File name:

SysInternals[1].exe

Full analysis: https://app.any.run/tasks/8e1a02c1-e5e0-453d-9a1c-2d372662a1e3
Verdict: Malicious activity
Analysis date: September 14, 2024, 15:54:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
xor-url
generic
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

D1A27B871A86C5371215F71885862CFF

SHA1:

FA1002B02FC5551E075EC44BB4FF9CC13D563DCF

SHA256:

72E6D1728A546C2F3EE32C063ED09FA6BA8C46AC33B0DD2E354087C1AD26EF48

SSDEEP:

384:2N8wZM3bOjP2p7INtIBPEyEr/urrrDp7VbbFaDrrrfOqvspSDwGmU/IQGFETP:2N8wZMG2p7INwDo9wGd/S6TP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • XORed URL has been found (YARA)

      • SysInternals[1].exe (PID: 320)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SysInternals[1].exe (PID: 320)

    • Starts CMD.EXE for commands execution

      • SysInternals[1].exe (PID: 320)

    • Checks Windows Trust Settings

      • SysInternals[1].exe (PID: 320)

  • INFO

    • Reads the machine GUID from the registry

      • SysInternals[1].exe (PID: 320)

    • Reads the computer name

      • SysInternals[1].exe (PID: 320)

    • Reads the software policy settings

      • SysInternals[1].exe (PID: 320)
      • slui.exe (PID: 5504)
      • slui.exe (PID: 1292)

    • Creates files or folders in the user directory

      • SysInternals[1].exe (PID: 320)

    • Checks proxy server information

      • SysInternals[1].exe (PID: 320)
      • slui.exe (PID: 1292)

    • Checks supported languages

      • SysInternals[1].exe (PID: 320)

    • The process uses the downloaded file

      • SysInternals[1].exe (PID: 320)

    • Process checks computer location settings

      • SysInternals[1].exe (PID: 320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

xor-url

(PID) Process(320) SysInternals[1].exe
Decrypted-URLs (1)https://download.sysinternals.com/files/Hex2Dec.zip
Decrypted-URLs (4)http://www.google.com
http://www.malware430.com/html/VMwareUpdate.exeAhttps://download.sysinternals.com/files/Hex2Dec.zip
https://docs.microsoft.com/en-us/sysinternals/AAhttp://www.malware430.com/html/VMwareUpdate.exeAhttps://download.sysinternals.com/files/Hex2Dec.zip
https://download.sysinternals.com/files/Hex2Dec.zip
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:18 19:09:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.24
CodeSize: 4096
InitializedDataSize: 53248
UninitializedDataSize: -
EntryPoint: 0x1483
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 2.0.0.1
ProductVersionNumber: 2.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: SysInternals, Inc.
FileDescription: SysInternals Suite Downloader
FileVersion: 2.0.0.1
InternalName: SysInternals.exe
LegalCopyright: Copyright (C) 2020
OriginalFileName: SysInternals.exe
ProductName: SysInternals Suite Downloader
ProductVersion: 2.0.0.1
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #XOR-URL sysinternals[1].exe conhost.exe no specs cmd.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Users\admin\AppData\Local\Temp\SysInternals[1].exe" C:\Users\admin\AppData\Local\Temp\SysInternals[1].exe
explorer.exe
User:
admin
Company:
SysInternals, Inc.
Integrity Level:
MEDIUM
Description:
SysInternals Suite Downloader
Exit code:
0
Version:
2.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\sysinternals[1].exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
xor-url
(PID) Process(320) SysInternals[1].exe
Decrypted-URLs (1)https://download.sysinternals.com/files/Hex2Dec.zip
(PID) Process(320) SysInternals[1].exe
Decrypted-URLs (4)http://www.google.com
http://www.malware430.com/html/VMwareUpdate.exeAhttps://download.sysinternals.com/files/Hex2Dec.zip
https://docs.microsoft.com/en-us/sysinternals/AAhttp://www.malware430.com/html/VMwareUpdate.exeAhttps://download.sysinternals.com/files/Hex2Dec.zip
https://download.sysinternals.com/files/Hex2Dec.zip
1292C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1964\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SysInternals[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5344"C:\Windows\System32\cmd.exe" /C c:\Windows\vmtoolsIO.exe -install && net start VMwareIOHelperService && sc config VMwareIOHelperService start= autoC:\Windows\SysWOW64\cmd.exe—SysInternals[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5504"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6052C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
1 982
Read events
1 979
Write events
3
Delete events
0

