File name:

ArtistSponsorship.exe

Full analysis: https://app.any.run/tasks/b4236b4c-254e-4cfc-ab41-9193cdb8be8d
Verdict: Malicious activity
Analysis date: November 13, 2024, 12:39:16
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

EBC6F990E84AD33B646F6E074875A2A6

SHA1:

E298CD6C5FE7B9B05A28480FD215DDCBD7AAA48A

SHA256:

62C7688CB717F59CD6E2FA6070590C995066845B22C1D6AB95DF222E0ED53191

SSDEEP:

98304:qqUnj6VtGjdZMPjIy4VoMUcB9pXZTHMnbZXOM4YUZ0xa:IT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Finals.pif (PID: 5980)

  • SUSPICIOUS

    • Get information on the list of running processes

      • cmd.exe (PID: 2272)

    • Starts CMD.EXE for commands execution

      • ArtistSponsorship.exe (PID: 6244)
      • cmd.exe (PID: 2272)

    • Executing commands from ".cmd" file

      • ArtistSponsorship.exe (PID: 6244)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2272)

    • Reads security settings of Internet Explorer

      • ArtistSponsorship.exe (PID: 6244)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 2272)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 2272)

    • Application launched itself

      • cmd.exe (PID: 2272)

    • The executable file from the user directory is run by the CMD process

      • Finals.pif (PID: 5980)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2272)

  • INFO

    • Checks supported languages

      • ArtistSponsorship.exe (PID: 6244)
      • Finals.pif (PID: 5980)

    • Create files in a temporary directory

      • ArtistSponsorship.exe (PID: 6244)

    • Reads the computer name

      • ArtistSponsorship.exe (PID: 6244)
      • Finals.pif (PID: 5980)

    • Process checks computer location settings

      • ArtistSponsorship.exe (PID: 6244)

    • Creates a new folder

      • cmd.exe (PID: 6332)

    • The process uses the downloaded file

      • ArtistSponsorship.exe (PID: 6244)

    • Reads mouse settings

      • Finals.pif (PID: 5980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:24 19:19:54+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 501248
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start artistsponsorship.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs THREAT finals.pif choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1572\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2272"C:\Windows\System32\cmd.exe" /c copy Explicit Explicit.cmd & Explicit.cmdC:\Windows\SysWOW64\cmd.exe
ArtistSponsorship.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3728findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5036tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5736cmd /c copy /b ..\Betty + ..\Struggle + ..\Accessed + ..\Promised + ..\Foo + ..\Cst + ..\Halfcom X C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5748findstr /I "wrsa opssvc" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5980Finals.pif X C:\Users\admin\AppData\Local\Temp\244214\Finals.pif
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 3
Modules
Images
c:\users\admin\appdata\local\temp\244214\finals.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
5984findstr /V "MinnesotaRepeatPlumbingLuggage" Auto C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6244"C:\Users\admin\AppData\Local\Temp\ArtistSponsorship.exe" C:\Users\admin\AppData\Local\Temp\ArtistSponsorship.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\artistsponsorship.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6332cmd /c md 244214C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 091
Read events
1 091
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
9
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Accessedini
MD5:B1882477F8FC8C3A8A8455A49B1E5935
SHA256:F3A3D9A23B69BED6136ED6DFC19D476E3B0958C4FE9BB7E0D23DDFCFCCE798A1
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Foobinary
MD5:0AA3CB12B8B4E17D3D3660DBE8127250
SHA256:613A916A5616A2DAC8B85F1B0113824AE2C7070152ECF466BA7220062B6B34B5
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Halfcombinary
MD5:96D4467148FC4721700B92F99C892181
SHA256:DA4344D26DCAA9D4B8A7953C3D4517F488523965EB9E1D2BAC999EEC4D764470
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Bettybinary
MD5:62E4AF54D904DB665D3DC5221CB58BA5
SHA256:4F3671364DED5EBD95AA15014F8F8873DA8175B028836FB085285FA71BC4ACF9
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Explicittext
MD5:68DE3CADC55A1143EFBD598B05367F59
SHA256:34F84009E442B8805ADF53F4BADD89C6E8D17369BCE0D69B0809261C1E870F5E
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Provincebinary
MD5:2E2FF18098945EF29FE501CF02CF8537
SHA256:4FC16B523EDDAA1F1041315B17A909237F028A2AF39D7B8DEFF53D86C98DC548
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Autobinary
MD5:D1F49CDAC587E9E1C2C99DF1037082AE
SHA256:DE302C0D3AB142D0EDEA606F314D5140B48D6179616C36948265DF038C66D58E
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Strugglebinary
MD5:1F4AC31B4B4EF75AA98CE457A4A0D601
SHA256:5343202435383DE26294173F7DAD5AB1748CD936A1389E30D7065079C90447D1
2272cmd.exeC:\Users\admin\AppData\Local\Temp\Explicit.cmdtext
MD5:68DE3CADC55A1143EFBD598B05367F59
SHA256:34F84009E442B8805ADF53F4BADD89C6E8D17369BCE0D69B0809261C1E870F5E
6244ArtistSponsorship.exeC:\Users\admin\AppData\Local\Temp\Cstbinary
MD5:B4CC0024964ECF0AEC2DC7B3C3F09434
SHA256:8B62F5777FC333C27DDCDB1F7A6B355E1F220EF769DE0952B46D743349F51646
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
49
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7028
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1700
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7136
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1700
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3396
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
92.123.104.36:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6944
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 88.221.169.152
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 92.123.104.36
  • 92.123.104.43
  • 92.123.104.38
  • 92.123.104.37
  • 92.123.104.45
  • 92.123.104.47
  • 92.123.104.42
  • 92.123.104.46
  • 92.123.104.48
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
XUiJXZRTxXkzAZZ.XUiJXZRTxXkzAZZ
  • —
unknown
login.live.com
  • 40.126.32.138
  • 40.126.32.74
  • 40.126.32.133
  • 40.126.32.76
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.22
whitelisted
th.bing.com
  • 92.123.104.4
  • 92.123.104.63
  • 92.123.104.66
  • 92.123.104.65
  • 92.123.104.58
  • 92.123.104.59
  • 92.123.104.67
  • 92.123.104.61
  • 92.123.104.64
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ArtistSponsorship.exe