File name:

66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d

Full analysis: https://app.any.run/tasks/bef0a8ac-75c6-4bc8-9468-fc1d1d2c5e98
Verdict: Malicious activity
Analysis date: December 02, 2023, 17:59:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5:

76C9BCE4BEB37CC8C00A05F3EFAFE89A

SHA1:

53BFAC12403C84993F959E511DAEC16D87B47161

SHA256:

66A1514EA0B833D9108F7AD1EC39A568CEDCB46839F956AB330FB72791FD827D

SSDEEP:

49152:gsn5tb8rCeoUjI9LCQk/3LOZWTxjZ+Ohx1R+thZJ+DFB7uyGk426QRxtIM7BYAd3:gs50CqcGHyUTJTxn2JinCW4qRxt1V5KU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 1236)
      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)

    • Application was injected by another process

      • explorer.exe (PID: 1388)

    • Runs injected code in another process

      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 1236)

    • Creates a writable file in the system directory

      • dllhost.exe (PID: 2528)
      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)

    • Starts NET.EXE for service management

      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)
      • net.exe (PID: 3112)

  • SUSPICIOUS

    • Get information on the list of running processes

      • cmd.exe (PID: 3980)
      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 1236)
      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)
      • cmd.exe (PID: 3216)

    • Starts CMD.EXE for commands execution

      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 1236)
      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)

    • Process drops legitimate windows executable

      • dllhost.exe (PID: 2528)
      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)

    • Uses RUNDLL32.EXE to load library

      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)

    • Executing commands from a ".bat" file

      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)

  • INFO

    • Checks supported languages

      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 1236)
      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)

    • Create files in a temporary directory

      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 1236)
      • 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe (PID: 2336)

    • Manual execution by a user

      • ComputerDefaults.exe (PID: 2220)
      • ComputerDefaults.exe (PID: 1352)

    • Drops the executable file immediately after the start

      • dllhost.exe (PID: 2528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1970:01:01 04:25:45+01:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.52
CodeSize: 22756
InitializedDataSize: 1422336
UninitializedDataSize: 2192
EntryPoint: 0x199c51
OSVersion: 1
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.3.1.148
ProductVersionNumber: 6.3.1.148
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Local Spooler DLL
FileVersion: 6.03.01.0148)
InternalName: localspn.dll
LegalCopyright: (C) Microsoft Corporation. All rights reserved.
OriginalFileName: localspn.dll
ProductName: Microsoft(R) Windows(R) Operating System
ProductVersion: 6.03.01.0148
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
58
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
inject start 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe no specs cmd.exe no specs tasklist.exe no specs explorer.exe Copy/Move/Rename/Delete/Link Object no specs computerdefaults.exe no specs computerdefaults.exe 66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe no specs cmd.exe no specs tasklist.exe no specs net.exe no specs net1.exe no specs rundll32.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1236"C:\Users\admin\AppData\Local\Temp\66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe" C:\Users\admin\AppData\Local\Temp\66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Local Spooler DLL
Exit code:
0
Version:
6.03.01.0148)
Modules
Images
c:\users\admin\appdata\local\temp\66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1352"C:\Windows\System32\sysprep\ComputerDefaults.exe" -Start "C:\Users\admin\AppData\Local\Temp\66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe"C:\Windows\System32\sysprep\ComputerDefaults.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Set Program Access and Computer Defaults Control Panel
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sysprep\computerdefaults.exe
c:\windows\system32\ntdll.dll
1388C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1584tasklist.exeC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1844C:\Windows\system32\net1 stop "Remote Registry Configuration"C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1936tasklist.exeC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2220"C:\Windows\System32\sysprep\ComputerDefaults.exe" -Start "C:\Users\admin\AppData\Local\Temp\66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe"C:\Windows\System32\sysprep\ComputerDefaults.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Set Program Access and Computer Defaults Control Panel
Exit code:
4294967227
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sysprep\computerdefaults.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2336C:\Users\admin\AppData\Local\Temp\66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exeC:\Users\admin\AppData\Local\Temp\66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe—ComputerDefaults.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Local Spooler DLL
Exit code:
0
Version:
6.03.01.0148)
Modules
Images
c:\users\admin\appdata\local\temp\66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2520C:\Windows\system32\cmd.exe /c C:\Users\admin\AppData\Local\Temp\\51FADBE.batC:\Windows\System32\cmd.exe—66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2528C:\Windows\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
335
Read events
333
Write events
2
Delete events
0

Modification events

(PID) Process:(1388) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000F6D6788197A75D498472ACE88906AC8D000000000200000000001066000000010000200000007F0C5AFCF1AE7F71286A81A9B86E67A7BE47980777E154AD953E683E2064784E000000000E8000000002000020000000C547D0854BEA52CCDED7859B79990A863903B335001ED826D40C3D8E323F237F30000000DF0FBC24E15CFF4FE438F74D8486DFB808CBF3EC9160BD0CF16731298F2800053F0DC9D2737FB85ABF81EDB882A089A94000000011BAC043EAAF96F8497DEE93A36C7829C97427DA018BC7750377DAC2CC3CE4D64139784732F789D57202D54D80C3AAC2B4B5EE990B65AEF23416199647916AD4
(PID) Process:(4036) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Operation:writeName:netsvcs
Value:
AeLookupSvc
Executable files
4
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
233666a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exeC:\Windows\system32\ntvdm32.dllexecutable
MD5:4C03C35544ED3DF29FAA8686BA14438B
SHA256:B9DAB099BF021B55A2CB0C2BDF4A7B51419601FF44285BF76963F57816689816
2528dllhost.exeC:\Windows\System32\sysprep\appwiz.cplexecutable
MD5:4A5DD94A7F0BC445A0BFA846793058E6
SHA256:3DDADD39D06B555BAC28706A9A654F967A3F9D3CB2E3694E7D2C72CA62B8BC65
233666a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exeC:\Users\admin\AppData\Local\Temp\51FADBE.battext
MD5:E4684ABFBE62BB4D18779B5F8DA2CBAF
SHA256:FAC02BAC07081C20BAFF35030C63D86240BF78A579F6F8E2E4160DD6E377F0C8
2528dllhost.exeC:\Windows\System32\sysprep\ComputerDefaults.exeexecutable
MD5:7620C8CEB498649D489F6DFF8FA411CB
SHA256:7B44DCD534D38EF2685C4522D301568662CA6E0434E2CE95C0F9D139A2A327B0
123666a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d.exeC:\Users\admin\AppData\Local\Temp\houwqN.Dllexecutable
MD5:4A5DD94A7F0BC445A0BFA846793058E6
SHA256:3DDADD39D06B555BAC28706A9A654F967A3F9D3CB2E3694E7D2C72CA62B8BC65
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
1
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1276
svchost.exe
123.151.204.82:53
conhost.serveuser.com
ASN for TIANJIN Provincial Net of CT
CN
unknown
1276
svchost.exe
123.151.204.82:80
conhost.serveuser.com
ASN for TIANJIN Provincial Net of CT
CN
unknown
1276
svchost.exe
123.151.204.82:443
conhost.serveuser.com
ASN for TIANJIN Provincial Net of CT
CN
unknown

DNS requests

Domain
IP
Reputation
conhost.serveuser.com
  • 123.151.204.82
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.serveuser .com Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
66a1514ea0b833d9108f7ad1ec39a568cedcb46839f956ab330fb72791fd827d