File name:

2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a

Full analysis: https://app.any.run/tasks/5f905991-9beb-4b02-9a7c-958d6f11eaf6
Verdict: Malicious activity
Analysis date: January 11, 2025, 01:09:08
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

B484AB0D0D6B28AAB2CA7D572FAED148

SHA1:

92CA4BCA70D7F2A54473AB14C9F3E209EA4D7CD5

SHA256:

2D7B1254F8BE246E9115B243208608A4E55B687DB0FF8FD77AA19A126159037A

SSDEEP:

49152:sRa5FJMVq4kIfUqBgyeC9PdLbDYDetRxjMK01r0VCmhtI0vzN9w3IARz3Y2f2y8b:s8EP3tI0zNS+y8NneIuW8XmjfomATS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)
      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 6952)

    • Uses Task Scheduler to run other applications

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • Reads security settings of Internet Explorer

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • Application launched itself

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • Executes application which crashes

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 6952)

  • INFO

    • Creates files or folders in the user directory

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)
      • WerFault.exe (PID: 640)

    • Reads the computer name

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • Create files in a temporary directory

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • Checks supported languages

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • Reads the machine GUID from the registry

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • The process uses the downloaded file

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • Process checks computer location settings

      • 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe (PID: 5880)

    • Reads the software policy settings

      • WerFault.exe (PID: 640)

    • Checks proxy server information

      • WerFault.exe (PID: 640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:19 11:16:27+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 956928
InitializedDataSize: 13312
UninitializedDataSize: -
EntryPoint: 0xeb91e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.781
ProductVersionNumber: 2.0.0.781
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: PDF document
CompanyName: Adobe Reader
FileDescription: Microsoft PDF Document
FileVersion: 2.0.0.781
InternalName: uQREc.exe
LegalCopyright: Adobe Inc. All rights reserved
LegalTrademarks: PDF document
OriginalFileName: uQREc.exe
ProductName: Adobe Reader
ProductVersion: 2.0.0.781
AssemblyVersion: 2.0.0.781
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe schtasks.exe no specs conhost.exe no specs 2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
5880"C:\Users\admin\AppData\Local\Temp\2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe" C:\Users\admin\AppData\Local\Temp\2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe
explorer.exe
User:
admin
Company:
Adobe Reader
Integrity Level:
MEDIUM
Description:
Microsoft PDF Document
Exit code:
0
Version:
2.0.0.781
Modules
Images
c:\users\admin\appdata\local\temp\2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6884"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VcwyKCYSGjcL" /XML "C:\Users\admin\AppData\Local\Temp\tmp98E8.tmp"C:\Windows\SysWOW64\schtasks.exe—2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6892\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6952"C:\Users\admin\AppData\Local\Temp\2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe"C:\Users\admin\AppData\Local\Temp\2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe
2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe
User:
admin
Company:
Adobe Reader
Integrity Level:
MEDIUM
Description:
Microsoft PDF Document
Exit code:
3221225477
Version:
2.0.0.781
Modules
Images
c:\users\admin\appdata\local\temp\2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
640C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6952 -s 228C:\Windows\SysWOW64\WerFault.exe
2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 563
Read events
3 563
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
640WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_2d7b1254f8be246e_6cc5e48c1cf2a956b4a4d94a7e7a7eb48149b_e001d9e6_0f1cad9b-218d-4e88-b2dd-427a40707588\Report.wer —
MD5:—
SHA256:—
640WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
640WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER84C.tmp.WERInternalMetadata.xmlxml
MD5:54A36A6998CACDFE832017BECA39E9E4
SHA256:EA0FAB9BBEBB78944591406E8461F7D2264B619B3A33D54294962D76AE0F69F5
640WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER87C.tmp.xmlxml
MD5:ADC1A8BE296279B41531712BF8A43FC5
SHA256:B323D988A8BE5BB37E506ED108AF7CDA13C9438388EA2F05B5B2B2C10CF003D7
640WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
640WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:062336C7F1F1679450A27B446D778BF3
SHA256:907FE427BF8673FC47EEE7718B56F8E75974A7923DA35DBECDE8E3B36F8892AB
640WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:6CF5860692FE10C16A717015C8444513
SHA256:EAA7A9BAC3C5D1F2D876ADC5DDBC3D8267FF57A4404F13D6E124B1A49F6A34BF
640WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER80D.tmp.dmpbinary
MD5:C8F03D5C7A82D107A794DEEC3B9F32FC
SHA256:74B112E61550A7C34B5988D53B160F8B28591BD8147461043C99DD8D882C47C6
640WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exe.6952.dmpbinary
MD5:0E7E3A71FEE5801895E8F70CF0F9C220
SHA256:06FB5A28951CB0B5652E94BA48C786B39D3E0A140F39AD24FFE6E3D074B6438A
58802d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a.exeC:\Users\admin\AppData\Roaming\VcwyKCYSGjcL.exeexecutable
MD5:B484AB0D0D6B28AAB2CA7D572FAED148
SHA256:2D7B1254F8BE246E9115B243208608A4E55B687DB0FF8FD77AA19A126159037A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2548
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2548
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7028
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7028
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6160
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
640
WerFault.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2548
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2548
svchost.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
1176
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.110
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.71
  • 20.190.159.68
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.4
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
2d7b1254f8be246e9115b243208608a4e55b687db0ff8fd77aa19a126159037a