Modification events

(PID) Process:(320) SysInternals[1].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(320) SysInternals[1].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(320) SysInternals[1].exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
8
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
320SysInternals[1].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\87D78C45136644DE48CA5BE9C7B7FB9E_BB00108E24CF7C583AE5C1D9CA671CA3binary
MD5:294ADF19DF02EE41572B5479AF9277BB
SHA256:D424935391F25B99E350D88B65F1851FC1F60E39B9DED58406C1A087BC4C9FE9
320SysInternals[1].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_0C4CF5196B6676C60436CD17DE56BD63binary
MD5:39747100ADC97F89DAEE7646BDD4E401
SHA256:1913C2E07A396C1F8AA083DE2796AC619AC982FE2216DD87C27952E54DA179E9
320SysInternals[1].exeC:\Windows\Temp\Hex2Dec.zipcompressed
MD5:A8EA74C54DE2A885530A4BFFDEE761B7
SHA256:88B4D4DC34855C0171A53B12A626F349E3F72FB4F07EDB4FEA906AD02D42DAB8
320SysInternals[1].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_0C4CF5196B6676C60436CD17DE56BD63binary
MD5:4929D0EFD0B1DB3324659535FA1C7177
SHA256:B5EF12E3FCC85F51D9A13E681F777A9EA7D55A9234DD0B44AC890B660A2587D4
320SysInternals[1].exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Hex2Dec[1].zipcompressed
MD5:A8EA74C54DE2A885530A4BFFDEE761B7
SHA256:88B4D4DC34855C0171A53B12A626F349E3F72FB4F07EDB4FEA906AD02D42DAB8
320SysInternals[1].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:1C501DDCEA8CC8758AB3B0C155F0BAB8
SHA256:821BC615814B336B1CD48E182A19E329DC4C7AB7305179ADD765CC65214C064B
320SysInternals[1].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\87D78C45136644DE48CA5BE9C7B7FB9E_BB00108E24CF7C583AE5C1D9CA671CA3binary
MD5:81305272B3D2894E934D7EEF7B016AC4
SHA256:AADB7C2E397661D6167F583C96E597380C61EDFDE8CB7ED1C4CAEC23824D8C7F
320SysInternals[1].exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:B846B882719E09EE4996593FE9CE2FDB
SHA256:BEC22A671CF77D0BEB4395ABC6CEB14A9C02822997BCE4B9F4B79EF54EFFAEB7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
40
DNS requests
23
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
320
SysInternals[1].exe
GET
200
142.250.185.132:80
http://www.google.com/
unknown
—
—
whitelisted
7128
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7128
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
320
SysInternals[1].exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEA7y5dg2gVICVeksYI%2B8L%2FQ%3D
unknown
—
—
whitelisted
320
SysInternals[1].exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSQXI0BX8IeiVGTBY3Wzmndxh3q4gQUrVQdA1Rxxi9e1lsYWM5uJMXWogoCEzMAAARgUJNB7iYCa%2BgAAAAABGA%3D
unknown
—
—
whitelisted
6192
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
320
SysInternals[1].exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6108
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6192
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
448
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
320
SysInternals[1].exe
142.250.185.132:80
www.google.com
GOOGLE
US
whitelisted
320
SysInternals[1].exe
23.56.206.34:443
docs.microsoft.com
AKAMAI-AS
GB
whitelisted
320
SysInternals[1].exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
320
SysInternals[1].exe
204.79.197.203:80
oneocsp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
320
SysInternals[1].exe
23.35.230.168:443
learn.microsoft.com
AKAMAI-AS
DE
whitelisted
6192
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.google.com
  • 142.250.185.132
whitelisted
docs.microsoft.com
  • 23.56.206.34
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
oneocsp.microsoft.com
  • 204.79.197.203
whitelisted
learn.microsoft.com
  • 23.35.230.168
whitelisted
www.malware430.com
  • —
unknown
www.microsoft.com
  • 23.35.229.160
whitelisted
download.sysinternals.com
  • 152.199.19.160
whitelisted

Threats

PID
Process
Class
Message
320
SysInternals[1].exe
A Network Trojan was detected
ET HUNTING Suspicious UA (^IE[ds])
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SysInternals[1].exe