Analysis date (UTC): 15 October 2026, 14:12Analysis environment: Windows 10 Pro, build 19044, x64

IMG_958742253158.scr

MD5:8772DCE19DE3EEC069559FE06557572D

SHA1:867F19FDD663CC4D589CA54B5CA1BCA56979B145

SHA256:9B43BB4E22B438EF28EA41F29C755D71A825950C70A11FA9C569DD02BCA91129

Analysis result

Threat level:Malicious activity

Tags:

arch-scrpythonopenssltoolwebsocket

Full analysis:Analysis IMG_958742253158.scr (MD5: 8772DCE19DE3EEC069559FE06557572D) Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Create files in the Startup directory

winsec.exe (PID: 7848)

SUSPICIOUS

The process drops C-runtime libraries

IMG_958742253158.scr.exe (PID: 3216)

The process executes files with name similar to system file names

IMG_958742253158.scr.exe (PID: 3216)

Loads Python modules

winsec.exe (PID: 7848)

Drops a system driver (possible attempt to evade defenses)

IMG_958742253158.scr.exe (PID: 3216)

Suspicious source code drop

IMG_958742253158.scr.exe (PID: 3216)

OpenSSL library usage detected (YARA)

winsec.exe (PID: 7848)

Starts NET.EXE to manage network resources

cmd.exe (PID: 4152)
net.exe (PID: 5796)

INFO

Creates files or folders in the user directory

IMG_958742253158.scr.exe (PID: 3216)
winsec.exe (PID: 7848)

Manual execution by a user

IMG_958742253158.scr.exe (PID: 3216)

Checks supported languages

IMG_958742253158.scr.exe (PID: 3216)
winsec.exe (PID: 7848)

Reads the computer name

IMG_958742253158.scr.exe (PID: 3216)
winsec.exe (PID: 7848)

Reads Microsoft Office registry keys

explorer.exe (PID: 872)

Reads security settings of Internet Explorer

explorer.exe (PID: 872)

The sample compiled with english language support

IMG_958742253158.scr.exe (PID: 3216)

Reads the time zone

WmiPrvSE.exe (PID: 5556)

Reads the machine GUID from the registry

winsec.exe (PID: 7848)

Create files in a temporary directory

winsec.exe (PID: 7848)

Attempting to connect via WebSocket

winsec.exe (PID: 7848)

Launching a file from the Startup directory

winsec.exe (PID: 7848)

Threats

PID	Process	Class	Message
2228	svchost.exe	Misc activity	INFO [ANY.RUN] .cc TLD domain request
7848	winsec.exe	Misc activity	INFO [ANY.RUN] Python requests User-agent in HTTP request
7848	winsec.exe	Not Suspicious Traffic	INFO [ANY.RUN] Websocket Upgrade Request