File name:

Explorer.exe

Full analysis: https://app.any.run/tasks/9756d1b5-03a7-4a03-97fa-7857e9ffe23a
Verdict: Malicious activity
Analysis date: June 15, 2021, 22:16:13
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1EB40158DDEE938B5E40AF9E66C3E1B7

SHA1:

651768E6150E44BA75759EA0A3E9E5AC2BBD16F8

SHA256:

AD6E57C05BCDD11AFDE9D328FBFF56CBDCDF27DE70ADF027912689D7744906E1

SSDEEP:

384:qNcb2rfmHbXRRVuuniM1thLLp8ttXO/Bmkzr8AxhoSrgGUd+zsbCRw3TD30sXJIH:qNMHlxv1TLVEamDSrgt3bCRGx5+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Explorer.exe (PID: 3844)

    • Changes the login/logoff helper path in the registry

      • EXPLORER.EXE (PID: 2476)

    • Changes the autorun value in the registry

      • EXPLORER.EXE (PID: 2476)

  • SUSPICIOUS

    • Starts itself from another location

      • Explorer.exe (PID: 3844)

    • Creates executable files which already exist in Windows

      • Explorer.exe (PID: 3844)

    • Creates files in the Windows directory

      • Explorer.exe (PID: 3844)

    • Executable content was dropped or overwritten

      • Explorer.exe (PID: 3844)

    • Drops a file with too old compile date

      • Explorer.exe (PID: 3844)

  • INFO

    • Manual execution by user

      • Explorer.exe (PID: 3844)
      • explorer.exe (PID: 1536)
      • regedit.exe (PID: 3392)
      • regedit.exe (PID: 3840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (84.4)
.dll | Win32 Dynamic Link Library (generic) (6.7)
.exe | Win32 Executable (generic) (4.6)
.exe | Generic Win/DOS Executable (2)
.exe | DOS Executable Generic (2)

EXIF

EXE

OriginalFileName: EXPLORER.EXE
InternalName: EXPLORER
ProductVersion: 6.2900.2180
FileVersion: 6.2900.2180
ProductName: Microsoft(R) Windows(R) Operating System
LegalCopyright: (C) Microsoft Corporation. All rights reserved.
FileDescription: Windows Explorer
CompanyName: Microsoft Corporation
CharacterSet: Unicode
LanguageCode: Chinese (Simplified)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 6.2900.0.2180
FileVersionNumber: 6.2900.0.2180
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6.29
OSVersion: 4
EntryPoint: 0x16f0
UninitializedDataSize: -
InitializedDataSize: 8192
CodeSize: 24576
LinkerVersion: 6
PEType: PE32
TimeStamp: 2006:10:25 02:32:34+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Oct-2006 00:32:34
Detected languages:
  • Chinese - PRC
CompanyName: Microsoft Corporation
FileDescription: Windows Explorer
LegalCopyright: (C) Microsoft Corporation. All rights reserved.
ProductName: Microsoft(R) Windows(R) Operating System
FileVersion: 6.2900.2180
ProductVersion: 6.2900.2180
InternalName: EXPLORER
OriginalFilename: EXPLORER.EXE

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C0

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 25-Oct-2006 00:32:34
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000055B0
0x00006000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.28606
.data
0x00007000
0x00000B2C
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00008000
0x000008AC
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.25086

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.49824
856
Unicode (UTF 16LE)
Chinese - PRC
RT_VERSION
30001
2.6611
744
Unicode (UTF 16LE)
UNKNOWN
RT_ICON
30002
2.32253
296
Unicode (UTF 16LE)
UNKNOWN
RT_ICON

Imports

MSVBVM60.DLL
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start explorer.exe no specs explorer.exe no specs explorer.exe explorer.exe regedit.exe no specs regedit.exe

Process information

PID
CMD
Path
Indicators
Parent process
1536"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2256"C:\Users\admin\AppData\Local\Temp\Explorer.exe" C:\Users\admin\AppData\Local\Temp\Explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.2900.2180
Modules
Images
c:\users\admin\appdata\local\temp\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2476C:\Windows\system32\EXPLORER.EXEC:\Windows\system32\EXPLORER.EXE
Explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
0
Version:
6.2900.2180
Modules
Images
c:\windows\system32\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3392"C:\Windows\regedit.exe" C:\Windows\regedit.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
3840"C:\Windows\regedit.exe" C:\Windows\regedit.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3844"C:\Users\admin\AppData\Local\Temp\Explorer.exe" C:\Users\admin\AppData\Local\Temp\Explorer.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
0
Version:
6.2900.2180
Modules
Images
c:\users\admin\appdata\local\temp\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
1 215
Read events
30
Write events
1 185
Delete events
0

Modification events

(PID) Process:(2476) EXPLORER.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:wsctf.exe
Value:
wsctf.exe
(PID) Process:(2476) EXPLORER.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:EXPLORER.EXE
Value:
EXPLORER.EXE
(PID) Process:(2476) EXPLORER.EXEKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Userinit
Value:
userinit.exe,EXPLORER.EXE
(PID) Process:(3840) regedit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
Operation:writeName:View
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF85000000330000004504000028020000D600000078000000780000007F01000001000000
(PID) Process:(3840) regedit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
Operation:writeName:FindFlags
Value:
14
(PID) Process:(3840) regedit.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Applets\Regedit
Operation:writeName:LastKey
Value:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Executable files
1
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2256Explorer.exeC:\Users\admin\AppData\Local\Temp\~DF493A4ED3706D8A80.TMP —
MD5:—
SHA256:—
3844Explorer.exeC:\Users\admin\AppData\Local\Temp\~DF98E6EC80FE791CAE.TMP —
MD5:—
SHA256:—
3844Explorer.exeC:\Windows\system32\Explorer.exeexecutable
MD5:1EB40158DDEE938B5E40AF9E66C3E1B7
SHA256:AD6E57C05BCDD11AFDE9D328FBFF56CBDCDF27DE70ADF027912689D7744906E1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Explorer.exe