File name:

4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f

Full analysis: https://app.any.run/tasks/747749a1-4700-4f97-82da-e24b246470be
Verdict: Malicious activity
Analysis date: December 02, 2023, 17:45:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

011858556AD3A5EF1A6BBC6AD9EAAE09

SHA1:

ABCF6BE357C375773A9C66022AA781832F85354E

SHA256:

4769732228D757EE48547FBB27C74495437381F13924039C75C48993F85B930F

SSDEEP:

49152:B9YwIPiZcry7w0iAFPpojU3Zp4WaE3G//7/RITXmIy/YDmpr5soSCN6LLAKAgv9O:/I9ry7w0vFCjU3Zp4lE3G//zRITXmIyp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • dllhost.exe (PID: 1852)

    • Drops the executable file immediately after the start

      • update.exe (PID: 1832)
      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 2300)

    • Runs injected code in another process

      • update.exe (PID: 1832)

    • Application was injected by another process

      • explorer.exe (PID: 1388)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • dllhost.exe (PID: 1852)
      • update.exe (PID: 2300)

    • Reads the Internet Settings

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 2300)

    • Executing commands from a ".bat" file

      • update.exe (PID: 2300)

    • Uses RUNDLL32.EXE to load library

      • update.exe (PID: 2300)

    • Creates or modifies Windows services

      • rundll32.exe (PID: 1360)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 3216)

    • Starts CMD.EXE for commands execution

      • update.exe (PID: 2300)

  • INFO

    • Checks supported languages

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 2300)
      • update.exe (PID: 1832)

    • Reads Microsoft Office registry keys

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)

    • Reads the computer name

      • update.exe (PID: 2300)
      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)

    • Create files in a temporary directory

      • 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe (PID: 3060)
      • update.exe (PID: 1832)
      • update.exe (PID: 2300)

    • Manual execution by a user

      • iscsicpl.exe (PID: 684)
      • iscsicpl.exe (PID: 2184)

    • Drops the executable file immediately after the start

      • dllhost.exe (PID: 1852)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:03:23 07:06:49+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 47616
InitializedDataSize: 757760
UninitializedDataSize: -
EntryPoint: 0xe8ec5
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe no specs winword.exe no specs update.exe no specs explorer.exe Copy/Move/Rename/Delete/Link Object no specs iscsicpl.exe no specs iscsicpl.exe update.exe no specs rundll32.exe no specs cmd.exe no specs attrib.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
684"C:\Windows\System32\migwiz\iscsicpl.exe" -Direct3D "C:\Users\admin\AppData\Local\Temp\update.exe" C:\Windows\System32\migwiz\iscsicpl.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft iSCSI Initiator Configuration Tool
Exit code:
4294967227
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\migwiz\iscsicpl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1360"C:\Windows\System32\rundll32.exe" "C:\PROGRA~1\COMMON~1\MICROS~1\VGX\Stub.dll",InstallC:\Windows\System32\rundll32.exe—update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1388C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1832"C:\Users\admin\AppData\Local\Temp\update.exe" C:\Users\admin\AppData\Local\Temp\update.exe—4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
RpcEndpoint
Exit code:
0
Version:
1.0
Modules
Images
c:\users\admin\appdata\local\temp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1852C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2184"C:\Windows\System32\migwiz\iscsicpl.exe" -Direct3D "C:\Users\admin\AppData\Local\Temp\update.exe" C:\Windows\System32\migwiz\iscsicpl.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft iSCSI Initiator Configuration Tool
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\migwiz\iscsicpl.exe
c:\windows\system32\ntdll.dll
2300"C:\Users\admin\AppData\Local\Temp\update.exe"C:\Users\admin\AppData\Local\Temp\update.exe—iscsicpl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
RpcEndpoint
Exit code:
0
Version:
1.0
Modules
Images
c:\users\admin\appdata\local\temp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3060"C:\Users\admin\AppData\Local\Temp\4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe" C:\Users\admin\AppData\Local\Temp\4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3144attrib -r -s -h"C:\Users\admin\AppData\Local\Temp\"C:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3216C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\2126859.bat" "C:\Users\admin\AppData\Local\Temp\""C:\Windows\System32\cmd.exe—update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
4 652
Read events
4 178
Write events
348
Delete events
126

