File name:

NewPurchaseOrder.exe

Full analysis: https://app.any.run/tasks/fd22bd58-e9f6-44d8-86a0-4d51fb853e82
Verdict: Malicious activity
Analysis date: March 25, 2025, 07:21:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D6E27EBA7CE52A97269531309B3CE30C

SHA1:

8BFA189B8958527DF12E76A20FE787C5F4C93B7F

SHA256:

905CA82E14094EAF2E1D9F2349C53368F3CD2186A381E1B59280DFB7B1F12A39

SSDEEP:

49152:bHlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZr:gAGQX21RBt7QjTmcaTH/vU4do9Pcjq1u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • neophobia.exe (PID: 7584)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • NewPurchaseOrder.exe (PID: 7544)

    • Starts itself from another location

      • NewPurchaseOrder.exe (PID: 7544)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7968)

    • Executes application which crashes

      • neophobia.exe (PID: 7584)
      • neophobia.exe (PID: 8020)

  • INFO

    • Checks supported languages

      • NewPurchaseOrder.exe (PID: 7544)
      • neophobia.exe (PID: 7584)
      • neophobia.exe (PID: 8020)

    • Creates files or folders in the user directory

      • NewPurchaseOrder.exe (PID: 7544)
      • neophobia.exe (PID: 7584)
      • WerFault.exe (PID: 7740)
      • WerFault.exe (PID: 8080)

    • Reads mouse settings

      • neophobia.exe (PID: 7584)
      • neophobia.exe (PID: 8020)
      • NewPurchaseOrder.exe (PID: 7544)

    • The sample compiled with english language support

      • NewPurchaseOrder.exe (PID: 7544)

    • Create files in a temporary directory

      • NewPurchaseOrder.exe (PID: 7544)
      • neophobia.exe (PID: 7584)
      • neophobia.exe (PID: 8020)

    • Reads the machine GUID from the registry

      • NewPurchaseOrder.exe (PID: 7544)

    • Autorun file from Startup directory

      • neophobia.exe (PID: 7584)

    • Manual execution by a user

      • wscript.exe (PID: 7968)

    • Reads the software policy settings

      • slui.exe (PID: 6620)

    • Checks proxy server information

      • slui.exe (PID: 6620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:25 01:36:44+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 418816
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
9
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start newpurchaseorder.exe neophobia.exe regsvcs.exe no specs werfault.exe no specs wscript.exe no specs neophobia.exe regsvcs.exe no specs werfault.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
6620C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7544"C:\Users\admin\Desktop\NewPurchaseOrder.exe" C:\Users\admin\Desktop\NewPurchaseOrder.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\newpurchaseorder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7584"C:\Users\admin\Desktop\NewPurchaseOrder.exe" C:\Users\admin\AppData\Local\porcelainization\neophobia.exe
NewPurchaseOrder.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\porcelainization\neophobia.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7608"C:\Users\admin\Desktop\NewPurchaseOrder.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—neophobia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
7740C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7584 -s 736C:\Windows\SysWOW64\WerFault.exe—neophobia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7968"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neophobia.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8020"C:\Users\admin\AppData\Local\porcelainization\neophobia.exe" C:\Users\admin\AppData\Local\porcelainization\neophobia.exe
wscript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\porcelainization\neophobia.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
8044"C:\Users\admin\AppData\Local\porcelainization\neophobia.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—neophobia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
8080C:\WINDOWS\SysWOW64\WerFault.exe -u -p 8020 -s 748C:\Windows\SysWOW64\WerFault.exe—neophobia.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
7 215
Read events
7 215
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
11
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_neophobia.exe_5f2a27e5d0231b7e88e7d353bdf137575dc8f22_068f149e_582e8661-e68a-485d-8cd2-35cb72781bc0\Report.wer —
MD5:—
SHA256:—
8080WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_neophobia.exe_5f2a27e5d0231b7e88e7d353bdf137575dc8f22_068f149e_c5245621-dfd0-4e22-b0f3-b9ea96ac9f02\Report.wer —
MD5:—
SHA256:—
7584neophobia.exeC:\Users\admin\AppData\Local\Temp\autD4A7.tmpbinary
MD5:DD4004987233C232346C752707756438
SHA256:6C669756BE49FE20FE61F6E47DFF19BEC274D7CE2F77894A98479C1456A0D096
7544NewPurchaseOrder.exeC:\Users\admin\AppData\Local\porcelainization\neophobia.exeexecutable
MD5:D6E27EBA7CE52A97269531309B3CE30C
SHA256:905CA82E14094EAF2E1D9F2349C53368F3CD2186A381E1B59280DFB7B1F12A39
7584neophobia.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\neophobia.vbsbinary
MD5:4D13CDEAC65154A7C96CB558351991FA
SHA256:439DF17A5BC50C37B638A2322F90090FD3632C03A776CE5FB844C21E87C38D47
7544NewPurchaseOrder.exeC:\Users\admin\AppData\Local\Temp\autD14C.tmpbinary
MD5:DD4004987233C232346C752707756438
SHA256:6C669756BE49FE20FE61F6E47DFF19BEC274D7CE2F77894A98479C1456A0D096
8020neophobia.exeC:\Users\admin\AppData\Local\Temp\autF00F.tmpbinary
MD5:DD4004987233C232346C752707756438
SHA256:6C669756BE49FE20FE61F6E47DFF19BEC274D7CE2F77894A98479C1456A0D096
7740WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERDB50.tmp.xmlxml
MD5:88D790B0617C8996E36493F3F8FE2A2B
SHA256:8EBBE9CBB67FD2BA67BB1D4FC44A94DD8A6192457A9D8D7CB5057449E03760EB
8080WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\neophobia.exe.8020.dmpbinary
MD5:9692FD9BD31F612B465A2AA286A85FD0
SHA256:BB715B71E1275B804263900DAFC64A04DF16DB6A452D3E2723E0FE7FF43CC592
8080WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERF3E7.tmp.dmpbinary
MD5:E5F5F19947BF9A42F94F33CC951474BF
SHA256:BBD8E6AAA500E08511C442E5FF248DBD4296EA00C55DC729C50F2143A0147404
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
54
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5164
SIHClient.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
5164
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
52.165.164.15:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
—
—
GET
200
20.12.23.50:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
—
—
GET
304
20.12.23.50:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7320
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5164
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
login.live.com
  • 20.190.159.128
  • 20.190.159.23
  • 40.126.31.67
  • 40.126.31.128
  • 40.126.31.73
  • 40.126.31.131
  • 20.190.159.129
  • 40.126.31.130
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NewPurchaseOrder.exe