File name:

conhost.exe

Full analysis: https://app.any.run/tasks/f15db5e2-d48e-4343-a539-94ebf8658b08
Verdict: Malicious activity
Analysis date: December 02, 2023, 16:47:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

144C9D72C4ABF8F3F052929522749DC5

SHA1:

B3172F803604089A2DAE8296D00D5E60BA394F4C

SHA256:

45081E83D7D860FC7316761A9F88B5F0B607FF6500683E500B18551FA95AD048

SSDEEP:

12288:PJ7Cr3m/xK0t3LMbod6oCZEhcg6zf3f1d:PJ7Cr3m/PuodBKEhc5zVd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • conhost.exe (PID: 2144)
      • zyersydiabb.exe (PID: 3976)
      • WinMail.exe (PID: 1152)

    • Scans artifacts that could help determine the target

      • WinMail.exe (PID: 1152)

    • Runs injected code in another process

      • zyersydiabb.exe (PID: 3976)

    • Application was injected by another process

      • dwm.exe (PID: 932)

    • Actions looks like stealing of personal data

      • dwm.exe (PID: 932)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • conhost.exe (PID: 2144)
      • zyersydiabb.exe (PID: 3976)

    • Starts itself from another location

      • conhost.exe (PID: 2144)

    • Reads Internet Explorer settings

      • WinMail.exe (PID: 1152)

    • Detected use of alternative data streams (AltDS)

      • WinMail.exe (PID: 1152)

    • Checks Windows Trust Settings

      • WinMail.exe (PID: 1152)

    • Reads security settings of Internet Explorer

      • WinMail.exe (PID: 1152)

    • Reads settings of System Certificates

      • WinMail.exe (PID: 1152)

    • Reads the Internet Settings

      • dwm.exe (PID: 932)
      • conhost.exe (PID: 2144)
      • WinMail.exe (PID: 1152)
      • cmd.exe (PID: 2696)

    • Drops a self-deleting batch file

      • conhost.exe (PID: 2144)

    • Executing commands from a ".bat" file

      • conhost.exe (PID: 2144)

    • Reads Microsoft Outlook installation path

      • WinMail.exe (PID: 1152)

    • Starts CMD.EXE for commands execution

      • conhost.exe (PID: 2144)

  • INFO

    • Create files in a temporary directory

      • conhost.exe (PID: 2144)
      • zyersydiabb.exe (PID: 3976)
      • WinMail.exe (PID: 1152)

    • Reads the computer name

      • conhost.exe (PID: 2144)
      • zyersydiabb.exe (PID: 3976)
      • WinMail.exe (PID: 1152)

    • Checks supported languages

      • conhost.exe (PID: 2144)
      • zyersydiabb.exe (PID: 3976)
      • WinMail.exe (PID: 1152)

    • Creates files or folders in the user directory

      • conhost.exe (PID: 2144)
      • WinMail.exe (PID: 1152)

    • Reads the machine GUID from the registry

      • WinMail.exe (PID: 1152)
      • conhost.exe (PID: 2144)

    • Checks proxy server information

      • WinMail.exe (PID: 1152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (42.5)
.exe | DOS Executable Borland Pascal 7.0x (19.2)
.exe | Generic Win/DOS Executable (18.8)
.exe | DOS Executable Generic (18.8)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:10:12 17:42:38+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 255488
InitializedDataSize: 22528
UninitializedDataSize: -
EntryPoint: 0x3f4d4
OSVersion: 5.1
ImageVersion: 1
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
5
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inject conhost.exe no specs zyersydiabb.exe no specs winmail.exe no specs dwm.exe cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
932"C:\Windows\system32\Dwm.exe"C:\Windows\System32\dwm.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\uxtheme.dll
1152"C:\Program Files\Windows Mail\WinMail.exe" -EmbeddingC:\Program Files\Windows Mail\WinMail.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Mail
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows mail\winmail.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2144"C:\Users\admin\AppData\Local\Temp\conhost.exe" C:\Users\admin\AppData\Local\Temp\conhost.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2696"C:\Windows\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\tmpdb7d2ac7.bat"C:\Windows\System32\cmd.exe—conhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3976"C:\Users\admin\AppData\Roaming\Myokuhesism\zyersydiabb.exe"C:\Users\admin\AppData\Roaming\Myokuhesism\zyersydiabb.exe—conhost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\myokuhesism\zyersydiabb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
4 547
Read events
4 507
Write events
34
Delete events
6

