File name:

Antivirus.exe

Full analysis: https://app.any.run/tasks/b19a4c56-19b0-4f01-b377-4bfed7812ad2
Verdict: Malicious activity
Analysis date: February 10, 2024, 16:51:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C7E9746B1B039B8BD1106BCA3038C38F

SHA1:

CB93AC887876BAFE39C5F9AA64970D5E747FB191

SHA256:

B1369BD254D96F7966047AD4BE06103830136629590182D49E5CB8680529EBD4

SSDEEP:

49152:FH/1Fdq0wneDrEoYxWFjmYMcKabLVp3diY7kp:FH/1Fdq0nIo2YAcl/NisA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Antivirus.exe (PID: 3668)

    • Changes the autorun value in the registry

      • Antivirus.exe (PID: 3668)

    • Uses NET.EXE to stop Windows Security Center service

      • net.exe (PID: 3944)
      • Antivirus.exe (PID: 3668)

    • Starts NET.EXE for service management

      • Antivirus.exe (PID: 3668)
      • net.exe (PID: 3944)
      • net.exe (PID: 3228)
      • net.exe (PID: 1876)
      • net.exe (PID: 2332)

  • SUSPICIOUS

    • Changes internet zones settings

      • Antivirus.exe (PID: 3668)

    • Reads security settings of Internet Explorer

      • Antivirus.exe (PID: 3668)

    • Reads the Internet Settings

      • Antivirus.exe (PID: 3668)

    • Reads Microsoft Outlook installation path

      • Antivirus.exe (PID: 3668)

    • Checks Windows Trust Settings

      • Antivirus.exe (PID: 3668)

    • Reads settings of System Certificates

      • Antivirus.exe (PID: 3668)

    • Reads Internet Explorer settings

      • Antivirus.exe (PID: 3668)

  • INFO

    • Checks supported languages

      • Antivirus.exe (PID: 3668)

    • Reads the computer name

      • Antivirus.exe (PID: 3668)

    • Checks proxy server information

      • Antivirus.exe (PID: 3668)

    • Reads the machine GUID from the registry

      • Antivirus.exe (PID: 3668)

    • Create files in a temporary directory

      • Antivirus.exe (PID: 3668)
      • mofcomp.exe (PID: 2444)

    • Creates files or folders in the user directory

      • Antivirus.exe (PID: 3668)

    • Reads Environment values

      • Antivirus.exe (PID: 3668)

    • Application launched itself

      • iexplore.exe (PID: 3636)
      • iexplore.exe (PID: 2728)

    • Reads the software policy settings

      • Antivirus.exe (PID: 3668)

    • Process checks whether UAC notifications are on

      • Antivirus.exe (PID: 3668)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:07:21 07:55:24+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 708608
InitializedDataSize: 1357312
UninitializedDataSize: -
EntryPoint: 0x3f9df
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
59
Monitored processes
14
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start antivirus.exe net.exe no specs net.exe no specs net.exe no specs net.exe no specs mofcomp.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs iexplore.exe iexplore.exe iexplore.exe no specs iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
1692C:\Windows\system32\net1 stop wscsvcC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1836C:\Windows\system32\net1 stop winmgmt /yC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
1876net start winmgmtC:\Windows\System32\net.exe—Antivirus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2232C:\Windows\system32\net1 start wscsvcC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
2244"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2728 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2332net start wscsvcC:\Windows\System32\net.exe—Antivirus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2444mofcomp C:\Users\admin\AppData\Local\Temp\4otjesjty.mofC:\Windows\System32\wbem\mofcomp.exe—Antivirus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
The Managed Object Format (MOF) Compiler
Exit code:
3
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\wbem\mofcomp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2648C:\Windows\system32\net1 start winmgmtC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
2728"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
3228net stop winmgmt /yC:\Windows\System32\net.exe—Antivirus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
Total events
43 360
Read events
42 968
Write events
306
Delete events
86

Modification events

(PID) Process:(3668) Antivirus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
Operation:writeName:Settings_0
Value:
1
(PID) Process:(3668) Antivirus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:Use FormSuggest
Value:
Yes
(PID) Process:(3668) Antivirus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Operation:writeName:1601
Value:
0
(PID) Process:(3668) Antivirus.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:WarnOnZoneCrossing
Value:
0
(PID) Process:(3668) Antivirus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
Operation:writeName:SecStatus_3
Value:
1
(PID) Process:(3668) Antivirus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
Operation:writeName:SecStatus_4
Value:
1
(PID) Process:(3668) Antivirus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
Operation:writeName:SecStatus_5
Value:
1
(PID) Process:(3668) Antivirus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
Operation:writeName:FD
Value:
0
(PID) Process:(3668) Antivirus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
Operation:writeName:GUID
Value:
425360974253608542536082
(PID) Process:(3668) Antivirus.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AnVi
Operation:writeName:Data
Value:
:2238:2411:2584:2757:2930:3103:3276:3622:3795:3968:4314:4487:
Executable files
0
Suspicious files
12
Text files
15
Unknown types
15

