File name:

4.7.exe

Full analysis: https://app.any.run/tasks/93a52373-e2ca-412d-9496-bded4cc4daee
Verdict: Malicious activity
Analysis date: September 01, 2024, 18:24:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pyinstaller
discord
python
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

D71D9CE33E1D1F7CCA026EE9D8A84455

SHA1:

210E8F26480BD6EC8CEFB3A0E06B742EA553F468

SHA256:

B0E1E030AD98FE4164D26E7F6A0E6E9A4ECB229B504F816CA7772B119996AD3E

SSDEEP:

98304:P+QW8EWOSzsuDNvgZXScbtnbGd49IRQJ+FgLHIcctvQ4qUmb/Idt16QrS2uFaZYX:k5GnkYYzeIZQUTspvl217

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • WaaSMedicAgent.exe (PID: 6128)
      • MusNotifyIcon.exe (PID: 6288)
      • svchost.exe (PID: 5708)
      • RUXIMICS.exe (PID: 4444)
      • MusNotificationUx.exe (PID: 6884)
      • consent.exe (PID: 3672)
      • 4.7.exe (PID: 6872)
      • svchost.exe (PID: 5160)
      • conhost.exe (PID: 5476)
      • 4.7.exe (PID: 4980)
      • conhost.exe (PID: 3708)
      • cmd.exe (PID: 2720)
      • svchost.exe (PID: 3972)

  • SUSPICIOUS

    • Process drops python dynamic module

      • 4.7.exe (PID: 4980)

    • Process drops legitimate windows executable

      • 4.7.exe (PID: 4980)

    • The process drops C-runtime libraries

      • 4.7.exe (PID: 4980)

    • Drops the executable file immediately after the start

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Executable content was dropped or overwritten

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Application launched itself

      • 4.7.exe (PID: 4980)

    • Starts CMD.EXE for commands execution

      • 4.7.exe (PID: 6872)

    • Loads Python modules

      • 4.7.exe (PID: 6872)

  • INFO

    • Reads the computer name

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Reads the software policy settings

      • consent.exe (PID: 3672)
      • WaaSMedicAgent.exe (PID: 6128)

    • The process uses the downloaded file

      • consent.exe (PID: 3672)

    • Create files in a temporary directory

      • 4.7.exe (PID: 4980)
      • 4.7.exe (PID: 6872)

    • Checks supported languages

      • 4.7.exe (PID: 4980)
      • RUXIMICS.exe (PID: 4444)
      • 4.7.exe (PID: 6872)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 6884)
      • MusNotifyIcon.exe (PID: 6288)

    • Creates files in the program directory

      • MusNotificationUx.exe (PID: 6884)
      • RUXIMICS.exe (PID: 4444)
      • MusNotifyIcon.exe (PID: 6288)

    • PyInstaller has been detected (YARA)

      • 4.7.exe (PID: 4980)

    • Checks proxy server information

      • 4.7.exe (PID: 6872)

    • Checks operating system version

      • 4.7.exe (PID: 6872)

    • Attempting to use instant messaging service

      • 4.7.exe (PID: 6872)
      • svchost.exe (PID: 2256)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:08:12 18:38:55+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.38
CodeSize: 176128
InitializedDataSize: 95232
UninitializedDataSize: -
EntryPoint: 0xc540
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
126
Monitored processes
15
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT 4.7.exe consent.exe no specs ruximics.exe no specs svchost.exe no specs conhost.exe no specs svchost.exe no specs waasmedicagent.exe no specs musnotifyicon.exe no specs musnotificationux.exe no specs 4.7.exe cmd.exe no specs conhost.exe no specs svchost.exe svchost.exe no specs 4.7.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2720C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exe—4.7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
3672consent.exe 1824 306 0000017C0D206940C:\Windows\System32\consent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Consent UI for administrative applications
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\consent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
3708\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3972C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4444%ProgramFiles%\RUXIM\RUXIMICS.EXE /nonetworkC:\Program Files\RUXIM\RUXIMICS.exe—PLUGScheduler.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Reusable UX Interaction Manager
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\ruximics.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4980"C:\Users\admin\Desktop\4.7.exe" C:\Users\admin\Desktop\4.7.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\desktop\4.7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5160C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5476\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5708C:\WINDOWS\System32\svchost.exe -k netsvcs -p -s BITSC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
9 381
Read events
9 375
Write events
5
Delete events
1

