File name:

8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09

Full analysis: https://app.any.run/tasks/d6b42cd8-70e3-4905-a46f-7bd314ff10cf
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:18:30
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
sinkhole
expiro
m0yv
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

B5C6AC313FA5167296FBE879F26C4E0F

SHA1:

D03372158B51E7C5925B372758A52EA118D5E09B

SHA256:

8DDFDA62DECD6DE3185B1EC3BEBE067A20A124A39F8483AFA9BBC47B3F3D0C09

SSDEEP:

49152:6HlGAbWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZ4:rAyQX21RBt7QjTmcaTH/vU4do9Pcjq12

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • M0YV mutex has been found

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Connects to the CnC server

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • EXPIRO has been detected (SURICATA)

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Request for a sinkholed resource

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Expiro has been found (SURICATA)

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Executes application which crashes

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Executable content was dropped or overwritten

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Contacting a server suspected of hosting an CnC

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

  • INFO

    • Creates files or folders in the user directory

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)
      • WerFault.exe (PID: 6208)

    • Checks supported languages

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • The sample compiled with english language support

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Reads mouse settings

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Reads the computer name

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Create files in a temporary directory

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)

    • Checks proxy server information

      • 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe (PID: 4972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x27dcd
UninitializedDataSize: -
InitializedDataSize: 623104
CodeSize: 581120
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:16 05:09:12+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #EXPIRO 8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe svchost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
4972"C:\Users\admin\AppData\Local\Temp\8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe" C:\Users\admin\AppData\Local\Temp\8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
4136"C:\Users\admin\AppData\Local\Temp\8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe" C:\Windows\SysWOW64\svchost.exe—8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6208C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4972 -s 912C:\Windows\SysWOW64\WerFault.exe
8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 393
Read events
3 393
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
9
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6208WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_8ddfda62decd6de3_58a86a8278f69c1be65a28ad7a453f848c8965_a2bc34b9_8722a0eb-23e3-4d1c-86fe-ce67c05bf5eb\Report.wer —
MD5:—
SHA256:—
49728ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exeC:\Users\admin\AppData\Local\Temp\apostrophisebinary
MD5:6511CF77F2157C57B6B23F8A02E86041
SHA256:336C36FD60E9B7F20CBD93B1156768CFB53CAC9DE0F2620863493A4C86E6E63F
49728ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exeexecutable
MD5:BAAD65B85D29B7785A2AD232C8C12655
SHA256:11CA072E112EA49D25934E02B7B8DB20A7B59B3447B93D01D815BF98F45F20BA
6208WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:E437D126870E1D8F866DC006471A2FFF
SHA256:70A68363F997A5F5F001D88CDE297AE089917550863609F15EB4FA2CE91CE2F8
6208WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe.4972.dmpbinary
MD5:F2A705449011C7310AF30357A468AF52
SHA256:3F26BFF71C288B8205B0A80817B347864C6843B40B9C3A530E8B5B27926E3996
49728ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exeexecutable
MD5:351A94036242DA2B733AF875998BD0BD
SHA256:E349733E6686EB0270BADB96FEE8B7CF20008B8C37D53B3B17C7F4961CC99717
49728ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exeC:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exeexecutable
MD5:D8F7D08D03E7F751A417E2EB1FE25203
SHA256:45A66FAD360988627B21F98343BC41D3D341542179EA157E9A82EA51AACA3133
49728ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exeC:\Users\admin\AppData\Local\Temp\aut5D46.tmpbinary
MD5:6511CF77F2157C57B6B23F8A02E86041
SHA256:336C36FD60E9B7F20CBD93B1156768CFB53CAC9DE0F2620863493A4C86E6E63F
6208WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6A18.tmp.WERInternalMetadata.xmlxml
MD5:F70438044B61440558FF77E9F73E4097
SHA256:39E3B54D77D2F4F44B578F51F53520BB21A426A02789D7E41653E107CB345A00
6208WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER67F4.tmp.dmpbinary
MD5:BA204E80B77C8A752879ECA33C61D3FF
SHA256:D078AA92C14E4A558D4B4A06C15C97C9223C20430BB1E486148865192A904171
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
35
DNS requests
20
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7080
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6208
WerFault.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6208
WerFault.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6736
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4972
8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe
POST
—
18.141.10.107:80
http://ssbzmoy.biz/kmkgtmfnyoutxp
unknown
—
—
—
7080
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4972
8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe
POST
200
54.244.188.177:80
http://pywolwnvd.biz/dbcskslisxk
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
5340
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4972
8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe
54.244.188.177:80
pywolwnvd.biz
AMAZON-02
US
malicious
4972
8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09.exe
18.141.10.107:80
ssbzmoy.biz
AMAZON-02
SG
unknown
6208
WerFault.exe
52.182.143.212:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6208
WerFault.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
google.com
  • 172.217.16.142
whitelisted
pywolwnvd.biz
  • 54.244.188.177
malicious
ssbzmoy.biz
  • 18.141.10.107
unknown
watson.events.data.microsoft.com
  • 52.182.143.212
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.75
  • 20.190.159.23
  • 40.126.31.67
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
—
—
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
8ddfda62decd6de3185b1ec3bebe067a20a124a39f8483afa9bbc47b3f3d0c09