File name:

sample_94

Full analysis: https://app.any.run/tasks/589edcd9-d386-4229-bcee-53e7eaeac011
Verdict: Malicious activity
Analysis date: October 23, 2024, 14:35:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

F536047A1FB17B7A962F0AE91CB8F838

SHA1:

A9EC77B45A43AF41ED1F19331021378771DF7274

SHA256:

8D21CB631C8CAF7F62F60BBB7C77FED05A698A6A9084478DC8FD00E946826BA6

SSDEEP:

3072:N4pbMwF4vO/domY5m0YyAra8ZHOHZKPIZFSak4eZ00edS9K9/1Kr2TvhvCdG8g9k:N4mpgCA7sem0edo2bYsav

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • sample_94.exe (PID: 2660)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sample_94.exe (PID: 2660)

    • The process creates files with name similar to system file names

      • sample_94.exe (PID: 2660)

    • Starts itself from another location

      • sample_94.exe (PID: 2660)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • sample_94.exe (PID: 2660)

    • Checks Windows Trust Settings

      • lsass.exe (PID: 6256)

    • Reads security settings of Internet Explorer

      • lsass.exe (PID: 6256)

    • Checks for external IP

      • lsass.exe (PID: 6256)

    • Potential Corporate Privacy Violation

      • lsass.exe (PID: 6256)

  • INFO

    • Checks supported languages

      • sample_94.exe (PID: 2660)
      • lsass.exe (PID: 6256)

    • Creates files or folders in the user directory

      • sample_94.exe (PID: 2660)
      • lsass.exe (PID: 6256)

    • Reads the computer name

      • sample_94.exe (PID: 2660)
      • lsass.exe (PID: 6256)

    • Checks proxy server information

      • lsass.exe (PID: 6256)

    • Reads the machine GUID from the registry

      • lsass.exe (PID: 6256)

    • Reads the software policy settings

      • lsass.exe (PID: 6256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (46.3)
.exe | Win64 Executable (generic) (41)
.exe | Win32 Executable (generic) (6.6)
.exe | Generic Win/DOS Executable (2.9)
.exe | DOS Executable Generic (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:03:08 04:21:36+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 200704
InitializedDataSize: 12288
UninitializedDataSize: -
EntryPoint: 0x25bc
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: Bonjour
FileVersion: 1
ProductVersion: 1
InternalName: Bonjour
OriginalFileName: Bonjour.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
8
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start sample_94.exe netsh.exe no specs conhost.exe no specs lsass.exe ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2660"C:\Users\admin\AppData\Local\Temp\sample_94.exe" C:\Users\admin\AppData\Local\Temp\sample_94.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sample_94.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
5740netsh advfirewall firewall add rule name="ImgBurn" dir=in action=allow description="Multimedia suite" program="C:\Users\admin\AppData\Roaming\Microsoft\lsass.exe" enable=yesC:\Windows\SysWOW64\netsh.exe—sample_94.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6256 /k C:\Users\admin\AppData\Local\Temp\sample_94.exeC:\Users\admin\AppData\Roaming\Microsoft\lsass.exe
sample_94.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\microsoft\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7932"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7952\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8080"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
8100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 254
Read events
1 210
Write events
44
Delete events
0

