File name:

Zamowienie_032725.cmd

Full analysis: https://app.any.run/tasks/3f912851-c16f-4bb4-b103-e38b425f179e
Verdict: Malicious activity
Analysis date: April 29, 2025, 08:51:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with very long lines (1232), with CRLF line terminators
MD5:

00B10A741EB8F2C914F83CB048DD174D

SHA1:

FADE082B20A88AC211AE7E6E5CBBB79AB73D9FF1

SHA256:

9D968540A796C21CA09FEB3EFC201AD3E6C57FCE267BA05A08A337DD1E14AACF

SSDEEP:

49152:9PvF3OHzPPT0u2J6EdQJk21KsexQ+EHZsBxJbsgET:g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Drops a file with a rarely used extension (PIF)

      • extrac32.exe (PID: 7228)
      • expha.pif (PID: 7264)
      • expha.pif (PID: 7288)
      • expha.pif (PID: 7312)
      • ghf.pif (PID: 7400)
      • esentutl.exe (PID: 8076)
      • chrome.PIF (PID: 7588)

    • Process drops legitimate windows executable

      • extrac32.exe (PID: 7228)
      • expha.pif (PID: 7264)
      • expha.pif (PID: 7288)

    • Executable content was dropped or overwritten

      • extrac32.exe (PID: 7228)
      • expha.pif (PID: 7264)
      • expha.pif (PID: 7288)
      • expha.pif (PID: 7312)
      • ghf.pif (PID: 7400)
      • esentutl.exe (PID: 8076)
      • chrome.PIF (PID: 7588)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2136)
      • alpha.pif (PID: 7336)
      • alpha.pif (PID: 7384)
      • rdha.pif (PID: 7552)
      • chrome.PIF (PID: 7588)
      • cmd.exe (PID: 7948)

    • Starts itself from another location

      • cmd.exe (PID: 2136)
      • cmd.exe (PID: 7948)

    • Process drops legitimate windows executable (CertUtil.exe)

      • expha.pif (PID: 7312)

    • Reads the date of Windows installation

      • rdha.pif (PID: 7552)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2136)
      • chrome.PIF (PID: 7588)

    • Application launched itself

      • cmd.exe (PID: 2136)

    • Reads security settings of Internet Explorer

      • chrome.PIF (PID: 7588)
      • rdha.pif (PID: 7552)

    • Executing commands from ".cmd" file

      • chrome.PIF (PID: 7588)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7984)
      • alpha.pif (PID: 7500)

    • Likely accesses (executes) a file from the Public directory

      • esentutl.exe (PID: 8076)
      • alpha.pif (PID: 8108)
      • alpha.pif (PID: 8128)

    • Starts a Microsoft application from unusual location

      • alpha.pif (PID: 8108)
      • alpha.pif (PID: 8128)

    • Created directory related to system

      • alpha.pif (PID: 8108)

    • There is functionality for taking screenshot (YARA)

      • chrome.PIF (PID: 7588)

  • INFO

    • Creates files in the program directory

      • extrac32.exe (PID: 7228)
      • expha.pif (PID: 7264)
      • expha.pif (PID: 7288)
      • expha.pif (PID: 7312)
      • ghf.pif (PID: 7352)
      • ghf.pif (PID: 7400)
      • chrome.PIF (PID: 7588)

    • Checks supported languages

      • extrac32.exe (PID: 7228)
      • expha.pif (PID: 7264)
      • expha.pif (PID: 7288)
      • expha.pif (PID: 7312)
      • alpha.pif (PID: 7384)
      • alpha.pif (PID: 7336)
      • ghf.pif (PID: 7352)
      • ghf.pif (PID: 7400)
      • alpha.pif (PID: 7500)
      • rdha.pif (PID: 7552)
      • chrome.PIF (PID: 7588)
      • cgtvfwqI.pif (PID: 7340)
      • alpha.pif (PID: 8108)
      • alpha.pif (PID: 8128)

    • Reads the computer name

      • extrac32.exe (PID: 7228)
      • ghf.pif (PID: 7352)
      • ghf.pif (PID: 7400)
      • rdha.pif (PID: 7552)
      • chrome.PIF (PID: 7588)

    • The sample compiled with english language support

      • extrac32.exe (PID: 7228)
      • expha.pif (PID: 7264)
      • expha.pif (PID: 7288)
      • expha.pif (PID: 7312)
      • esentutl.exe (PID: 8076)
      • chrome.PIF (PID: 7588)

    • Process checks computer location settings

      • rdha.pif (PID: 7552)

    • Checks proxy server information

      • chrome.PIF (PID: 7588)

    • Reads the software policy settings

      • chrome.PIF (PID: 7588)
      • slui.exe (PID: 7452)

    • Reads the machine GUID from the registry

      • chrome.PIF (PID: 7588)

    • Compiled with Borland Delphi (YARA)

