File name:

ZeroAccess_xxx-porn-movie.avi.exe_

Full analysis: https://app.any.run/tasks/7f125aae-e54f-4fed-89d9-a2a5a27964fe
Verdict: Malicious activity
Analysis date: January 20, 2025, 12:28:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
zeroaccess
geo
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 4 sections
MD5:

A2611095F689FADFFD3068E0D4E3E7ED

SHA1:

6D21FC25B9DA49D746B2B7609A5EFAED4D332E6A

SHA256:

71B38F041B4A4AE169C44E3AFF412E527E1156F92C27F1340A8ABE70A45BEE10

SSDEEP:

6144:3yL9TAhWmj1HqIH835CbffrVzNZv8XDCY18LfRgM:5suKIH83wbffr5NZ0XBEfRg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZEROACCESS mutex has been found

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)
      • InstallFlashPlayer.exe (PID: 6376)

    • ZEROACCESS has been detected

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)

    • ZEROACCESS has been detected (SURICATA)

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)
      • InstallFlashPlayer.exe (PID: 6376)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)

    • Creates/Modifies COM task schedule object

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)

    • Reads security settings of Internet Explorer

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)
      • InstallFlashPlayer.exe (PID: 6376)

    • Starts CMD.EXE for commands execution

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)

    • There is functionality for lookup Geolocation (YARA)

      • InstallFlashPlayer.exe (PID: 6376)

    • There is functionality for taking screenshot (YARA)

      • InstallFlashPlayer.exe (PID: 6376)

  • INFO

    • Checks supported languages

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)
      • InstallFlashPlayer.exe (PID: 6376)

    • Reads the machine GUID from the registry

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)

    • Reads the computer name

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)
      • InstallFlashPlayer.exe (PID: 6376)

    • Process checks computer location settings

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)

    • The sample compiled with english language support

      • ZeroAccess_xxx-porn-movie.avi.exe_.exe (PID: 132)

    • Checks proxy server information

      • InstallFlashPlayer.exe (PID: 6376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)
.vxd | VXD Driver (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2004:04:29 03:00:54+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug, Bytes reversed hi
PEType: PE32
LinkerVersion: 6
CodeSize: 150706
InitializedDataSize: -
UninitializedDataSize: 4096
EntryPoint: 0x3515
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZEROACCESS zeroaccess_xxx-porn-movie.avi.exe_.exe #ZEROACCESS installflashplayer.exe cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132"C:\Users\admin\AppData\Local\Temp\ZeroAccess_xxx-porn-movie.avi.exe_.exe" C:\Users\admin\AppData\Local\Temp\ZeroAccess_xxx-porn-movie.avi.exe_.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\zeroaccess_xxx-porn-movie.avi.exe_.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6376"C:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exe" C:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exe
ZeroAccess_xxx-porn-movie.avi.exe_.exe
User:
admin
Company:
Adobe Systems, Inc.
Integrity Level:
HIGH
Description:
Adobe® Flash® Player Installer/Uninstaller 11.0 r1
Version:
11,0,1,152
Modules
Images
c:\users\admin\appdata\local\temp\installflashplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6388"C:\WINDOWS\system32\cmd.exe"C:\Windows\SysWOW64\cmd.exe—ZeroAccess_xxx-porn-movie.avi.exe_.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
4294967295
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 734
Read events
1 720
Write events
14
Delete events
0

Modification events

(PID) Process:(132) ZeroAccess_xxx-porn-movie.avi.exe_.exeKey:HKEY_CLASSES_ROOT\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(132) ZeroAccess_xxx-porn-movie.avi.exe_.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000062B06A59D2B415429F74E9109B0A81538D000000
(PID) Process:(132) ZeroAccess_xxx-porn-movie.avi.exe_.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100004E3AAA90BA1C3342B8BB535773D48449BC0000006078A409B011A54DAFA526D86198A7803901000062B06A59D2B415429F74E9109B0A81538D000000
(PID) Process:(132) ZeroAccess_xxx-porn-movie.avi.exe_.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100004E3AAA90BA1C3342B8BB535773D48449BC0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAD5010000
(PID) Process:(132) ZeroAccess_xxx-porn-movie.avi.exe_.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E232827701000010901EF8A46ECE11A7FF00AA003CA9F6EA0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAD5010000
(PID) Process:(132) ZeroAccess_xxx-porn-movie.avi.exe_.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100007696BFE28F5F5C4397EB11607A5BEDF7FA0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAD5010000
(PID) Process:(132) ZeroAccess_xxx-porn-movie.avi.exe_.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
93418E6700000000
(PID) Process:(132) ZeroAccess_xxx-porn-movie.avi.exe_.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D29010000BD0E0C47735D584D9CEDE91E22E23282770100007696BFE28F5F5C4397EB11607A5BEDF7FA0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAD5010000
(PID) Process:(6376) InstallFlashPlayer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6376) InstallFlashPlayer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
3
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
132ZeroAccess_xxx-porn-movie.avi.exe_.exeC:\Users\admin\AppData\Local\Temp\msimg32.dllexecutable
MD5:D6F7C05386CAA9ABFF7CBF41D6C51470
SHA256:67FAD3B5C42794783EC3757AE5CB6F1A06F5B76214C1CC967108DFE84F76626C
132ZeroAccess_xxx-porn-movie.avi.exe_.exeC:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exeexecutable
MD5:2FF9B590342C62748885D459D082295F
SHA256:672EC8DCEAFD429C1A09CFAFBC4951968953E2081E0D97243040DB16EDB24429
132ZeroAccess_xxx-porn-movie.avi.exe_.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\$81b8c3da9d80cef97346aaa39584b477\@binary
MD5:0D50B778BF62CF3F0C8ED6849F94B796
SHA256:D5F9FC5A3DA4B5BEAFFE3AC067D247CF9728B2775635A35F75F2E3292739E2A4
132ZeroAccess_xxx-porn-movie.avi.exe_.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\$81b8c3da9d80cef97346aaa39584b477\nexecutable
MD5:9E0CD37B6D0809CF7D5FA5B521538D0D
SHA256:55D9748F0556576A8D522CF4B8DCFC9717436ADCC487D49B3320770432960DB2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
51
DNS requests
20
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5564
RUXIMICS.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5564
RUXIMICS.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6376
InstallFlashPlayer.exe
GET
404
104.102.58.45:80
http://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_cab_64_ax_sgn.z
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6592
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2076
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2076
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5004
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.19.96.82:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5564
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5564
RUXIMICS.exe
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5564
RUXIMICS.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
66.85.130.234:53
—
—
—
malicious
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
194.165.17.3:53
—
—
—
malicious

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.19.96.82
  • 2.19.96.130
  • 2.19.96.83
  • 2.19.96.91
  • 2.19.96.35
  • 2.19.96.129
  • 2.19.96.90
  • 2.19.96.18
  • 2.19.96.11
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.106
  • 2.16.164.18
  • 2.16.164.114
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 2.23.246.101
whitelisted
j.maxmind.com
  • —
shared
fpdownload.macromedia.com
  • 104.102.58.45
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.75
  • 20.190.159.68
  • 20.190.159.23
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 2.18.97.227
whitelisted
settings-win.data.microsoft.com
  • 40.119.249.228
  • 4.231.128.59
  • 40.127.240.158
  • 51.124.78.146
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
132
ZeroAccess_xxx-porn-movie.avi.exe_.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ZeroAccess_xxx-porn-movie.avi.exe_