File name:

2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver

Full analysis: https://app.any.run/tasks/411efc09-295a-49e0-a285-19de1cc239a5
Verdict: Malicious activity
Analysis date: February 24, 2025, 09:39:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
websocket
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:

91F189CD2C1F476B8289639D43A7E2F5

SHA1:

AE64A272B314077774E17B9FC1EFBC1F202F042C

SHA256:

41493DE1DCF8AB49001C03F89C254538FA12C297B80EB609EEA26A6601A71D0E

SSDEEP:

98304:d/NkRdEtqLdOvOSWHO2mSxzbOep2irTPNn:j+dnn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • msedge.exe (PID: 7060)
      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6956)
      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)

    • Reads the date of Windows installation

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)

    • Application launched itself

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)

    • Uses WMIC.EXE to obtain operating system information

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)

    • Executable content was dropped or overwritten

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6956)

    • Executes as Windows Service

      • msedge.exe (PID: 7060)

    • Creates or modifies Windows services

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6956)

    • Creates a software uninstall entry

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6956)

  • INFO

    • The sample compiled with english language support

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)
      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6956)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6336)

    • Reads the machine GUID from the registry

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)
      • msedge.exe (PID: 7060)

    • Checks supported languages

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)
      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6956)
      • msedge.exe (PID: 7060)

    • Process checks computer location settings

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)

    • Reads the computer name

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6956)
      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6256)
      • msedge.exe (PID: 7060)

    • Creates files in the program directory

      • 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe (PID: 6956)
      • msedge.exe (PID: 7060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2022:12:09 20:12:49+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 2122240
InitializedDataSize: 1310720
UninitializedDataSize: -
EntryPoint: 0x1d9d8c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 132.0.2957.115
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Microsoft Edge
FileVersion: 132.0.2957.115
LegalCopyright: Copyright Microsoft Corporation. All rights reserved.
ProductName: Microsoft Edge
ProductVersion: 132.0.2957.115
InternalName: Microsoft Edge
OriginalFileName: msedge.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe conhost.exe no specs msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
6256"C:\Users\admin\Desktop\2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe" C:\Users\admin\Desktop\2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
132.0.2957.115
Modules
Images
c:\users\admin\desktop\2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\dbghelp.dll
6268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6336wmic os get oslanguage /FORMAT:LISTC:\Windows\System32\wbem\WMIC.exe—2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
6352\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6956"C:\Users\admin\Desktop\2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe" -fullinstall C:\Users\admin\Desktop\2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe
2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe
User:
admin
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
132.0.2957.115
Modules
Images
c:\users\admin\desktop\2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\crypt32.dll
6968\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7060"C:\Program Files\Microsoft\Edge\msedge.exe" --meshServiceName="Edge" --installedByUser="S-1-5-21-1693682860-607145093-2874071422-1001"C:\Program Files\Microsoft\Edge\msedge.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
Microsoft Edge
Version:
132.0.2957.115
Modules
Images
c:\program files\microsoft\edge\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
Total events
1 425
Read events
1 406
Write events
19
Delete events
0

