File name:

Demon-Extra-Skill.exe

Full analysis: https://app.any.run/tasks/ae09c3aa-a2e3-4870-b446-698dea3fb53a
Verdict: Malicious activity
Analysis date: March 29, 2025, 15:53:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
jeefo
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

844248D1B9CE15718DD7CF9C487A849C

SHA1:

6217172EFC4CA2DA2971B019F9F164B1360FEE8E

SHA256:

5332A4F202442C0E60695D4211308DCF580E9A2B1CA33E3A5DAC87AA3BC157AE

SSDEEP:

98304:5cleVXEdH8zphsvRvzyyMy3DMy34ffffYLS7ARqyngRyFiIzQS:o5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • JEEFO has been detected

      • Demon-Extra-Skill.exe (PID: 7208)
      • icsys.icn.exe (PID: 7240)
      • svchost.exe (PID: 7392)
      • explorer.exe (PID: 7348)

    • Changes the autorun value in the registry

      • svchost.exe (PID: 7392)
      • explorer.exe (PID: 7348)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Demon-Extra-Skill.exe (PID: 7208)
      • spoolsv.exe (PID: 7372)
      • icsys.icn.exe (PID: 7240)
      • explorer.exe (PID: 7348)

    • Starts itself from another location

      • Demon-Extra-Skill.exe (PID: 7208)
      • spoolsv.exe (PID: 7372)
      • svchost.exe (PID: 7392)
      • icsys.icn.exe (PID: 7240)
      • explorer.exe (PID: 7348)

    • Starts application with an unusual extension

      • Demon-Extra-Skill.exe (PID: 7208)

    • The process creates files with name similar to system file names

      • spoolsv.exe (PID: 7372)
      • icsys.icn.exe (PID: 7240)

  • INFO

    • The sample compiled with english language support

      • Demon-Extra-Skill.exe (PID: 7208)

    • Checks supported languages

      • Demon-Extra-Skill.exe (PID: 7208)
      • icsys.icn.exe (PID: 7240)
      • svchost.exe (PID: 7392)
      • explorer.exe (PID: 7348)
      • spoolsv.exe (PID: 7372)
      • spoolsv.exe (PID: 7428)

    • Create files in a temporary directory

      • Demon-Extra-Skill.exe (PID: 7208)
      • icsys.icn.exe (PID: 7240)
      • svchost.exe (PID: 7392)
      • explorer.exe (PID: 7348)
      • spoolsv.exe (PID: 7372)
      • spoolsv.exe (PID: 7428)

    • Reads the computer name

      • icsys.icn.exe (PID: 7240)
      • svchost.exe (PID: 7392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:04:01 07:08:22+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 106496
InitializedDataSize: 12288
UninitializedDataSize: -
EntryPoint: 0x290c
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: Project1
FileVersion: 1
ProductVersion: 1
InternalName: TJprojMain
OriginalFileName: TJprojMain.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #JEEFO demon-extra-skill.exe demon-extra-skill.exe  no specs #JEEFO icsys.icn.exe conhost.exe no specs #JEEFO explorer.exe spoolsv.exe #JEEFO svchost.exe spoolsv.exe no specs sppextcomobj.exe no specs slui.exe no specs demon-extra-skill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2284"C:\Users\admin\AppData\Local\Temp\Demon-Extra-Skill.exe" C:\Users\admin\AppData\Local\Temp\Demon-Extra-Skill.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\demon-extra-skill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7208"C:\Users\admin\AppData\Local\Temp\Demon-Extra-Skill.exe" C:\Users\admin\AppData\Local\Temp\Demon-Extra-Skill.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\local\temp\demon-extra-skill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
7232c:\users\admin\appdata\local\temp\demon-extra-skill.exe  C:\Users\admin\AppData\Local\Temp\demon-extra-skill.exe —Demon-Extra-Skill.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225781
Modules
Images
c:\users\admin\appdata\local\temp\demon-extra-skill.exe 
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7240C:\Windows\Resources\Themes\icsys.icn.exeC:\Windows\Resources\Themes\icsys.icn.exe
Demon-Extra-Skill.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\themes\icsys.icn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
7248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—demon-extra-skill.exe 
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7348c:\windows\resources\themes\explorer.exeC:\Windows\Resources\Themes\explorer.exe
icsys.icn.exe
User:
admin
Integrity Level:
HIGH
Version:
1.00
Modules
Images
c:\windows\resources\themes\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
7372c:\windows\resources\spoolsv.exe SEC:\Windows\Resources\spoolsv.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
7392c:\windows\resources\svchost.exeC:\Windows\Resources\svchost.exe
spoolsv.exe
User:
admin
Integrity Level:
HIGH
Version:
1.00
Modules
Images
c:\windows\resources\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
7428c:\windows\resources\spoolsv.exe PRC:\Windows\Resources\spoolsv.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.00
Modules
Images
c:\windows\resources\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
7536C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
517
Read events
506
Write events
7
Delete events
4

