File name:

300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a

Full analysis: https://app.any.run/tasks/0be67a00-6d03-4361-a41d-413a7298314e
Verdict: Malicious activity
Analysis date: January 10, 2025, 18:32:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

4450623DB60A968EAF4EB0048A2BD51C

SHA1:

CDC4DC46BF612018E09174B79BE22DE8B22CF682

SHA256:

300557A343F3A60BB9000F3D80CFD4F57E6A553C97AE46B45BDC912A9A09536A

SSDEEP:

49152:SbIHVPpCvU47K88988NtCPWNWFm7WvSvSx5pVI7jah8Az04VT5QHLDkZtc6Sk:SbIHVPpCNzSWsavSvSx5H6ah8Az0+T5p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • GRajOu.exe (PID: 3188)

    • Executing a file with an untrusted certificate

      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 4576)
      • GRajOu.exe (PID: 3188)
      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 3144)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 4576)
      • ShellExperienceHost.exe (PID: 4320)

    • Executable content was dropped or overwritten

      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 3144)

    • Application launched itself

      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 4576)

    • Starts itself from another location

      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 3144)

    • There is functionality for taking screenshot (YARA)

      • GRajOu.exe (PID: 3188)

    • Connects to unusual port

      • GRajOu.exe (PID: 3188)

  • INFO

    • Reads the computer name

      • GRajOu.exe (PID: 3188)
      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 4576)
      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 3144)
      • ShellExperienceHost.exe (PID: 4320)

    • Reads the machine GUID from the registry

      • GRajOu.exe (PID: 3188)
      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 3144)
      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 4576)

    • Checks supported languages

      • GRajOu.exe (PID: 3188)
      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 3144)
      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 4576)
      • ShellExperienceHost.exe (PID: 4320)

    • Process checks computer location settings

      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 4576)

    • The sample compiled with english language support

      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 3144)
      • 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe (PID: 4576)

    • UPX packer has been detected

      • GRajOu.exe (PID: 3188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:01 14:58:13+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 716800
InitializedDataSize: 421888
UninitializedDataSize: -
EntryPoint: 0x86b3c
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.8.8.3
ProductVersionNumber: 3.6.2.7
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 3.8.8.3
ProductVersion: 3.6.2.7
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe no specs 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe grajou.exe shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4576"C:\Users\admin\Desktop\300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe" C:\Users\admin\Desktop\300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.8.8.3
Modules
Images
c:\users\admin\desktop\300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3144"C:\Users\admin\Desktop\300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe" Sfz GPd ahX Eys bfjC:\Users\admin\Desktop\300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe
300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
3.8.8.3
Modules
Images
c:\users\admin\desktop\300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3188oeIYcvtcqAuKelZJC:\Users\Public\Downloads\GRajOu.exe
300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exe
User:
admin
Integrity Level:
HIGH
Version:
3.8.8.3
Modules
Images
c:\users\public\downloads\grajou.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4320"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
Total events
1 790
Read events
1 785
Write events
5
Delete events
0

Modification events

(PID) Process:(4576) 300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings
Operation:writeName:JITDebug
Value:
0
(PID) Process:(3188) GRajOu.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(3188) GRajOu.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\DOS Devices
Operation:writeName:O:
Value:
\??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs
(PID) Process:(4320) ShellExperienceHost.exeKey:\REGISTRY\A\{4c7b6f45-34dd-800c-84a4-aaa4e404982b}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D00000013E6BBFB8D63DB01
(PID) Process:(4320) ShellExperienceHost.exeKey:\REGISTRY\A\{4c7b6f45-34dd-800c-84a4-aaa4e404982b}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D0000003249BEFB8D63DB01
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3188GRajOu.exeC:\Users\Public\Downloads\LqfZcw LTqlI.Nqhtatext
MD5:F2358376C37A5AD754A221414A30770A
SHA256:7C2F977865CBA093478D44ABEE0CE0D3FDC3198930685B185333B5776A8EED61
3144300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a.exeC:\Users\Public\Downloads\GRajOu.exeexecutable
MD5:4450623DB60A968EAF4EB0048A2BD51C
SHA256:300557A343F3A60BB9000F3D80CFD4F57E6A553C97AE46B45BDC912A9A09536A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
32
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5892
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.186:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5892
svchost.exe
GET
200
23.48.23.186:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5892
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
92.123.104.32:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5892
svchost.exe
23.48.23.186:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.186:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5892
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
www.bing.com
  • 92.123.104.32
  • 92.123.104.34
  • 92.123.104.62
  • 92.123.104.31
  • 92.123.104.38
  • 92.123.104.33
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.186
  • 23.48.23.134
  • 23.48.23.188
  • 23.48.23.191
  • 23.48.23.192
  • 23.48.23.182
  • 23.48.23.193
  • 23.48.23.190
  • 23.48.23.183
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
self.events.data.microsoft.com
  • 20.189.173.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
300557a343f3a60bb9000f3d80cfd4f57e6a553c97ae46b45bdc912a9a09536a