Modification events

(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Edge
Operation:writeName:ImagePath
Value:
"C:\Program Files\Microsoft\Edge\msedge.exe" --meshServiceName="Edge" --installedByUser="S-1-5-21-1693682860-607145093-2874071422-1001"
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Edge
Operation:writeName:_InstalledBy
Value:
S-1-5-21-1693682860-607145093-2874071422-1001
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Edge
Operation:writeName:DisplayName
Value:
Microsoft Edge
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Edge
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Microsoft\Edge\msedge.exe
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Edge
Operation:writeName:InstallLocation
Value:
C:\Program Files\Microsoft\Edge\
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Edge
Operation:writeName:EstimatedSize
Value:
3400
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Edge
Operation:writeName:NoModify
Value:
1
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Edge
Operation:writeName:NoRepair
Value:
1
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Edge
Operation:writeName:UninstallString
Value:
C:\Program Files\Microsoft\Edge\msedge.exe -funinstall --meshServiceName="Edge"
(PID) Process:(6956) 2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Edge
Operation:writeName:DisplayVersion
Value:
2022-12-02 19:42:16.000+00:00
Executable files
1
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7060msedge.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\AFD42881E8547A9AAB9FB72BFB8B32365D615CC0binary
MD5:D730A7C3F405DC32FEF8FFD05D4AA02C
SHA256:885CF3D6B77EF911A17397A5D8D99DEC458F02D20AB06BFE7C44301CB0F47DCC
69562025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver.exeC:\Program Files\Microsoft\Edge\msedge.exeexecutable
MD5:91F189CD2C1F476B8289639D43A7E2F5
SHA256:41493DE1DCF8AB49001C03F89C254538FA12C297B80EB609EEA26A6601A71D0E
7060msedge.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\71B46AD0130D711F77901F167FE38B33961ACFC0binary
MD5:BC2D3F46BC10B1C2A53A66D44B62D10F
SHA256:53F51C8F385FB3618641C270E932A6878872AFF9DEC272552310152F1831C2C9
7060msedge.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\5263EA46926F9D24E53E1DE93AB4E8081EAB746Bbinary
MD5:DF8A30EA3CE52DBCB534F9E4C7C1B4CE
SHA256:1A2F7C6A98DC2CB5CC3E8BE106F75FD6A0AF2235BCF19F251D0617D0630B9E04
7060msedge.exeC:\Program Files\Microsoft\Edge\msedge.mshtext
MD5:58CCA491A52A93482ED037D40C552B8B
SHA256:C0ABD34D25B6280C76F74161BCDB5DF802F10B520CC7E803ECCCA72D7D64C593
7060msedge.exeC:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\6102C497FE52F129B9E4A5E461C1C4F32051121Fbinary
MD5:81FBCAD7CE7827B680EE6B5D7A9C78C5
SHA256:A81017DB12913FFCA707B71772B9DFF4C1E217E95BB958F06FC28D83DA3FD901
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
25
DNS requests
8
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.179:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5892
RUXIMICS.exe
GET
200
23.48.23.179:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
640
svchost.exe
GET
200
23.48.23.179:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
101
196.251.84.234:443
https://meshcentral.qfff.org/agent.ashx
unknown
—
—
—
—
—
GET
101
196.251.84.234:443
https://meshcentral.qfff.org/agent.ashx
unknown
—
—
—
—
—
GET
101
196.251.84.234:443
https://meshcentral.qfff.org/agent.ashx
unknown
—
—
—
—
—
GET
101
196.251.84.234:443
https://meshcentral.qfff.org/agent.ashx
unknown
—
—
—
—
—
GET
101
196.251.84.234:443
https://meshcentral.qfff.org/agent.ashx
unknown
—
—
—
4712
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5892
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
640
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.204.155:443
www.bing.com
Akamai International B.V.
DE
whitelisted
640
svchost.exe
23.48.23.179:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.179:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5892
RUXIMICS.exe
23.48.23.179:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3976
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.16.204.155
  • 2.16.204.160
  • 2.16.204.151
  • 2.16.204.156
  • 2.16.204.149
  • 2.16.204.152
  • 2.16.204.157
  • 2.16.204.158
  • 2.16.204.150
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.48.23.179
  • 23.48.23.181
  • 23.48.23.175
  • 23.48.23.180
  • 23.48.23.189
  • 23.48.23.184
  • 23.48.23.183
  • 23.48.23.182
  • 23.48.23.190
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
meshcentral.qfff.org
  • 196.251.84.234
unknown
self.events.data.microsoft.com
  • 20.189.173.24
whitelisted

Threats

PID
Process
Class
Message
7060
msedge.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 37
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2025-02-24_91f189cd2c1f476b8289639d43a7e2f5_ismagent_ryuk_sliver