File name:

31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5

Full analysis: https://app.any.run/tasks/086b43a8-9b3e-44f0-b815-3275088177c7
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:51:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

1116B4010248E6A756D4592E1D6F2655

SHA1:

3559E695B44532A92B0C571A74402492D9821261

SHA256:

31109CAF75646DA80171EA44BE4076DD91D3A4F965A278CF3ADF188C2E1A3DC5

SSDEEP:

49152:KRnuBD7tSq0QcNj+NM2bm5JcxboHf2ZIfDdLc3LVd4Z/c5GdgCB2hgvRzpg5fVBC:4uBftSXNj+NM2bm5JcxboHf2ZCDdLc3B

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executes application which crashes

      • 31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe (PID: 6136)
  • INFO

    • The sample compiled with english language support

      • 31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe (PID: 6136)
    • Reads mouse settings

      • 31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe (PID: 6136)
    • Checks supported languages

      • 31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe (PID: 6136)
    • Create files in a temporary directory

      • 31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe (PID: 6136)
    • Reads the software policy settings

      • WerFault.exe (PID: 6220)
    • The process uses AutoIt

      • 31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe (PID: 6136)
    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6220)
    • Checks proxy server information

      • WerFault.exe (PID: 6220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x25f74
UninitializedDataSize: -
InitializedDataSize: 608256
CodeSize: 570880
LinkerVersion: 11
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:23 04:15:08+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe svchost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6136"C:\Users\admin\AppData\Local\Temp\31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe" C:\Users\admin\AppData\Local\Temp\31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1556"C:\Users\admin\AppData\Local\Temp\31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe" C:\Windows\SysWOW64\svchost.exe31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6220C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6136 -s 764C:\Windows\SysWOW64\WerFault.exe
31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\twinapi.appcore.dll
c:\windows\syswow64\policymanager.dll
c:\windows\syswow64\winhttp.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\ondemandconnroutehelper.dll
c:\windows\syswow64\mswsock.dll
c:\windows\syswow64\iphlpapi.dll
c:\windows\syswow64\winnsi.dll
c:\windows\syswow64\nsi.dll
c:\windows\syswow64\dhcpcsvc6.dll
Total events
681
Read events
681
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
6
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
6220WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_31109caf75646da8_e0f722f6a726181405bf96faa660f363386d3a_b3e43ff9_cac5dec6-b179-4543-a4f5-d8795651c284\Report.wer
MD5:
SHA256:
613631109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exeC:\Users\admin\AppData\Local\Temp\contraposetext
MD5:D446EAFC96A631E11DF505AFCE3F8E9C
SHA256:5F250CF1997E8441D1B0DAA47182FF72F241F8105AAE0C17AD45851086F0901F
613631109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exeC:\Users\admin\AppData\Local\Temp\tabulatorbinary
MD5:00DC902C05F8C1DFEE069FEC6429B85B
SHA256:E4FB9B3485311B7C445763177AD4DE9B7A360E12BCE663EE710748CF0248021A
613631109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exeC:\Users\admin\AppData\Local\Temp\aut4903.tmpbinary
MD5:D848B4ADC448AF98815F4AA520379FBF
SHA256:479A07CCE84499D3E3E6C0E305AD1AD828057119AEB7C3AA8B7019F19E1AC127
613631109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exeC:\Users\admin\AppData\Local\Temp\aut4932.tmpbinary
MD5:00DC902C05F8C1DFEE069FEC6429B85B
SHA256:E4FB9B3485311B7C445763177AD4DE9B7A360E12BCE663EE710748CF0248021A
6220WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:90668ECB820B9498BA10F92C7E8530CA
SHA256:B151B4DEA67D03486EC350A75C0C790E97F6A814655480CDC96B2A1DCFA49144
6220WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6220WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6220WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\31109caf75646da80171ea44be4076dd91d3a4f965a278cf3adf188c2e1a3dc5.exe.6136.dmpbinary
MD5:FC9320691417F4CECB87E3F5BC1B5177
SHA256:D716A38AAF2520064D4FFA53100BBA6B30647CB442758FDD7586F6FAAEEFB4CB
6220WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:4F456F9E0235BB77D586B90C7B217B93
SHA256:205C1F226C0C05BB87820D1CB7532E63055CACC6A5AA683A3FCB1C8F0D0CFC2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
36
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6220
WerFault.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6220
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
640
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6384
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
640
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
2992
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
104.126.37.145:443
www.bing.com
Akamai International B.V.
DE
whitelisted
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.4
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
watson.events.data.microsoft.com
  • 13.89.179.12
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info