File name:

X1SX.exe

Full analysis: https://app.any.run/tasks/d1ae9e96-48aa-4551-832b-5bb58397d4df
Verdict: Malicious activity
Analysis date: June 13, 2025, 03:15:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

C286118DDD5ABE7A7325D34E22FF722B

SHA1:

B59E99D0F7432A00591D3E060A773441867FE0F8

SHA256:

AA749D399EA42A429468BC0CBE9DECCB0CAE199CF62DFABD46D0EFEDD0C8B341

SSDEEP:

98304:EhKB2bwMCVrwRMlgo606iLTVDTjia9Faw3mzUNzlHPs5gwHFf7JONkCLmYDEC05g:UfTk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • un.exe (PID: 6672)
      • un.exe (PID: 1096)
      • un.exe (PID: 3576)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • X1SX.exe (PID: 2680)
      • irsetup.exe (PID: 6224)

    • Executable content was dropped or overwritten

      • X1SX.exe (PID: 2680)
      • irsetup.exe (PID: 6224)
      • un.exe (PID: 3576)
      • iusb3mon.exe (PID: 7100)

    • Creates file in the systems drive root

      • conhost.exe (PID: 1752)
      • un.exe (PID: 6672)
      • irsetup.exe (PID: 6224)
      • conhost.exe (PID: 3048)
      • un.exe (PID: 1096)
      • conhost.exe (PID: 3668)
      • un.exe (PID: 3576)
      • cmd.exe (PID: 856)
      • iusb3mon.exe (PID: 7100)

    • Connects to unusual port

      • iusb3mon.exe (PID: 7100)

    • Creates or modifies Windows services

      • iusb3mon.exe (PID: 7100)

    • There is functionality for taking screenshot (YARA)

      • iusb3mon.exe (PID: 7100)

    • Starts itself from another location

      • iusb3mon.exe (PID: 7100)

    • Starts CMD.EXE for commands execution

      • iusb3mon.exe (PID: 7100)

  • INFO

    • Checks supported languages

      • X1SX.exe (PID: 2680)
      • irsetup.exe (PID: 6224)
      • un.exe (PID: 6672)
      • un.exe (PID: 1096)
      • un.exe (PID: 3576)
      • iusb3mon.exe (PID: 7100)
      • microsoft.exe (PID: 1720)

    • Reads the computer name

      • X1SX.exe (PID: 2680)
      • irsetup.exe (PID: 6224)
      • iusb3mon.exe (PID: 7100)
      • microsoft.exe (PID: 1720)

    • The sample compiled with english language support

      • X1SX.exe (PID: 2680)
      • un.exe (PID: 3576)
      • iusb3mon.exe (PID: 7100)

    • Create files in a temporary directory

      • X1SX.exe (PID: 2680)
      • irsetup.exe (PID: 6224)
      • iusb3mon.exe (PID: 7100)
      • microsoft.exe (PID: 1720)

    • Process checks computer location settings

      • X1SX.exe (PID: 2680)
      • irsetup.exe (PID: 6224)

    • Creates files in the program directory

      • irsetup.exe (PID: 6224)
      • un.exe (PID: 6672)
      • un.exe (PID: 1096)
      • iusb3mon.exe (PID: 7100)

    • The sample compiled with chinese language support

      • irsetup.exe (PID: 6224)
      • iusb3mon.exe (PID: 7100)

    • Reads the machine GUID from the registry

      • iusb3mon.exe (PID: 7100)
      • microsoft.exe (PID: 1720)

    • UPX packer has been detected

      • iusb3mon.exe (PID: 7100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:06:14 16:16:10+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 22528
InitializedDataSize: 48128
UninitializedDataSize: -
EntryPoint: 0x29e1
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 9.1.0.0
ProductVersionNumber: 9.1.0.0
FileFlagsMask: 0x003f
FileFlags: Private build
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Created with Setup Factory
FileDescription: Setup Application
FileVersion: 9.1.0.0
InternalName: suf_launch
LegalCopyright: Setup Engine Copyright © 2004-2012 Indigo Rose Corporation
LegalTrademarks: Setup Factory is a trademark of Indigo Rose Corporation.
OriginalFileName: suf_launch.exe
ProductName: Setup Factory Runtime
ProductVersion: 9.1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
13
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start x1sx.exe irsetup.exe un.exe no specs conhost.exe no specs un.exe no specs conhost.exe no specs un.exe conhost.exe no specs iusb3mon.exe microsoft.exe no specs cmd.exe no specs conhost.exe no specs x1sx.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856cmd /c echo.>c:\inst.iniC:\Windows\SysWOW64\cmd.exe—iusb3mon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1096"C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar ziliao.jpg C:\ProgramData\Microsoft\Program\C:\un.exe—irsetup.exe
User:
admin
Company:
WinRAR 压缩管理软件中文版
Integrity Level:
HIGH
Description:
命令行 RAR
Exit code:
0
Version:
5.20.0
Modules
Images
c:\un.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1296"C:\Users\admin\Desktop\X1SX.exe" C:\Users\admin\Desktop\X1SX.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup Application
Exit code:
3221226540
Version:
9.1.0.0
Modules
Images
c:\users\admin\desktop\x1sx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1720C:\ProgramData\Microsoft\microsoft.exeC:\ProgramData\Microsoft\microsoft.exe—iusb3mon.exe
User:
admin
Company:
Indigo Rose Corporation
Integrity Level:
HIGH
Description:
TrueUpdate Client
Version:
3.8.0.0
Modules
Images
c:\programdata\microsoft\microsoft.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—un.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2680"C:\Users\admin\Desktop\X1SX.exe" C:\Users\admin\Desktop\X1SX.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup Application
Exit code:
0
Version:
9.1.0.0
Modules
Images
c:\users\admin\desktop\x1sx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3048\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—un.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3576"C:\un.exe" x -o+ -ppoiuytrewq C:\ProgramData\Data\upx.rar iusb3mon.exe iusb3mon.dat C:\Microsoft\C:\un.exe
irsetup.exe
User:
admin
Company:
WinRAR 压缩管理软件中文版
Integrity Level:
HIGH
Description:
命令行 RAR
Exit code:
0
Version:
5.20.0
Modules
Images
c:\un.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
3668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—un.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 557
Read events
1 554
Write events
3
Delete events
0

