File name:

HardwareCheck.exe

Full analysis: https://app.any.run/tasks/3369af2e-7095-4b7e-8a8b-5d9abb2d80f1
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 12, 2024, 16:58:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
loader
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

0BAD83DC910D04207CC273FD1ABE2688

SHA1:

D798C65E164EC0534F4F85D21A6F1E253730A3D6

SHA256:

7D263C6EB41295F8740A75D02C26CBDDD6B952B55C8385AEBE3EEFD161C79520

SSDEEP:

98304:f+QWmOdxPEmRbS2zjI+GHE4uYHivHL5uXWUuHI6jdoRpl89a/ylTdN7dyITYnq/L:0ZScKBYNB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • HardwareCheck.exe (PID: 5528)
      • curl.exe (PID: 5712)
      • MP.exe (PID: 3640)
      • MP.exe (PID: 364)

    • Adds path to the Windows Defender exclusion list

      • HardwareCheck.exe (PID: 1944)
      • cmd.exe (PID: 5012)
      • cmd.exe (PID: 2280)

    • UAC/LUA settings modification

      • reg.exe (PID: 4996)

    • Creates a writable file in the system directory

      • MP.exe (PID: 364)

    • Changes the login/logoff helper path in the registry

      • MP.exe (PID: 364)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • HardwareCheck.exe (PID: 5528)
      • MP.exe (PID: 3640)

    • The process drops C-runtime libraries

      • HardwareCheck.exe (PID: 5528)
      • MP.exe (PID: 3640)

    • Process drops python dynamic module

      • HardwareCheck.exe (PID: 5528)
      • MP.exe (PID: 3640)

    • Executable content was dropped or overwritten

      • HardwareCheck.exe (PID: 5528)
      • curl.exe (PID: 5712)
      • MP.exe (PID: 364)
      • MP.exe (PID: 3640)

    • Application launched itself

      • HardwareCheck.exe (PID: 5528)
      • MP.exe (PID: 3640)

    • Loads Python modules

      • HardwareCheck.exe (PID: 1944)
      • MP.exe (PID: 364)

    • Starts CMD.EXE for commands execution

      • HardwareCheck.exe (PID: 1944)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 5012)
      • cmd.exe (PID: 2280)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5012)
      • cmd.exe (PID: 2280)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 2280)
      • cmd.exe (PID: 5012)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5800)

    • Reads security settings of Internet Explorer

      • ShellExperienceHost.exe (PID: 4140)

    • The executable file from the user directory is run by the CMD process

      • MP.exe (PID: 3640)

    • Connects to unusual port

      • MP.exe (PID: 364)

  • INFO

    • Checks supported languages

      • HardwareCheck.exe (PID: 5528)
      • HardwareCheck.exe (PID: 1944)
      • curl.exe (PID: 5712)
      • ShellExperienceHost.exe (PID: 4140)
      • MP.exe (PID: 3640)
      • MP.exe (PID: 364)

    • Reads the computer name

      • HardwareCheck.exe (PID: 5528)
      • curl.exe (PID: 5712)
      • ShellExperienceHost.exe (PID: 4140)
      • MP.exe (PID: 3640)

    • Reads the machine GUID from the registry

      • HardwareCheck.exe (PID: 1944)
      • MP.exe (PID: 364)

    • Create files in a temporary directory

      • HardwareCheck.exe (PID: 5528)
      • curl.exe (PID: 5712)
      • MP.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:06:02 13:08:38+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.38
CodeSize: 176128
InitializedDataSize: 94720
UninitializedDataSize: -
EntryPoint: 0xc540
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
18
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start hardwarecheck.exe hardwarecheck.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs curl.exe shellexperiencehost.exe no specs mp.exe mp.exe hardwarecheck.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
364MP.exe C:\Users\admin\AppData\Local\Temp\MP.exe
MP.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\mp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1100"C:\Users\admin\Desktop\HardwareCheck.exe" C:\Users\admin\Desktop\HardwareCheck.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\hardwarecheck.exe
c:\windows\system32\ntdll.dll
1720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1944"C:\Users\admin\Desktop\HardwareCheck.exe" C:\Users\admin\Desktop\HardwareCheck.exe—HardwareCheck.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\hardwarecheck.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2280C:\WINDOWS\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"C:\Windows\System32\cmd.exe—HardwareCheck.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3640MP.exe C:\Users\admin\AppData\Local\Temp\MP.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\mp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3956powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Windows\System32"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
4140"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
4716powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local\Temp"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
14 789
Read events
14 785
Write events
4
Delete events
0

