File name:

pyld611114.exe

Full analysis: https://app.any.run/tasks/d2756ef8-e72d-412b-a14e-e1e53150a5b2
Verdict: Malicious activity
Analysis date: August 26, 2024, 03:51:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
github
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

43BCE45D873189F9AE2767D89A1C46E0

SHA1:

34BC871A24E54A83740E0DF51320B9836D8B820B

SHA256:

9AE4784F0B139619CA8FDADFA31B53B1CBF7CD2B45F74B7E4004E5A97E842291

SSDEEP:

98304:YQ/yBoq4XxZdxkq+56fdaknEHe2wWsqGPS0EJrcLgIRBvgquQFjMPngqABapeD1W:NG9p9CTT1CPwDvt3uFGCC7EdEVB3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 6368)
      • cmd.exe (PID: 7084)
      • usvcinsta64.exe (PID: 6184)
      • pyld611114.exe (PID: 6724)
      • cmd.exe (PID: 6648)
      • cmd.exe (PID: 1812)
      • printui.exe (PID: 2636)
      • svchost.exe (PID: 6280)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 236)
      • cmd.exe (PID: 6608)

    • Starts CMD.EXE for self-deleting

      • pyld611114.exe (PID: 6724)
      • usvcinsta64.exe (PID: 6184)

    • Creates or modifies Windows services

      • reg.exe (PID: 6260)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 7032)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pyld611114.exe (PID: 6724)
      • usvcinsta64.exe (PID: 6184)
      • printui.exe (PID: 2636)
      • svchost.exe (PID: 6280)

    • Starts CMD.EXE for commands execution

      • usvcinsta64.exe (PID: 6184)
      • printui.exe (PID: 2636)
      • console_zero.exe (PID: 6124)
      • svchost.exe (PID: 6280)
      • pyld611114.exe (PID: 6724)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6228)
      • cmd.exe (PID: 400)
      • cmd.exe (PID: 6588)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6368)
      • cmd.exe (PID: 1812)
      • cmd.exe (PID: 6648)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 236)
      • cmd.exe (PID: 6608)
      • cmd.exe (PID: 7084)

    • Drops the executable file immediately after the start

      • pyld611114.exe (PID: 6724)
      • usvcinsta64.exe (PID: 6184)
      • printui.exe (PID: 2636)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7084)
      • cmd.exe (PID: 6368)
      • cmd.exe (PID: 1812)
      • cmd.exe (PID: 6648)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 236)
      • cmd.exe (PID: 6608)

    • Created directory related to system

      • cmd.exe (PID: 6792)

    • Process drops legitimate windows executable

      • usvcinsta64.exe (PID: 6184)
      • printui.exe (PID: 2636)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6320)

    • The process drops C-runtime libraries

      • printui.exe (PID: 2636)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6544)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6320)

    • The process deletes folder without confirmation

      • printui.exe (PID: 2636)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • svchost.exe (PID: 6280)

    • Connects to unusual port

      • svchost.exe (PID: 6280)

  • INFO

    • Checks supported languages

      • pyld611114.exe (PID: 6724)
      • usvcinsta64.exe (PID: 6184)
      • printui.exe (PID: 2636)
      • console_zero.exe (PID: 6124)
      • crypti.exe (PID: 6764)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7144)
      • powershell.exe (PID: 6536)
      • powershell.exe (PID: 6688)
      • powershell.exe (PID: 6180)
      • powershell.exe (PID: 6496)
      • powershell.exe (PID: 6476)
      • powershell.exe (PID: 4160)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7144)
      • powershell.exe (PID: 6536)
      • powershell.exe (PID: 6688)
      • powershell.exe (PID: 6180)
      • powershell.exe (PID: 6476)
      • powershell.exe (PID: 6496)
      • powershell.exe (PID: 4160)

    • Dropped object may contain TOR URL's

      • printui.exe (PID: 2636)

