File name:

f6fb58ffdb5677fab17b5a8195c8d09b

Full analysis: https://app.any.run/tasks/e8b0121e-9cb2-479e-8202-9c65b773c965
Verdict: Malicious activity
Analysis date: October 30, 2024, 03:27:12
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

F6FB58FFDB5677FAB17B5A8195C8D09B

SHA1:

59B4A727B2899EDC54586221CEA97DB5BBED0BA1

SHA256:

401C641FF4F1215CF2B3624D13D0169DFA8848306F636D46D70F1733249C8461

SSDEEP:

98304:yEWn4ErF2t0A2qzpZyBGXZOflNZGHOQya0TuqTA0PzRYqmh7vSRpl89+bE9d9YbB:90KCFboh11kYAlW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 1792)

    • The process drops C-runtime libraries

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 1792)

    • Process drops python dynamic module

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 1792)

    • Executable content was dropped or overwritten

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 1792)

    • Application launched itself

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 1792)

  • INFO

    • Reads the computer name

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 1792)

    • Checks supported languages

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 1792)
      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 5932)

    • Reads the machine GUID from the registry

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 5932)

    • Reads security settings of Internet Explorer

      • backgroundTaskHost.exe (PID: 1112)

    • Create files in a temporary directory

      • f6fb58ffdb5677fab17b5a8195c8d09b.exe (PID: 1792)

    • Checks proxy server information

      • backgroundTaskHost.exe (PID: 1112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:26 18:22:41+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 168960
InitializedDataSize: 153600
UninitializedDataSize: -
EntryPoint: 0xc0d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
17
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start f6fb58ffdb5677fab17b5a8195c8d09b.exe f6fb58ffdb5677fab17b5a8195c8d09b.exe no specs backgroundtaskhost.exe no specs backgroundtaskhost.exe runtimebroker.exe no specs svchost.exe no specs ruximics.exe no specs musnotificationux.exe no specs conhost.exe no specs waasmedicagent.exe no specs svchost.exe no specs sihclient.exe wmiprvse.exe no specs svchost.exe no specs musnotifyicon.exe no specs svchost.exe no specs svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1112"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mcaC:\Windows\System32\backgroundTaskHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Background Task Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1792"C:\Users\admin\AppData\Local\Temp\f6fb58ffdb5677fab17b5a8195c8d09b.exe" C:\Users\admin\AppData\Local\Temp\f6fb58ffdb5677fab17b5a8195c8d09b.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\f6fb58ffdb5677fab17b5a8195c8d09b.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1804C:\WINDOWS\System32\svchost.exe -k LocalService -p -s LicenseManagerC:\Windows\System32\svchost.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2484%systemroot%\system32\MusNotificationUx.exe ClearActiveNotificationsC:\Windows\System32\MusNotificationUx.exe—MusNotification.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MusNotificationUx.exe
Exit code:
0
Version:
10.0.19041.3693 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\musnotificationux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcp_win.dll
2648"C:\WINDOWS\system32\backgroundTaskHost.exe" -ServerName:Global.IrisService.AppXwt29n3t7x7q6fgyrrbbqxwzkqjfjaw4y.mcaC:\Windows\System32\backgroundTaskHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Background Task Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtaskhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2684C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5508C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5792C:\WINDOWS\System32\svchost.exe -k wsappx -p -s ClipSVCC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5932"C:\Users\admin\AppData\Local\Temp\f6fb58ffdb5677fab17b5a8195c8d09b.exe" C:\Users\admin\AppData\Local\Temp\f6fb58ffdb5677fab17b5a8195c8d09b.exe—f6fb58ffdb5677fab17b5a8195c8d09b.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\f6fb58ffdb5677fab17b5a8195c8d09b.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
13 426
Read events
13 374
Write events
51
Delete events
1

