File name:

ESFXCreator.exe

Full analysis: https://app.any.run/tasks/84b246a2-17a5-4b62-98d2-531c9348bc11
Verdict: Malicious activity
Threats:

First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments.

Malware Trends Tracker     >>>
Analysis date: August 01, 2025, 02:54:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
emmenhtal
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

DA17623F70DA83A98F7ECF8390550EA4

SHA1:

D0C91542AE48EC2E02E669A85006F9831F62600E

SHA256:

5D6284D388386800AC17C2BD04C5F62E8B33577AC02E8C5E5A51D260640A50C9

SSDEEP:

12288:SaSk5uceHAmCMoJ7s+hESUaSk5uceHAmlMoJ7snlu:ok5uceHAr6k5uceHAllu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EMMENHTAL has been detected (YARA)

      • mshta.exe (PID: 2596)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • ESFXCreator.exe (PID: 2976)

    • There is functionality for taking screenshot (YARA)

      • ESFXCreator.exe (PID: 2976)

    • Executes application which crashes

      • mshta.exe (PID: 2596)

  • INFO

    • Reads the computer name

      • ESFXCreator.exe (PID: 2976)

    • Create files in a temporary directory

      • ESFXCreator.exe (PID: 2976)

    • Process checks computer location settings

      • ESFXCreator.exe (PID: 2976)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 2596)

    • Checks proxy server information

      • mshta.exe (PID: 2596)
      • WerFault.exe (PID: 6748)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6748)

    • Checks supported languages

      • ESFXCreator.exe (PID: 2976)

    • Reads security settings of Internet Explorer

      • WerFault.exe (PID: 6748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:12:31 00:38:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 89600
InitializedDataSize: 467968
UninitializedDataSize: -
EntryPoint: 0x1638f
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.6.0.2712
ProductVersionNumber: 1.6.0.2712
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Djengineer14
FileDescription: Create SFX/Exe Files
FileVersion: 1.6.0.2712
InternalName: 7ZSfxMod
LegalCopyright: Copyright © 2005-2012 Oleg N. Scherbakov
OriginalFileName: 7ZSfxMod_x86.exe
PrivateBuild: December 30, 2012
ProductName: 7-Zip SFX
ProductVersion: 1.6.0.2712
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start esfxcreator.exe no specs #EMMENHTAL mshta.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
2596"C:\Windows\SysWOW64\mshta.exe" "C:\Users\admin\AppData\Local\Temp\7ZipSfx.000\ESFXCreator.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5} C:\Windows\SysWOW64\mshta.exe
ESFXCreator.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
3221225477
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2976"C:\Users\admin\AppData\Local\Temp\ESFXCreator.exe" C:\Users\admin\AppData\Local\Temp\ESFXCreator.exe—explorer.exe
User:
admin
Company:
Djengineer14
Integrity Level:
MEDIUM
Description:
Create SFX/Exe Files
Exit code:
0
Version:
1.6.0.2712
Modules
Images
c:\users\admin\appdata\local\temp\esfxcreator.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6748C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2596 -s 4608C:\Windows\SysWOW64\WerFault.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
10 252
Read events
10 071
Write events
172
Delete events
9

Modification events

(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2976) ESFXCreator.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.hta\OpenWithProgids
Operation:writeName:htafile
Value:
(PID) Process:(2596) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:NodeSlots
Value:
02020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202020202
(PID) Process:(2596) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
Operation:writeName:MRUListEx
Value:
040000000000000003000000110000000E000000100000000F0000000C0000000D0000000B000000050000000A000000090000000800000001000000070000000600000002000000FFFFFFFF
(PID) Process:(2596) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4
Operation:writeName:MRUListEx
Value:
040000000000000003000000050000000200000001000000FFFFFFFF
(PID) Process:(2596) mshta.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\Bags\119\Shell
Operation:writeName:SniffedFolderType
Value:
Documents
(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
121
(PID) Process:(2596) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
642C8C6800000000
Executable files
0
Suspicious files
3
Text files
4
Unknown types
5

Dropped files

PID
Process
Filename
Type
6748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_mshta.exe_1456b662b7911e7956fd7245c3cbee08940652_07a62b6c_32a4ce51-9b51-4b2e-a857-73c3aeff1cb7\Report.wer —
MD5:—
SHA256:—
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:42077132515F6812792EF9198E7FB55A
SHA256:70913BD0639E552CAFD7A30130E75D885050632978678C50169E63C90C750694
2596mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\tumblr_ce50029b59099bbd35ee97380a74210f_7feb2f0e_540[1].pngimage
MD5:846200917511DB5E257EEE5A951B89F8
SHA256:53A8CECC35F40854DFBE687C5B74A20F121AD6D63B78116F2CCCD656FFD0EDE6
2976ESFXCreator.exeC:\Users\admin\AppData\Local\Temp\7ZipSfx.000\ESFXCreator.htahtml
MD5:1516B1A94E1D66E3BC4035D119EABD49
SHA256:BA895A4FB0B9637CFED510E8EFCED88D20DFB486E2858C5C98E8D5E6A5BA6D73
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90der
MD5:0D6B2F6550791138E2C93EADAC4C5CC2
SHA256:65A9A277F4D1C3FFE6BBD1DBF9CCD2A999981E6E8B28AABC682DD5361365245A
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25der
MD5:F2A7A6D8C2D143C4E63CAD20647AC166
SHA256:DA2ACF6F9CA54051CEFD0C6DE9D83AF5C717522BE8209BF9D319D2D821736538
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4A0E35806347FEC05C6A09191AE5B7A2der
MD5:A9AA9E3A151E7CF9A86C99A3177CCAC1
SHA256:C724A29260D1A37812C71B6C2508A4932C9D722E44CF614F0A7CE427B70E183D
2596mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4A0E35806347FEC05C6A09191AE5B7A2binary
MD5:0DC846CBB4F48C96CE59969B768FC679
SHA256:CD4BCF4ECA374CE7592589CF1204F5A86F56CB2FE8CB3E43EAFDCECFCB45A699
6748WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\mshta.exe.2596.dmpdmp
MD5:83E1341D81C1A3B38E50609B0D351F3D
SHA256:3FD334B8A609EE4B13D8C559CBD86EC11024446A7A9F20508E72B920E078839C
6748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER67E.tmp.dmpdmp
MD5:EF9F1DB0C8CA846F0D1601F9575D86D3
SHA256:818D3A9B91DD5C716F256E2C9771B8F6869F9998467EF97857B2648897FEB515
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
17
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2596
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
binary
980 b
whitelisted
2596
mshta.exe
GET
200
172.64.149.23:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCRtIGhqxv2nGcM1oL8kmb%2F
US
binary
282 b
whitelisted
2064
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
2596
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
binary
1.42 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5032
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2596
mshta.exe
192.0.77.3:443
64.media.tumblr.com
AUTOMATTIC
US
whitelisted
2596
mshta.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
whitelisted
2596
mshta.exe
172.64.149.23:80
ocsp.comodoca.com
CLOUDFLARENET
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2064
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2064
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
64.media.tumblr.com
  • 192.0.77.3
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.sectigo.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted
login.live.com
  • 20.190.160.3
  • 40.126.32.133
  • 20.190.160.64
  • 20.190.160.22
  • 20.190.160.66
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ESFXCreator.exe