File name:

program.exe

Full analysis: https://app.any.run/tasks/6573b4cd-8328-4e74-9590-51b2983eedad
Verdict: Malicious activity
Analysis date: November 22, 2024, 08:24:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, PECompact2 compressed, 2 sections
MD5:

B18CA9C57E8DD3B1298296AEE0016B63

SHA1:

1FB7EA70AAE6CF869F348FB1DC610ACDB3AD18DA

SHA256:

34ED049A431884739C3F04B135B0734C0C4EF34121DB5ABF8187062984141AFB

SSDEEP:

1536:qmr1zQ09GiNb9Ltrja6Amr1zQjZv7O8IQq:qmrhQaNb9Lt66AmrhQjZiAq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • backup.exe (PID: 2076)
      • backup.exe (PID: 3928)
      • backup.exe (PID: 1796)
      • program.exe (PID: 1668)
      • backup.exe (PID: 748)
      • backup.exe (PID: 3732)
      • backup.exe (PID: 4652)
      • backup.exe (PID: 5660)
      • backup.exe (PID: 8)
      • backup.exe (PID: 2008)
      • program.exe (PID: 3640)

    • Starts itself from another location

      • backup.exe (PID: 3928)
      • backup.exe (PID: 1796)
      • program.exe (PID: 1668)
      • backup.exe (PID: 2076)
      • backup.exe (PID: 748)
      • backup.exe (PID: 3732)
      • backup.exe (PID: 4652)
      • backup.exe (PID: 5660)
      • backup.exe (PID: 8)
      • backup.exe (PID: 2008)

  • INFO

    • Checks supported languages

      • program.exe (PID: 1668)

    • Create files in a temporary directory

      • program.exe (PID: 1668)

    • Reads the computer name

      • program.exe (PID: 1668)

    • Manual execution by a user

      • program.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:01:06 03:24:42+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 45056
InitializedDataSize: 28672
UninitializedDataSize: -
EntryPoint: 0x1134
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.50
ProductVersionNumber: 1.0.0.50
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: Microsoft Windows
FileVersion: 1.00.0050
ProductVersion: 1.00.0050
InternalName: music
OriginalFileName: music.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
20
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start program.exe backup.exe no specs backup.exe backup.exe backup.exe backup.exe no specs backup.exe no specs backup.exe no specs backup.exe backup.exe backup.exe backup.exe backup.exe no specs backup.exe backup.exe no specs system restore.exe no specs data.exe no specs backup.exe system restore.exe no specs program.exe

Process information

PID
CMD
Path
Indicators
Parent process
8C:\Users\admin\AppData\Local\Temp\Diagnostics\backup.exe C:\Users\admin\AppData\Local\Temp\Diagnostics\C:\Users\admin\AppData\Local\Temp\Diagnostics\backup.exe
program.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\diagnostics\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
644C:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\backup.exe C:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\C:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\backup.exe—backup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\acrobat_sbx\ngl\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
720C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\backup.exe C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\backup.exe—backup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\acrobat_sbx\adobe\acrobat\dc\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
748C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\backup.exe C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\backup.exe
program.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\acrord32_super_sbx\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1668"C:\Users\admin\AppData\Local\Temp\program.exe" C:\Users\admin\AppData\Local\Temp\program.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\program.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1796C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\backup.exe C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\backup.exe
backup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\acrobat_sbx\adobe\acrobat\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1796"C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\10x64\System Restore.exe" C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\10x64\C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\10x64\System Restore.exe—backup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$dra988.30171\10x64\system restore.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2008C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\backup.exe C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\C:\Users\admin\AppData\Local\Temp\Rar$DRa988.30171\backup.exe
program.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$dra988.30171\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2076C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\backup.exe C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\C:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\backup.exe
backup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\acrobat_sbx\adobe\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2436C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\backup.exe C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\C:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\DC\SearchEmbdIndex\backup.exe—backup.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\acrord32_super_sbx\adobe\acrobat\dc\searchembdindex\backup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
842
Read events
788
Write events
36
Delete events
18

