA292B3BF50903A7CA1A1A0D6697D5C7B0ED3D1C5E43EBDF6F82DB074
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
49
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6528
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1948
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6552
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6664
Stand.Launchpad.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6664
Stand.Launchpad.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6664
Stand.Launchpad.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEQCA5WrF4j1Lr8MOJXyXArf%2F
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2064
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
2.23.209.130:443
www.bing.com
Akamai International B.V.
GB
unknown
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1948
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1948
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.238
whitelisted
www.bing.com
  • 2.23.209.130
  • 2.23.209.189
  • 2.23.209.140
  • 2.23.209.185
  • 2.23.209.181
  • 2.23.209.182
  • 2.23.209.179
  • 2.23.209.177
  • 2.23.209.141
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.113.103.199
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.72
  • 20.190.160.17
  • 40.126.32.76
  • 20.190.160.20
  • 40.126.32.140
  • 40.126.32.133
  • 40.126.32.136
whitelisted
th.bing.com
  • 2.23.209.176
  • 2.23.209.181
  • 2.23.209.185
  • 2.23.209.187
  • 2.23.209.179
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.182
  • 2.23.209.177
whitelisted
stand.sh
  • 172.67.160.249
  • 104.21.15.7
unknown
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Stand.Launchpad.exe