File name:

1 (1147)

Full analysis: https://app.any.run/tasks/9abb9df7-492a-4e53-939f-6c246caff54f
Verdict: Malicious activity
Analysis date: March 24, 2025, 08:44:11
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections
MD5:

15162569BD9D2C1CF2ED6826E394F3E0

SHA1:

71027576035B5342187ABE1D871D01FED9B10063

SHA256:

A2CFA70AA0F765177366F1BD47C29E168523D5A7F6CFC6CCDFBCFA7BB1ED1C17

SSDEEP:

12288:I0BSIi9l1t54/4n6PTKkkFc11ZYCvkhOfloDbYYoTThSSVF:I0gIKl1tS/4n6PTKFFcbZaUlqYYoXUST

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • 1.exe (PID: 7404)

    • Loads dropped or rewritten executable

      • 1.exe (PID: 7404)
      • regsvr32.exe (PID: 7612)
      • 1 (1147).exe (PID: 4408)
      • FileCoAuth.exe (PID: 7912)
      • cmd.exe (PID: 7628)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1 (1147).exe (PID: 4408)
      • 1 (1147) (PID: 2108)
      • 1.exe (PID: 7404)

    • Starts application with an unusual extension

      • 1 (1147).exe (PID: 4408)

    • Process drops legitimate windows executable

      • 1 (1147) (PID: 2108)

    • Detected use of alternative data streams (AltDS)

      • 1.exe (PID: 7404)

    • Starts CMD.EXE for commands execution

      • 1.exe (PID: 7404)

    • Executing commands from a ".bat" file

      • 1.exe (PID: 7404)

  • INFO

    • Checks supported languages

      • 1 (1147).exe (PID: 4408)
      • 1.exe (PID: 7404)

    • Reads the computer name

      • 1 (1147).exe (PID: 4408)
      • 1.exe (PID: 7404)

    • Create files in a temporary directory

      • 1 (1147).exe (PID: 4408)

    • The sample compiled with english language support

      • 1 (1147) (PID: 2108)

    • Creates files or folders in the user directory

      • 1.exe (PID: 7404)

    • Failed to create an executable file in Windows directory

      • 1.exe (PID: 7404)

    • Reads the software policy settings

      • slui.exe (PID: 6988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | ASPack compressed Win32 Executable (generic) (89.8)
.dll | Win32 Dynamic Link Library (generic) (4.4)
.exe | Win32 Executable (generic) (3)
.exe | Generic Win/DOS Executable (1.3)
.exe | DOS Executable Generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2006:07:20 14:23:52+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 5
CodeSize: 458752
InitializedDataSize: 45056
UninitializedDataSize: -
EntryPoint: 0x93001
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1 (1147).exe 1 (1147) sppextcomobj.exe no specs slui.exe 1.exe regsvr32.exe no specs cmd.exe no specs conhost.exe no specs filecoauth.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2108"C:\Users\admin\AppData\Local\Temp\1 (1147)" C:\Users\admin\AppData\Local\Temp\1 (1147)
1 (1147).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.00
4408"C:\Users\admin\AppData\Local\Temp\1 (1147).exe" C:\Users\admin\AppData\Local\Temp\1 (1147).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1 (1147).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5116C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6988"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7404C:\Users\admin\AppData\Roaming\1.exeC:\Users\admin\AppData\Roaming\1.exe
1 (1147)
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.00.0001
Modules
Images
c:\users\admin\appdata\roaming\1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
7428C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7612regsvr32 /s "C:\WINDOWS\system32\mswinsck.ocx"C:\Windows\SysWOW64\regsvr32.exe—1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7628C:\WINDOWS\system32\cmd.exe /c C:\Users\admin\AppData\Roaming\1.batC:\Windows\SysWOW64\cmd.exe—1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7636\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7912C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
824
Read events
815
Write events
9
Delete events
0

Modification events

(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:d
Value:
Æ`²ªí!øc–ÏšrÃ}èƒ×K
(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:i
Value:
(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:n
Value:
(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:n.s
Value:
(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:s
Value:
(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:b
Value:
(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:b.m
Value:
(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:d
Value:
(PID) Process:(7404) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Setup\1132536
Operation:writeName:o
Value:
Executable files
4
Suspicious files
3
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
44081 (1147).exeC:\Users\admin\AppData\Local\Temp\1 (1147)59257533text
MD5:0036C0B3A676885534B38F3148AB396D
SHA256:83A8821E78723A829B70784AC1E9F5D46C29161049CA8B77BC13ED9E1B8E0AFD
7912FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-03-24.0844.7912.1.aodlbinary
MD5:28DCA2FF4B34B5A52A2E59DF202A6ED3
SHA256:33BACCB7296F1ED1F995FC77A23049F261CF391AC0388F9E8DD161F8C17B7F94
44081 (1147).exeC:\Users\admin\AppData\Local\Temp\1 (1147)executable
MD5:6248830267EB84498ECF95EE9E3BF3C9
SHA256:1A98ADA7A2BD8019F298EC60F56186E4EDC835BCFA8D73910AB40D432FD4407D
21081 (1147)C:\Users\admin\AppData\Local\Temp\tmpbinary
MD5:52A25BFEE0675E0121AB0E98CD8BBC56
SHA256:DC5DE493937D846192C34403EBF87EAA1CEFB6465E47AABC87B16D42662FE238
74041.exeC:\Users\admin\AppData\Roaming\1.battext
MD5:C2306AD97F7DE7AB02FCE7BC3ED61FF5
SHA256:81FDEF8025CE002C4811FE0E57B07F5A3A8400D8B3A181053C4489DC1B047CB5
7912FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2025-03-24.0844.7912.1.odlbinary
MD5:71316301F967FFCF48F9FEE40CCB9E9F
SHA256:3E35C55A8792F2C35457124198D9A0F386E0D523B18FAEB30E0E182ADBD6FC38
74041.exeC:\Users\admin\AppData\Local\VirtualStore\Windows:msou.exeexecutable
MD5:D1CCFEAFDE33D68DE6A142A358428237
SHA256:6D173A2C1221F4AA8FC159E8476E398BFAA27CDB4B371AC2AE0B60003785A27E
21081 (1147)C:\Users\admin\AppData\Roaming\1.exeexecutable
MD5:D1CCFEAFDE33D68DE6A142A358428237
SHA256:6D173A2C1221F4AA8FC159E8476E398BFAA27CDB4B371AC2AE0B60003785A27E
21081 (1147)C:\Users\admin\AppData\Roaming\kernel33.dllexecutable
MD5:EEAA667929C0415EA0B74B7B9E9F9C23
SHA256:723DB2A50BB3A7D0666B371721CBF37C9B08A516EAC6D0C6923BB639C692590E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
23
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2692
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7968
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7968
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2692
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2692
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.130
  • 20.190.159.0
  • 40.126.31.129
  • 40.126.31.0
  • 40.126.31.73
  • 20.190.159.129
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (1147)