Modification events

(PID) Process:(5708) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
Operation:writeName:PerfMMFileName
Value:
Global\MMF_BITS26ceb547-7d7e-49e3-88fe-db80a32a5ac1
(PID) Process:(6288) MusNotifyIcon.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate
Operation:writeName:TrayIconStatus
Value:
0
(PID) Process:(5708) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\BITS
Operation:delete valueName:PerfMMFileName
Value:
Global\MMF_BITS26ceb547-7d7e-49e3-88fe-db80a32a5ac1
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Wake To Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(3972) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Maintenance Work
Value:
Microsoft\Windows\UpdateOrchestrator
Executable files
48
Suspicious files
5
Text files
930
Unknown types
33

Dropped files

PID
Process
Filename
Type
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\VCRUNTIME140_1.dllexecutable
MD5:7E668AB8A78BD0118B94978D154C85BC
SHA256:E4B533A94E02C574780E4B333FCF0889F65ED00D39E32C0FBBDA2116F185873F
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_ctypes.pydexecutable
MD5:BD36F7D64660D120C6FB98C8F536D369
SHA256:EE543453AC1A2B9B52E80DC66207D3767012CA24CE2B44206804767F37443902
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_uuid.pydexecutable
MD5:46E9D7B5D9668C9DB5CAA48782CA71BA
SHA256:F6063622C0A0A34468679413D1B18D1F3BE67E747696AB972361FAED4B8D6735
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\api-ms-win-crt-convert-l1-1-0.dllexecutable
MD5:F1966E566459389D610B3773C3E065F1
SHA256:DB128A378C682A0ACD5FB4D074B45FAD33AB57E70637F3EFF917562D8100923A
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_cffi_backend.cp311-win_amd64.pydexecutable
MD5:FDE9A1D6590026A13E81712CD2F23522
SHA256:16ECCC4BAF6CF4AB72ACD53C72A1F2B04D952E07E385E9050A933E78074A7D5B
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_asyncio.pydexecutable
MD5:79F71C92C850B2D0F5E39128A59054F1
SHA256:0237739399DB629FDD94DE209F19AC3C8CD74D48BEBE40AD8EA6AC7556A51980
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_decimal.pydexecutable
MD5:65B4AB77D6C6231C145D3E20E7073F51
SHA256:93EB9D1859EDCA1C29594491863BF3D72AF70B9A4240E0D9DD171F668F4F8614
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_lzma.pydexecutable
MD5:E5ABC3A72996F8FDE0BCF709E6577D9D
SHA256:1796038480754A680F33A4E37C8B5673CC86C49281A287DC0C5CAE984D0CB4BB
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_hashlib.pydexecutable
MD5:4255C44DC64F11F32C961BF275AAB3A2
SHA256:E557873D5AD59FD6BD29D0F801AD0651DBB8D9AC21545DEFE508089E92A15E29
49804.7.exeC:\Users\admin\AppData\Local\Temp\_MEI49802\_queue.pydexecutable
MD5:F00133F7758627A15F2D98C034CF1657
SHA256:35609869EDC57D806925EC52CCA9BC5A035E30D5F40549647D4DA6D7983F8659
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
17
DNS requests
4
Threats
4

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
4132
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6856
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4324
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6872
4.7.exe
104.26.0.5:443
keyauth.win
CLOUDFLARENET
US
malicious
6872
4.7.exe
162.159.138.232:443
discord.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
keyauth.win
  • 104.26.0.5
  • 104.26.1.5
  • 172.67.72.57
malicious
discord.com
  • 162.159.138.232
  • 162.159.135.232
  • 162.159.128.233
  • 162.159.136.232
  • 162.159.137.232
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain in DNS Lookup (keyauth .win)
6872
4.7.exe
Potentially Bad Traffic
ET INFO Fake Game Cheat Related Domain (keyauth .win) in TLS SNI
2256
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
6872
4.7.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
4.7.exe