File name:

soft 1.14.exe

Full analysis: https://app.any.run/tasks/244416c3-d063-4f0f-baf1-dad5dc2b5817
Verdict: Malicious activity
Analysis date: January 02, 2025, 19:04:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 10 sections
MD5:

E8D4D6351B0DE37BB6D5EC41CFDEFEA6

SHA1:

6AF7670E19ADB4A4389A46E7EF67B1C16BB5E184

SHA256:

2758881789906D339EC7FD1D34CD6EB6470534E2B93FD385ECB8095184F3FFFC

SSDEEP:

12288:AvRMKb8wBPOo335q7foqA29YgC226TCxO6T+ycJ/Ae9gN:QkwBPvnQToqAPgC226THycR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • soft 1.14.exe (PID: 556)

  • SUSPICIOUS

    • Application launched itself

      • soft 1.14.exe (PID: 3144)

    • Executable content was dropped or overwritten

      • soft 1.14.exe (PID: 556)

    • Executes application which crashes

      • soft 1.14.exe (PID: 556)

    • Connects to unusual port

      • soft 1.14.exe (PID: 556)

  • INFO

    • Checks supported languages

      • soft 1.14.exe (PID: 3144)
      • soft 1.14.exe (PID: 556)

    • Create files in a temporary directory

      • soft 1.14.exe (PID: 556)

    • Checks proxy server information

      • WerFault.exe (PID: 6304)

    • Reads the software policy settings

      • WerFault.exe (PID: 6304)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:12:25 14:37:17+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 73216
InitializedDataSize: 3202048
UninitializedDataSize: -
EntryPoint: 0x50b0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start soft 1.14.exe no specs soft 1.14.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Users\admin\AppData\Local\Temp\soft 1.14.exe"C:\Users\admin\AppData\Local\Temp\soft 1.14.exe
soft 1.14.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\soft 1.14.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3144"C:\Users\admin\AppData\Local\Temp\soft 1.14.exe" C:\Users\admin\AppData\Local\Temp\soft 1.14.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\soft 1.14.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6304C:\WINDOWS\system32\WerFault.exe -u -p 556 -s 504C:\Windows\System32\WerFault.exe
soft 1.14.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
Total events
3 424
Read events
3 423
Write events
1
Delete events
0

Modification events

(PID) Process:(556) soft 1.14.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:WinDiesel
Value:
C:\Users\admin\AppData\Local\Temp\copied_self.exe
Executable files
1
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6304WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_soft 1.14.exe_1b9e81baab6cf75d7b37b4346b106de49d9f2ee0_e5a33a07_7db6a619-e12f-4155-be19-ceebf2229b33\Report.wer —
MD5:—
SHA256:—
556soft 1.14.exeC:\Users\admin\AppData\Local\Temp\copied_self.exeexecutable
MD5:E8D4D6351B0DE37BB6D5EC41CFDEFEA6
SHA256:2758881789906D339EC7FD1D34CD6EB6470534E2B93FD385ECB8095184F3FFFC
6304WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5A6A.tmp.xmlxml
MD5:0A7685C5136FB0F82BA28BFAB7789805
SHA256:3A1E8A882F0F7FD7E0C9D1A3A9CBED71EF579CEE7A65AF89CC8388EAEFC2504B
6304WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6304WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\soft 1.14.exe.556.dmpbinary
MD5:3C05ABBC7A79C92F0334060FB45B8EEC
SHA256:0177C054B9B894B419E211494A36D467D56C8C55B395C113678C171E3E074958
6304WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6304WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER599D.tmp.dmpbinary
MD5:54D9DEB41A519676769168610D1916A3
SHA256:2AB51BC47A97253503314665713C8665A7412B594B0741886D626DE3BDC94693
6304WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:272F889791E6B6B786705DD70F8EB05D
SHA256:03583A3AB5B200E9E8F755DF2056D74A245272A31BE859843E334A0526F5A255
6304WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:DE878C29211E8274C68101F244E1348B
SHA256:87DFC955336CF339E58BA4A77BD81CA208A0DEBBE5CBE5717151E8F66AF2351F
6304WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5A3A.tmp.WERInternalMetadata.xmlxml
MD5:8BD12B27C623DED02A90D1F968F6B4CC
SHA256:D604790AEE3B221F9A1A002CD5A99E506931E17C24D8BE278B07DBF5752D62FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
37
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.164:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6304
WerFault.exe
GET
200
23.48.23.164:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5580
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6304
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6924
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6924
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5064
SearchApp.exe
104.126.37.160:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
23.48.23.164:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
440
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
556
soft 1.14.exe
80.76.49.56:22322
—
Alsycon B.V.
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 104.126.37.160
  • 104.126.37.161
  • 104.126.37.146
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.139
  • 104.126.37.178
  • 104.126.37.130
  • 104.126.37.163
whitelisted
crl.microsoft.com
  • 23.48.23.164
  • 23.48.23.167
  • 23.48.23.170
  • 23.48.23.155
  • 23.48.23.166
  • 23.48.23.162
  • 23.48.23.160
  • 23.48.23.151
  • 23.48.23.159
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.68
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
watson.events.data.microsoft.com
  • 13.89.179.12
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted

Threats

PID
Process
Class
Message
556
soft 1.14.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 8
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
soft 1.14.exe