| File name: | W10Privacy.exe |
| Full analysis: | https://app.any.run/tasks/3c545904-237a-4881-8455-a1fcb60d26ea |
| Verdict: | Malicious activity |
| Analysis date: | May 10, 2025, 06:23:28 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections |
| MD5: | B64E40D8D9D93A31EB533900441301F2 |
| SHA1: | 0598CD7137CECFC6F158954406CF7E1881F61D3C |
| SHA256: | 78471B1D3118E163E77E85BA6A9993ECE080AD1235C16DF7430F1C9C2F539904 |
| SSDEEP: | 98304:+5Drp5VkvdRLca1GlDCMMLIP3ueftJOS8XDblsOqmILByW+lbsNA1o9va/xmISHb:9fUR |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 7696)
Identifying current user with WHOAMI command
- cmd.exe (PID: 7152)
There is functionality for taking screenshot (YARA)
- W10Privacy.exe (PID: 5956)
Lists all scheduled tasks in specific format
- schtasks.exe (PID: 7380)
Starts CMD.EXE for commands execution
- W10Privacy.exe (PID: 5956)
Suspicious use of NETSH.EXE
- cmd.exe (PID: 8120)
INFO
Checks supported languages
- W10Privacy.exe (PID: 5956)
The process uses AutoIt
- W10Privacy.exe (PID: 5956)
Reads mouse settings
- W10Privacy.exe (PID: 5956)
UPX packer has been detected
- W10Privacy.exe (PID: 5956)
Reads security settings of Internet Explorer
- netsh.exe (PID: 8176)
Reads the computer name
- W10Privacy.exe (PID: 5956)
Create files in a temporary directory
- W10Privacy.exe (PID: 5956)
The sample compiled with german language support
- W10Privacy.exe (PID: 5956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (28.6) |
|---|---|---|
| .exe | | | UPX compressed Win32 Executable (28) |
| .exe | | | Win32 EXE Yoda's Crypter (27.5) |
| .dll | | | Win32 Dynamic Link Library (generic) (6.8) |
| .exe | | | Win32 Executable (generic) (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:12:19 07:34:02+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 12 |
| CodeSize: | 356352 |
| InitializedDataSize: | 1986560 |
| UninitializedDataSize: | 2514944 |
| EntryPoint: | 0x2bd340 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 5.1.0.2 |
| ProductVersionNumber: | 3.3.14.5 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Unknown |
| FileSubtype: | - |
| LanguageCode: | German |
| CharacterSet: | Unicode |
| FileVersion: | 5.1.0.2 |
| Comments: | http://www.autoitscript.com/autoit3/ |
| FileDescription: | W10Privacy |
| ProductVersion: | 3.3.14.5 |
| LegalCopyright: | Bernd Schuster |
Total processes
154
Monitored processes
27
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 456 | C:\WINDOWS\system32\cmd.exe /C del /s /q "C:\Users\admin\AppData\Local\Temp\rules_out.txt" | C:\Windows\SysWOW64\cmd.exe | — | W10Privacy.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 896 | whoami /ALL | C:\Windows\SysWOW64\whoami.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: whoami - displays logged on user information Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 960 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1072 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1088 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1180 | C:\WINDOWS\system32\cmd.exe /C del /s /q "C:\Users\admin\AppData\Local\Temp\systemapps_names.txt" | C:\Windows\SysWOW64\cmd.exe | — | W10Privacy.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5008 | C:\WINDOWS\system32\cmd.exe /C dir "C:\WINDOWS\SystemApps" /B > C:\Users\admin\AppData\Local\Temp\systemapps_names.txt | C:\Windows\SysWOW64\cmd.exe | — | W10Privacy.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5956 | "C:\Users\admin\AppData\Local\Temp\W10Privacy.exe" | C:\Users\admin\AppData\Local\Temp\W10Privacy.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: W10Privacy Version: 5.1.0.2 Modules
| |||||||||||||||
| 7152 | C:\WINDOWS\system32\cmd.exe /C whoami /ALL > C:\Users\admin\AppData\Local\Temp\whoami.txt | C:\Windows\SysWOW64\cmd.exe | — | W10Privacy.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7180 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
6 734
Read events
6 734
Write events
0
Delete events
0
Modification events
Executable files
1
Suspicious files
10
Text files
15
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5956 | W10Privacy.exe | C:\Users\admin\AppData\Local\Temp\autBD19.tmp | binary | |
MD5:D9D811335FF25BBEE17F19575C10E557 | SHA256:1F2B0DF83C896B97B5E960C1395CDB6FB26A1892BF298E5A85533D9E119D65BB | |||
| 5956 | W10Privacy.exe | C:\Users\admin\AppData\Local\Temp\Languages.ini | text | |
MD5:F23FA29FCC97B88410431156BCBAD210 | SHA256:A31ED815F6A83EF726DD3E30676906F0B45F82F3E0AA6D76BBF10B6D084A687B | |||
| 5956 | W10Privacy.exe | C:\Users\admin\AppData\Local\Temp\autBD39.tmp | binary | |
MD5:EE09704A4C7C778ECC040B2A11082C95 | SHA256:A5D2FC1343B7E7EE8328C9369999FDFC6F1035AB9AE38BCA291658BF78888A14 | |||
| 5956 | W10Privacy.exe | C:\Users\admin\AppData\Local\Temp\W10Privacy_IPs_LIGHT.txt | text | |
MD5:18FF7DD5648F76880022FE6F5D5BB6AF | SHA256:20A9DC17BC09E52CA4FBDD1571E5C84AF1C14CB3FE28D6DDE5570470338BC7C1 | |||
| 5956 | W10Privacy.exe | C:\Users\admin\AppData\Local\Temp\W10Privacy.log | text | |
MD5:88D9971A3E8D08BF821E4AED87CEFAA8 | SHA256:D61062C011272E4F1453C86AB77AC6633810E957AC5EBBE3940924C57E78E8F2 | |||
| 8120 | cmd.exe | C:\Users\admin\AppData\Local\Temp\rules_out.txt | text | |
MD5:E6C63CA6C04E36ADC0082B7E0402F026 | SHA256:7935BCEC3EA380AC5B40CF00DD94C3EC785C190C37EB7DC7307462320CCEA9A1 | |||
| 7776 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e5clglob.354.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7696 | cmd.exe | C:\Users\admin\AppData\Local\Temp\benutzerapps.txt | text | |
MD5:558FD48C6607826BAEAC779DA52A2510 | SHA256:CE9276D2CC1CE3A2A1596C1B2A8FAA5C29768B40EA19552C9698336FB08746F6 | |||
| 7152 | cmd.exe | C:\Users\admin\AppData\Local\Temp\whoami.txt | text | |
MD5:46ED8955B55EF2FE721CD9F4D9DC92B9 | SHA256:57C962A0605FA1F6189375C8ECE2E72EA2A266BF8DF33D122F4556B060138661 | |||
| 7776 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_iyjwzkxx.ymg.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
13
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 2.16.164.17:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5072 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5072 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 2.16.164.17:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted |
— | — | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.160.64:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2104 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |