File name:

点击此处安装语言包.exe

Full analysis: https://app.any.run/tasks/f015aabf-c919-4424-953f-387a13e9dcb1
Verdict: Malicious activity
Analysis date: August 01, 2024, 09:11:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
payload
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B870E407C73E0E67598A2BD52BE901D3

SHA1:

EAC8FE722AB0B8AE08A6A246B2CDED4368B65EEF

SHA256:

5AD6A353F211050D91B196DBC85958629888BFA4DB8828A2F7B941B90655CAF7

SSDEEP:

49152:zlu5dF7/u+xLysh1FYShjSdkwOunK0YHw0hRWQiLrmyN+:z4tDu+LVYM+37nK0YQ0viPmZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 点击此处安装语言包.exe (PID: 6388)

    • Create files in the Startup directory

      • 点击此处安装语言包.exe (PID: 6388)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 点击此处安装语言包.exe (PID: 6388)

    • Payload loading activity detected

      • 点击此处安装语言包.exe (PID: 6388)

    • Connects to unusual port

      • msdot.exe (PID: 6580)

    • Likely accesses (executes) a file from the Public directory

      • msdot.exe (PID: 6580)

  • INFO

    • Creates files or folders in the user directory

      • 点击此处安装语言包.exe (PID: 6388)

    • Checks supported languages

      • 点击此处安装语言包.exe (PID: 6388)
      • msdot.exe (PID: 6580)

    • Reads the computer name

      • 点击此处安装语言包.exe (PID: 6388)
      • msdot.exe (PID: 6580)

    • Creates files in the program directory

      • msdot.exe (PID: 6580)

    • Reads CPU info

      • msdot.exe (PID: 6580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:10:15 07:41:44+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 548864
InitializedDataSize: 315392
UninitializedDataSize: -
EntryPoint: 0xec2c6
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 点击此处安装语言包.exe msdot.exe

Process information

PID
CMD
Path
Indicators
Parent process
6388"C:\Users\admin\AppData\Local\Temp\点击此处安装语言包.exe" C:\Users\admin\AppData\Local\Temp\点击此处安装语言包.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\点击此处安装语言包.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6580C:\Users\Public\Videos\VSTelem\msdot\msdot.exeC:\Users\Public\Videos\VSTelem\msdot\msdot.exe
点击此处安装语言包.exe
User:
admin
Company:
CyberLink Corp.
Integrity Level:
MEDIUM
Description:
PowerDVD Language Application
Version:
1.00.3413
Modules
Images
c:\users\public\videos\vstelem\msdot\msdot.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
1 920
Read events
1 920
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
1
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
6580msdot.exeC:\ProgramData\Lexicon\Setting.dt —
MD5:—
SHA256:—
6388点击此处安装语言包.exeC:\Users\Public\Videos\VSTelem\msdot\Update.logbinary
MD5:7E651E861E25E68820D109B1F2618D79
SHA256:E7B0140998A55EAC72263FD9D41452851475EF99FEA74E201DFB76A963E25B80
6388点击此处安装语言包.exeC:\Users\Public\Videos\VSTelem\msdot\Language.dllexecutable
MD5:3DC8268E939EA269474B319E6AD64066
SHA256:0E807EEA09CFB000D965D3F32AC4DFBA6FA9A480BF6289FFD3C7576DDDFDBB5A
6388点击此处安装语言包.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SYSTEM_START.lnklnk
MD5:6A5697D2DF94F2D08A61C943BAFBE6A9
SHA256:3BC6BBFFBD5EFB514D9073C1320941C96CED3938E94301C3ABC6315B3FAE000D
6388点击此处安装语言包.exeC:\Users\Public\Videos\VSTelem\msdot\msdot.exeexecutable
MD5:86810E2D993F7327EB5B25B5D17D21C1
SHA256:63636CEC408ACBBC4D04C01F9EFDBE4B9B08FA0C4390EC8729B9FF0C8BE9D246
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
44
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6388
点击此处安装语言包.exe
GET
—
148.113.164.76:8080
http://qincc.vip:8080/navi/D41D8CD98F00B204
unknown
—
—
suspicious
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2204
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2204
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6768
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6816
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5240
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4100
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6388
点击此处安装语言包.exe
148.113.164.76:8080
—
OVH SAS
CA
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4100
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6580
msdot.exe
148.113.152.19:9266
sk.2x5.xyz
OVH SAS
CA
unknown
5336
SearchApp.exe
2.23.209.187:443
www.bing.com
Akamai International B.V.
GB
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
s.2x5.xyz
  • 229.213.232.169
malicious
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
sk.2x5.xyz
  • 148.113.152.19
unknown
www.bing.com
  • 2.23.209.187
  • 2.23.209.171
  • 2.23.209.181
  • 2.23.209.186
  • 2.23.209.185
  • 2.23.209.182
  • 2.23.209.179
  • 2.23.209.178
  • 2.23.209.173
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.72
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.74
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.185
  • 2.23.209.180
  • 2.23.209.181
  • 2.23.209.173
  • 2.23.209.178
  • 2.23.209.171
  • 2.23.209.179
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
6388
点击此处安装语言包.exe
Potentially Bad Traffic
PAYLOAD [ANY.RUN] XORed Windows executable has been loaded
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
点击此处安装语言包.exe