File name:

Fotos fiesta 7 millones de clientes .jpg.exe

Full analysis: https://app.any.run/tasks/6d3ee945-527b-41b9-a3bb-3d0d5fd1871a
Verdict: Malicious activity
Analysis date: October 16, 2024, 17:14:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pyinstaller
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

7A578E3738AFA30A63E0BEDE2B80B83A

SHA1:

B1C36FF3AE2E3468575F116780876B17F796E113

SHA256:

46ABEFCD1C15CD58B797BA58D15D7B0CE6F71F7FF35ED8299874CE46F3B3F85A

SSDEEP:

196608:1NcP9YaqYITyYNwnGX4Be0plRWooJKIDSIc:1N4LITynGIBeYWLr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops python dynamic module

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)

    • The process drops C-runtime libraries

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)

    • Executable content was dropped or overwritten

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)

    • Application launched itself

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)

    • Process drops legitimate windows executable

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)

  • INFO

    • Create files in a temporary directory

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)

    • PyInstaller has been detected (YARA)

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)

    • Reads the computer name

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)

    • Checks supported languages

      • Fotos fiesta 7 millones de clientes .jpg.exe (PID: 6692)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:10:13 23:51:30+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 172032
InitializedDataSize: 161280
UninitializedDataSize: -
EntryPoint: 0xcdb0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT fotos fiesta 7 millones de clientes .jpg.exe sppextcomobj.exe no specs slui.exe no specs fotos fiesta 7 millones de clientes .jpg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5068"C:\Users\admin\AppData\Local\Temp\Fotos fiesta 7 millones de clientes .jpg.exe" C:\Users\admin\AppData\Local\Temp\Fotos fiesta 7 millones de clientes .jpg.exe—Fotos fiesta 7 millones de clientes .jpg.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\fotos fiesta 7 millones de clientes .jpg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6164C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6692"C:\Users\admin\AppData\Local\Temp\Fotos fiesta 7 millones de clientes .jpg.exe" C:\Users\admin\AppData\Local\Temp\Fotos fiesta 7 millones de clientes .jpg.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\fotos fiesta 7 millones de clientes .jpg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7128"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
292
Read events
292
Write events
0
Delete events
0

Modification events

No data
Executable files
70
Suspicious files
3
Text files
1 037
Unknown types
0

Dropped files

PID
Process
Filename
Type
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\PIL\_imaging.cp313-win_amd64.pydexecutable
MD5:EF228C0B3BEC799DB695CA6F8BBED5D6
SHA256:3970E5ACEC7E890D5279F14E29DD5982C9435262CBB36BCBFD5DB493FA7C192A
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\PIL\_imagingtk.cp313-win_amd64.pydexecutable
MD5:1042EC0CB4E0CB65D6AA82FDE0B9C5A4
SHA256:4604AB53311C25130E8A52E2721CF6F5B3E76B750B00B446FF03A3C224648B4A
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\VCRUNTIME140.dllexecutable
MD5:862F820C3251E4CA6FC0AC00E4092239
SHA256:36585912E5EAF83BA9FEA0631534F690CCDC2D7BA91537166FE53E56C221E153
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\_ctypes.pydexecutable
MD5:A55E57D7594303C89B5F7A1D1D6F2B67
SHA256:F63C6C7E71C342084D8F1A108786CA6975A52CEFEF8BE32CC2589E6E2FE060C8
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\PIL\_webp.cp313-win_amd64.pydexecutable
MD5:946CAAF6DB0893119C36A528256BDD3C
SHA256:EE90ED7EB3D53AB8A7895CD3993418FF1AAC294A7FFA769487E4EAA109A2E061
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\_overlapped.pydexecutable
MD5:A72527454DD6DA346DDB221FC729E3D4
SHA256:404353D7B867749FA2893033BD1EBF2E3F75322D4015725D697CFA5E80EC9D0F
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\VCRUNTIME140_1.dllexecutable
MD5:68156F41AE9A04D89BB6625A5CD222D4
SHA256:82A2F9AE1E6146AE3CB0F4BC5A62B7227E0384209D9B1AEF86BBCC105912F7CD
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\PIL\_imagingcms.cp313-win_amd64.pydexecutable
MD5:287734AE6B2AE9A9E771C1D573DD1CE2
SHA256:E0126A6C19EDEF624EF44CA9930795E209F2147FF0CC7D1A02E6DA424D60887F
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\_hashlib.pydexecutable
MD5:32D76C9ABD65A5D2671AEEDE189BC290
SHA256:838D5C8B7C3212C8429BAF612623ABBBC20A9023EEC41E34E5461B76A285B86C
6692Fotos fiesta 7 millones de clientes .jpg.exeC:\Users\admin\AppData\Local\Temp\_MEI66922\_decimal.pydexecutable
MD5:F3377F3DE29579140E2BBAEEFD334D4F
SHA256:B715D1C18E9A9C1531F21C02003B4C6726742D1A2441A1893BC3D79D7BB50E91
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
52
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6376
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2000
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1576
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1576
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.23.209.183:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4360
SearchApp.exe
2.23.209.177:443
www.bing.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.209.183
  • 2.23.209.177
  • 2.23.209.130
  • 2.23.209.189
  • 2.23.209.181
  • 2.23.209.193
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.179
  • 2.23.209.158
  • 2.23.209.176
  • 2.23.209.161
  • 2.23.209.160
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
google.com
  • 142.250.185.206
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 88.221.169.152
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
th.bing.com
  • 2.23.209.131
  • 2.23.209.141
  • 2.23.209.189
  • 2.23.209.133
  • 2.23.209.150
  • 2.23.209.130
  • 2.23.209.148
  • 2.23.209.135
  • 2.23.209.193
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fotos fiesta 7 millones de clientes .jpg.exe