Modification events

(PID) Process:(4996) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(4140) ShellExperienceHost.exeKey:\REGISTRY\A\{b823b286-f4bf-bc62-e154-3cc45ae78d60}\LocalState
Operation:writeName:PeekBadges
Value:
5B005D0000000C06B8BBE9BCDA01
(PID) Process:(364) MP.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Userinit
Value:
C:\Windows\System32\WindowsHelpProvider.exe
Executable files
22
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
5528HardwareCheck.exeC:\Users\admin\AppData\Local\Temp\_MEI55282\_decimal.pydexecutable
MD5:B6ACB44C2F580991DF7B1358A0FC0B69
SHA256:2BAB2833C24EB4E07FE082D291013EED000A5CFC22DF49311C729E7A57FE632E
5528HardwareCheck.exeC:\Users\admin\AppData\Local\Temp\_MEI55282\libcrypto-1_1.dllexecutable
MD5:6F4B8EB45A965372156086201207C81F
SHA256:976CE72EFD0A8AEEB6E21AD441AA9138434314EA07F777432205947CDB149541
4716powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tkhnvxcm.hek.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5528HardwareCheck.exeC:\Users\admin\AppData\Local\Temp\_MEI55282\_hashlib.pydexecutable
MD5:477DD76DBB15BAD8D77B978EA336F014
SHA256:23063B56AA067C3D4A79A873D4DB113F6396F3E1FE0AF4B12D95D240C4CF9969
5528HardwareCheck.exeC:\Users\admin\AppData\Local\Temp\_MEI55282\base_library.zipcompressed
MD5:E3A29ABDC88C00438CBB487CB0D802BE
SHA256:A8997BB015CF5C48FD205C3DC1D279B8984DB58A69FC4449882AC6435398F55A
5528HardwareCheck.exeC:\Users\admin\AppData\Local\Temp\_MEI55282\_socket.pydexecutable
MD5:4CEB5B09B8E7DC208C45C6AC11F13335
SHA256:71F014C3C56661EC93500DB1D9F120E11725A8AEDABC3A395658275710065178
4716powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:38B47535879464E88744A36FE6975662
SHA256:4D745D871364A1AB5D3F1DABE32EC127CB88A739DA186A2D5F684A8D689D996C
5528HardwareCheck.exeC:\Users\admin\AppData\Local\Temp\_MEI55282\python310.dllexecutable
MD5:54F8267C6C116D7240F8E8CD3B241CD9
SHA256:C30589187BE320BC8E65177AEB8DC1D39957F7B7DCDA4C13524DD7F436FB0948
5528HardwareCheck.exeC:\Users\admin\AppData\Local\Temp\_MEI55282\select.pydexecutable
MD5:A7863648B3839BFE2D5F7C450B108545
SHA256:8B4B5D37B829BA885281134D9948F249E0ECD553AE72DEDA6A404619FDF4CCC5
5528HardwareCheck.exeC:\Users\admin\AppData\Local\Temp\_MEI55282\unicodedata.pydexecutable
MD5:CF1EDA3F804DFA64AC00CAD29AB243E1
SHA256:A3AA957CF891A411A4E22E41AA4053265ECCBA4D47B5ABE6475789EBBA7FCCA0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
23
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
528
RUXIMICS.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5548
svchost.exe
GET
—
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
528
RUXIMICS.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5140
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
—
—
GET
200
130.61.214.204:443
https://test.obvgamer.xyz/download/MP.exe
unknown
executable
5.19 Mb
—
—
—
POST
200
20.189.173.10:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
binary
9 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
5548
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
528
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
528
RUXIMICS.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5548
svchost.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5140
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
5140
MoUsoCoreWorker.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
unknown
528
RUXIMICS.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.218.209.163
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
test.obvgamer.xyz
  • 130.61.214.204
unknown
self.events.data.microsoft.com
  • 20.189.173.17
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET HUNTING SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
—
—
Attempted Information Leak
ET POLICY curl User-Agent Outbound
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HardwareCheck.exe