File name:

857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe

Full analysis: https://app.any.run/tasks/56d90901-e236-4ce2-a815-408597a27c7b
Verdict: Malicious activity
Analysis date: January 10, 2025, 23:13:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections
MD5:

BDB76745FA583ECC67E2EE61C6CF3AD3

SHA1:

0EE29B7889F06C58056960D1EE8EE14D4BE491F6

SHA256:

857873B053F675A77B208952D699EE48BCCCB07D6011366055FA44AE84C73FF6

SSDEEP:

1536:EhPpyASvVVVVVVVVWs5jfzQ/F3ZdUsj5qKEruDrDCKj:cpDSvVVVVVVVVrfQF3Esj5qePCKj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

    • Executable content was dropped or overwritten

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

  • INFO

    • Checks supported languages

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

    • Creates files or folders in the user directory

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

    • UPX packer has been detected

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (30.9)
.exe | Win64 Executable (generic) (27.3)
.exe | UPX compressed Win32 Executable (26.8)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x2130
UninitializedDataSize: 24576
InitializedDataSize: 4096
CodeSize: 8192
LinkerVersion: 6
PEType: PE32
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
TimeStamp: 2011:03:15 04:06:07+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe

Process information

PID
CMD
Path
Indicators
Parent process
2804"C:\Users\admin\Desktop\857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe" C:\Users\admin\Desktop\857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
11
Read events
11
Write events
0
Delete events
0

Modification events

No data
Executable files
1 655
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe —
MD5:—
SHA256:—
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\cef.pak.tmpexecutable
MD5:6F8A4166A4DBF0933DBEB5BF986DD40B
SHA256:D2D467BACBDC5C6C80D606BC883A32E9F163084F22049E6DE9F473755F1FE8ED
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:CE3CCB6B3ACD0C17EA309CBA7D4F3CC1
SHA256:C4BBF3D69A38E4AFFC321CB4289D9EE82E2FE33C582C53A3FD3D05CA319C7C7F
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.tmpexecutable
MD5:0BB37BA3E277D4E0015CE6E8B8985553
SHA256:D8A9D0D8AE21BF3CAFED60EF4D7E4BE496024B4F682F034FA5FB0221F0486279
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:BE7E2053F5D74E327711D0019B360577
SHA256:8CEC189B363AA20610039757CB9DB8E76FF9A0AF779C9359C4DBD71757134893
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:1EA56E2289C8CC574637B997D01A88E8
SHA256:3C9FA3D3D9EA3877BADD3766B8CCA7A1073103FD369F9F59AEF39D68C5DE5AF9
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:57FCEA5B76BFD412EC7E48E5910013DD
SHA256:0439731335788EA401153FD358EBCDC9D38826CB982D1BB0C65A5D7ACED5BB95
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:3407B0C0593839370C7CB9988E4E449C
SHA256:F0A4D07E526CDC824F98D035AE99F4A261683CDA01C0750D95BEDDC3506138BC
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe.tmpexecutable
MD5:E2B2D8297607214C41E67969E030BA49
SHA256:684E9EE449BE96E1F369EE848713D587422F99DD773E8308FB7E716076D712BE
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:238C03F22D471FA457BDE6B540D3277A
SHA256:BCA74F670511E7CCA7A7A4ED4451532C05283D69399B65C8A588C02C95FD43F8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
17
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4500
RUXIMICS.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
132
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4500
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
132
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
132
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4500
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
132
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4500
RUXIMICS.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
132
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4500
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
self.events.data.microsoft.com
  • 20.189.173.23
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe