File name:	2025-06-21_4007bbab89f6e284fc0c43c33277f6bc_elex_mafia
Full analysis:	https://app.any.run/tasks/5bf17dab-badd-4b86-9aff-3d2ae8d1a71a
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 03:00:31
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	4007BBAB89F6E284FC0C43C33277F6BC
SHA1:	FFA02FC5CAEBDB16CC3DC1B798A3385DE127F0F8
SHA256:	638600D551FF0532C63D49B700ADC456F7CA48F114927D7655188A9FC1757F13
SSDEEP:	24576:GEY89WxC6ipwjcBY4XpLSTNxd+nRTcVj12Eks9thEq4Uyzr:GEY89WxC6ipwjcBbXpL6Nxd+nRTcVj1G

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3148	686E.tmp	C:\Users\admin\AppData\Local\Temp\68CC.tmp		executable
		MD5:8105BCCF189EE3527B8818546626C7FD	SHA256:4F0254E6BE1D71654FC2D7C2B9CB64609D8FE62CC4A9539A21DFADABD551653A
1700	69C6.tmp	C:\Users\admin\AppData\Local\Temp\6A24.tmp		executable
		MD5:B05F6ED67D6CC496D838FBE32450E2DE	SHA256:5793414F1DA8D87EB41C0EFC7F3383335D6996520085057500BD1ADC02068802
4892	2025-06-21_4007bbab89f6e284fc0c43c33277f6bc_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\67A3.tmp		executable
		MD5:F391858B463EDC9E7C4735174110D3D5	SHA256:3385F5B0A145B2140795B34F8F230C0525E47780BEC3168E32F04C8DE9227A11
4968	67A3.tmp	C:\Users\admin\AppData\Local\Temp\6801.tmp		executable
		MD5:45AFDB74E834616DEA2C7D1B574DA1C8	SHA256:AC99C762DAE53D0929D7813995F922930C3BF5B80A5C0C99FD2CE8A31739E4FF
6700	6968.tmp	C:\Users\admin\AppData\Local\Temp\69C6.tmp		executable
		MD5:33B03F2FAEBDCB1D56C513030750D24E	SHA256:51112F5A7398FC5B4EB05BC70998ED3BB256F9317C18F1AE6B0123571A16A78E
2220	6AEF.tmp	C:\Users\admin\AppData\Local\Temp\6B5C.tmp		executable
		MD5:B5ECE2A3643D4178A3B5AE5215208994	SHA256:C731E9512F17179CF0615F7D108262B79759A177B35ADC047F1080D74F66EA74
6756	6A24.tmp	C:\Users\admin\AppData\Local\Temp\6A81.tmp		executable
		MD5:AD58A1ED4075D75735BCC79F1D4CBE22	SHA256:F5DEF984956B1A21DEC2F870A043619D01003DBAD63D9BC459AB47D8EEF203CE
4520	6EC7.tmp	C:\Users\admin\AppData\Local\Temp\6F34.tmp		executable
		MD5:8FF8B8485A4DD261B9DEAC5E5C0F4BF4	SHA256:412E273A91280CB92FB630FD3C28D5CCF73C2E4C3CC342DBACC013007FD1F5D3
1332	6BF8.tmp	C:\Users\admin\AppData\Local\Temp\6C56.tmp		executable
		MD5:1FF11B9FB3B28C6E9CA8FE2418F31522	SHA256:7FB82C379E8DFA9AC3AE577FDED200AFFD171D1C338A81C1543B664A59290518
2716	68CC.tmp	C:\Users\admin\AppData\Local\Temp\6968.tmp		executable
		MD5:BA579AA6B84AA444E640FE5041303792	SHA256:09D13E6A2E51C1F60B1A90DF83FCBDB417B0B7C33E1BB7951DB2F702BAEE4359

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
3956	RUXIMICS.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
3956	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3956	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
3956	RUXIMICS.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146	whitelisted
google.com	142.250.186.46	whitelisted
crl.microsoft.com	23.55.104.172	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
self.events.data.microsoft.com	51.116.253.169	whitelisted

General Info

2025-06-21_4007bbab89f6e284fc0c43c33277f6bc_elex_mafia

4007BBAB89F6E284FC0C43C33277F6BC

FFA02FC5CAEBDB16CC3DC1B798A3385DE127F0F8

638600D551FF0532C63D49B700ADC456F7CA48F114927D7655188A9FC1757F13

24576:GEY89WxC6ipwjcBY4XpLSTNxd+nRTcVj12Eks9thEq4Uyzr:GEY89WxC6ipwjcBbXpL6Nxd+nRTcVj1G

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Starts itself from another location

Starts application with an unusual extension

Process drops legitimate windows executable

Executable content was dropped or overwritten

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings