File name:

VbsToExePortable_3.2_Dev_Test_1.paf.exe

Full analysis: https://app.any.run/tasks/0d6f9cc4-2858-40fc-836a-b9c4269b20b0
Verdict: Malicious activity
Analysis date: July 22, 2024, 06:38:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

ED9776CDE2D5CBEFE7A9694FB6764CDD

SHA1:

D0D06013E017291F5EA2DBBA652DD133B2CA55F5

SHA256:

470887F40264DCECD818DED225970338D2C84CBC3B7D0A3169BDA7582D83633B

SSDEEP:

98304:1aXNOJY5KMlZA0Tkffj8kmI3OB3l6hOlWApuOlEuXve4OM9kIOhIxOsshp1nqgML:vIo4FsLLMUY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Vbs_To_Exe_(x64).exe (PID: 5696)
      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)
      • VbsToExePortable.exe (PID: 7064)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)
      • VbsToExePortable.exe (PID: 7064)

    • The process creates files with name similar to system file names

      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)
      • VbsToExePortable.exe (PID: 7064)

    • Reads security settings of Internet Explorer

      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)
      • VbsToExePortable.exe (PID: 7064)
      • Vbs_To_Exe_(x64).exe (PID: 5696)

    • Executable content was dropped or overwritten

      • Vbs_To_Exe_(x64).exe (PID: 5696)
      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)
      • VbsToExePortable.exe (PID: 7064)

    • There is functionality for taking screenshot (YARA)

      • Vbs_To_Exe_(x64).exe (PID: 5696)

    • Reads Microsoft Outlook installation path

      • Vbs_To_Exe_(x64).exe (PID: 5696)

    • Reads Internet Explorer settings

      • Vbs_To_Exe_(x64).exe (PID: 5696)

  • INFO

    • Reads the computer name

      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)
      • VbsToExePortable.exe (PID: 7064)
      • Vbs_To_Exe_(x64).exe (PID: 5696)

    • Checks supported languages

      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)
      • VbsToExePortable.exe (PID: 7064)
      • Vbs_To_Exe_(x64).exe (PID: 5696)

    • Create files in a temporary directory

      • VbsToExePortable_3.2_Dev_Test_1.paf.exe (PID: 1456)
      • VbsToExePortable.exe (PID: 7064)
      • Vbs_To_Exe_(x64).exe (PID: 5696)

    • Process checks Internet Explorer phishing filters

      • Vbs_To_Exe_(x64).exe (PID: 5696)

    • UPX packer has been detected

      • Vbs_To_Exe_(x64).exe (PID: 5696)

    • Checks proxy server information

      • Vbs_To_Exe_(x64).exe (PID: 5696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:12:15 22:26:01+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 428544
UninitializedDataSize: 16384
EntryPoint: 0x34a5
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.1.99.1
ProductVersionNumber: 3.1.99.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: For additional details, visit PortableApps.com
CompanyName: PortableApps.com
FileDescription: VbsToExe Portable
FileVersion: 3.1.99.1
InternalName: VbsToExe Portable
LegalCopyright: 2007-2019 PortableApps.com, PortableApps.com Installer 3.5.14.0
LegalTrademarks: PortableApps.com is a registered trademark of Rare Ideas, LLC.
OriginalFileName: VbsToExePortable_3.2_Dev_Test_1.paf.exe
PortableAppscomAppID: VbsToExePortable
PortableAppscomFormatVersion: 3.5.14
PortableAppscomInstallerVersion: 3.5.14.0
ProductName: VbsToExe Portable
ProductVersion: 3.1.99.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vbstoexeportable_3.2_dev_test_1.paf.exe slui.exe no specs vbstoexeportable.exe THREAT vbs_to_exe_(x64).exe

Process information

PID
CMD
Path
Indicators
Parent process
1456"C:\Users\admin\AppData\Local\Temp\VbsToExePortable_3.2_Dev_Test_1.paf.exe" C:\Users\admin\AppData\Local\Temp\VbsToExePortable_3.2_Dev_Test_1.paf.exe
explorer.exe
User:
admin
Company:
PortableApps.com
Integrity Level:
MEDIUM
Description:
VbsToExe Portable
Exit code:
0
Version:
3.1.99.1
Modules
Images
c:\users\admin\appdata\local\temp\vbstoexeportable_3.2_dev_test_1.paf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5696"C:\Users\admin\Desktop\VbsToExe\VbsToExePortable\App\VbsToExe\Vbs_To_Exe_(x64).exe"C:\Users\admin\Desktop\VbsToExe\VbsToExePortable\App\VbsToExe\Vbs_To_Exe_(x64).exe
VbsToExePortable.exe
User:
admin
Company:
Fatih Kodak
Integrity Level:
MEDIUM
Description:
Vbs To Exe
Version:
3.2
Modules
Images
c:\users\admin\desktop\vbstoexe\vbstoexeportable\app\vbstoexe\vbs_to_exe_(x64).exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6868C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7064"C:\Users\admin\Desktop\VbsToExe\VbsToExePortable\VbsToExePortable.exe"C:\Users\admin\Desktop\VbsToExe\VbsToExePortable\VbsToExePortable.exe
VbsToExePortable_3.2_Dev_Test_1.paf.exe
User:
admin
Company:
PortableApps.com
Integrity Level:
MEDIUM
Description:
VbsToExe Portable (PortableApps.com Launcher)
Version:
2.2.1.0
Modules
Images
c:\users\admin\desktop\vbstoexe\vbstoexeportable\vbstoexeportable.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
18 975
Read events
18 915
Write events
56
Delete events
4

