File name:

bootstat.dat

Full analysis: https://app.any.run/tasks/7c14aa28-0837-4d71-9b53-ef41a28b16ce
Verdict: Malicious activity
Analysis date: July 10, 2024, 18:03:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/octet-stream
File info: data
MD5:

CD92E4F79851F17ACF0719F3C9C12B39

SHA1:

5DE37578B0EC62BE249FF47A2D4B296FF99B1C24

SHA256:

7A510517252AA94DBD5E0C185F3B42C3AAA87292DA681ECF0B6B755B3C627754

SSDEEP:

24576:jUVKLW+h7EFHNKCM5zWhNbOqIMjF21xJ48/ovRGHc21gHxIf2rjmYdSG4XlOmttA:jUVKLW+h7ExNKCM5ShNbOqIMjk1xJ488

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • WerFault.exe (PID: 4632)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • dllhost.exe (PID: 2252)

    • Executable content was dropped or overwritten

      • dllhost.exe (PID: 2252)

    • Reads security settings of Internet Explorer

      • update_task.exe (PID: 4724)
      • LockApp.exe (PID: 3776)

    • Reads the date of Windows installation

      • update_task.exe (PID: 4724)

    • Executes as Windows Service

      • wsc_proxy.exe (PID: 3136)

    • Executes application which crashes

      • wsc_proxy.exe (PID: 3136)

  • INFO

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 3068)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 2252)

    • Drops the executable file immediately after the start

      • dllhost.exe (PID: 2252)

    • Manual execution by a user

      • update_task.exe (PID: 3540)
      • update_task.exe (PID: 4724)

    • Checks supported languages

      • update_task.exe (PID: 4724)
      • SkypeApp.exe (PID: 4800)
      • LockApp.exe (PID: 3776)
      • wsc_proxy.exe (PID: 3136)

    • Reads the computer name

      • update_task.exe (PID: 4724)
      • LockApp.exe (PID: 3776)
      • SkypeApp.exe (PID: 4800)
      • wsc_proxy.exe (PID: 3136)

    • Process checks computer location settings

      • update_task.exe (PID: 4724)

    • Reads the machine GUID from the registry

      • wsc_proxy.exe (PID: 3136)

    • Reads CPU info

      • wsc_proxy.exe (PID: 3136)

    • Creates files in the program directory

      • wsc_proxy.exe (PID: 3136)

    • Reads the software policy settings

      • WerFault.exe (PID: 4632)

    • Checks proxy server information

      • update_task.exe (PID: 4724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
11
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start openwith.exe no specs rundll32.exe no specs Copy/Move/Rename/Delete/Link Object update_task.exe no specs update_task.exe conhost.exe no specs skypeapp.exe no specs conhost.exe no specs lockapp.exe no specs wsc_proxy.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
524\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SkypeApp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2252C:\WINDOWS\system32\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2916\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—update_task.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3068"C:\WINDOWS\System32\OpenWith.exe" C:\WINDOWS\bootstat.datC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3136"C:\Windows\en-US\wsc_proxy.exe" /runassvc /rpcserver /wsc_name:" "C:\Windows\en-US\wsc_proxy.exe
services.exe
User:
SYSTEM
Company:
AVAST Software
Integrity Level:
SYSTEM
Description:
Avast remediation exe
Exit code:
255
Version:
21.4.6162.0
Modules
Images
c:\windows\en-us\wsc_proxy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\en-us\wsc.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3540"C:\Windows\en-US\update_task.exe" C:\Windows\en-US\update_task.exe—explorer.exe
User:
admin
Company:
Fortinet Inc.
Integrity Level:
MEDIUM
Description:
FortiClient Virus Feedback Service
Exit code:
3221226540
Version:
7.2.4.0972
Modules
Images
c:\windows\en-us\update_task.exe
c:\windows\system32\ntdll.dll
3776"C:\WINDOWS\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe" -ServerName:WindowsDefaultLockScreen.AppX7y4nbzq37zn4ks9k7amqjywdat7d3j2z.mcaC:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
LockApp.exe
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.lockapp_cw5n1h2txyewy\lockapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
4632C:\WINDOWS\system32\WerFault.exe -u -p 3136 -s 164C:\Windows\System32\WerFault.exe
wsc_proxy.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\oleaut32.dll
4724"C:\Windows\en-US\update_task.exe" C:\Windows\en-US\update_task.exe
explorer.exe
User:
admin
Company:
Fortinet Inc.
Integrity Level:
HIGH
Description:
FortiClient Virus Feedback Service
Version:
7.2.4.0972
Modules
Images
c:\windows\en-us\update_task.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\en-us\utilsdll.dll
c:\windows\system32\rpcrt4.dll
4800"C:\Windows\en-US\SkypeApp.exe" C:\Windows\en-US\SkypeApp.exe—update_task.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\windows\en-us\skypeapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
11 531
Read events
11 489
Write events
36
Delete events
6