Modification events

(PID) Process:(1668) program.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(1668) program.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableRegistryTools
Value:
1
(PID) Process:(1668) program.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(4060) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(4060) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableRegistryTools
Value:
1
(PID) Process:(4060) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(3928) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
(PID) Process:(3928) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableRegistryTools
Value:
1
(PID) Process:(3928) backup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Streams
Operation:delete valueName:Settings
Value:
(PID) Process:(2076) backup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:NoFolderOptions
Value:
1
Executable files
20
Suspicious files
29
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1668program.exeC:\Users\admin\AppData\Local\Temp\backup.exeexecutable
MD5:DC3BAA3A9824FEA598735F0426BEA7F2
SHA256:0366ADBD1B7DA630F26FFC221B21C4216169E116D8D86FB28B2A655F388D097D
1668program.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\backup.exeexecutable
MD5:DC3BAA3A9824FEA598735F0426BEA7F2
SHA256:0366ADBD1B7DA630F26FFC221B21C4216169E116D8D86FB28B2A655F388D097D
1668program.exeC:\Users\admin\AppData\Local\Temp\{9EE293E3-390D-48FF-A2D0-59F3E2EC8873}\backup.exeexecutable
MD5:DC3BAA3A9824FEA598735F0426BEA7F2
SHA256:0366ADBD1B7DA630F26FFC221B21C4216169E116D8D86FB28B2A655F388D097D
1796backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\DC\backup.exeexecutable
MD5:3AFEDC20630AED4FD682522F4E27A247
SHA256:1D604FDF33EF27A3BD90F729907B27C7C3F2054261C24D038FB355A9210C0FD5
2076backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\Acrobat\backup.exeexecutable
MD5:5FD182F3E6D1E59E088F72622B7E8FAB
SHA256:32B16B58FB3B59B06E450E3D3FDACBDB8AC6525236E5848607365EF41D3C9D89
720backup.exeC:\Users\admin\AppData\Local\Temp\~DFD59B62B05BDB6C49.TMPbinary
MD5:40E6700615A04581F77E2D20281FA172
SHA256:762406FE1382680DF35B266CFDA07342BD545A6A8535CCF9897C47FEF7467A2A
3928backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\backup.exeexecutable
MD5:1BCBC285A6167CCBCED47699207D07B4
SHA256:C4229C88B660FCD6D88A6BCEED1D97CF06F3D132A2CDC18E8A0D5D2B6BE40505
2076backup.exeC:\Users\admin\AppData\Local\Temp\~DF2DBF7A207C832226.TMPbinary
MD5:2606A0DFF12C96FE8EA6B4CC2C59DAD7
SHA256:70BADD76579BF344CD7FB31F097C0E49D090E00532DC26BCA29A48AA411CAD79
3928backup.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\Adobe\backup.exeexecutable
MD5:1BCBC285A6167CCBCED47699207D07B4
SHA256:C4229C88B660FCD6D88A6BCEED1D97CF06F3D132A2CDC18E8A0D5D2B6BE40505
3732backup.exeC:\Users\admin\AppData\Local\Temp\acrord32_super_sbx\Adobe\Acrobat\backup.exeexecutable
MD5:6FDABD64818896E6517268767AF032EF
SHA256:E9C188BB795C31A127BD23693864870B675B57C441DA80C173DB3F3A81B5AC76
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
32
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6324
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2972
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6324
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2480
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4932
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4932
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
92.123.104.11:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 92.123.104.11
  • 92.123.104.14
  • 92.123.104.16
  • 92.123.104.10
  • 92.123.104.15
  • 92.123.104.17
  • 92.123.104.12
  • 92.123.104.9
  • 92.123.104.18
whitelisted
google.com
  • 142.250.185.110
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.68
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.74
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
program.exe