Malware analysis Clash of Clans Gem Hack.exe Malicious activity

Add for printing

File name:	Clash of Clans Gem Hack.exe
Full analysis:	https://app.any.run/tasks/ab5528af-44bd-4183-a28f-604a96e3e2b1
Verdict:	Malicious activity
Analysis date:	April 09, 2025, 14:30:52
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	python
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (console) x86-64, for MS Windows, 7 sections
MD5:	0A684AE01B16B1158858933DC878CC75
SHA1:	7EF681159CA9F60E16601156A16CC3A5340C3277
SHA256:	AAE2F5B69D63E10DC09409EB89A2864DC8994AA35FC9DB50B08600A5952C4B30
SSDEEP:	98304:sxb2nfvvqeLnc1ZaDPHUFK/uXbQx2Uc9XLDbenkuA83wpYp2twryIUwt0LQ3FaHb:CKVydTyMNUfF4939W

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Changes the autorun value in the registry
  - Clash of Clans Gem Hack.exe (PID: 7316)
SUSPICIOUS
- The process drops C-runtime libraries
  - Clash of Clans Gem Hack.exe (PID: 7252)
- Application launched itself
  - Clash of Clans Gem Hack.exe (PID: 7252)
- Likely accesses (executes) a file from the Public directory
  - attrib.exe (PID: 7392)
  - attrib.exe (PID: 7416)
- Loads Python modules
  - Clash of Clans Gem Hack.exe (PID: 7316)
- Uses ATTRIB.EXE to modify file attributes
  - Clash of Clans Gem Hack.exe (PID: 7316)
- Executable content was dropped or overwritten
  - Clash of Clans Gem Hack.exe (PID: 7252)
- Process drops legitimate windows executable
  - Clash of Clans Gem Hack.exe (PID: 7252)
- Process drops python dynamic module
  - Clash of Clans Gem Hack.exe (PID: 7252)
- Starts CMD.EXE for commands execution
  - Clash of Clans Gem Hack.exe (PID: 7316)
- Uses TIMEOUT.EXE to delay execution
  - cmd.exe (PID: 7628)
- Executing commands from a ".bat" file
  - Clash of Clans Gem Hack.exe (PID: 7316)
INFO
- Checks supported languages
  - Clash of Clans Gem Hack.exe (PID: 7252)
  - Clash of Clans Gem Hack.exe (PID: 7316)
- Reads the computer name
  - Clash of Clans Gem Hack.exe (PID: 7252)
- The sample compiled with english language support
  - Clash of Clans Gem Hack.exe (PID: 7252)
- Create files in a temporary directory
  - Clash of Clans Gem Hack.exe (PID: 7252)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2025:04:09 14:25:37+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	14.42
CodeSize:	178688
InitializedDataSize:	153600
UninitializedDataSize:	-
EntryPoint:	0xc380
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows command line

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

135

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

7252

"C:\Users\admin\AppData\Local\Temp\Clash of Clans Gem Hack.exe"

C:\Users\admin\AppData\Local\Temp\Clash of Clans Gem Hack.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\clash of clans gem hack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

7260

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

Clash of Clans Gem Hack.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

7316

"C:\Users\admin\AppData\Local\Temp\Clash of Clans Gem Hack.exe"

C:\Users\admin\AppData\Local\Temp\Clash of Clans Gem Hack.exe

Clash of Clans Gem Hack.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\clash of clans gem hack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

7392

attrib +H C:\\Users\\Public\\Documents\\system32_update.pyw

C:\Windows\System32\attrib.exe

—

Clash of Clans Gem Hack.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Attribute Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll

7416

attrib +H C:\\Users\\Public\\Music\\audio_driver_updater.pyw

C:\Windows\System32\attrib.exe

—

Clash of Clans Gem Hack.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Attribute Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll

7628

cmd /c C:\Users\admin\AppData\Local\Temp\cleanup.bat

C:\Windows\System32\cmd.exe

—

Clash of Clans Gem Hack.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll

7652

timeout /t 2 /nobreak

C:\Windows\System32\timeout.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

timeout - pauses command processing

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

Add for printing

Total events

114

Read events

112

Write events

Delete events

Modification events


(PID) Process:	(7316) Clash of Clans Gem Hack.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	SystemUpdate
Value: "C:\Users\admin\AppData\Local\Temp\Clash of Clans Gem Hack.exe" "C:\\Users\\Public\\Documents\\system32_update.pyw"
(PID) Process:	(7316) Clash of Clans Gem Hack.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:	write	Name:	AudioDriver
Value: "C:\Users\admin\AppData\Local\Temp\Clash of Clans Gem Hack.exe" "C:\\Users\\Public\\Music\\audio_driver_updater.pyw"