Modification events

(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail
Operation:writeName:StoreMigratedV5
Value:
1
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail
Operation:writeName:Settings Upgraded
Value:
10
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\IAM
Operation:writeName:Server ID
Value:
2
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Identities
Operation:writeName:Identity Ordinal
Value:
2
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows Mail
Operation:writeName:LastBackup
Value:
E1070A0004000500090014000400CA01
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\IAM
Operation:writeName:Default News Account
Value:
account{30CE7C98-AA27-4327-91CA-78FA20FFA850}.oeaccount
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\WAB
Operation:delete valueName:NamedProps
Value:
0420060000000000C00000000000004604000000000000800E0000000100330032003800350034000000000001800E0000000100330032003800350035000000000002800E0000000100330032003800350036000000000003800E0000000100330032003800350037000000
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\WAB
Operation:delete valueName:NamedPropCount
Value:
1
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\WAB
Operation:delete valueName:NamedProps
Value:
0420060000000000C00000000000004604000000000000800E0000000100330032003800350034000000000001800E0000000100330032003800350035000000000002800E0000000100330032003800350036000000000003800E0000000100330032003800350037000000813284C18505D011B29000AA003CF6760B000000000004800E0000000100330032003700360039000000000005800E0000000100330032003700370030000000000006800E0000000100330032003700370031000000000007800E0000000100330032003700370032000000000008800E0000000100330032003700370033000000000009800E000000010033003200370037003400000000000A800E000000010033003200370037003500000000000B800E000000010033003200370037003600000000000C800E000000010033003200370037003700000000000D800E000000010033003200370037003800000000000E800E0000000100330032003700370039000000
(PID) Process:(1152) WinMail.exeKey:HKEY_CURRENT_USER\Software\Microsoft\WAB
Operation:delete valueName:NamedPropCount
Value:
2
Executable files
6
Suspicious files
19
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2144conhost.exeC:\Users\admin\AppData\Roaming\Myokuhesism\zyersydiabb.exeexecutable
MD5:BFEEC3C40F353BD83B55330B4D67EA4E
SHA256:459D5649FC3D8DB6879A8C2EF8E5A931D7909D055A2B222BE199E1CF07CCB66B
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edb00002.logbinary
MD5:D5FED0D952B448322A924A0064B3A38B
SHA256:4A087BA30C6AD95313C19A956D25875563A49328F71A4B3259B68959903F7AD2
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStorebinary
MD5:47618B0406DA5BC324763E00D4A0CB93
SHA256:0AE27C8570E08B362D07E902E634CA1C33E921A3C3EBC625E8B5DF0271BDDF60
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edbtmp.logbinary
MD5:07AE2538251773F3825975F7EE7E6270
SHA256:93087DEE00D614C2629CEF76D0FD5ABE6A71C07435885B937C6A3136A373A9FB
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\edb.chkbinary
MD5:073F2394E22872C8AAC474B7F40802B5
SHA256:EBF080E39266A308FFF262BB8F076F741F434CF1F6CA1A796A31495B389B63F3
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\WindowsMail.patbinary
MD5:01D9836C4D2F53F64107614BE90ADB99
SHA256:27B14F8CD89FA2C2F17D7570B08415D0B1AE79239A55757A7E3B049600C072A1
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\WindowsMail.patbinary
MD5:01D9836C4D2F53F64107614BE90ADB99
SHA256:27B14F8CD89FA2C2F17D7570B08415D0B1AE79239A55757A7E3B049600C072A1
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Backup\temp\edb00002.logbinary
MD5:D5FED0D952B448322A924A0064B3A38B
SHA256:4A087BA30C6AD95313C19A956D25875563A49328F71A4B3259B68959903F7AD2
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\winmail.folbinary
MD5:4BCBF3AE2DB0F8AEE8E792FD9BA8DA7F
SHA256:1A17F24F9D36E0ABE7E2C7C1AD06E30E9EBE674ED2E2E2E0FB9FD451C4D64B51
1152WinMail.exeC:\Users\admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Deleted Items\winmail.folbinary
MD5:60A3B6592DE01A4CB2E07DA218C9F34B
SHA256:8AD29C309236F0210E3AE7AF8ADEDF1642A9E561498F9320B50CEC8938EE8B83
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
zloy1312.tk
  • —
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a .tk domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
conhost.exe