File name:

b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe

Full analysis: https://app.any.run/tasks/ce77dae6-9c5a-4551-a9a9-4d8bab5744c1
Verdict: Malicious activity
Analysis date: January 10, 2025, 22:54:28
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
zombie
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed, 4 sections
MD5:

B89C4DEA38B4191A1D7ECA9ECBBD34F7

SHA1:

A39EFA1A4D2D4B9746A180573A4F8B436A849515

SHA256:

B29AE96EA57CE81F1AB2BBC351BF1CA1ED4600EF3A2BCC183D07DDDBD3BA2AC3

SSDEEP:

1536:EhPpyASvVVVVVVVVWs5ZEDgWsgW1JqOpc7Fc7n:cpDSvVVVVVVVVIgWsgW1JqOh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZOMBIE has been detected (YARA)

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • Executable content was dropped or overwritten

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • The process creates files with name similar to system file names

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

  • INFO

    • Creates files or folders in the user directory

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • Checks supported languages

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)

    • UPX packer has been detected

      • b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe (PID: 6384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (30.9)
.exe | Win64 Executable (generic) (27.3)
.exe | UPX compressed Win32 Executable (26.8)
.dll | Win32 Dynamic Link Library (generic) (6.5)
.exe | Win32 Executable (generic) (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:03:15 04:06:07+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 8192
InitializedDataSize: 4096
UninitializedDataSize: 24576
EntryPoint: 0x2130
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZOMBIE b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe

Process information

PID
CMD
Path
Indicators
Parent process
6384"C:\Users\admin\Desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe" C:\Users\admin\Desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
11
Read events
11
Write events
0
Delete events
0

Modification events

No data
Executable files
1 688
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe —
MD5:—
SHA256:—
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.tmpexecutable
MD5:88C95F5CF83E40A620FEB9055C41E9C1
SHA256:ADF98E9FF5AE8EBF6C704656D8B3A9D98EB00B03F8A4BB7737931E3A5B29BCFA
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\bootmgr.tmpexecutable
MD5:89BCBFD2B4CE684B78E2E883B1EE054E
SHA256:74159A64C163FD3FCB83431C3323BE10C7AA40861E664EF6421A951C8BB0213B
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\bootTel.dat.tmpexecutable
MD5:7EE8A4B4AC1D27530C01E9F9C49A0B8C
SHA256:2E6ECAFDB930B474BE92E78C177268EF6AE80B8CBD1544EEF3710939D8E8A397
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\desktop.ini.exeexecutable
MD5:88C95F5CF83E40A620FEB9055C41E9C1
SHA256:ADF98E9FF5AE8EBF6C704656D8B3A9D98EB00B03F8A4BB7737931E3A5B29BCFA
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\A3DUtils.dll.tmpexecutable
MD5:C0AE1BA641F656425EBE5BEFF8795A6F
SHA256:1A4158A25671B0A5CE0ECFC663F0E1650C5280090CABDF0D62D805E884F63A01
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf.tmpexecutable
MD5:4392CEEF8CC86DF60B34B8A896BC356B
SHA256:BE01CA5BB06B13C0E4CC0C78412AEFB18C3103EB443D648808ACC5CF7CA9F508
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe.tmpexecutable
MD5:84F8BDB56D4975437A03DB5B1E457D46
SHA256:DB4147BA260DD015154D90D19562C8DFAE6E7F1D6A020495266D05B2C8B72E53
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\acrobat.tlb.tmpexecutable
MD5:7B6F381321DFC16A0019A09A08854A75
SHA256:C4E86685840AEAF55C4665B17C43EFD1E4E5C20B583556735CF75E506651A949
6384b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exeC:\Users\admin\AppData\Local\VirtualStore\Program Files\Adobe\Acrobat DC\Acrobat\ACE.dll.tmpexecutable
MD5:C0511A31C843A5492E25B23D270E4CFA
SHA256:24F634C0BDB660C9D7A8F8C3283E258F6D29A6CADED2AD7D007760CE7C05AE94
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
20
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1140
RUXIMICS.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1488
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1488
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1140
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1488
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1140
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.227.215:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1140
RUXIMICS.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1488
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1140
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
self.events.data.microsoft.com
  • 13.69.239.78
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
b29ae96ea57ce81f1ab2bbc351bf1ca1ed4600ef3a2bcc183d07dddbd3ba2ac3.exe