      • chrome.PIF (PID: 7588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
159
Monitored processes
27
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs extrac32.exe expha.pif expha.pif expha.pif alpha.pif no specs ghf.pif no specs alpha.pif no specs ghf.pif sppextcomobj.exe no specs slui.exe alpha.pif no specs ping.exe no specs rdha.pif no specs chrome.pif cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs esentutl.exe alpha.pif no specs alpha.pif no specs cgtvfwqi.pif no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2136C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Zamowienie_032725.cmd" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5116C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7228extrac32 /C /Y "C:\\Windows\\System32\\extrac32.exe" "C:\\ProgramData\\expha.pif" C:\Windows\System32\extrac32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7264C:\\ProgramData\\expha.pif /C /Y "C:\\Windows\\System32\\cmd.exe" "C:\\ProgramData\\alpha.pif" C:\ProgramData\expha.pif
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\expha.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7288C:\\ProgramData\\expha.pif /C /Y "C:\\Windows\\System32\\rundll32.exe" "C:\\ProgramData\\rdha.pif" C:\ProgramData\expha.pif
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\expha.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7312C:\\ProgramData\\expha.pif /C /Y "C:\Windows\System32\certutil.exe" "C:\\ProgramData\\ghf.pif" C:\ProgramData\expha.pif
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\expha.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7336C:\\ProgramData\\alpha.pif /C C:\\ProgramData\\ghf.pif -decodehex -f "C:\Users\admin\AppData\Local\Temp\Zamowienie_032725.cmd" "C:\\ProgramData\\donex.avi" 9 C:\ProgramData\alpha.pif—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\alpha.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7340C:\\Users\\admin\\Links\\cgtvfwqI.pifC:\Users\admin\Links\cgtvfwqI.pif—chrome.PIF
User:
admin
Company:
David Harris
Integrity Level:
MEDIUM
Description:
Pegasus Mail Mailbox Maintenance Utility
Exit code:
0
Version:
4.51
Modules
Images
c:\users\admin\links\cgtvfwqi.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7352C:\\ProgramData\\ghf.pif -decodehex -f "C:\Users\admin\AppData\Local\Temp\Zamowienie_032725.cmd" "C:\\ProgramData\\donex.avi" 9 C:\ProgramData\ghf.pif—alpha.pif
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\programdata\ghf.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
Total events
2 302
Read events
2 301
Write events
1
Delete events
0

Modification events

(PID) Process:(7552) rdha.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
7
Suspicious files
0
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7228extrac32.exeC:\ProgramData\expha.pifexecutable
MD5:41330D97BF17D07CD4308264F3032547
SHA256:A224559FD6621066347A5BA8F4AEECEEA8A0A7A881A71BD36DE69ACEB52E9DF7
7264expha.pifC:\ProgramData\alpha.pifexecutable
MD5:CB6CD09F6A25744A8FA6E4B3E4D260C5
SHA256:265B69033CEA7A9F8214A34CD9B17912909AF46C7A47395DD7BB893A24507E59
7352ghf.pifC:\ProgramData\donex.avitext
MD5:C351D470389095B4D9FF905027D47303
SHA256:4A6217650FD04F7A3BA1CC105F7FD3A5A4398A24FF8644EE7395283BDC623183
7400ghf.pifC:\ProgramData\chrome.PIFexecutable
MD5:ECD7A91603EA4ED1F45C8BC6400679C8
SHA256:2F8D684263C0813C102F3D6243334B93F8AD608C4B7F888F1BB5D69F1E47F534
7288expha.pifC:\ProgramData\rdha.pifexecutable
MD5:100F56A73211E0B2BCD076A55E6393FD
SHA256:00BE065F405E93233CC2F0012DEFDCBB1D6817B58969D5FFD9FD72FC4783C6F4
8076esentutl.exeC:\Users\Public\alpha.pifexecutable
MD5:D3348AC2130C7E754754A6E9CB053B09
SHA256:E9EF013238495BFFCE7459E059BFFE340A0F08B439EC94E7D4436F4E13714ECD
7588chrome.PIFC:\ProgramData\3139.cmdtext
MD5:1DF650CCA01129127D30063634AB5C03
SHA256:EDD4094E7A82A6FF8BE65D6B075E9513BD15A6B74F8032B5C10CE18F7191FA60
7588chrome.PIFC:\Users\admin\Links\cgtvfwqI.pifexecutable
MD5:3776012E2EF5A5CAE6935853E6CA79B2
SHA256:8E104CC58E62DE0EAB837AC09B01D30E85F79045CC1803FA2EF4EAFBDBD41E8D
7312expha.pifC:\ProgramData\ghf.pifexecutable
MD5:A7A5B67EC704EAC6D6E6AF0489353F42
SHA256:BF072F9A6A15B550B13AE86A4FBD3FA809D2A13236847AE9FA9A68F41386106E
7588chrome.PIFC:\ProgramData\7616.cmdtext
MD5:9A020804EBA1FFAC2928D7C795144BBF
SHA256:A86C6C7A2BF9E12C45275A5E7EBEBD5E6D2BA302FE0A12600B7C9FDF283D9E63
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4988
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4988
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4208
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
login.live.com
  • 20.190.160.2
  • 40.126.32.138
  • 20.190.160.5
  • 20.190.160.131
  • 20.190.160.67
  • 40.126.32.72
  • 20.190.160.66
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
  • 4.231.128.59
whitelisted
mack-concord.hr
  • 195.29.178.20
unknown
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Zamowienie_032725.cmd