File name:

4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f

Full analysis: https://app.any.run/tasks/747749a1-4700-4f97-82da-e24b246470be
Verdict: Malicious activity
Analysis date: December 02, 2023, 17:45:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

011858556AD3A5EF1A6BBC6AD9EAAE09

SHA1:

ABCF6BE357C375773A9C66022AA781832F85354E

SHA256:

4769732228D757EE48547FBB27C74495437381F13924039C75C48993F85B930F

SSDEEP:

49152:B9YwIPiZcry7w0iAFPpojU3Zp4WaE3G//7/RITXmIy/YDmpr5soSCN6LLAKAgv9O:/I9ry7w0vFCjU3Zp4lE3G//zRITXmIyp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 1832)
      • update.exe (PID: 2300)

    • Application was injected by another process

      • explorer.exe (PID: 1388)

    • Runs injected code in another process

      • update.exe (PID: 1832)

    • Creates a writable file in the system directory

      • dllhost.exe (PID: 1852)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • dllhost.exe (PID: 1852)
      • update.exe (PID: 2300)

    • Reads the Internet Settings

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 2300)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3216)

    • Uses RUNDLL32.EXE to load library

      • update.exe (PID: 2300)

    • Executing commands from a ".bat" file

      • update.exe (PID: 2300)

    • Starts CMD.EXE for commands execution

      • update.exe (PID: 2300)

    • Creates or modifies Windows services

      • rundll32.exe (PID: 1360)

  • INFO

    • Reads Microsoft Office registry keys

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)

    • Create files in a temporary directory

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 1832)
      • update.exe (PID: 2300)

    • Checks supported languages

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 1832)
      • update.exe (PID: 2300)

    • Reads the computer name

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 2300)

    • Drops the executable file immediately after the start

      • dllhost.exe (PID: 1852)

    • Manual execution by a user

      • iscsicpl.exe (PID: 2184)
      • iscsicpl.exe (PID: 684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:03:23 07:06:49+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 47616
InitializedDataSize: 757760
UninitializedDataSize: -
EntryPoint: 0xe8ec5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe no specs winword.exe no specs update.exe no specs explorer.exe Copy/Move/Rename/Delete/Link Object no specs iscsicpl.exe no specs iscsicpl.exe update.exe no specs rundll32.exe no specs cmd.exe no specs attrib.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Windows\System32\migwiz\iscsicpl.exe" -Direct3D "C:\Users\admin\AppData\Local\Temp\update.exe" C:\Windows\System32\migwiz\iscsicpl.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft iSCSI Initiator Configuration Tool
Exit code:
4294967227
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\migwiz\iscsicpl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1360"C:\Windows\System32\rundll32.exe" "C:\PROGRA~1\COMMON~1\MICROS~1\VGX\Stub.dll",InstallC:\Windows\System32\rundll32.exe—update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1388C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1832"C:\Users\admin\AppData\Local\Temp\update.exe" C:\Users\admin\AppData\Local\Temp\update.exe—4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
RpcEndpoint
Exit code:
0
Version:
1.0
Modules
Images
c:\users\admin\appdata\local\temp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1852C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2184"C:\Windows\System32\migwiz\iscsicpl.exe" -Direct3D "C:\Users\admin\AppData\Local\Temp\update.exe" C:\Windows\System32\migwiz\iscsicpl.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft iSCSI Initiator Configuration Tool
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\migwiz\iscsicpl.exe
c:\windows\system32\ntdll.dll
2300"C:\Users\admin\AppData\Local\Temp\update.exe"C:\Users\admin\AppData\Local\Temp\update.exe—iscsicpl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
RpcEndpoint
Exit code:
0
Version:
1.0
Modules
Images
c:\users\admin\appdata\local\temp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3060"C:\Users\admin\AppData\Local\Temp\4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe" C:\Users\admin\AppData\Local\Temp\4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3144attrib -r -s -h"C:\Users\admin\AppData\Local\Temp\"C:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3216C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\2126859.bat" "C:\Users\admin\AppData\Local\Temp\""C:\Windows\System32\cmd.exe—update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 652
Read events
4 178
Write events
348
Delete events
126