Modification events

(PID) Process:(7100) iusb3mon.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdefgh
Operation:writeName:Groupfenzhu
Value:
(PID) Process:(7100) iusb3mon.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdefgh
Operation:writeName:Remarkbeizhu
Value:
(PID) Process:(7100) iusb3mon.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Cdefgh
Operation:writeName:MarkTime
Value:
2025-06-13 03:15
Executable files
6
Suspicious files
11
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
6224irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.datbinary
MD5:8E62A76EC23473BD18EE362287A87127
SHA256:5A21C32E508AE2B08745CC8CAD22E5A81978B5E9AF308C513A7D07B26FCAAC53
2680X1SX.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exeexecutable
MD5:5FDD43E3AB3CE33ECD67B7FCEF9C6B00
SHA256:98AE390BBE7652CADF1AA618DD269D271AF4CE1170A038A198B5B374F94FC84A
6224irsetup.exeC:\Users\admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPGimage
MD5:3220A6AEFB4FC719CC8849F060859169
SHA256:988CF422CBF400D41C48FBE491B425A827A1B70691F483679C1DF02FB9352765
7100iusb3mon.exeC:\Users\admin\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG2.JPGimage
MD5:E39405E85E09F64CCDE0F59392317DD3
SHA256:CFD9677E1C0E10B1507F520C4ECD40F68DB78154C0D4E6563403D540F3BF829F
7100iusb3mon.exeC:\ProgramData\Microsoft\microsoft.exeexecutable
MD5:E79F996B69D7FA546ED9235FDC0EE06D
SHA256:EC7FCD3F4533D3514A9A42CBC41C40358EEA47255BAB1171146A5CCEBAF20990
7100iusb3mon.exeC:\Users\admin\AppData\Local\Temp\_ir_tu2_temp_0\_TUProjDT.dattext
MD5:67BF1F80834081FC794C6ED1F7C2FED5
SHA256:54FD2361602E82DB016D6EA62FBADC3984B566399DFAAC7E0A1181E4C70B90C2
7100iusb3mon.exeC:\Users\admin\AppData\Local\Temp\Xlpd 5 Update Log.txttext
MD5:4E7D22673326DFB9D2E61645CDAC08C5
SHA256:FBACF7E5A473AE59DEFC85D1E90947D1304064667D881E39B7E8169EF64EC59B
7100iusb3mon.exeC:\Users\admin\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG1.JPGimage
MD5:E39405E85E09F64CCDE0F59392317DD3
SHA256:CFD9677E1C0E10B1507F520C4ECD40F68DB78154C0D4E6563403D540F3BF829F
7100iusb3mon.exeC:\Users\admin\AppData\Local\Temp\_ir_tu2_temp_0\IRIMG3.JPGbinary
MD5:9CA19B0ABBD0BBF8C01D835AABE36C0E
SHA256:568BA3C29FFB6BC581602235D46210989831B00689F369B965ABBA061A042C02
7100iusb3mon.exeC:\ProgramData\Microsoft\templateWatch.datbinary
MD5:38A3809EB8817155921D68C0BB5BD7EB
SHA256:CA9AF5DFE524DF77731FD7165BF3F7E61CE257D6A7AED041DEC7722FBB14C358
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
15
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2764
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5712
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5712
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4380
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7100
iusb3mon.exe
118.107.42.181:36061
—
BGPNET Global ASN
SG
unknown
2764
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2764
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.131
  • 40.126.32.138
  • 20.190.160.17
  • 20.190.160.2
  • 20.190.160.132
  • 40.126.32.136
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 2.23.181.156
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
Process
Message
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
iusb3mon.exe
Thread running...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
X1SX.exe