File name:

Axam.a.exe

Full analysis: https://app.any.run/tasks/a021112f-ea01-4c34-aab0-fa842f207565
Verdict: Malicious activity
Analysis date: June 09, 2024, 12:48:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
worm
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0FBF8022619BA56C545B20D172BF3B87

SHA1:

752E5CE51F0CF9192B8FA1D28A7663B46E3577FF

SHA256:

4AE7D63EC497143C2ACDE1BA79F1D9EED80086A420B6F0A07B1E2917DA0A6C74

SSDEEP:

192:33K8Vn5fAIBkPA9tQdEnhAv+mKqh1RwE9gCOMv8eIry2aZoa5qq/b:33X54IB8SCY2W3qmSgaIrTDSqq/b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • Axam.a.exe (PID: 3976)

    • Drops the executable file immediately after the start

      • Axam.a.exe (PID: 3976)

    • Changes the autorun value in the registry

      • Axam.a.exe (PID: 3976)
      • Axam.a.exe (PID: 768)
      • Axam.exe (PID: 1884)
      • Axam.exe (PID: 1676)
      • Axam.exe (PID: 1936)
      • Axam.exe (PID: 2332)
      • Axam.exe (PID: 2516)

    • Creates a writable file in the system directory

      • OUTLOOK.EXE (PID: 2060)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Axam.a.exe (PID: 3976)

    • Creates file in the systems drive root

      • Axam.a.exe (PID: 3976)
      • Axam.exe (PID: 1884)
      • Axam.a.exe (PID: 768)
      • Axam.exe (PID: 1676)
      • Axam.exe (PID: 1936)
      • Axam.exe (PID: 2332)
      • Axam.exe (PID: 2516)

  • INFO

    • Checks supported languages

      • Axam.a.exe (PID: 3976)
      • Axam.a.exe (PID: 768)
      • Axam.exe (PID: 1884)
      • Axam.exe (PID: 1936)
      • Axam.exe (PID: 1676)
      • Axam.exe (PID: 2332)
      • Axam.exe (PID: 2516)

    • Create files in a temporary directory

      • Axam.a.exe (PID: 3976)
      • Axam.a.exe (PID: 768)
      • Axam.exe (PID: 1884)
      • Axam.exe (PID: 1936)
      • Axam.exe (PID: 1676)
      • Axam.exe (PID: 2332)
      • Axam.exe (PID: 2516)

    • Reads the machine GUID from the registry

      • Axam.a.exe (PID: 3976)
      • Axam.a.exe (PID: 768)
      • Axam.exe (PID: 1884)
      • Axam.exe (PID: 1676)
      • Axam.exe (PID: 1936)
      • Axam.exe (PID: 2332)
      • Axam.exe (PID: 2516)

    • Creates files or folders in the user directory

      • Axam.a.exe (PID: 3976)

    • Reads the computer name

      • Axam.a.exe (PID: 3976)
      • Axam.a.exe (PID: 768)
      • Axam.exe (PID: 1884)
      • Axam.exe (PID: 2516)
      • Axam.exe (PID: 1936)
      • Axam.exe (PID: 1676)
      • Axam.exe (PID: 2332)

    • Manual execution by a user

      • Axam.a.exe (PID: 768)
      • Axam.exe (PID: 1884)
      • Axam.exe (PID: 1676)
      • Axam.exe (PID: 1936)
      • Axam.exe (PID: 2516)
      • Axam.exe (PID: 2332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (44)
.exe | Win32 EXE Yoda's Crypter (42.3)
.exe | Win32 Executable (generic) (7.1)
.exe | Generic Win/DOS Executable (3.1)
.exe | DOS Executable Generic (3.1)

EXIF

EXE

OriginalFileName: Axam.exe
InternalName: Axam
ProductVersion: 1
FileVersion: 1
ProductName: Axam
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 1
OSVersion: 4
EntryPoint: 0xa260
UninitializedDataSize: 28672
InitializedDataSize: 4096
CodeSize: 12288
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
TimeStamp: 2003:02:09 12:20:54+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
1
Suspicious processes
6

Behavior graph

Click at the process to see the details
start axam.a.exe outlook.exe axam.a.exe outlook.exe axam.exe outlook.exe no specs axam.exe axam.exe axam.exe axam.exe

Process information

PID
CMD
Path
Indicators
Parent process
3976"C:\Users\admin\Desktop\Axam.a.exe" C:\Users\admin\Desktop\Axam.a.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\desktop\axam.a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
4060"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
768"C:\Users\admin\Desktop\Axam.a.exe" C:\Users\admin\Desktop\Axam.a.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Version:
1.00
Modules
Images
c:\users\admin\desktop\axam.a.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2060"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1884"C:\Users\admin\AppData\Roaming\Axam.exe" "C:\Program Files\Mozilla Firefox\firefox.exe" C:\Users\admin\AppData\Roaming\Axam.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\axam.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1600"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1676"C:\Users\admin\AppData\Roaming\Axam.exe" "C:\Program Files\Google\Chrome\Application\chrome.exe" "--disable-features=OptimizationGuideModelDownloading,OptimizationHintsFetching,OptimizationTargetPrediction,OptimizationHints"C:\Users\admin\AppData\Roaming\Axam.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\axam.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1936"C:\Users\admin\AppData\Roaming\Axam.exe" "C:\Program Files\FileZilla FTP Client\filezilla.exe" C:\Users\admin\AppData\Roaming\Axam.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\axam.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2332"C:\Users\admin\AppData\Roaming\Axam.exe" "C:\Program Files\CCleaner\CCleaner.exe" C:\Users\admin\AppData\Roaming\Axam.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\axam.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2516"C:\Users\admin\AppData\Roaming\Axam.exe" "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" C:\Users\admin\AppData\Roaming\Axam.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\axam.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
12 462
Read events
12 219
Write events
196
Delete events
47

Modification events

(PID) Process:(3976) Axam.a.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:sysaxam32
Value:
C:\Users\admin\AppData\Roaming\Axam.exe
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
Off
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
Off
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
Off
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
Off
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
Off
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
Off
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
Off
(PID) Process:(4060) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
Off
Executable files
3
Suspicious files
6
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
4060OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR6246.tmp.cvr —
MD5:—
SHA256:—
4060OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2060OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR98E6.tmp.cvr —
MD5:—
SHA256:—
1600OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRBDD3.tmp.cvr —
MD5:—
SHA256:—
4060OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{BB81904E-558A-43D9-A136-1DA02AD54478}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
4060OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
768Axam.a.exeC:\Autoexec.battext
MD5:3E52A60FCC425D91ED81E648223C8294
SHA256:19A3BF8A108DECBE5FB92F4B26AC2DF43C3F00F1CDBC4BE03FBBDF1722095E17
3976Axam.a.exeC:\Users\admin\AppData\Roaming\Axam.exeexecutable
MD5:0FBF8022619BA56C545B20D172BF3B87
SHA256:4AE7D63EC497143C2ACDE1BA79F1D9EED80086A420B6F0A07B1E2917DA0A6C74
2060OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\mapisvc.inftext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
2060OUTLOOK.EXEC:\Windows\inf\Outlook\0009\outlperf.initext
MD5:509A7197AE66401D1DA76F4BAC1DD0A8
SHA256:EE9E288C3495FD548FD49095BE08807F215FC0780064E179011098C0C7461A34
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4060
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2060
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Axam.a.exe