File name:

857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe

Full analysis: https://app.any.run/tasks/56d90901-e236-4ce2-a815-408597a27c7b
Verdict: Malicious activity
Analysis date: January 10, 2025, 23:13:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections
MD5:

BDB76745FA583ECC67E2EE61C6CF3AD3

SHA1:

0EE29B7889F06C58056960D1EE8EE14D4BE491F6

SHA256:

857873B053F675A77B208952D699EE48BCCCB07D6011366055FA44AE84C73FF6

SSDEEP:

1536:EhPpyASvVVVVVVVVWs5jfzQ/F3ZdUsj5qKEruDrDCKj:cpDSvVVVVVVVVrfQF3Esj5qePCKj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

    • The process creates files with name similar to system file names

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

  • INFO

    • Checks supported languages

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

    • UPX packer has been detected

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)

    • Creates files or folders in the user directory

      • 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe (PID: 2804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (30.9)
.exe | Win64 Executable (generic) (27.3)
.exe | UPX compressed Win32 Executable (26.8)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:03:15 04:06:07+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 8192
InitializedDataSize: 4096
UninitializedDataSize: 24576
EntryPoint: 0x2130
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE 857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe

Process information

PID
CMD
Path
Indicators
Parent process
2804"C:\Users\admin\Desktop\857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe" C:\Users\admin\Desktop\857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
11
Read events
11
Write events
0
Delete events
0

Modification events

No data
Executable files
1 655
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe —
MD5:—
SHA256:—
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:92A744207C694D6AC23DF11AC9ABF3A2
SHA256:B0A492389AC41FEB4C8881CCBEA36E1C919E0AC537E53DB5F4A2D4136B07BFCD
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe.tmpexecutable
MD5:57FCEA5B76BFD412EC7E48E5910013DD
SHA256:0439731335788EA401153FD358EBCDC9D38826CB982D1BB0C65A5D7ACED5BB95
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\BOOTNXT.tmpexecutable
MD5:C22ED6A665529CF9DEAFC8F74BB51F1A
SHA256:0CCD596AFAEEC8B6EE8442C7F82578CF73FCD2D6883EF1F62E126D326A31CBA6
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:238C03F22D471FA457BDE6B540D3277A
SHA256:BCA74F670511E7CCA7A7A4ED4451532C05283D69399B65C8A588C02C95FD43F8
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmpexecutable
MD5:4092B45D160FF290F0ADD6B76DE73303
SHA256:F1361E21838A2131B24AA8A19C42146249723F230A1370BEF8692DC42FC502B3
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_reader_appicon_16.png.tmpexecutable
MD5:C69B6A79CF53187D34753919B82238D8
SHA256:718F359606D0F408C9F29CEF3B2EFA62517BA3C2BFA26788FED248C3BC30CAB9
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:0BB37BA3E277D4E0015CE6E8B8985553
SHA256:D8A9D0D8AE21BF3CAFED60EF4D7E4BE496024B4F682F034FA5FB0221F0486279
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:3407B0C0593839370C7CB9988E4E449C
SHA256:F0A4D07E526CDC824F98D035AE99F4A261683CDA01C0750D95BEDDC3506138BC
2804857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:1EA56E2289C8CC574637B997D01A88E8
SHA256:3C9FA3D3D9EA3877BADD3766B8CCA7A1073103FD369F9F59AEF39D68C5DE5AF9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
17
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
132
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4500
RUXIMICS.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
132
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4500
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
132
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4500
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
132
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4500
RUXIMICS.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
132
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4500
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
self.events.data.microsoft.com
  • 20.189.173.23
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
857873b053f675a77b208952d699ee48bcccb07d6011366055fa44ae84c73ff6.exe