File name:

4.7.exe

Full analysis: https://app.any.run/tasks/93a52373-e2ca-412d-9496-bded4cc4daee
Verdict: Malicious activity
Analysis date: September 01, 2024, 18:24:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pyinstaller
discord
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

D71D9CE33E1D1F7CCA026EE9D8A84455

SHA1:

210E8F26480BD6EC8CEFB3A0E06B742EA553F468

SHA256:

B0E1E030AD98FE4164D26E7F6A0E6E9A4ECB229B504F816CA7772B119996AD3E

SSDEEP:

98304:P+QW8EWOSzsuDNvgZXScbtnbGd49IRQJ+FgLHIcctvQ4qUmb/Idt16QrS2uFaZYX:k5GnkYYzeIZQUTspvl217

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • conhost.exe (PID: 5476)
      • svchost.exe (PID: 5160)
      • svchost.exe (PID: 5708)
      • MusNotifyIcon.exe (PID: 6288)
      • MusNotificationUx.exe (PID: 6884)
      • consent.exe (PID: 3672)
      • 4.7.exe (PID: 6872)
      • conhost.exe (PID: 3708)
      • cmd.exe (PID: 2720)
      • WaaSMedicAgent.exe (PID: 6128)
      • 4.7.exe (PID: 4980)
      • RUXIMICS.exe (PID: 4444)
      • svchost.exe (PID: 3972)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • 4.7.exe (PID: 4980)

    • Process drops python dynamic module

      • 4.7.exe (PID: 4980)

    • Process drops legitimate windows executable

      • 4.7.exe (PID: 4980)

    • Drops the executable file immediately after the start

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Executable content was dropped or overwritten

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Application launched itself

      • 4.7.exe (PID: 4980)

    • Loads Python modules

      • 4.7.exe (PID: 6872)

    • Starts CMD.EXE for commands execution

      • 4.7.exe (PID: 6872)

  • INFO

    • Reads the computer name

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Reads the software policy settings

      • consent.exe (PID: 3672)
      • WaaSMedicAgent.exe (PID: 6128)

    • The process uses the downloaded file

      • consent.exe (PID: 3672)

    • Checks supported languages

      • RUXIMICS.exe (PID: 4444)
      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Create files in a temporary directory

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 6884)
      • MusNotifyIcon.exe (PID: 6288)

    • Creates files in the program directory

      • MusNotificationUx.exe (PID: 6884)
      • MusNotifyIcon.exe (PID: 6288)
      • RUXIMICS.exe (PID: 4444)

    • PyInstaller has been detected (YARA)

      • 4.7.exe (PID: 4980)

    • Checks proxy server information

      • 4.7.exe (PID: 6872)

    • Checks operating system version

      • 4.7.exe (PID: 6872)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2256)
      • 4.7.exe (PID: 6872)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:12 18:38:55+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.38
CodeSize: 176128
InitializedDataSize: 95232
UninitializedDataSize: -
EntryPoint: 0xc540
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT 4.7.exe consent.exe no specs ruximics.exe no specs svchost.exe no specs conhost.exe no specs svchost.exe no specs waasmedicagent.exe no specs musnotifyicon.exe no specs musnotificationux.exe no specs 4.7.exe cmd.exe no specs conhost.exe no specs svchost.exe svchost.exe no specs 4.7.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2720C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—4.7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
3672consent.exe 1824 306 0000017C0D206940C:\Windows\System32\consent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Consent UI for administrative applications
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\consent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
3708\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3972C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4444%ProgramFiles%\RUXIM\RUXIMICS.EXE /nonetworkC:\Program Files\RUXIM\RUXIMICS.exe—PLUGScheduler.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Reusable UX Interaction Manager
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\ruximics.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4980"C:\Users\admin\Desktop\4.7.exe" C:\Users\admin\Desktop\4.7.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\4.7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5160C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5708C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
9 381
Read events
9 375
Write events
5
Delete events
1

Modification events

(PID) Process:(5708) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
Operation:writeName:PerfMMFileName
Value:
Global\MMF_BITS26ceb547-7d7e-49e3-88fe-db80a32a5ac1
(PID) Process:(6288) MusNotifyIcon.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate
Operation:writeName:TrayIconStatus
Value:
0
(PID) Process:(5708) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
Operation:delete valueName:PerfMMFileName
Value:
Global\MMF_BITS26ceb547-7d7e-49e3-88fe-db80a32a5ac1
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Wake To Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Maintenance Work
Value:
Microsoft\Windows\UpdateOrchestrator
Executable files
48
Suspicious files
5
Text files
930
Unknown types
33

Dropped files

PID
Process
Filename
Type
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\VCRUNTIME140.dllexecutable
MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
SHA256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_multiprocessing.pydexecutable
MD5:827439C35A0CEE0DE6421AF039CA7FF9
SHA256:B86E19E57A415AE9D65D4C0A86658DE2D2AD6A97617CB514A105449C9B679D89
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_decimal.pydexecutable
MD5:65B4AB77D6C6231C145D3E20E7073F51
SHA256:93EB9D1859EDCA1C29594491863BF3D72AF70B9A4240E0D9DD171F668F4F8614
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_queue.pydexecutable
MD5:F00133F7758627A15F2D98C034CF1657
SHA256:35609869EDC57D806925EC52CCA9BC5A035E30D5F40549647D4DA6D7983F8659
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_lzma.pydexecutable
MD5:E5ABC3A72996F8FDE0BCF709E6577D9D
SHA256:1796038480754A680F33A4E37C8B5673CC86C49281A287DC0C5CAE984D0CB4BB
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_asyncio.pydexecutable
MD5:79F71C92C850B2D0F5E39128A59054F1
SHA256:0237739399DB629FDD94DE209F19AC3C8CD74D48BEBE40AD8EA6AC7556A51980
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_bz2.pydexecutable
MD5:3859239CED9A45399B967EBCE5A6BA23
SHA256:A4DD883257A7ACE84F96BCC6CD59E22D843D0DB080606DEFAE32923FC712C75A
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_hashlib.pydexecutable
MD5:4255C44DC64F11F32C961BF275AAB3A2
SHA256:E557873D5AD59FD6BD29D0F801AD0651DBB8D9AC21545DEFE508089E92A15E29
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_ssl.pydexecutable
MD5:208B0108172E59542260934A2E7CFA85
SHA256:5160500474EC95D4F3AF7E467CC70CB37BEC1D12545F0299AAB6D69CEA106C69
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_overlapped.pydexecutable
MD5:E5ACEAF21E82253E300C0B78793887A8
SHA256:D950342686C959056FF43C9E5127554760FA20669D97166927DD6AAE5494E02A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
17
DNS requests
4
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
4132
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6856
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6872
4.7.exe
104.26.0.5:443
keyauth.win
CLOUDFLARENET
US
malicious
6872
4.7.exe
162.159.138.232:443
discord.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
keyauth.win
  • 104.26.0.5
  • 104.26.1.5
  • 172.67.72.57
malicious
discord.com
  • 162.159.138.232
  • 162.159.135.232
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.137.232
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain in DNS Lookup (keyauth .win)
—
—
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain (keyauth .win) in TLS SNI
—
—
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
—
—
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
4.7.exe