File name:

pivot_v5-2.exe

Full analysis: https://app.any.run/tasks/2f07261c-de08-48b1-a547-3bec0de6a89f
Verdict: Malicious activity
Analysis date: March 23, 2024, 09:44:22
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

F577FC68521D8CA399EDD72AC913255D

SHA1:

8FF05351F4D8F3C4C80ED4985590E8AB1B989EA1

SHA256:

AE9E4974652DC907C017D94D511F1C4CBAB72B8C440C052F38ACAC86279EB509

SSDEEP:

24576:9hAEbPGRZyzvxuQ49949949IHyzvALayzvKzF:9hAEbPGRZyzvxuQ49949949IHyzvALaH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pivot_v5-2.exe (PID: 2892)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • pivot_v5-2.exe (PID: 2892)

    • Reads the Internet Settings

      • pivot_v5-2.exe (PID: 2892)

    • Reads settings of System Certificates

      • pivot_v5-2.exe (PID: 2892)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2744)

    • Checks Windows Trust Settings

      • pivot_v5-2.exe (PID: 2892)

    • Adds/modifies Windows certificates

      • pivot_v5-2.exe (PID: 2892)

  • INFO

    • Reads Environment values

      • pivot_v5-2.exe (PID: 2892)

    • Checks supported languages

      • pivot_v5-2.exe (PID: 2892)
      • pivot.exe (PID: 2804)

    • Reads the machine GUID from the registry

      • pivot_v5-2.exe (PID: 2892)

    • Reads the computer name

      • pivot_v5-2.exe (PID: 2892)
      • pivot.exe (PID: 2804)

    • Reads the software policy settings

      • pivot_v5-2.exe (PID: 2892)

    • Creates files or folders in the user directory

      • pivot.exe (PID: 2804)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:15 17:46:37+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 613376
InitializedDataSize: 52224
UninitializedDataSize: -
EntryPoint: 0x97bc2
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.92.3.8643
ProductVersionNumber: 1.92.3.8643
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Motus Software
CompanyName: -
FileDescription: Pivot Animator
FileVersion: 1.92.3.8643
InternalName: Pivot.exe
LegalCopyright: Copyright Pіvotstіck
LegalTrademarks: -
OriginalFileName: Pivot.exe
ProductName: Pіvotstіck
ProductVersion: 1.92.3.8643
AssemblyVersion: 1.92.3.8643
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pivot_v5-2.exe regsvr32.exe no specs pivot.exe no specs pivot_v5-2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe" C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Pivot Animator
Exit code:
3221226540
Version:
1.92.3.8643
Modules
Images
c:\users\admin\appdata\local\temp\pivot_v5-2.exe
c:\windows\system32\ntdll.dll
2744"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Pivot Animator v5\STKPreview.dll"C:\Windows\System32\regsvr32.exe—pivotsetup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2804"C:\Program Files\Pivot Animator v5\pivot.exe" C:\Program Files\Pivot Animator v5\pivot.exe—pivot_v5-2.exe
User:
admin
Company:
Motusoft GmbH
Integrity Level:
HIGH
Description:
Pivot Animator
Version:
5.2.5.0
Modules
Images
c:\program files\pivot animator v5\pivot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2892"C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe" C:\Users\admin\AppData\Local\Temp\pivot_v5-2.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Pivot Animator
Exit code:
0
Version:
1.92.3.8643
Modules
Images
c:\users\admin\appdata\local\temp\pivot_v5-2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 786
Read events
7 728
Write events
51
Delete events
7

Modification events

(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\ASP.NET_4.0.30319\Names
Operation:writeName:GZiCjMdm0rtP3mbrZ8cDxD2mup6IYHlLzc7YGRHjqDfmBdjhvpVFH80CP68yXHTCBCXWwpw3Hjv1E627l29qtOGKQJF9jJybvM0cuFuS5xZDyzeYZJlcFL
Value:
2892
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2892) pivot_v5-2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\pivot_v5-2_RASMANCS
Operation:writeName:FileTracingMask
Value:
Executable files
0
Suspicious files
40
Text files
1
Unknown types
2

Dropped files

PID
Process
Filename
Type
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\tumble.pivbinary
MD5:F93B4710781FA8957A8CC3C86929025A
SHA256:C57EBE624A4CF08EB72783F7AA5F7F1F511FCEA84791908BE722398A69D8F7B3
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\sprite_demo.pivbinary
MD5:8FCDEDBABA257EADD8BE3CAB322A9251
SHA256:07E2827109F791EA15F3DC095593BBF9F8B04D897B84F20D721B0B12E0123D0C
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\text_bike.pivbinary
MD5:DE938ED1FCA12777739E6720AA846370
SHA256:4F83A5BA94AA5FEFFF5FAAA6747077D424792023407E7795D68E98ED91E72326
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\deformation_demo.pivbinary
MD5:B810F7A219611F4CE7C078005683474B
SHA256:2ED6A7C53C65EC762D9D9B0EBADF64E02E22B5C5A0F507627D062DB661A00B68
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\Legacy\dominos.pivbinary
MD5:08557C8776D979A1143CC674A5FAFB32
SHA256:D8E45CDCD53EC9AD56FBA89575C66701B01E009C4D371DB092DEECB1604A087F
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\pythagoras proof.pivbinary
MD5:12AE5F64729CB7EDB9B1713DD53DA83D
SHA256:933073BE25C12E6D089AE9413230630804DD830742EE2E8114D621278055816B
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\square wheels.pivbinary
MD5:5EC681F762DF42F824781509B07A8197
SHA256:96C0EDA02ADC1F87D89BC0996DA0B50935EFD3CDB36475748753B02C5A362D43
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\text_speech_bubble.pivbinary
MD5:C0DA29C6C68E6B07B3C3663BCCDEF12F
SHA256:A98E443C17047E009CE0B40D868597B49DBD09CC64F1A73991C59DFDDC1CD2EC
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\tween_camera.pivbinary
MD5:A0C7825383DFD56F8448654563E2D3F1
SHA256:D2059B69914B3342FD2F0E62EB659CF84B6EE5FAF9D09A760BB63A70B36599DB
2804pivot.exeC:\Users\admin\Documents\Pivot Animator v5\Animations\tween_falling_object.pivbinary
MD5:CC39EF21859D52916FA65A8B21A27D22
SHA256:7F2AD7F786867BD68469017E04A905AE07688053BD04D1EC513BEE83A9442F58
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
8
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2892
pivot_v5-2.exe
52.222.250.96:443
d20ozt0ryq20yh.cloudfront.net
AMAZON-02
US
unknown
2184
svchost.exe
239.255.255.250:1900
—
—
—
unknown
856
svchost.exe
52.222.250.96:443
d20ozt0ryq20yh.cloudfront.net
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
d20ozt0ryq20yh.cloudfront.net
  • 52.222.250.96
  • 52.222.250.5
  • 52.222.250.9
  • 52.222.250.139
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pivot_v5-2.exe