Modification events

(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000F6D6788197A75D498472ACE88906AC8D000000000200000000001066000000010000200000007F0C5AFCF1AE7F71286A81A9B86E67A7BE47980777E154AD953E683E2064784E000000000E8000000002000020000000C547D0854BEA52CCDED7859B79990A863903B335001ED826D40C3D8E323F237F30000000DF0FBC24E15CFF4FE438F74D8486DFB808CBF3EC9160BD0CF16731298F2800053F0DC9D2737FB85ABF81EDB882A089A94000000011BAC043EAAF96F8497DEE93A36C7829C97427DA018BC7750377DAC2CC3CE4D64139784732F789D57202D54D80C3AAC2B4B5EE990B65AEF23416199647916AD4
(PID) Process:(3060) 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3060) 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3060) 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3060) 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
Executable files
7
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3476WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6D45.tmp.cvr —
MD5:—
SHA256:—
3476WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:22F7549C8E4AF2D627FECAB67F1FE9CF
SHA256:0EFA37DEAFEB5602CA022DC990ADD2F16BFC7D1FFB745EA1B20555659767039C
30604769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeC:\Users\admin\AppData\Local\Temp\update.exeexecutable
MD5:494BEDC21836A3323F88717066150ABF
SHA256:0CF6D9A5AA3B390F97F20B2FBD2CD9DF76C5BB018C997C26D2E16EB44127C624
1832update.exeC:\Users\admin\AppData\Local\Temp\_2125390__.tmpexecutable
MD5:DFB879F80F14B7DA35A591C8727DD26B
SHA256:831A8204148EF10EB37C8E4FEBF2E19D1DF4F4D5E00EEFC700467B67E3C23E3B
3476WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$¾©´óѧÐÅÏ¢°²È«Ïµ - ÁõÁ¢ - ÖÐÎļòÀú.docbinary
MD5:CBD2801636EBB7638FB2BAB3CE3DB2F3
SHA256:B5CF234A0D94A4771EE079EDA7BC5979E157D73AB9B15BEDD24C5CBD7D17D448
30604769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeC:\Users\admin\AppData\Local\Temp\±±¾©´óѧÐÅÏ¢°²È«Ïµ - ÁõÁ¢ - ÖÐÎļòÀú.docdocument
MD5:260BA703C30B4FBE7F78ABF59C082034
SHA256:0F565C30DCAC19E455591B4B01B7475E7154797953907739CBFFD172DE0991AD
1832update.exeC:\Users\admin\AppData\Local\Temp\_2125390__2.tmpbinary
MD5:BD4057B438566E45268BB457C93A156D
SHA256:D3A722F54C4062F455C63872EFE90B30880B108DB19E7099D9BCECA62AB12969
1852dllhost.exeC:\Windows\System32\migwiz\iscsiexe.dllexecutable
MD5:DFB879F80F14B7DA35A591C8727DD26B
SHA256:831A8204148EF10EB37C8E4FEBF2E19D1DF4F4D5E00EEFC700467B67E3C23E3B
2300update.exeC:\Program Files\Common Files\microsoft shared\VGX\Stub.dllexecutable
MD5:FCEC72D588C1CDD03361A334F29C125B
SHA256:2D752E8A6E42D4B1D14E4400CCCB5F1BDA3DCCD1264D09F4BB2FEFB6B6F5048A
2300update.exeC:\Users\admin\AppData\Local\Temp\2126859.battext
MD5:76042C0A012F48520F7BAABB5AF6C1FC
SHA256:F1DD60586402013EA9F0A4A3650D730B7F04CC71C2641739320FBEDCA76B2EE1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
down.fengzigame.net
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f