File name:

af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe

Full analysis: https://app.any.run/tasks/b248aaaf-b371-46d8-abde-1ddd761c7c7d
Verdict: Malicious activity
Analysis date: November 23, 2024, 02:29:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

E06300F0E52C5A1C0229011EBE9110F8

SHA1:

247AE647D3444E9E9F0FF8687B9DCFF45682A49E

SHA256:

AF495518F7B851E182D2D63D21314CD12534CD179B25FDFF2BF3C8B4662E63C7

SSDEEP:

3072:D/24+1gjmeXqHi9pvyLV/X7jIunLOyuKhg3mZsWxcYfjay8WPHZB:7ZDZ2nl78ALgWiWxzbJrPn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 4996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)
      • csrs.exe (PID: 3560)

    • Reads security settings of Internet Explorer

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)

    • Starts CMD.EXE for commands execution

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)
      • csrs.exe (PID: 3560)

    • Executing commands from a ".bat" file

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4764)
      • cmd.exe (PID: 5268)
      • cmd.exe (PID: 5856)
      • cmd.exe (PID: 4976)
      • cmd.exe (PID: 2632)

    • Starts itself from another location

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)

    • Application launched itself

      • csrs.exe (PID: 3848)

  • INFO

    • Reads the computer name

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)
      • EDnlk.exe (PID: 4548)
      • csrs.exe (PID: 3848)
      • csrs.exe (PID: 3560)

    • Checks supported languages

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)
      • EDnlk.exe (PID: 4548)
      • csrs.exe (PID: 3848)
      • csrs.exe (PID: 3560)

    • Create files in a temporary directory

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)

    • Process checks computer location settings

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)

    • The process uses the downloaded file

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)

    • Creates files or folders in the user directory

      • af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe (PID: 3620)
      • csrs.exe (PID: 3560)

    • UPX packer has been detected

      • csrs.exe (PID: 3560)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:02:25 03:25:21+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 1925120
InitializedDataSize: 8192
UninitializedDataSize: -
EntryPoint: 0x10e0
OSVersion: 4
ImageVersion: 9.13
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.13.0.25
ProductVersionNumber: 9.13.0.25
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: ZU
FileVersion: 9.13.0025
ProductVersion: 9.13.0025
InternalName: ndfpzxa
OriginalFileName: ndfpzxa.exe
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
20
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe ednlk.exe no specs cmd.exe no specs conhost.exe no specs reg.exe csrs.exe no specs csrs.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1480\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2632cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\admin\AppData\Roaming\csrs.exe" /t REG_SZ /d "C:\Users\admin\AppData\Roaming\csrs.exe:*:Enabled:Windows Messanger" /fC:\Windows\SysWOW64\cmd.exe—csrs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2972REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\admin\AppData\Roaming\svhost32.exe" /t REG_SZ /d "C:\Users\admin\AppData\Roaming\svhost32.exe:*:Enabled:Windows Messanger" /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3560C:\Users\admin\AppData\Roaming\csrs.exeC:\Users\admin\AppData\Roaming\csrs.exe
csrs.exe
User:
admin
Integrity Level:
MEDIUM
Version:
9.13.0025
Modules
Images
c:\users\admin\appdata\roaming\csrs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3620"C:\Users\admin\Desktop\af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe" C:\Users\admin\Desktop\af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
9.13.0025
Modules
Images
c:\users\admin\desktop\af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
3688REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\admin\AppData\Roaming\csrs.exe" /t REG_SZ /d "C:\Users\admin\AppData\Roaming\csrs.exe:*:Enabled:Windows Messanger" /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3848"C:\Users\admin\AppData\Roaming\csrs.exe" C:\Users\admin\AppData\Roaming\csrs.exe—af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
9.13.0025
Modules
Images
c:\users\admin\appdata\roaming\csrs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
1 071
Read events
1 068
Write events
3
Delete events
0

Modification events

(PID) Process:(4996) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:csrs
Value:
C:\Users\admin\AppData\Roaming\csrs.exe
(PID) Process:(3560) csrs.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\SrvID\ID
Operation:writeName:GO29FHKZGR
Value:
cbzsrv21
(PID) Process:(3560) csrs.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\INSTALL\DATE
Operation:writeName:GO29FHKZGR
Value:
November 23, 2024
Executable files
4
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3620af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exeC:\Users\admin\AppData\Roaming\csrs.txtexecutable
MD5:E06300F0E52C5A1C0229011EBE9110F8
SHA256:AF495518F7B851E182D2D63D21314CD12534CD179B25FDFF2BF3C8B4662E63C7
3560csrs.exeC:\Users\admin\AppData\Roaming\svhost32.exeexecutable
MD5:2C98EF6AF099BBC4C78A4AF9744F39FB
SHA256:A24FF8158248205078979E903EA822884899602316C81F3AE60BE90FD4F95F16
3620af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exeC:\Users\admin\AppData\Local\Temp\qgpor.txttext
MD5:B5BC8DCD2FE346BD41383392DF511585
SHA256:C3B79A6BCA03CA236F8E749D1B00BD3A3094C7DF28A6A9D7ED4F902AE7AAF01A
3620af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exeC:\Users\admin\AppData\Local\Temp\EDnlk.exeexecutable
MD5:466773BFCBD01059584CDAE36E3C281C
SHA256:21F0910A1D71DFC63744474B2BA6B8248D893226576EA48791DC0CEF7DD52105
3620af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exeC:\Users\admin\AppData\Local\Temp\qgpor.battext
MD5:B5BC8DCD2FE346BD41383392DF511585
SHA256:C3B79A6BCA03CA236F8E749D1B00BD3A3094C7DF28A6A9D7ED4F902AE7AAF01A
3620af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exeC:\Users\admin\AppData\Roaming\csrs.exeexecutable
MD5:2C98EF6AF099BBC4C78A4AF9744F39FB
SHA256:A24FF8158248205078979E903EA822884899602316C81F3AE60BE90FD4F95F16
3560csrs.exeC:\Users\admin\AppData\Roaming\data.dattext
MD5:97288000321B65754A89293AE8B59A06
SHA256:1C23E2BE7A2497D6BFB432C98297A5657697405512C5DFCF568E4067D8E00C22
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
17
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5776
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1412
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5776
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1412
RUXIMICS.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5776
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1412
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.110.121:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5776
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1412
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5776
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.16.110.121
whitelisted
google.com
  • 142.250.184.238
whitelisted
46657272617269.3utilities.com
  • —
unknown
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
self.events.data.microsoft.com
  • 20.189.173.13
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
2192
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.3utilities .com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
af495518f7b851e182d2d63d21314cd12534cd179b25fdff2bf3c8b4662e63c7.exe