Modification events

(PID) Process:(3068) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\oregres.dll,-205
Value:
Word
(PID) Process:(3068) OpenWith.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@wmploc.dll,-102
Value:
Windows Media Player
(PID) Process:(4724) update_task.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4724) update_task.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4724) update_task.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4724) update_task.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4800) SkypeApp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast
Operation:writeName:ProgramFolder
Value:
C:\Windows\en-US
(PID) Process:(3136) wsc_proxy.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast\properties
Operation:writeName:UseRegistry
Value:
1
(PID) Process:(3136) wsc_proxy.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast\Wsc
Operation:writeName:IWscAVStatus4
Value:
(PID) Process:(3136) wsc_proxy.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Avast Software\Avast\Wsc
Operation:writeName:IWscASStatus
Value:
Executable files
6
Suspicious files
6
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4632WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_wsc_proxy.exe_8b25899f1fb3d5d2785872911ba1ea1fea2dfb1c_e2da83c0_29d5c027-5183-43c6-a05c-682cb49faa9b\Report.wer —
MD5:—
SHA256:—
2252dllhost.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-msbinary
MD5:AE09203D26E59907F858887C2BBB2153
SHA256:3EE23749C0DE7A738FF5CA060C0C93D3E3D6784B21AA13FBE852680925AF4438
2252dllhost.exeC:\Windows\en-US\bootstat.datbinary
MD5:CD92E4F79851F17ACF0719F3C9C12B39
SHA256:7A510517252AA94DBD5E0C185F3B42C3AAA87292DA681ECF0B6B755B3C627754
2252dllhost.exeC:\Windows\en-US\SkypeApp.exeexecutable
MD5:C0DCAE518FE65E407FDBB6F2A71B35C7
SHA256:CB2FF159566E5D73EC3DF5C12ED502648F0F35D1917BEFCE39E9569B09CA4DCD
2252dllhost.exeC:\Windows\en-US\update_task.exeexecutable
MD5:624A9592ECF9DC33A8F837DC5256A2BC
SHA256:A4B2439027F2F45D95D6C9DF9979B76AB6B3252886CDDE436BF5F9AE88D79B13
2252dllhost.exeC:\Windows\en-US\utilsdll.dllexecutable
MD5:88118F697925A8DD74691B714AB8B4C9
SHA256:E0EDE21DCEE0D47825D7B869395C0805EA9AF2797D1E7CED8F296D55E15DA9A0
2252dllhost.exeC:\Windows\en-US\powrprof.dllexecutable
MD5:E0B6BD1728237354A7FB60407ED098D0
SHA256:0B8B72E4C1EA80AF57EE638BC8E65BA48550E716C77EB88EA319CC007C7C3B57
4800SkypeApp.exeC:\Windows\en-US\ctx.binbinary
MD5:441077CC9E57554DD476BDFB8B8B8102
SHA256:B413F47D13EE2FE6C845B2EE141AF81DE858DF4EC549A58B7970BB96645BC8D2
4632WerFault.exeC:\WINDOWS\AppCompat\Programs\Amcache.hvebinary
MD5:8301D65F3DDBB258C1E453E5BAE38257
SHA256:D6570458B7FDBB3EE21740E6BE43A1FF8554CB5CB0E053733686D303DEC028DF
4632WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERA587.tmp.xmlxml
MD5:85231EDD3AC9538D512447C523F90BA9
SHA256:AA6925A195A0D32EE4AA8D42D584131583921E5403EB984CA31C14879F8C7975
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
30
DNS requests
13
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2072
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1972
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6004
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2072
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3040
OfficeClickToRun.exe
13.69.239.79:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4632
WerFault.exe
104.208.16.94:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.174
whitelisted
self.events.data.microsoft.com
  • 13.69.239.79
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
  • 2a01:111:f100:9001::1761:914d
whitelisted
198.187.3.20.in-addr.arpa
  • —
unknown
d.4.1.9.1.6.7.1.0.0.0.0.0.0.0.0.1.0.0.9.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa
  • —
unknown

Threats

No threats detected
Process
Message
wsc_proxy.exe
[2024-07-10 18:05:04.881] [error ] [crashguard ] [ 3136: 5776] [E9669F: 103] Dump path 'C:\ProgramData\Avast Software\Avast\log' does not exist. Directory should be already created.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bootstat.dat