Modification events

(PID) Process:(1112) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(1112) backgroundTaskHost.exeKey:\REGISTRY\A\{96200786-8ea1-d57b-2177-28c9e0c39da0}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
00001862ACA37B2ADB01
(PID) Process:(1112) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
(PID) Process:(1112) backgroundTaskHost.exeKey:\REGISTRY\A\{96200786-8ea1-d57b-2177-28c9e0c39da0}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
00001862ACA37B2ADB01
(PID) Process:(1112) backgroundTaskHost.exeKey:\REGISTRY\A\{96200786-8ea1-d57b-2177-28c9e0c39da0}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
00001862ACA37B2ADB01
(PID) Process:(1112) backgroundTaskHost.exeKey:\REGISTRY\A\{96200786-8ea1-d57b-2177-28c9e0c39da0}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
4E006F006E00650000001862ACA37B2ADB01
(PID) Process:(2648) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\IrisService\Permission
Operation:delete keyName:(default)
Value:
(PID) Process:(2648) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\IrisService\Providers\Display
Operation:writeName:Version
Value:
2
(PID) Process:(2648) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\IrisService\Providers\Display
Operation:writeName:Attributes
Value:
{"disphorzres":"1280","dispsize":"15.3","dispvertres":"720","ldisphorzres":"1280","ldispvertres":"720","moncnt":"1"}
(PID) Process:(2648) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\IrisService\Providers\Display
Operation:writeName:UpdateTime
Value:
2024-10-30T03:27:25Z
Executable files
50
Suspicious files
39
Text files
2
Unknown types
4

Dropped files

PID
Process
Filename
Type
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\_lzma.pydexecutable
MD5:37057C92F50391D0751F2C1D7AD25B02
SHA256:9442DC46829485670A6AC0C02EF83C54B401F1570D1D5D1D85C19C1587487764
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\_bz2.pydexecutable
MD5:3DC8AF67E6EE06AF9EEC52FE985A7633
SHA256:C55821F5FDB0064C796B2C0B03B51971F073140BC210CBE6ED90387DB2BED929
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\VCRUNTIME140.dllexecutable
MD5:0E675D4A7A5B7CCD69013386793F68EB
SHA256:BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-heap-l1-1-0.dllexecutable
MD5:B071E761CEA670D89D7AE80E016CE7E6
SHA256:63FB84A49308B857804AE1481D2D53B00A88BBD806D257D196DE2BD5C385701E
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-namedpipe-l1-1-0.dllexecutable
MD5:61F70F2D1E3F22E976053DF5F3D8ECB7
SHA256:2695761B010D22FDFDA2B5E73CF0AC7328CCC62B4B28101D5C10155DD9A48020
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-localization-l1-2-0.dllexecutable
MD5:1D75E7B9F68C23A195D408CF02248119
SHA256:67EBE168B7019627D68064043680674F9782FDA7E30258748B29412C2B3D4C6B
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-libraryloader-l1-1-0.dllexecutable
MD5:569A7AC3F6824A04282FF708C629A6D2
SHA256:84C579A8263A87991CA1D3AEE2845E1C262FB4B849606358062093D08AFDC7A2
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:7D4D4593B478B4357446C106B64E61F8
SHA256:0A6E2224CDE90A0D41926E8863F9956848FFBF19848E8855BD08953112AFC801
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-handle-l1-1-0.dllexecutable
MD5:7BC1B8712E266DB746914DB48B27EF9C
SHA256:F82D05AEA21BCF6337EF45FBDAD6D647D17C043A67B44C7234F149F861A012B9
1792f6fb58ffdb5677fab17b5a8195c8d09b.exeC:\Users\admin\AppData\Local\Temp\_MEI17922\api-ms-win-core-interlocked-l1-1-0.dllexecutable
MD5:1DCCF27F2967601CE6666C8611317F03
SHA256:6A83AB9A413AFD74D77A090F52784B0128527BEE9CB0A4224C59D5C75FC18387
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
44
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7028
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2648
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2464
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4360
SearchApp.exe
2.23.209.140:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7028
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7028
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4360
SearchApp.exe
2.23.209.130:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.bing.com
  • 2.23.209.140
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.182
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.23
  • 40.126.31.69
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.4
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.31.67
whitelisted
th.bing.com
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.140
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f6fb58ffdb5677fab17b5a8195c8d09b