Modification events

(PID) Process:(7208) Demon-Extra-Skill.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
(PID) Process:(7240) icsys.icn.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Explorer\Process
Operation:writeName:LO
Value:
1
(PID) Process:(7348) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Explorer
Value:
c:\windows\resources\themes\explorer.exe RO
(PID) Process:(7348) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Svchost
Value:
c:\windows\resources\svchost.exe RO
(PID) Process:(7348) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Explorer
Value:
(PID) Process:(7348) explorer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Svchost
Value:
(PID) Process:(7392) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Explorer
Value:
c:\windows\resources\themes\explorer.exe RO
(PID) Process:(7392) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:Svchost
Value:
c:\windows\resources\svchost.exe RO
(PID) Process:(7392) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Explorer
Value:
(PID) Process:(7392) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Svchost
Value:
Executable files
5
Suspicious files
4
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7348explorer.exeC:\Windows\Resources\spoolsv.exeexecutable
MD5:C265340420BACB624FBF8AB933F1E4F1
SHA256:09FDF27B5E56770E2B1A60BC276EE3294C3142F7F90BA3DD59F2E7714A2CD71F
7240icsys.icn.exeC:\Windows\Resources\Themes\explorer.exeexecutable
MD5:4C87B1ED7BDA329FB8EF5626CB76E7B4
SHA256:71809C7282F6FDA26690C9D3E8FBAA7A86CDFD69257CA3A88F5DD65BBE8B16FF
7208Demon-Extra-Skill.exeC:\Windows\Resources\Themes\icsys.icn.exeexecutable
MD5:BF83630A3F3182F2C44AB4BFEE85DA8C
SHA256:1079EE370067ECCDC02B1B805A5150DDF419AD85BE028804A8676E6E7C795B21
7240icsys.icn.exeC:\Users\admin\AppData\Local\Temp\~DFFC4687B21E20401A.TMPbinary
MD5:481FA7E3AC892A4424D5DB892C9B7D94
SHA256:D5685B788D8F28C51074B1E9B9DA1F9087DB79850096D50E1B40795C4AA8F38B
7428spoolsv.exeC:\Users\admin\AppData\Local\Temp\~DFC6E5F11A83ABF768.TMPbinary
MD5:C300F61D10A6B8B02B2BACA4ADA66BB0
SHA256:739B99AB00292C07C3D5199BEF9BB965FC956D8267C85BC013168C8576C32F06
7208Demon-Extra-Skill.exeC:\Users\admin\AppData\Local\Temp\~DFE1501047EADCB75B.TMPbinary
MD5:96CFE581E3CFD7DE99A900D8D3F40A41
SHA256:E0F7DD168932710FB8783FA3AFDE6CB8A5F751870C81838A27766A87220284CF
7372spoolsv.exeC:\Users\admin\AppData\Local\Temp\~DF5C58EE148665BE66.TMPbinary
MD5:2D0230CBA18E0F29CE23BFEEDBE3F36A
SHA256:3F8EC150D0F2B4FA69F4C7B67B673A7E745CFBFDE4C2D01F073F595F6E24E186
7372spoolsv.exeC:\Windows\Resources\svchost.exeexecutable
MD5:37EC0160903B606EBE3ED0FA757CF2F4
SHA256:1B1883A7A308761DAA3361C29F979D25DB3A2C5ECEFF19723592F3AEC95537E3
7208Demon-Extra-Skill.exeC:\Users\admin\AppData\Local\Temp\demon-extra-skill.exe executable
MD5:34EB33B985338574DA17B2E17A76FF46
SHA256:D68A6A23BF1260118185F4B1736FAE5CD4328E0A4DC0E9A0491B11BE8DCA8B6B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8096
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8096
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6668
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.166
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • —
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.64
  • 40.126.32.76
  • 20.190.160.4
  • 20.190.160.132
  • 20.190.160.65
  • 40.126.32.136
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 2.19.217.218
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Demon-Extra-Skill.exe