File name:

sapphire.ofx.6.10-patch32.exe

Full analysis: https://app.any.run/tasks/254004fb-c30a-43c6-894e-1521dd66e9dc
Verdict: Malicious activity
Analysis date: August 05, 2024, 23:12:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
MD5:

3B4F39C0FDEBD4E695D4CD4A0B94DBF4

SHA1:

5B20C94DCACCC0AA09ECF160B86A2FE76E2CC3D6

SHA256:

9D5A68DEF776DE4F186D86B76C09422C392CFDCA8092F4028E1A7E44E3AF6DE6

SSDEEP:

24576:mHi5wlFrrVzuyxbB0Yk+9YDrQZG/FsKSkVTRCmUpx4bIYzSatzWCa:mtlFFuytB0YPnZQpBVTuP4bTzSszWCa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sapphire.ofx.6.10-patch32.exe (PID: 6456)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • sapphire.ofx.6.10-patch32.exe (PID: 6456)

  • INFO

    • Checks supported languages

      • sapphire.ofx.6.10-patch32.exe (PID: 6456)

    • Create files in a temporary directory

      • sapphire.ofx.6.10-patch32.exe (PID: 6456)

    • Reads the computer name

      • sapphire.ofx.6.10-patch32.exe (PID: 6456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (v2.x) (51)
.exe | Win32 EXE PECompact compressed (generic) (35.9)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:05:02 17:50:41+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 512
InitializedDataSize: 1082880
UninitializedDataSize: -
EntryPoint: 0x102b
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sapphire.ofx.6.10-patch32.exe sapphire.ofx.6.10-patch32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6408"C:\Users\admin\AppData\Local\Temp\sapphire.ofx.6.10-patch32.exe" C:\Users\admin\AppData\Local\Temp\sapphire.ofx.6.10-patch32.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\sapphire.ofx.6.10-patch32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6456"C:\Users\admin\AppData\Local\Temp\sapphire.ofx.6.10-patch32.exe" C:\Users\admin\AppData\Local\Temp\sapphire.ofx.6.10-patch32.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\sapphire.ofx.6.10-patch32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
392
Read events
392
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6456sapphire.ofx.6.10-patch32.exeC:\Users\admin\AppData\Local\Temp\bassmod.dllexecutable
MD5:780D14604D49E3C634200C523DEF8351
SHA256:844EB66A10B848D3A71A8C63C35F0A01550A46D2FF8503E2CA8947978B03B4D2
6456sapphire.ofx.6.10-patch32.exeC:\Users\admin\AppData\Local\Temp\dup2patcher.dllexecutable
MD5:5E9874572DFA2632F0C3D5267B6B8E59
SHA256:D44817B32DDE6830E724F21929A2BC9CDE2E81E2031038DF2F328CF27B26113C
6456sapphire.ofx.6.10-patch32.exeC:\Users\admin\AppData\Local\Temp\Trajan Pro.otfbinary
MD5:64685C54969B5BD6E5068027F1746361
SHA256:8BE3A4B25193EBE367A6478F9D56BBCA0D07F64E775C7484B2FFB20B9DFDC1A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
41
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7088
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7040
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4708
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5116
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4708
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5336
SearchApp.exe
92.123.104.59:443
www.bing.com
Akamai International B.V.
DE
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1372
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
www.bing.com
  • 92.123.104.59
  • 92.123.104.33
  • 92.123.104.11
  • 92.123.104.34
  • 92.123.104.32
  • 92.123.104.28
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.133
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.72
  • 20.190.160.22
  • 40.126.32.140
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 92.123.104.32
  • 92.123.104.34
  • 92.123.104.11
  • 92.123.104.59
  • 92.123.104.33
  • 92.123.104.28
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sapphire.ofx.6.10-patch32.exe