File name:

pivot_v5-2.exe

Full analysis: https://app.any.run/tasks/2f07261c-de08-48b1-a547-3bec0de6a89f
Verdict: Malicious activity
Analysis date: March 23, 2024, 09:44:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

F577FC68521D8CA399EDD72AC913255D

SHA1:

8FF05351F4D8F3C4C80ED4985590E8AB1B989EA1

SHA256:

AE9E4974652DC907C017D94D511F1C4CBAB72B8C440C052F38ACAC86279EB509

SSDEEP:

24576:9hAEbPGRZyzvxuQ49949949IHyzvALayzvKzF:9hAEbPGRZyzvxuQ49949949IHyzvALaH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pivot_v5-2.exe (PID: 2892)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • pivot_v5-2.exe (PID: 2892)

    • Reads the Internet Settings

      • pivot_v5-2.exe (PID: 2892)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2744)

    • Reads settings of System Certificates

      • pivot_v5-2.exe (PID: 2892)

    • Reads security settings of Internet Explorer

      • pivot_v5-2.exe (PID: 2892)

    • Adds/modifies Windows certificates

      • pivot_v5-2.exe (PID: 2892)

  • INFO

    • Checks supported languages

      • pivot_v5-2.exe (PID: 2892)
      • pivot.exe (PID: 2804)

    • Reads the computer name

      • pivot_v5-2.exe (PID: 2892)
      • pivot.exe (PID: 2804)

    • Reads the machine GUID from the registry

      • pivot_v5-2.exe (PID: 2892)

    • Reads Environment values

      • pivot_v5-2.exe (PID: 2892)

    • Creates files or folders in the user directory

      • pivot.exe (PID: 2804)

    • Reads the software policy settings

      • pivot_v5-2.exe (PID: 2892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:15 17:46:37+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 613376
InitializedDataSize: 52224
UninitializedDataSize: -
EntryPoint: 0x97bc2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.92.3.8643
ProductVersionNumber: 1.92.3.8643
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Motus Software
CompanyName: -
FileDescription: Pivot Animator
FileVersion: 1.92.3.8643
InternalName: Pivot.exe
LegalCopyright: Copyright Pіvotstіck
LegalTrademarks: -
OriginalFileName: Pivot.exe
ProductName: Pіvotstіck
ProductVersion: 1.92.3.8643
AssemblyVersion: 1.92.3.8643
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pivot_v5-2.exe regsvr32.exe no specs pivot.exe no specs pivot_v5-2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe" C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Pivot Animator
Exit code:
3221226540
Version:
1.92.3.8643
Modules
Images
c:\users\admin\appdata\local\temp\pivot_v5-2.exe
c:\windows\system32\ntdll.dll
2744"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Pivot Animator v5\STKPreview.dll"C:\Windows\System32\regsvr32.exe—pivotsetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2804"C:\Program Files\Pivot Animator v5\pivot.exe" C:\Program Files\Pivot Animator v5\pivot.exe—pivot_v5-2.exe
User:
admin
Company:
Motusoft GmbH
Integrity Level:
HIGH
Description:
Pivot Animator
Version:
5.2.5.0
Modules
Images
c:\program files\pivot animator v5\pivot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2892"C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe" C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Pivot Animator
Exit code:
0
Version:
1.92.3.8643
Modules
Images
c:\users\admin\appdata\local\temp\pivot_v5-2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 786
Read events
7 728
Write events
51
Delete events
7

Modification events

(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names
Operation:writeName:GZiCjMdm0rtP3mbrZ8cDxD2mup6IYHlLzc7YGRHjqDfmBdjhvpVFH80CP68yXHTCBCXWwpw3Hjv1E627l29qtOGKQJF9jJybvM0cuFuS5xZDyzeYZJlcFL
Value:
2892
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:FileTracingMask
Value:
Executable files
0
Suspicious files
40
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\archer.pivbinary
MD5:55EE1CC860856D8EDFB175139FBC0CD6
SHA256:1F7255A15E09DADB3A35E9A07B60DC48C681605DE35A7473A5FEF5BFC75BDD35
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\deformation_demo.pivbinary
MD5:B810F7A219611F4CE7C078005683474B
SHA256:2ED6A7C53C65EC762D9D9B0EBADF64E02E22B5C5A0F507627D062DB661A00B68
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\dominos.pivbinary
MD5:08557C8776D979A1143CC674A5FAFB32
SHA256:D8E45CDCD53EC9AD56FBA89575C66701B01E009C4D371DB092DEECB1604A087F
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\tower_fall.pivbinary
MD5:62B0D70606A4007449FE4B874FE5439A
SHA256:1AF0FEF50894C5AFF61C2A521C872715105F25D2039AA37B1A048AA628373CFF
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\walking.pivbinary
MD5:B2EDA498C427624B00B8DD1A03939AFA
SHA256:525E4AD75A58BA9D20C3950878F27B2C55277E4D59757AA980A5B6260D2F16D0
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\run.pivbinary
MD5:8AF3F2F0668A79696FD82F8BE2EDA937
SHA256:06CD354FD29A8D1A3EA697D0BF9D5B8F29CF413554CFD995B2111BDD21C1C4DA
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\tumble.pivbinary
MD5:F93B4710781FA8957A8CC3C86929025A
SHA256:C57EBE624A4CF08EB72783F7AA5F7F1F511FCEA84791908BE722398A69D8F7B3
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\text_bike.pivbinary
MD5:DE938ED1FCA12777739E6720AA846370
SHA256:4F83A5BA94AA5FEFFF5FAAA6747077D424792023407E7795D68E98ED91E72326
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\pythagoras proof.pivbinary
MD5:12AE5F64729CB7EDB9B1713DD53DA83D
SHA256:933073BE25C12E6D089AE9413230630804DD830742EE2E8114D621278055816B
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\run_demo.pivbinary
MD5:42803149C1F956A427F150D0905BE563
SHA256:F2783753894AD376681F370247314C1377FF6724145501635C7A7C8682155023
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2892
pivot_v5-2.exe
52.222.250.96:443
d20ozt0ryq20yh.cloudfront.net
AMAZON-02
US
unknown
2184
svchost.exe
239.255.255.250:1900
—
—
—
unknown
856
svchost.exe
52.222.250.96:443
d20ozt0ryq20yh.cloudfront.net
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
d20ozt0ryq20yh.cloudfront.net
  • 52.222.250.96
  • 52.222.250.5
  • 52.222.250.9
  • 52.222.250.139
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pivot_v5-2.exe