File name:

a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe

Full analysis: https://app.any.run/tasks/eff1e268-8e8b-475e-8321-246b12576213
Verdict: Malicious activity
Threats:

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Malware Trends Tracker     >>>
Analysis date: September 18, 2024, 23:43:15
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
sality
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

98157242119050A31F3206A6BC672B40

SHA1:

5D2C2D43D422F3F3F7AFCD0656D1B8962C24300A

SHA256:

A870C320630662DC799591A755E192FDADCB7AC52CAF9781F52AE3ED5FB78660

SSDEEP:

98304:n0Q69xPmHe383KEgdIHKiIsICA6vksfO95xLgWIt+Ls/ZVKXuQRGhZenyLUK3eYo:uJLpx4R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • TiWorker.exe (PID: 3908)
      • VCREDI~2.EXE (PID: 6316)
      • a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe (PID: 2492)

  • INFO

    • UPX packer has been detected

      • a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe (PID: 2492)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | MS generic-sfx Cabinet File Unpacker (32/64bit MSCFU) (48.1)
.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (41.6)
.exe | Win32 Executable MS Visual C++ (generic) (4.2)
.exe | Win64 Executable (generic) (3.7)
.dll | Win32 Dynamic Link Library (generic) (0.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:03:25 07:08:18+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7.1
CodeSize: 36864
InitializedDataSize: 3153408
UninitializedDataSize: -
EntryPoint: 0x5d3c
OSVersion: 5.2
ImageVersion: 5.2
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.0.3790.0
ProductVersionNumber: 6.0.3790.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 6.00.3790.0 (srv03_rtm.030324-2048)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.00.3790.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
10
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start THREAT a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660n.exe vcredi~2.exe no specs vcredi~2.exe msiexec.exe no specs msiexec.exe vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe no specs tiworker.exe

Process information

PID
CMD
Path
Indicators
Parent process
1432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2328C:\Windows\syswow64\MsiExec.exe -Embedding 72B537CE09411B952EA2E5F7DC54EEA7C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2492"C:\Users\admin\Desktop\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe" C:\Users\admin\Desktop\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
6.00.3790.0 (srv03_rtm.030324-2048)
Modules
Images
c:\users\admin\desktop\a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660n.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
3908C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Version:
10.0.19041.3989 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
6284msiexec /i vcredist.msiC:\Windows\SysWOW64\msiexec.exe—VCREDI~2.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6288C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6316C:\Users\admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE
a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IExpress Setup
Exit code:
0
Version:
2.0.50727.762
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\vcredi~2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6532C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11C:\Windows\System32\SrTasks.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6652C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6776C:\Users\admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXE—a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IExpress Setup
Exit code:
3221226540
Version:
2.0.50727.762
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\vcredi~2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
5 029
Read events
4 177
Write events
770
Delete events
82

Modification events

(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UpdatesDisableNotify
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UacDisableNotify
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(2492) a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc
Operation:writeName:FirewallOverride
Value:
1
Executable files
62
Suspicious files
47
Text files
78
Unknown types
19

Dropped files

PID
Process
Filename
Type
6316VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Microsoft.VC80.CRT.catbinary
MD5:B7FDCFED2BAA76AFD68FDDFA59976527
SHA256:07AEF10E350CC2F9F10CE8EEDBC3A539E26A35F3E0805CDCA9CF4A84000B8AF1
6316VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Microsoft.VC80.DebugCRT.catbinary
MD5:039B9CE25053DA4812547496875D852E
SHA256:C7B568ED1F151417F70125E6E48C2F4F15987DB594C64753A3CAA4190AE7846F
6316VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP001.TMP\policy.8.00.Microsoft.VC80.OpenMP.catbinary
MD5:F78AAD519D5E012F8A432A8BDC05566C
SHA256:4D3C99C7E42E790930C9CA795777D81B988E287B485FDB270A6C6F71D2C861B2
2492a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\VCREDI~2.EXEexecutable
MD5:F6F02ACC9F12ED50752A46D6D604366C
SHA256:9B8E03F752EDFFBB99EC66A296854EB0CDEA242B3B0D2D1C4971519F065FDE3B
6288msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6316VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP001.TMP\policy.8.00.Microsoft.VC80.DebugMFC.catcat
MD5:32C313B88853848E833141741398B283
SHA256:A15B3320774073E144166CCBCF0942153A4CD71270C520AEF3253CE8228DDE40
6316VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP001.TMP\vcredis1.cabcompressed
MD5:AAE3979B3284A81600EE6C53B9FACEB1
SHA256:B02B597C8F40C3E7EB8A0F341F1DEB31EE067F05E0FE2C35F95FE0D048EA7CEF
6316VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP001.TMP\Microsoft.VC80.ATL.catbinary
MD5:E14F8AB0F1AC2F1770C96279D69B3A0F
SHA256:D854C591D65D81091875A75879D6BA1CDBFB6BCD969ABC11DB5DAC21D9E6BC6E
6316VCREDI~2.EXEC:\Users\admin\AppData\Local\Temp\IXP001.TMP\policy.8.00.Microsoft.VC80.DebugCRT.catbinary
MD5:753C0382806F00242E525968FCAD3DCB
SHA256:7D235CAC362D1A4EAC17C8E336FFC7F4AF20327444D76C4C37C07D140FC7ECDD
2492a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exeC:\Windows\system.inibinary
MD5:7B1B0B6BE247145603FFA64088BE149C
SHA256:24B2990AFAF1FD23E96648DFBE2FBE0783DE86F569FD0D615C333425987F0407
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
34
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5172
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7072
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2576
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2576
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5172
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2976
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.42.73.30:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5172
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5172
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.2
  • 40.126.31.71
  • 20.190.159.23
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a870c320630662dc799591a755e192fdadcb7ac52caf9781f52ae3ed5fb78660N.exe