Modification events

(PID) Process:(2660) sample_94.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MSWUpdate
Value:
C:\Users\admin\AppData\Roaming\Microsoft\lsass.exe
(PID) Process:(2660) sample_94.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MSWUpdate
Value:
C:\Users\admin\AppData\Roaming\Microsoft\lsass.exe
(PID) Process:(2660) sample_94.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Microsoft\4842
Operation:writeName:F
Value:
True
(PID) Process:(6256) lsass.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6256) lsass.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6256) lsass.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6256) lsass.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MSWUpdate
Value:
C:\Users\admin\AppData\Roaming\Microsoft\lsass.exe
(PID) Process:(6256) lsass.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MSWUpdate
Value:
C:\Users\admin\AppData\Roaming\Microsoft\lsass.exe
Executable files
1
Suspicious files
6
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2660sample_94.exeC:\Users\admin\AppData\Roaming\Microsoft\lsass.exeexecutable
MD5:F536047A1FB17B7A962F0AE91CB8F838
SHA256:8D21CB631C8CAF7F62F60BBB7C77FED05A698A6A9084478DC8FD00E946826BA6
6256lsass.exeC:\Users\admin\AppData\Roaming\Microsoft\SkMBcUxCgJhenC.tmphtml
MD5:A8CE57F8EBDBF9874FE8BF7E5451D4C9
SHA256:7D91B2F5AC1EB62980F70F9EF5F9B49AF35A42B60B85A0E9D3C71A794AD32196
6256lsass.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CBbinary
MD5:931827F9E5836BEA7768AF9AA871ABFC
SHA256:636EA0046AE1983234E7DF36F9E0E40D4A2E506233B806DA9ED5625F5A625221
6256lsass.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\GXD9DSQV.htmhtml
MD5:A8CE57F8EBDBF9874FE8BF7E5451D4C9
SHA256:7D91B2F5AC1EB62980F70F9EF5F9B49AF35A42B60B85A0E9D3C71A794AD32196
6256lsass.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CBbinary
MD5:C4DBBDB5D4E271BC001764733120BA13
SHA256:E7695D5C62BB059F0771CBA63CA50581D5D7C538ACBF209B927C64F075489FAF
6256lsass.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78binary
MD5:CFCFF040C9A38D142A82CDFEF20F8AE3
SHA256:26F2FCB70ACA21212AA5C0FAA99CBD9CDB709092D86D8E56DFC6574F1318C5E6
6256lsass.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:40AF5989D5D19F37E8C903946C279BF2
SHA256:E2E1EEB02FF7397E19167A72D5198A39060BF62E0ECC60AD195888BDE6517402
6256lsass.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:D530281A7FC892FD743C191B1B1BAFD4
SHA256:059D09183B9B3BC063DB7E2F67D45D81DA812D0541F2949AD3918E8C534CA3C0
6256lsass.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78binary
MD5:F301490058051A9CC7EF4A90FD070629
SHA256:427E0EFF606FA64FCE4441038CC943150C7CBFC6557CA323CF2B3A87FCDEA8B8
6256lsass.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\OX0RARUT.htmhtml
MD5:0104C301C5E02BD6148B8703D19B3A73
SHA256:446A6087825FA73EADB045E5A2E9E2ADF7DF241B571228187728191D961DDA1F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
70
DNS requests
37
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6256
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6256
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRyyuDOSqb8BtprWZSAvBT9kFoYdwQU%2BftQxItnu2dk%2FoMhpqnOP1WEk5kCEQCO7jhRuOm3rEfj7UZpN0J8
unknown
—
—
whitelisted
6256
lsass.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQCTi7COYph7T3X5jLalBFyW
unknown
—
—
whitelisted
6256
lsass.exe
GET
301
188.114.96.3:80
http://www.geoiptool.com/
unknown
—
—
whitelisted
3964
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
624
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7400
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6944
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1752
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5488
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4360
SearchApp.exe
104.126.37.152:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
www.bing.com
  • 104.126.37.152
  • 104.126.37.146
  • 104.126.37.155
  • 104.126.37.130
  • 104.126.37.153
  • 104.126.37.139
  • 104.126.37.128
  • 104.126.37.131
  • 104.126.37.136
  • 2.23.209.130
  • 2.23.209.189
  • 2.23.209.140
  • 2.23.209.137
  • 2.23.209.135
  • 2.23.209.186
  • 2.23.209.132
  • 2.23.209.131
  • 2.23.209.143
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.geoiptool.com
  • 188.114.96.3
  • 188.114.97.3
whitelisted
www.geodatatool.com
  • 158.69.65.151
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

PID
Process
Class
Message
6256
lsass.exe
Potential Corporate Privacy Violation
ET POLICY Geo Location IP info online service (geoiptool.com)
6256
lsass.exe
Potential Corporate Privacy Violation
ET INFO External IP Address Lookup Domain SSL Cert (geodatatool .com)
2172
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2172
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2172
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2172
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2172
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2172
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2172
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
2172
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to a Suspicious no-ip Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sample_94