Modification events

(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000F6D6788197A75D498472ACE88906AC8D000000000200000000001066000000010000200000007F0C5AFCF1AE7F71286A81A9B86E67A7BE47980777E154AD953E683E2064784E000000000E8000000002000020000000C547D0854BEA52CCDED7859B79990A863903B335001ED826D40C3D8E323F237F30000000DF0FBC24E15CFF4FE438F74D8486DFB808CBF3EC9160BD0CF16731298F2800053F0DC9D2737FB85ABF81EDB882A089A94000000011BAC043EAAF96F8497DEE93A36C7829C97427DA018BC7750377DAC2CC3CE4D64139784732F789D57202D54D80C3AAC2B4B5EE990B65AEF23416199647916AD4
(PID) Process:(3060) 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3060) 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3060) 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3060) 4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(3476) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
Executable files
7
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3476WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR6D45.tmp.cvr —
MD5:—
SHA256:—
30604769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeC:\Users\admin\AppData\Local\Temp\update.exeexecutable
MD5:494BEDC21836A3323F88717066150ABF
SHA256:0CF6D9A5AA3B390F97F20B2FBD2CD9DF76C5BB018C997C26D2E16EB44127C624
30604769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f.exeC:\Users\admin\AppData\Local\Temp\±±¾©´óѧÐÅÏ¢°²È«Ïµ - ÁõÁ¢ - ÖÐÎļòÀú.docdocument
MD5:260BA703C30B4FBE7F78ABF59C082034
SHA256:0F565C30DCAC19E455591B4B01B7475E7154797953907739CBFFD172DE0991AD
1832update.exeC:\Users\admin\AppData\Local\Temp\_2125390__2.tmpbinary
MD5:BD4057B438566E45268BB457C93A156D
SHA256:D3A722F54C4062F455C63872EFE90B30880B108DB19E7099D9BCECA62AB12969
1852dllhost.exeC:\Windows\System32\migwiz\iscsiexe.dllexecutable
MD5:DFB879F80F14B7DA35A591C8727DD26B
SHA256:831A8204148EF10EB37C8E4FEBF2E19D1DF4F4D5E00EEFC700467B67E3C23E3B
3476WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$¾©´óѧÐÅÏ¢°²È«Ïµ - ÁõÁ¢ - ÖÐÎļòÀú.docbinary
MD5:CBD2801636EBB7638FB2BAB3CE3DB2F3
SHA256:B5CF234A0D94A4771EE079EDA7BC5979E157D73AB9B15BEDD24C5CBD7D17D448
1852dllhost.exeC:\Windows\System32\migwiz\iscsicpl.exeexecutable
MD5:6435B29D2018CFAD173BD50AE8F8D5DD
SHA256:5FAA1516327FC1F5694DA81FD20B6FD370575F95C0B5E570B3DF53948CD076E9
1832update.exeC:\Users\admin\AppData\Local\Temp\_2125390__.tmpexecutable
MD5:DFB879F80F14B7DA35A591C8727DD26B
SHA256:831A8204148EF10EB37C8E4FEBF2E19D1DF4F4D5E00EEFC700467B67E3C23E3B
3476WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:22F7549C8E4AF2D627FECAB67F1FE9CF
SHA256:0EFA37DEAFEB5602CA022DC990ADD2F16BFC7D1FFB745EA1B20555659767039C
1832update.exeC:\Users\admin\AppData\Local\Temp\_2125390.dllexecutable
MD5:DFB879F80F14B7DA35A591C8727DD26B
SHA256:831A8204148EF10EB37C8E4FEBF2E19D1DF4F4D5E00EEFC700467B67E3C23E3B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
down.fengzigame.net
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4769732228d757ee48547fbb27c74495437381f13924039c75c48993f85b930f