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\_bz2.pyd		executable
		MD5:057325E89B4DB46E6B18A52D1A691CAA	SHA256:5BA872CAA7FCEE0F4FB81C6E0201CEED9BD92A3624F16828DD316144D292A869
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\api-ms-win-core-console-l1-1-0.dll		executable
		MD5:9F746F4F7D845F063FEA3C37DCEBC27C	SHA256:88ACE577A9C51061CB7D1A36BABBBEFA48212FADC838FFDE98FDFFF60DE18386
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\api-ms-win-core-kernel32-legacy-l1-1-1.dll		executable
		MD5:0C1CC0A54D4B38885E1B250B40A34A84	SHA256:A9B13A1CD1B8C19B0C6B4AFCD5BB0DD29C0E2288231AC9E6DB8510094CE68BA6
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\_lzma.pyd		executable
		MD5:3E73BC69EFB418E76D38BE5857A77027	SHA256:6F48E7EBA363CB67F3465A6C91B5872454B44FC30B82710DFA4A4489270CE95C
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\api-ms-win-core-file-l1-1-0.dll		executable
		MD5:9F45A47EBFD9D0629F4935764243DD5A	SHA256:1CA895ABA4E7435563A6B43E85EBA67A0F8C74AA6A6A94D0FC48FA35535E2585
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\_socket.pyd		executable
		MD5:69C4A9A654CF6D1684B73A431949B333	SHA256:8DAEFAFF53E6956F5AEA5279A7C71F17D8C63E2B0D54031C3B9E82FCB0FB84DB
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\api-ms-win-core-fibers-l1-1-0.dll		executable
		MD5:B5E2760C5A46DBEB8AE18C75F335707E	SHA256:91D249D7BC0E38EF6BCB17158B1FDC6DD8888DC086615C9B8B750B87E52A5FB3
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\api-ms-win-core-datetime-l1-1-0.dll		executable
		MD5:8F8EB9CB9E78E3A611BC8ACAEC4399CB	SHA256:1BD81DFD19204B44662510D9054852FB77C9F25C1088D647881C9B976CC16818
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\api-ms-win-core-file-l2-1-0.dll		executable
		MD5:E368A236F5676A3DA44E76870CD691C9	SHA256:93C624B366BA16C643FC8933070A26F03B073AD0CF7F80173266D67536C61989
7252	Clash of Clans Gem Hack.exe	C:\Users\admin\AppData\Local\Temp\_MEI72522\api-ms-win-core-fibers-l1-1-1.dll		executable
		MD5:050A30A687E7A2FA6F086A0DB89AA131	SHA256:FC9D86CEC621383EAB636EBC87DDD3F5C19A3CB2A33D97BE112C051D0B275429

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6544	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
7864	SIHClient.exe	GET	200	2.16.253.202:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
7864	SIHClient.exe	GET	200	2.16.253.202:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
2104	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
3216	svchost.exe	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
6544	svchost.exe	20.190.159.0:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6544	svchost.exe	2.17.190.73:80	ocsp.digicert.com	AKAMAI-AS	DE	whitelisted
2112	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
7864	SIHClient.exe	4.175.87.197:443	slscr.update.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
7864	SIHClient.exe	2.16.253.202:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

DNS requests

Domain	IP	Reputation
client.wns.windows.com	172.211.123.249	whitelisted
login.live.com	20.190.159.0 20.190.159.130 40.126.31.0 20.190.159.23 40.126.31.129 40.126.31.131 40.126.31.1 20.190.159.129	whitelisted
ocsp.digicert.com	2.17.190.73	whitelisted
settings-win.data.microsoft.com	40.127.240.158	whitelisted
slscr.update.microsoft.com	4.175.87.197	whitelisted
www.microsoft.com	2.16.253.202	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted
activation-v2.sls.microsoft.com	—	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

Clash of Clans Gem Hack.exe

0A684AE01B16B1158858933DC878CC75

7EF681159CA9F60E16601156A16CC3A5340C3277

AAE2F5B69D63E10DC09409EB89A2864DC8994AA35FC9DB50B08600A5952C4B30

98304:sxb2nfvvqeLnc1ZaDPHUFK/uXbQx2Uc9XLDbenkuA83wpYp2twryIUwt0LQ3FaHb:CKVydTyMNUfF4939W

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes the autorun value in the registry

SUSPICIOUS

The process drops C-runtime libraries

Application launched itself

Likely accesses (executes) a file from the Public directory

Loads Python modules

Uses ATTRIB.EXE to modify file attributes

Executable content was dropped or overwritten

Process drops legitimate windows executable

Process drops python dynamic module

Starts CMD.EXE for commands execution

Uses TIMEOUT.EXE to delay execution

Executing commands from a ".bat" file

INFO

Checks supported languages

Reads the computer name

The sample compiled with english language support

Create files in a temporary directory

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings