File name:

1 (236)

Full analysis: https://app.any.run/tasks/750c1a76-f88a-4623-beb7-28421e655973
Verdict: Malicious activity
Analysis date: March 24, 2025, 19:08:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

5B1D448D0C2E376A311B2027471C8BB0

SHA1:

BA943A65CA35BDC8B41537CE8B5861DF4AA20E7E

SHA256:

4426BC674BEC068EEA4ECAB14D05917B8C3E334B81622980EB6AC9975E544C87

SSDEEP:

98304:ykGuf963WxjnAFJWwwsQmJoGkZc/heOYoQVl/x/jm:zjm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • 1 (236).exe (PID: 1628)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1 (236).exe (PID: 1628)

    • Reads security settings of Internet Explorer

      • 1 (236).exe (PID: 1628)

    • Creates file in the systems drive root

      • SeepTortuous.exe (PID: 4448)

  • INFO

    • Reads the computer name

      • 1 (236).exe (PID: 1628)
      • JollySynthetic.exe (PID: 1180)
      • RequisitionOctogenarian.exe (PID: 1388)
      • SeepTortuous.exe (PID: 6036)

    • Checks supported languages

      • 1 (236).exe (PID: 1628)
      • JollySynthetic.exe (PID: 4652)
      • JollySynthetic.exe (PID: 1180)
      • RequisitionOctogenarian.exe (PID: 2240)
      • SeepTortuous.exe (PID: 4448)
      • RequisitionOctogenarian.exe (PID: 1388)
      • SeepTortuous.exe (PID: 6036)

    • The sample compiled with english language support

      • 1 (236).exe (PID: 1628)

    • Process checks computer location settings

      • 1 (236).exe (PID: 1628)

    • Failed to create an executable file in Windows directory

      • 1 (236).exe (PID: 1628)

    • Create files in a temporary directory

      • 1 (236).exe (PID: 1628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:07:21 15:00:24+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 18944
InitializedDataSize: 29184
UninitializedDataSize: -
EntryPoint: 0x5650
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: LegitimateBereave
FileDescription: LenienceTassel
FileVersion: 1, 0, 0, 1
InternalName: Lesion Mansion
LegalCopyright: LexiconIdolater
LegalTrademarks: -
OriginalFileName: Leucocyte Ferocity
PrivateBuild: -
ProductName: LevitateFriable
ProductVersion: 1, 0, 0, 1
SpecialBuild: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
14
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1 (236).exe sppextcomobj.exe no specs slui.exe regsvr32.exe no specs jollysynthetic.exe no specs jollysynthetic.exe no specs regsvr32.exe no specs slui.exe no specs requisitionoctogenarian.exe no specs requisitionoctogenarian.exe no specs svchost.exe regsvr32.exe no specs seeptortuous.exe no specs seeptortuous.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1180"C:\Users\admin\AppData\Local\Temp\JollySynthetic.exe" C:\Users\admin\AppData\Local\Temp\JollySynthetic.exe—1 (236).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
200
Modules
Images
c:\users\admin\appdata\local\temp\jollysynthetic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1388"C:\Users\admin\AppData\Local\Temp\RequisitionOctogenarian.exe" C:\Users\admin\AppData\Local\Temp\RequisitionOctogenarian.exe—1 (236).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
200
Modules
Images
c:\users\admin\appdata\local\temp\requisitionoctogenarian.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1628"C:\Users\admin\AppData\Local\Temp\1 (236).exe" C:\Users\admin\AppData\Local\Temp\1 (236).exe
explorer.exe
User:
admin
Company:
LegitimateBereave
Integrity Level:
MEDIUM
Description:
LenienceTassel
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\1 (236).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2240C:\Users\admin\AppData\Local\Temp\RequisitionOctogenarian.exeC:\Users\admin\AppData\Local\Temp\RequisitionOctogenarian.exe—1 (236).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
200
Modules
Images
c:\users\admin\appdata\local\temp\requisitionoctogenarian.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2320regsvr32.exe /s "C:\WINDOWS\RVWVLYCAVB.dll"C:\Windows\SysWOW64\regsvr32.exe—1 (236).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2616"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2644regsvr32.exe /s "C:\WINDOWS\RVWVLYCAVB.dll"C:\Windows\SysWOW64\regsvr32.exe—1 (236).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4068C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4448C:\Users\admin\AppData\Local\Temp\SeepTortuous.exeC:\Users\admin\AppData\Local\Temp\SeepTortuous.exe—1 (236).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
200
Modules
Images
c:\users\admin\appdata\local\temp\seeptortuous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 942
Read events
1 942
Write events
0
Delete events
0

Modification events

No data
Executable files
3
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
16281 (236).exeC:\Users\admin\AppData\Local\Temp\JollySynthetic.exeexecutable
MD5:927476200FEEB6160AF47839940F10CC
SHA256:8EF17C559BDB684C212652CABC23C86AF9AF2E39361D0B8F81285C97CEFA7D95
16281 (236).exeC:\Users\admin\AppData\Local\Temp\RequisitionOctogenarian.exeexecutable
MD5:927476200FEEB6160AF47839940F10CC
SHA256:8EF17C559BDB684C212652CABC23C86AF9AF2E39361D0B8F81285C97CEFA7D95
16281 (236).exeC:\Users\admin\AppData\Local\Temp\SeepTortuous.exeexecutable
MD5:927476200FEEB6160AF47839940F10CC
SHA256:8EF17C559BDB684C212652CABC23C86AF9AF2E39361D0B8F81285C97CEFA7D95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
25
DNS requests
17
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5776
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5776
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
780
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4108
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
780
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 184.24.77.37
  • 184.24.77.35
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.134
  • 20.190.160.65
  • 20.190.160.131
  • 40.126.32.68
  • 20.190.160.22
  • 20.190.160.3
  • 20.190.160.17
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.ocry .com Domain
2196
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to DDNS Domain .zyns .com
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.zyns .com Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (236)