File name:

chancla.exe

Full analysis: https://app.any.run/tasks/025729c3-418b-4c80-a3b9-1c07d7389675
Verdict: Malicious activity
Analysis date: December 19, 2023, 22:50:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

AA11BEDC627F4BA588D444B977880ADE

SHA1:

C31C1DE2366E2146A5A44810213189AD570C175B

SHA256:

6D516A96D6AA39DD9FC2D745EA39658C52AB56D62EF7A56276E2E050D916E19F

SSDEEP:

98304:Gr0OjWMSLLJXCzz5Ez7CZQ9BpN9BI94I8wrUVx4DnEtCAKketUxFr7aLx6wJzI/D:4r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • chancla.exe (PID: 2044)

  • SUSPICIOUS

    • Reads the Internet Settings

      • chancla.exe (PID: 2044)

    • Reads settings of System Certificates

      • chancla.exe (PID: 2044)

    • Checks Windows Trust Settings

      • chancla.exe (PID: 2044)

    • Reads security settings of Internet Explorer

      • chancla.exe (PID: 2044)

  • INFO

    • Checks supported languages

      • chancla.exe (PID: 2044)
      • wmpnscfg.exe (PID: 1796)

    • Reads the computer name

      • chancla.exe (PID: 2044)
      • wmpnscfg.exe (PID: 1796)

    • Checks proxy server information

      • chancla.exe (PID: 2044)

    • Creates files or folders in the user directory

      • chancla.exe (PID: 2044)

    • Reads the machine GUID from the registry

      • chancla.exe (PID: 2044)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:15 09:26:42+02:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 3811840
InitializedDataSize: 3884032
UninitializedDataSize: -
EntryPoint: 0x3a3ef8
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 3.4.8658.2601
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (1809)
CharacterSet: Windows, Latin1
CompanyName: CreatiUPRPS Win Service
FileDescription: CreatiUPRPS Win Service
FileVersion: 3.4.0.0
InternalName: CreatiUPRPS Win Service
LegalCopyright: CreatiUPRPS Win Service
LegalTrademarks: CreatiUPRPS Win Service
OriginalFileName: CreatiUPRPS Win Service
ProductName: CreatiUPRPS Win Service
ProductVersion: 1.0.0.0
Comments: CreatiUPRPS Win Service
ProgramID: com.embarcadero.eraw
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
35
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chancla.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1796"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2044"C:\Users\admin\AppData\Local\Temp\chancla.exe" C:\Users\admin\AppData\Local\Temp\chancla.exe
explorer.exe
User:
admin
Company:
CreatiUPRPS Win Service
Integrity Level:
MEDIUM
Description:
CreatiUPRPS Win Service
Exit code:
0
Version:
3.4.0.0
Modules
Images
c:\users\admin\appdata\local\temp\chancla.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
3 377
Read events
3 350
Write events
27
Delete events
0

Modification events

(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2044) chancla.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2044) chancla.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
3
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2044chancla.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2044chancla.exeC:\Users\admin\Appdata\Roaming\tmp_chancla.exeexecutable
MD5:1AABF220905CD2AAB10182B0C13BC651
SHA256:FE2438974ED5E9EF3944236E82856B6E8978BDEE3087C99612C7227B0567403E
2044chancla.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691binary
MD5:B30095AE229E398319DF7DF683F016BC
SHA256:A6083345861D4EDA6ACBF45F6C3C6FF5E8F4E000F231EC67B4B77643EDC80A61
2044chancla.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F79F65CADDC4C3EAA1949FE7129FE3B3
SHA256:7F4A7B5A4BD8B2413A2FEC5D3C16669E4DF59B02BFA1F08F1E8CE29D3FD2EB16
2044chancla.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAbinary
MD5:8973F9A588B73C897D27EC8DE0783CD4
SHA256:7280AA55F889E7728DF6F2F0077A093DCBB9B9509AAEC206E946AF31DC83EE45
2044chancla.exeC:\Users\admin\AppData\Roaming\chancla.exeexecutable
MD5:1AABF220905CD2AAB10182B0C13BC651
SHA256:FE2438974ED5E9EF3944236E82856B6E8978BDEE3087C99612C7227B0567403E
2044chancla.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAbinary
MD5:5696D78473D22C76B7DCC38A8F52EF49
SHA256:29593F43AD7D390E3D2868FD00B4FC817CD630A5F5D2FCB5C88C09E6B79EE147
2044chancla.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691binary
MD5:54263B52F2C7A69C4EE05944106F7AA5
SHA256:4EA02D5E8A3BC109E42F9782D60AAE066008BC30977DC4310CDFCC2FA840D60F
2044chancla.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\519flaok[1].exeexecutable
MD5:1AABF220905CD2AAB10182B0C13BC651
SHA256:FE2438974ED5E9EF3944236E82856B6E8978BDEE3087C99612C7227B0567403E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
10
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2044
chancla.exe
GET
200
23.254.202.85:80
http://uperrunplay.com/license.txt
unknown
text
52 b
unknown
2044
chancla.exe
POST
200
23.254.202.85:80
http://uperrunplay.com/registrauser.php
unknown
text
2 b
unknown
2044
chancla.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9c35526d3a6ecb8f
unknown
compressed
4.66 Kb
unknown
2044
chancla.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEGfe9D7xe9riT%2FWUBgbSwIQ%3D
unknown
binary
1.42 Kb
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?eca8823d6d0692d6
unknown
—
—
unknown
2044
chancla.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY
unknown
binary
2.18 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2044
chancla.exe
23.254.202.85:80
uperrunplay.com
HOSTWINDS
US
unknown
2044
chancla.exe
142.11.192.113:443
dulcebuelos.com
HOSTWINDS
US
unknown
2044
chancla.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2044
chancla.exe
104.18.38.233:80
ocsp.comodoca.com
CLOUDFLARENET
—
shared
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
uperrunplay.com
  • 23.254.202.85
unknown
dulcebuelos.com
  • 142.11.192.113
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
chancla.exe