    • Reads the computer name

      • console_zero.exe (PID: 6124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:19 13:06:48+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 249856
InitializedDataSize: 14936064
UninitializedDataSize: -
EntryPoint: 0x235d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
182
Monitored processes
59
Malicious processes
6
Suspicious processes
10

Behavior graph

Click at the process to see the details
start pyld611114.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs usvcinsta64.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs printui.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs console_zero.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs cmd.exe conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs svchost.exe svchost.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs crypti.exe no specs pyld611114.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'D:\'C:\Windows\System32\cmd.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
400cmd.exe /c timeout /t 10 /nobreak && del "C:\Windows\System32\usvcinsta64.exe"C:\Windows\System32\cmd.exe—usvcinsta64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1124cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'C:\Windows\System32\cmd.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1812cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"C:\Windows\System32\cmd.exe—printui.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2092timeout /t 10 /nobreak C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2180cmd.exe /c start "" "c:\windows\system32\crypti.exe"C:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2212\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2360\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2636"C:\Windows \System32\printui.exe" C:\Windows \System32\printui.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change Printing Settings
Exit code:
127
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows \system32\printui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
Total events
45 370
Read events
45 338
Write events
31
Delete events
1

Modification events

(PID) Process:(6724) pyld611114.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Operation:writeName:DcomLaunch
Value:
Power
(PID) Process:(2636) printui.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PrinterInstallation
Operation:writeName:UIEntry
Value:
10
(PID) Process:(2636) printui.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Power
Operation:writeName:HiberbootEnabled
Value:
0
(PID) Process:(2636) printui.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Operation:writeName:DcomLaunch
Value:
Power
(PID) Process:(6260) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\x592050\Parameters
Operation:writeName:ServiceDll
Value:
C:\Windows\System32\x592050.dat
(PID) Process:(2636) printui.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PrinterInstallation
Operation:delete keyName:(default)
Value:
(PID) Process:(6496) powershell.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6496) powershell.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6496) powershell.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6496) powershell.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
16
Suspicious files
4
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
6536powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mqeg5koq.s5w.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6688powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_odqosp0g.2cl.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7144powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:59EFFD486222239998EDC7B99D2FDFCE
SHA256:09F1E0605BE1EA79D45D24BE8FF22EF7B47D09E6044A5DAB911581F79D9E7DBE
7144powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1vcsbnpl.ors.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7144powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ocpgjtd0.gcv.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6724pyld611114.exeC:\Windows\System32\usvcinsta64.exeexecutable
MD5:11DDC0A34BAC7AB099D2EE8D9817BF58
SHA256:0C396F737C1DECD395926CB52CC9F3D2AD1A3EEE5290DB62197CF617F2F0E554
6184usvcinsta64.exeC:\Windows \System32\printui.dllexecutable
MD5:6CD5395F5675ABBF7644268F0023B0BD
SHA256:397A1DD2D8DCDE26F5D22AE33AFBF6C6201920F8D27EE213B65896FE99944239
6688powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_u1411ivg.h4d.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2636printui.exeC:\Windows\System32\winsvcf\winlogsvcbinary
MD5:5B5E3152B3862FB64A11F90D69D3F481
SHA256:6F974DA1622596197B659CBC9E7D5D0BB3AA497B3330C73066A4D873DABB5EC7
6184usvcinsta64.exeC:\Windows \System32\printui.exeexecutable
MD5:E43252474ADF63E69B1FC65D202D88C3
SHA256:53DB039D9D46F2F3F80DF42C8BA48BB96CE4FB96C1BFCE5CD61514A7FF369411
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
21
DNS requests
6
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
3584
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2096
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2096
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4324
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6280
svchost.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
6280
svchost.exe
38.180.213.183:5432
runvrs.com
COGENT-174
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
ipinfo.io
  • 34.117.59.81
shared
runvrs.com
  • 38.180.213.183
unknown
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
  • 185.199.108.133
shared
github.com
  • 140.82.121.4
shared

Threats

PID
Process
Class
Message
6280
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
6280
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pyld611114.exe