Dropped files

PID
Process
Filename
Type
3668Antivirus.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\kevin[1].bmpimage
MD5:17B80ACE3086B464254C4D05BF85E488
SHA256:2290DED38494032284D49E7D53744B78CE836EC6354F4856878769C5D6FD2716
2444mofcomp.exeC:\Users\admin\AppData\Local\Temp\tmp1A1.tmpbinary
MD5:3DE4769F0E1EAD866FB009D8B49AA93C
SHA256:976579B449D58CE40B111C782C62571C0137C01577177E638BACA5405835BC57
3668Antivirus.exeC:\Users\admin\AppData\Local\Temp\4otjesjty.moftext
MD5:7FAD92AFDA308DCA8ACFC6FF45C80C24
SHA256:76E19416EB826A27BDCF626C3877CF7812BBE9B62CC2CCC5C2F65461D644246F
3668Antivirus.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:71A5465EBA35BEB4A557470450B2B478
SHA256:B08AF415F54488231DDE3CA13B30C0F303DE4369F0ED138B670190B3C48DF3D3
3668Antivirus.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:1942E9CD42DFDF08B09E6F5C386A9C47
SHA256:B87C89FDB6D99BE746BBAE6013B39DCFF072945A841BE6340541314A41D7D88A
3668Antivirus.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\v84a3a4012de94ce1a686ba8c167c359c1696973893317[1].jstext
MD5:DD1D068FDB5FE90B6C05A5B3940E088C
SHA256:6153D13804862B0FC1C016CF1129F34CB7C6185F2CF4BF1A3A862EECDAB50101
3668Antivirus.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:46517D43D1D09C99E74E0492BC38D8A6
SHA256:779294754FBE6247424E486D10D2978E76251902FD2F0F1CFD5900D13B2B9AB4
2244iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\v84a3a4012de94ce1a686ba8c167c359c1696973893317[1].jstext
MD5:DD1D068FDB5FE90B6C05A5B3940E088C
SHA256:6153D13804862B0FC1C016CF1129F34CB7C6185F2CF4BF1A3A862EECDAB50101
3668Antivirus.exeC:\Users\admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdbbinary
MD5:0D0A5169570971DD25E317917FABCF22
SHA256:A307514C2ACA0C8AD39E63DD03F1845E38B2A8E20BAC8AE52F210FF101D26FE6
3668Antivirus.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:618E1DE01FC7210B5A13CC8513CBFF83
SHA256:AF5DBA076A4308BB9CC3D612CDBFC5414E01B7FBFE3197306BFC9C94F591CBF3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
32
DNS requests
20
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3668
Antivirus.exe
GET
404
54.39.157.64:80
http://searchdusty.com/avt/avt_db
unknown
html
153 b
unknown
3668
Antivirus.exe
GET
404
54.39.157.64:80
http://searchdusty.com/avt/avtr.dat
unknown
html
153 b
unknown
3668
Antivirus.exe
GET
200
54.39.157.64:80
http://searchdusty.com/kevin.bmp
unknown
image
768 Kb
unknown
3668
Antivirus.exe
GET
200
54.39.157.64:80
http://searchdusty.com/customers/buy.php?pid=AVT_BASIC&id=139&subid=1
unknown
html
985 b
unknown
3668
Antivirus.exe
GET
—
54.39.157.64:80
http://searchdusty.com/kevin.mp3
unknown
—
—
unknown
2728
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
—
—
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
—
—
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
3668
Antivirus.exe
GET
—
54.39.157.64:80
http://searchdusty.com/customers/buy.php?pid=AVT_BASIC&id=139&subid=1
unknown
—
—
unknown
3668
Antivirus.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3668
Antivirus.exe
54.39.157.64:80
searchdusty.com
OVH SAS
CA
unknown
3668
Antivirus.exe
188.114.97.3:443
computernewb.com
CLOUDFLARENET
NL
unknown
3668
Antivirus.exe
23.32.238.88:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
3668
Antivirus.exe
142.250.185.131:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3668
Antivirus.exe
104.16.57.101:443
static.cloudflareinsights.com
CLOUDFLARENET
—
unknown
3668
Antivirus.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2244
iexplore.exe
188.114.97.3:443
computernewb.com
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
fastsofgeld.com
  • —
unknown
searchdusty.com
  • 54.39.157.64
whitelisted
frequentwin.com
  • —
unknown
highway-traffic.com
  • —
unknown
computernewb.com
  • 188.114.97.3
  • 188.114.96.3
whitelisted
ctldl.windowsupdate.com
  • 23.32.238.88
  • 23.32.238.155
  • 23.32.238.131
  • 2.19.198.42
  • 23.32.238.90
  • 173.222.108.249
  • 173.222.108.227
whitelisted
ocsp.pki.goog
  • 142.250.185.131
whitelisted
static.cloudflareinsights.com
  • 104.16.57.101
  • 104.16.56.101
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted

Threats

PID
Process
Class
Message
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
3668
Antivirus.exe
Potentially Bad Traffic
ET USER_AGENTS User-Agent (Internet Explorer)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Antivirus.exe