File name:

78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9

Full analysis: https://app.any.run/tasks/2ba807b5-35d4-4533-87da-b1a713c13789
Verdict: Malicious activity
Analysis date: April 22, 2025, 18:53:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

739138899F12457914579770DEC305FE

SHA1:

574657E84230108F8774AB0E5CDDBAB88CC01366

SHA256:

78CC615B06DF444CF13D4BABC113B5CEFE1E142B31CA2E405ABD0164243324C9

SSDEEP:

98304:Ql1d5GmjIB7LtfuE+pZwbp+0GBIK2paXRK3+mlc:Gps2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe (PID: 6132)

    • Runs injected code in another process

      • msservicesupd.exe (PID: 1764)

    • Application was injected by another process

      • explorer.exe (PID: 5492)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe (PID: 6132)

    • Executable content was dropped or overwritten

      • 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe (PID: 6132)

  • INFO

    • The sample compiled with english language support

      • 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe (PID: 6132)

    • Creates files or folders in the user directory

      • 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe (PID: 6132)

    • Reads the software policy settings

      • slui.exe (PID: 1328)

    • Checks supported languages

      • 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe (PID: 6132)
      • msservicesupd.exe (PID: 1764)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)

    • Auto-launch of the file from Startup directory

      • 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe (PID: 6132)

    • Manual execution by a user

      • msservicesupd.exe (PID: 1764)

    • Reads the computer name

      • 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe (PID: 6132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:28 14:03:27+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 1203200
InitializedDataSize: 401408
UninitializedDataSize: -
EntryPoint: 0xc94ff
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 22.5.4.14015
ProductVersionNumber: 22.5.4.14015
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Steganos Software GmbH
FileDescription: Steganos Trace Destructor Browser Monitor
FileVersion: 22.5.4.14015
InternalName: SteganosBrowserMonitor.exe
OriginalFileName: SteganosBrowserMonitor.exe
LegalCopyright: Copyright (c) 2018 Steganos Software GmbH
LegalTrademarks: Steganos Safe is a trademark of Steganos Software GmbH
ProductName: Steganos Safe
ProductVersion: 22.5.4.14015
Comments: Steganos Safe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
6
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe sppextcomobj.exe no specs slui.exe slui.exe no specs msservicesupd.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
720C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1020C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1328"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1764"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msservicesupd.exe"C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msservicesupd.exe—explorer.exe
User:
admin
Company:
Steganos Software GmbH
Integrity Level:
MEDIUM
Description:
Steganos Trace Destructor Browser Monitor
Version:
22.5.4.14015
Modules
Images
c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\msservicesupd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
5492C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
6132"C:\Users\admin\AppData\Local\Temp\78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe" C:\Users\admin\AppData\Local\Temp\78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe
explorer.exe
User:
admin
Company:
Steganos Software GmbH
Integrity Level:
MEDIUM
Description:
Steganos Trace Destructor Browser Monitor
Version:
22.5.4.14015
Modules
Images
c:\users\admin\appdata\local\temp\78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
1 671
Read events
1 670
Write events
1
Delete events
0

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000000800000009000000
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
613278cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msservicesupd.exeexecutable
MD5:739138899F12457914579770DEC305FE
SHA256:78CC615B06DF444CF13D4BABC113B5CEFE1E142B31CA2E405ABD0164243324C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4272
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4272
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.139:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.174
whitelisted
crl.microsoft.com
  • 23.48.23.139
  • 23.48.23.148
  • 23.48.23.147
  • 23.48.23.155
  • 23.48.23.138
  • 23.48.23.143
  • 23.48.23.153
  • 23.48.23.149
  • 23.48.23.146
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.128
  • 40.126.31.67
  • 20.190.159.129
  • 40.126.31.130
  • 20.190.159.75
  • 40.126.31.2
  • 20.190.159.0
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
78cc615b06df444cf13d4babc113b5cefe1e142b31ca2e405abd0164243324c9