File name:

pivot_v5-2.exe

Full analysis: https://app.any.run/tasks/2f07261c-de08-48b1-a547-3bec0de6a89f
Verdict: Malicious activity
Analysis date: March 23, 2024, 09:44:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

F577FC68521D8CA399EDD72AC913255D

SHA1:

8FF05351F4D8F3C4C80ED4985590E8AB1B989EA1

SHA256:

AE9E4974652DC907C017D94D511F1C4CBAB72B8C440C052F38ACAC86279EB509

SSDEEP:

24576:9hAEbPGRZyzvxuQ49949949IHyzvALayzvKzF:9hAEbPGRZyzvxuQ49949949IHyzvALaH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pivot_v5-2.exe (PID: 2892)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • pivot_v5-2.exe (PID: 2892)

    • Reads the Internet Settings

      • pivot_v5-2.exe (PID: 2892)

    • Reads security settings of Internet Explorer

      • pivot_v5-2.exe (PID: 2892)

    • Checks Windows Trust Settings

      • pivot_v5-2.exe (PID: 2892)

    • Adds/modifies Windows certificates

      • pivot_v5-2.exe (PID: 2892)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2744)

  • INFO

    • Reads the computer name

      • pivot_v5-2.exe (PID: 2892)
      • pivot.exe (PID: 2804)

    • Checks supported languages

      • pivot_v5-2.exe (PID: 2892)
      • pivot.exe (PID: 2804)

    • Reads Environment values

      • pivot_v5-2.exe (PID: 2892)

    • Reads the machine GUID from the registry

      • pivot_v5-2.exe (PID: 2892)

    • Reads the software policy settings

      • pivot_v5-2.exe (PID: 2892)

    • Creates files or folders in the user directory

      • pivot.exe (PID: 2804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:15 17:46:37+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 613376
InitializedDataSize: 52224
UninitializedDataSize: -
EntryPoint: 0x97bc2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.92.3.8643
ProductVersionNumber: 1.92.3.8643
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Motus Software
CompanyName: -
FileDescription: Pivot Animator
FileVersion: 1.92.3.8643
InternalName: Pivot.exe
LegalCopyright: Copyright Pіvotstіck
LegalTrademarks: -
OriginalFileName: Pivot.exe
ProductName: Pіvotstіck
ProductVersion: 1.92.3.8643
AssemblyVersion: 1.92.3.8643
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pivot_v5-2.exe regsvr32.exe no specs pivot.exe no specs pivot_v5-2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe" C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Pivot Animator
Exit code:
3221226540
Version:
1.92.3.8643
Modules
Images
c:\users\admin\appdata\local\temp\pivot_v5-2.exe
c:\windows\system32\ntdll.dll
2744"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Pivot Animator v5\STKPreview.dll"C:\Windows\System32\regsvr32.exe—pivotsetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2804"C:\Program Files\Pivot Animator v5\pivot.exe" C:\Program Files\Pivot Animator v5\pivot.exe—pivot_v5-2.exe
User:
admin
Company:
Motusoft GmbH
Integrity Level:
HIGH
Description:
Pivot Animator
Version:
5.2.5.0
Modules
Images
c:\program files\pivot animator v5\pivot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2892"C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe" C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Pivot Animator
Exit code:
0
Version:
1.92.3.8643
Modules
Images
c:\users\admin\appdata\local\temp\pivot_v5-2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 786
Read events
7 728
Write events
51
Delete events
7

Modification events

(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names
Operation:writeName:GZiCjMdm0rtP3mbrZ8cDxD2mup6IYHlLzc7YGRHjqDfmBdjhvpVFH80CP68yXHTCBCXWwpw3Hjv1E627l29qtOGKQJF9jJybvM0cuFuS5xZDyzeYZJlcFL
Value:
2892
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:FileTracingMask
Value:
Executable files
0
Suspicious files
40
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\tower_fall.pivbinary
MD5:62B0D70606A4007449FE4B874FE5439A
SHA256:1AF0FEF50894C5AFF61C2A521C872715105F25D2039AA37B1A048AA628373CFF
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\archer.pivbinary
MD5:55EE1CC860856D8EDFB175139FBC0CD6
SHA256:1F7255A15E09DADB3A35E9A07B60DC48C681605DE35A7473A5FEF5BFC75BDD35
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\gear wheels.pivbinary
MD5:0DB372AE4AF1F4DF6A104DC98D9ACF0A
SHA256:5AB8F2911C6C7610729134A1543926B8C4C4964C080DA9FDC3AD35A27626CF99
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\cursor.pivbinary
MD5:2E923D0F7F805C9ACB390A85A782D49C
SHA256:5EAF90001D8E3B867473137E904AF9BAF29A0CB6DBA41CAA9242A368C28D0C83
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\horse_revenge.pivbinary
MD5:834BB56ECE2EC9942D38013D3BB60A18
SHA256:703046DD6742DC3E04113EF1C2BEB8547C0F42501549372B8A17F954ACE2B5A5
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\text_abc.pivbinary
MD5:E90984F43F77778062A574BAEFFC3D56
SHA256:198D25DDC7FE0C87166AA6225811BE28B341DF8493404D5F32247B25774BC5EE
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\text_speech_bubble.pivbinary
MD5:C0DA29C6C68E6B07B3C3663BCCDEF12F
SHA256:A98E443C17047E009CE0B40D868597B49DBD09CC64F1A73991C59DFDDC1CD2EC
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\text_bike.pivbinary
MD5:DE938ED1FCA12777739E6720AA846370
SHA256:4F83A5BA94AA5FEFFF5FAAA6747077D424792023407E7795D68E98ED91E72326
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\tween_demo.pivbinary
MD5:75E011D607A4FE83E19C858F68D09709
SHA256:822610840DC2DA27AE1587916BEA90AA731B1CC7A99210E5FC91C27D2DB0973A
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\walking.pivbinary
MD5:B2EDA498C427624B00B8DD1A03939AFA
SHA256:525E4AD75A58BA9D20C3950878F27B2C55277E4D59757AA980A5B6260D2F16D0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2892
pivot_v5-2.exe
52.222.250.96:443
d20ozt0ryq20yh.cloudfront.net
AMAZON-02
US
unknown
2184
svchost.exe
239.255.255.250:1900
—
—
—
unknown
856
svchost.exe
52.222.250.96:443
d20ozt0ryq20yh.cloudfront.net
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
d20ozt0ryq20yh.cloudfront.net
  • 52.222.250.96
  • 52.222.250.5
  • 52.222.250.9
  • 52.222.250.139
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pivot_v5-2.exe