File name:

ESFXCreator.exe

Full analysis: https://app.any.run/tasks/84b246a2-17a5-4b62-98d2-531c9348bc11
Verdict: Malicious activity
Threats:

First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments.

Malware Trends Tracker     >>>
Analysis date: August 01, 2025, 02:54:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
emmenhtal
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

DA17623F70DA83A98F7ECF8390550EA4

SHA1:

D0C91542AE48EC2E02E669A85006F9831F62600E

SHA256:

5D6284D388386800AC17C2BD04C5F62E8B33577AC02E8C5E5A51D260640A50C9

SSDEEP:

12288:SaSk5uceHAmCMoJ7s+hESUaSk5uceHAmlMoJ7snlu:ok5uceHAr6k5uceHAllu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EMMENHTAL has been detected (YARA)

      • mshta.exe (PID: 2596)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ESFXCreator.exe (PID: 2976)

    • There is functionality for taking screenshot (YARA)

      • ESFXCreator.exe (PID: 2976)

    • Executes application which crashes

      • mshta.exe (PID: 2596)

  • INFO

    • Create files in a temporary directory

      • ESFXCreator.exe (PID: 2976)

    • Checks supported languages

      • ESFXCreator.exe (PID: 2976)

    • Process checks computer location settings

      • ESFXCreator.exe (PID: 2976)

    • Reads the computer name

      • ESFXCreator.exe (PID: 2976)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 2596)

    • Checks proxy server information

      • mshta.exe (PID: 2596)
      • WerFault.exe (PID: 6748)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6748)

    • Reads security settings of Internet Explorer

      • WerFault.exe (PID: 6748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:12:31 00:38:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 89600
InitializedDataSize: 467968
UninitializedDataSize: -
EntryPoint: 0x1638f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.2712
ProductVersionNumber: 1.6.0.2712
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Djengineer14
FileDescription: Create SFX/Exe Files
FileVersion: 1.6.0.2712
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2012 Oleg N. Scherbakov
OriginalFileName: 7ZSfxMod_x86.exe
PrivateBuild: December 30, 2012
ProductName: 7-Zip SFX
ProductVersion: 1.6.0.2712
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start esfxcreator.exe no specs #EMMENHTAL mshta.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
2596"C:\Windows\SysWOW64\mshta.exe" "C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\ESFXCreator.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} C:\Windows\SysWOW64\mshta.exe
ESFXCreator.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
3221225477
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2976"C:\Users\admin\AppData\Local\Temp\ESFXCreator.exe" C:\Users\admin\AppData\Local\Temp\ESFXCreator.exe—explorer.exe
User:
admin
Company:
Djengineer14
Integrity Level:
MEDIUM
Description:
Create SFX/Exe Files
Exit code:
0
Version:
1.6.0.2712
Modules
Images
c:\users\admin\appdata\local\temp\esfxcreator.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6748C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2596 -s 4608C:\Windows\SysWOW64\WerFault.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
10 252
Read events
10 071
Write events
172
Delete events
9

Modification events

(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2976) ESFXCreator.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hta\OpenWithProgids
Operation:writeName:htafile
Value:
(PID) Process:(2596) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2596) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000000000003000000110000000E000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(2596) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
040000000000000003000000050000000200000001000000FFFFFFFF
(PID) Process:(2596) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\Shell
Operation:writeName:SniffedFolderType
Value:
Documents
(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
121
(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
642C8C6800000000
Executable files
0
Suspicious files
3
Text files
4
Unknown types
5

Dropped files

PID
Process
Filename
Type
6748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_mshta.exe_1456b662b7911e7956fd7245c3cbee08940652_07a62b6c_32a4ce51-9b51-4b2e-a857-73c3aeff1cb7\Report.wer —
MD5:—
SHA256:—
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25der
MD5:F2A7A6D8C2D143C4E63CAD20647AC166
SHA256:DA2ACF6F9CA54051CEFD0C6DE9D83AF5C717522BE8209BF9D319D2D821736538
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:42077132515F6812792EF9198E7FB55A
SHA256:70913BD0639E552CAFD7A30130E75D885050632978678C50169E63C90C750694
2596mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\tumblr_ce50029b59099bbd35ee97380a74210f_7feb2f0e_540[1].pngimage
MD5:846200917511DB5E257EEE5A951B89F8
SHA256:53A8CECC35F40854DFBE687C5B74A20F121AD6D63B78116F2CCCD656FFD0EDE6
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A0E35806347FEC05C6A09191AE5B7A2der
MD5:A9AA9E3A151E7CF9A86C99A3177CCAC1
SHA256:C724A29260D1A37812C71B6C2508A4932C9D722E44CF614F0A7CE427B70E183D
6748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER67E.tmp.dmpdmp
MD5:EF9F1DB0C8CA846F0D1601F9575D86D3
SHA256:818D3A9B91DD5C716F256E2C9771B8F6869F9998467EF97857B2648897FEB515
6748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER8F0.tmp.WERInternalMetadata.xmlxml
MD5:45F0E6A00063DA6DACA04C95DA5C8FAC
SHA256:D0C76E63F22E00B9C51D2B7787ABB356B856AEDCE7653DF025100A9445EB386A
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:F9BA829389EF4401FB178464B485FA71
SHA256:2D277CB5ABFBB900B609D8181163E5AABB40503DDD77AAACC052D8C3B086A810
6748WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\mshta.exe.2596.dmpdmp
MD5:83E1341D81C1A3B38E50609B0D351F3D
SHA256:3FD334B8A609EE4B13D8C559CBD86EC11024446A7A9F20508E72B920E078839C
6748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER93F.tmp.xmlxml
MD5:9D258393CC0ECB241C8E89D5B43A340D
SHA256:81CE35EA910937BF0E1623CA2287AB3A1D0E9C24C438F1C2FBF5E94FAE6D2820
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
17
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2596
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
2596
mshta.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCRtIGhqxv2nGcM1oL8kmb%2F
unknown
—
—
whitelisted
2596
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
2064
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5032
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2596
mshta.exe
192.0.77.3:443
64.media.tumblr.com
AUTOMATTIC
US
whitelisted
2596
mshta.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
2596
mshta.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2064
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2064
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
64.media.tumblr.com
  • 192.0.77.3
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
login.live.com
  • 20.190.160.3
  • 40.126.32.133
  • 20.190.160.64
  • 20.190.160.22
  • 20.190.160.66
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ESFXCreator.exe