File name:

4.7.exe

Full analysis: https://app.any.run/tasks/93a52373-e2ca-412d-9496-bded4cc4daee
Verdict: Malicious activity
Analysis date: September 01, 2024, 18:24:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pyinstaller
discord
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

D71D9CE33E1D1F7CCA026EE9D8A84455

SHA1:

210E8F26480BD6EC8CEFB3A0E06B742EA553F468

SHA256:

B0E1E030AD98FE4164D26E7F6A0E6E9A4ECB229B504F816CA7772B119996AD3E

SSDEEP:

98304:P+QW8EWOSzsuDNvgZXScbtnbGd49IRQJ+FgLHIcctvQ4qUmb/Idt16QrS2uFaZYX:k5GnkYYzeIZQUTspvl217

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • conhost.exe (PID: 5476)
      • svchost.exe (PID: 5160)
      • WaaSMedicAgent.exe (PID: 6128)
      • MusNotifyIcon.exe (PID: 6288)
      • 4.7.exe (PID: 4980)
      • svchost.exe (PID: 5708)
      • MusNotificationUx.exe (PID: 6884)
      • consent.exe (PID: 3672)
      • RUXIMICS.exe (PID: 4444)
      • 4.7.exe (PID: 6872)
      • conhost.exe (PID: 3708)
      • cmd.exe (PID: 2720)
      • svchost.exe (PID: 3972)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • 4.7.exe (PID: 4980)

    • Application launched itself

      • 4.7.exe (PID: 4980)

    • Loads Python modules

      • 4.7.exe (PID: 6872)

    • Drops the executable file immediately after the start

      • 4.7.exe (PID: 6872)
      • 4.7.exe (PID: 4980)

    • Executable content was dropped or overwritten

      • 4.7.exe (PID: 6872)
      • 4.7.exe (PID: 4980)

    • Starts CMD.EXE for commands execution

      • 4.7.exe (PID: 6872)

    • Process drops python dynamic module

      • 4.7.exe (PID: 4980)

    • Process drops legitimate windows executable

      • 4.7.exe (PID: 4980)

  • INFO

    • Reads the software policy settings

      • consent.exe (PID: 3672)
      • WaaSMedicAgent.exe (PID: 6128)

    • PyInstaller has been detected (YARA)

      • 4.7.exe (PID: 4980)

    • Creates files in the program directory

      • MusNotifyIcon.exe (PID: 6288)
      • RUXIMICS.exe (PID: 4444)
      • MusNotificationUx.exe (PID: 6884)

    • Reads the time zone

      • MusNotifyIcon.exe (PID: 6288)
      • MusNotificationUx.exe (PID: 6884)

    • Reads the computer name

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Create files in a temporary directory

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Checks supported languages

      • 4.7.exe (PID: 4980)
      • RUXIMICS.exe (PID: 4444)
      • 4.7.exe (PID: 6872)

    • The process uses the downloaded file

      • consent.exe (PID: 3672)

    • Checks operating system version

      • 4.7.exe (PID: 6872)

    • Checks proxy server information

      • 4.7.exe (PID: 6872)

    • Attempting to use instant messaging service

      • 4.7.exe (PID: 6872)
      • svchost.exe (PID: 2256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:12 18:38:55+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.38
CodeSize: 176128
InitializedDataSize: 95232
UninitializedDataSize: -
EntryPoint: 0xc540
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT 4.7.exe consent.exe no specs ruximics.exe no specs svchost.exe no specs conhost.exe no specs svchost.exe no specs waasmedicagent.exe no specs musnotifyicon.exe no specs musnotificationux.exe no specs 4.7.exe cmd.exe no specs conhost.exe no specs svchost.exe svchost.exe no specs 4.7.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2720C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—4.7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
3672consent.exe 1824 306 0000017C0D206940C:\Windows\System32\consent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Consent UI for administrative applications
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\consent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
3708\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3972C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4444%ProgramFiles%\RUXIM\RUXIMICS.EXE /nonetworkC:\Program Files\RUXIM\RUXIMICS.exe—PLUGScheduler.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Reusable UX Interaction Manager
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\ruximics.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4980"C:\Users\admin\Desktop\4.7.exe" C:\Users\admin\Desktop\4.7.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\4.7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5160C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5708C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
9 381
Read events
9 375
Write events
5
Delete events
1

Modification events

(PID) Process:(5708) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
Operation:writeName:PerfMMFileName
Value:
Global\MMF_BITS26ceb547-7d7e-49e3-88fe-db80a32a5ac1
(PID) Process:(6288) MusNotifyIcon.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate
Operation:writeName:TrayIconStatus
Value:
0
(PID) Process:(5708) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
Operation:delete valueName:PerfMMFileName
Value:
Global\MMF_BITS26ceb547-7d7e-49e3-88fe-db80a32a5ac1
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Wake To Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Maintenance Work
Value:
Microsoft\Windows\UpdateOrchestrator
Executable files
48
Suspicious files
5
Text files
930
Unknown types
33

Dropped files

PID
Process
Filename
Type
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\VCRUNTIME140.dllexecutable
MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
SHA256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\VCRUNTIME140_1.dllexecutable
MD5:7E668AB8A78BD0118B94978D154C85BC
SHA256:E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_bz2.pydexecutable
MD5:3859239CED9A45399B967EBCE5A6BA23
SHA256:A4DD883257A7ACE84F96BCC6CD59E22D843D0DB080606DEFAE32923FC712C75A
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_multiprocessing.pydexecutable
MD5:827439C35A0CEE0DE6421AF039CA7FF9
SHA256:B86E19E57A415AE9D65D4C0A86658DE2D2AD6A97617CB514A105449C9B679D89
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_overlapped.pydexecutable
MD5:E5ACEAF21E82253E300C0B78793887A8
SHA256:D950342686C959056FF43C9E5127554760FA20669D97166927DD6AAE5494E02A
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_socket.pydexecutable
MD5:1EEA9568D6FDEF29B9963783827F5867
SHA256:74181072392A3727049EA3681FE9E59516373809CED53E08F6DA7C496B76E117
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_lzma.pydexecutable
MD5:E5ABC3A72996F8FDE0BCF709E6577D9D
SHA256:1796038480754A680F33A4E37C8B5673CC86C49281A287DC0C5CAE984D0CB4BB
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_ctypes.pydexecutable
MD5:BD36F7D64660D120C6FB98C8F536D369
SHA256:EE543453AC1A2B9B52E80DC66207D3767012CA24CE2B44206804767F37443902
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_hashlib.pydexecutable
MD5:4255C44DC64F11F32C961BF275AAB3A2
SHA256:E557873D5AD59FD6BD29D0F801AD0651DBB8D9AC21545DEFE508089E92A15E29
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_cffi_backend.cp311-win_amd64.pydexecutable
MD5:FDE9A1D6590026A13E81712CD2F23522
SHA256:16ECCC4BAF6CF4AB72ACD53C72A1F2B04D952E07E385E9050A933E78074A7D5B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
17
DNS requests
4
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
4132
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6856
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6872
4.7.exe
104.26.0.5:443
keyauth.win
CLOUDFLARENET
US
malicious
6872
4.7.exe
162.159.138.232:443
discord.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
keyauth.win
  • 104.26.0.5
  • 104.26.1.5
  • 172.67.72.57
malicious
discord.com
  • 162.159.138.232
  • 162.159.135.232
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.137.232
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain in DNS Lookup (keyauth .win)
6872
4.7.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain (keyauth .win) in TLS SNI
2256
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6872
4.7.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4.7.exe