File name:

1 (357)

Full analysis: https://app.any.run/tasks/47269019-83d7-4453-b272-cbe1e8c0ceae
Verdict: Malicious activity
Analysis date: March 24, 2025, 20:33:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amsi-bypass
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

7CC52F46DC8756754AB91074467C6E10

SHA1:

DD25D5B816D9EE01A7640FB3F244DB617AAC8231

SHA256:

8843E0FB496F3EE08A1BC6E0A1918FD7ECC02D5834A70B6A13711831874FD934

SSDEEP:

3072:Bkx1VGjSe302jRXYNcLwx9wUZBH20fHFwZJk+3nV:BqVGjp302jRX2cuwUZ1rHFi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • 1 (357).exe (PID: 7492)

  • SUSPICIOUS

    • Changes internet zones settings

      • 1 (357).exe (PID: 7492)

    • Potential Corporate Privacy Violation

      • 1 (357).exe (PID: 7492)

    • Contacting a server suspected of hosting an CnC

      • 1 (357).exe (PID: 7492)

  • INFO

    • The sample compiled with russian language support

      • 1 (357).exe (PID: 7492)

    • Failed to create an executable file in Windows directory

      • 1 (357).exe (PID: 7492)

    • Reads the software policy settings

      • slui.exe (PID: 7568)

    • Reads the computer name

      • 1 (357).exe (PID: 7492)

    • Checks supported languages

      • 1 (357).exe (PID: 7492)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:01:08 06:30:28+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.2
CodeSize: 8704
InitializedDataSize: 113664
UninitializedDataSize: -
EntryPoint: 0x1f80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.0.572.1152
ProductVersionNumber: 5.0.572.1152
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Windows, Cyrillic
Comments: -
CompanyName: ComponentOne LLC
FileDescription: DrWeb For Windows im 2011
FileVersion: 5.0.572.1152
InternalName: Dr.Web for Windows 0
LegalCopyright: Copyright (C) DoctorWeb, Ltd., 1992-2011
LegalTrademarks: -
OriginalFileName: BPE-PROTECTormTX.exe
ProductName: Dr.Web for Windows
ProductVersion: 5.0.572.1152
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1 (357).exe sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5512C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7492"C:\Users\admin\AppData\Local\Temp\1 (357).exe" C:\Users\admin\AppData\Local\Temp\1 (357).exe
explorer.exe
User:
admin
Company:
ComponentOne LLC
Integrity Level:
MEDIUM
Description:
DrWeb For Windows im 2011
Version:
5.0.572.1152
Modules
Images
c:\users\admin\appdata\local\temp\1 (357).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7536C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7568"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
2 677
Read events
2 670
Write events
7
Delete events
0

Modification events

(PID) Process:(7492) 1 (357).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\
Operation:writeName:1601
Value:
0
(PID) Process:(7492) 1 (357).exeKey:HKEY_CURRENT_USER\SOFTWARE\18RH6WMFH2
Operation:writeName:XmyD
Value:
5
(PID) Process:(7492) 1 (357).exeKey:HKEY_CURRENT_USER\SOFTWARE\18RH6WMFH2
Operation:writeName:Xmy3
Value:
31169989
(PID) Process:(7492) 1 (357).exeKey:HKEY_CURRENT_USER\SOFTWARE\18RH6WMFH2
Operation:writeName:XmyE
Value:
(PID) Process:(7492) 1 (357).exeKey:HKEY_CURRENT_USER\SOFTWARE\18RH6WMFH2
Operation:writeName:XmyD
Value:
10
(PID) Process:(7492) 1 (357).exeKey:HKEY_CURRENT_USER\SOFTWARE\18RH6WMFH2
Operation:writeName:XmyD
Value:
20
(PID) Process:(7492) 1 (357).exeKey:HKEY_CURRENT_USER\SOFTWARE\18RH6WMFH2
Operation:writeName:XmyD
Value:
40
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
74921 (357).exeC:\Windows\Tasks\{62C40AA6-4406-467a-A5A5-DFDF1B559B7A}.jobbinary
MD5:1599A71993382C57A3FE9A4619F126A1
SHA256:4300D17679F8AB745854870E9C3F5F43A365C708ACA74275A76A219AC136B574
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
28
DNS requests
26
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.191:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7828
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1300
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1300
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7492
1 (357).exe
POST
301
3.234.28.104:80
http://plusvan.com/1wave.php
unknown
—
—
malicious
7492
1 (357).exe
POST
301
3.234.28.104:80
http://plusvan.com/1wave.php
unknown
—
—
malicious
7492
1 (357).exe
POST
301
3.234.28.104:80
http://plusvan.com/1wave.php
unknown
—
—
malicious
7492
1 (357).exe
POST
301
3.234.28.104:80
http://plusvan.com/1wave.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.191:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7828
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.191
  • 23.48.23.185
  • 23.48.23.177
  • 23.48.23.174
  • 23.48.23.137
  • 23.48.23.138
  • 23.48.23.194
  • 23.48.23.190
  • 23.48.23.168
whitelisted
bit.ly
  • 67.199.248.10
  • 67.199.248.11
whitelisted
guardian.co.uk
  • 151.101.1.111
  • 151.101.65.111
  • 151.101.193.111
  • 151.101.129.111
whitelisted
login.live.com
  • 40.126.31.131
  • 40.126.31.67
  • 20.190.159.23
  • 40.126.31.129
  • 20.190.159.68
  • 20.190.159.130
  • 40.126.31.69
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
client.wns.windows.com
  • 40.113.110.67
  • 40.113.103.199
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
homebuyline.com
  • —
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
INFO [ANY.RUN] Possible short link service (bit .ly)
7492
1 (357).exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Windows NT Version 5.0
7492
1 (357).exe
A Network Trojan was detected
ET MALWARE FakeAV Check-in purporting to be MSIE with invalid terse HTTP headers
7492
1 (357).exe
Malware Command and Control Activity Detected
ET MALWARE Possible Fake AV Checkin
7492
1 (357).exe
Malware Command and Control Activity Detected
ET MALWARE Possible Fake AV Checkin
7492
1 (357).exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Windows NT Version 5.0
7492
1 (357).exe
A Network Trojan was detected
ET MALWARE FakeAV Check-in purporting to be MSIE with invalid terse HTTP headers
7492
1 (357).exe
A Network Trojan was detected
ET MALWARE FakeAV Check-in purporting to be MSIE with invalid terse HTTP headers
7492
1 (357).exe
Malware Command and Control Activity Detected
ET MALWARE Possible Fake AV Checkin
7492
1 (357).exe
Malware Command and Control Activity Detected
ET MALWARE Possible Fake AV Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (357)