Modification events

(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
87
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
8AFE9D6600000000
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-123
Value:
Microsoft Word Document
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-174
Value:
Microsoft PowerPoint Presentation
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-131
Value:
Rich Text Format
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-101
Value:
Microsoft Excel Worksheet
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Operation:delete keyName:(default)
Value:
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Operation:writeName:Classes
Value:
.accdb
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew
Operation:writeName:~reserved~
Value:
0800000000000600
(PID) Process:(1456) VbsToExePortable_3.2_Dev_Test_1.paf.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
0202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
Executable files
13
Suspicious files
7
Text files
44
Unknown types
0

Dropped files

PID
Process
Filename
Type
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\AppData\Local\Temp\nszA411.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\Desktop\VbsToExe\VbsToExePortable\App\AppInfo\appicon.icoimage
MD5:38F171FCC675214D6DB0C60E8C21E26B
SHA256:EA0E0C39654709894F9F50A16AD9C75467DD484515246039B19CFDA3783D82C6
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\Desktop\VbsToExe\VbsToExePortable\App\AppInfo\appicon_128.pngimage
MD5:17AE1CE224B839F70CAE38802A27CC51
SHA256:7D5CB97236C79DDB04BF08D4BC6C5A065A881786429CEAB3176A372061E6161F
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\AppData\Local\Temp\nszA411.tmp\modern-wizard.bmpimage
MD5:4DF53EFCAA2C52F39618B2AAD77BB552
SHA256:EE13539F3D66CC0592942EA1A4C35D8FD9AF67B1A7F272D0D791931E6E9CE4EB
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\AppData\Local\Temp\nszA411.tmp\w7tbp.dllexecutable
MD5:9A3031CC4CEF0DBA236A28EECDF0AFB5
SHA256:53BB519E3293164947AC7CBD7E612F637D77A7B863E3534BA1A7E39B350D3C00
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\Desktop\VbsToExe\VbsToExePortable\App\Readme.txttext
MD5:39809395CA95E97C59CB866F342435E3
SHA256:6DDD6B23FDDDEFD100900089CC6873D6506D4EB496B7D570AB388823E44675C4
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\Desktop\VbsToExe\VbsToExePortable\VbsToExePortable.exeexecutable
MD5:C8A30A92C4A144FEBF281538675EE5E7
SHA256:59FB4373FFE356A9053B396680F4449AE3110DF1D1757B4B6286F6030AF6C1F7
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\Desktop\VbsToExe\VbsToExePortable\App\AppInfo\appicon_16.pngimage
MD5:18074EE3251A960D63C6F7CC1749580F
SHA256:E99416420CB5D180105FD4939D73ADDFA1B2B124F7154191F68A29AB7E1C751F
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\Desktop\VbsToExe\VbsToExePortable\App\AppInfo\appicon_256.pngimage
MD5:0D2F25B26FCFBA86D666328F4EE0AF19
SHA256:839EBBC3B683060288E93D81E3824172EA2C0EA4C98422822BEDCD2891EB5123
1456VbsToExePortable_3.2_Dev_Test_1.paf.exeC:\Users\admin\Desktop\VbsToExe\VbsToExePortable\App\AppInfo\appicon_32.pngimage
MD5:B935639C20E0F3C3FDE34536D7C11BDE
SHA256:71EC24BDC833FC38FF7B11612502532503536AE03C987E915022C5E73805375D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
33
DNS requests
13
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4716
svchost.exe
20.190.159.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5620
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7856
svchost.exe
4.208.221.206:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2760
svchost.exe
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7976
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4716
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5620
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.159.4
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.73
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.68
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.46
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
www.bing.com
  • 184.86.251.21
  • 184.86.251.4
  • 184.86.251.27
  • 184.86.251.30
  • 184.86.251.20
  • 184.86.251.22
  • 184.86.251.31
  • 184.86.251.26
  • 184.86.251.24
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VbsToExePortable_3.2_Dev_Test_1.paf.exe