File name:

VeryFun.exe

Full analysis: https://app.any.run/tasks/a84c07dd-727f-4fcc-9960-3ad3085f12e3
Verdict: Malicious activity
Analysis date: January 20, 2024, 23:10:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

EF7B3C31BC127E64627EDD8B89B2AE54

SHA1:

310D606EC2F130013CC9D2F38A9CC13A2A34794A

SHA256:

8B04FDA4BEE1806587657DA6C6147D3E949AA7D11BE1EEFB8CD6EF0DBA76D387

SSDEEP:

49152:wshda+bFz6dmTTfO0JBhybeUXzELz/RkxI6Zxkxur4E5IReTD5GKHmDVJPY8t:Js/4ibecELz/RkO6LF4hRq5GKHmBBYC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VeryFun.exe (PID: 2416)

    • Scans artifacts that could help determine the target

      • cmd.exe (PID: 268)

  • SUSPICIOUS

    • Checks for the .NET to be installed

      • cmd.exe (PID: 268)

    • Starts CMD.EXE for commands execution

      • VeryFun.exe (PID: 2416)

    • Reads the history of recent RDP connections

      • cmd.exe (PID: 268)

    • Executes application which crashes

      • VeryFun.exe (PID: 2416)

  • INFO

    • Reads the computer name

      • VeryFun.exe (PID: 2416)

    • Checks supported languages

      • VeryFun.exe (PID: 2416)

    • Reads mouse settings

      • VeryFun.exe (PID: 2416)
      • cmd.exe (PID: 492)
      • cmd.exe (PID: 268)
      • cmd.exe (PID: 1232)

    • Checks transactions between databases Windows and Oracle

      • cmd.exe (PID: 268)

    • Manual execution by a user

      • WerFault.exe (PID: 568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (28.6)
.exe | UPX compressed Win32 Executable (28)
.exe | Win32 EXE Yoda's Crypter (27.5)
.dll | Win32 Dynamic Link Library (generic) (6.8)
.exe | Win32 Executable (generic) (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:09:23 00:25:28+02:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 356352
InitializedDataSize: 2826240
UninitializedDataSize: 3354624
EntryPoint: 0x389de0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
64
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start veryfun.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs veryfun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—VeryFun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
492"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—VeryFun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
568C:\Windows\system32\WerFault.exe -u -p 1164 -s 536C:\Windows\System32\WerFault.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1232"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—VeryFun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
1768C:\Windows\system32\WerFault.exe -u -p 2416 -s 58684C:\Windows\System32\WerFault.exe—VeryFun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1776"C:\Users\admin\AppData\Local\Temp\VeryFun.exe" C:\Users\admin\AppData\Local\Temp\VeryFun.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\veryfun.exe
c:\windows\system32\ntdll.dll
2416"C:\Users\admin\AppData\Local\Temp\VeryFun.exe" C:\Users\admin\AppData\Local\Temp\VeryFun.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\veryfun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2468"C:\Windows\system32\cmd.exe"C:\Windows\System32\cmd.exe—VeryFun.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2808C:\Windows\system32\WerFault.exe -u -p 596 -s 952C:\Windows\System32\WerFault.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
766 647
Read events
660 307
Write events
106 340
Delete events
0

Modification events

(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework
Operation:writeName:InstallRoot
Value:
C:\Windows\Microsoft.NET\Framework\
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AssemblyFolders\v3.0
Operation:writeName:All Assemblies In
Value:
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AssemblyFolders\v3.5
Operation:writeName:All Assemblies In
Value:
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Accessibility, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}
Operation:writeName:{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Value:
.NET Framework Redist Setup
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Fusion\References\AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}
Operation:writeName:{0A0CADCF-78DA-33C4-A350-CD51849B9702}
Value:
.NET Framework Redist Setup
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Fusion\References\CustomMarshalers, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=x86\{2EC93463-B0C3-45E1-8364-327E96AEA856}
Operation:writeName:{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Value:
.NET Framework Redist Setup
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Fusion\References\ISymWrapper, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=x86\{2EC93463-B0C3-45E1-8364-327E96AEA856}
Operation:writeName:{3C3901C5-3455-3E0A-A214-0B093A5070A6}
Value:
.NET Framework Redist Setup
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}
Operation:writeName:{0A0CADCF-78DA-33C4-A350-CD51849B9702}
Value:
.NET Framework Redist Setup
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Conversion.v4.0, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}
Operation:writeName:{0A0CADCF-78DA-33C4-A350-CD51849B9702}
Value:
.NET Framework Redist Setup
(PID) Process:(268) cmd.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\Fusion\References\Microsoft.Build.Engine, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL\{2EC93463-B0C3-45E1-8364-327E96AEA856}
Operation:writeName:{0A0CADCF-78DA-33C4-A350-CD51849B9702}
Value:
.NET Framework Redist Setup
Executable files
0
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2416VeryFun.exeC:\Windows\System.inibinary
MD5:01B77ED368DA8CC102C93724A58CFCF8
SHA256:8CED7467797999FE634B92841E0220E10FEC165E19B26D25D7804310FF261C4D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
Process
Message
VeryFun.exe
VeryFun.exe
Error -
VeryFun.exe
RtlWerpReportException failed with status code :-1073741823. Will try to launch the process directly
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VeryFun.exe