File name:

Mdac_typ.exe

Full analysis: https://app.any.run/tasks/b898db12-4e18-445d-9c9e-c7283a60c1a3
Verdict: Malicious activity
Analysis date: January 23, 2025, 22:43:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MS CAB-Installer self-extracting archive, 3 sections
MD5:

8556EDFCCE76C1BEC39599F301DF4237

SHA1:

C1E07FA16307DDA56CF12328501ED2B3074DD530

SHA256:

B4893E0FBAE52C19E0DA0CD699FCF6CE066C91B7C1C12E36095709A32E3AF6C0

SSDEEP:

196608:e/1b1yPsiKS6RlAjalFRZRVdkclZjamvU9YQsKt0k8x:gZdnS6cjaDjTKcvj1U9Jsq0jx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Mdac_typ.exe (PID: 6428)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Mdac_typ.exe (PID: 6428)

    • Executable content was dropped or overwritten

      • Mdac_typ.exe (PID: 6428)

    • Starts a Microsoft application from unusual location

      • Mdac_typ.exe (PID: 6428)

  • INFO

    • The sample compiled with english language support

      • Mdac_typ.exe (PID: 6428)

    • Reads the computer name

      • Mdac_typ.exe (PID: 6428)

    • Checks supported languages

      • Mdac_typ.exe (PID: 6428)

    • Create files in a temporary directory

      • Mdac_typ.exe (PID: 6428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 MS Cabinet Self-Extractor (WExtract stub) (81.3)
.exe | Win32 Executable MS Visual C++ (generic) (8.3)
.exe | Win64 Executable (generic) (7.4)
.exe | Win32 Executable (generic) (1.2)
.exe | Win16/32 Executable Delphi generic (0.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1998:03:11 01:39:29+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 36864
InitializedDataSize: 7807488
UninitializedDataSize: -
EntryPoint: 0x2749
OSVersion: 5
ImageVersion: 5
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 25.0.4403.12
ProductVersionNumber: 25.0.4403.12
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 2.50.4403.12
InternalName: Wextract
LegalCopyright: Copyright (C) Microsoft Corp. 1981-1997
LegalTrademarks: -
OriginalFileName: WEXTRACT.EXE
PrivateBuild: -
ProductName: Microsoft(R) Windows NT(R) Operating System
ProductVersion: 2.50.4403.12
SpecialBuild: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mdac_typ.exe dasetup.exe no specs dasetup.exe

Process information

PID
CMD
Path
Indicators
Parent process
6428"C:\Users\admin\AppData\Local\Temp\Mdac_typ.exe" C:\Users\admin\AppData\Local\Temp\Mdac_typ.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
2.50.4403.12
Modules
Images
c:\users\admin\appdata\local\temp\mdac_typ.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6472C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exe—Mdac_typ.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\dasetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6656C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exe
Mdac_typ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\dasetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
46
Read events
44
Write events
1
Delete events
1

Modification events

(PID) Process:(6428) Mdac_typ.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:wextract_cleanup0
Value:
rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\"
(PID) Process:(6428) Mdac_typ.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:wextract_cleanup0
Value:
Executable files
9
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mdacone.cab —
MD5:—
SHA256:—
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\cfgmgr32.dllexecutable
MD5:954E9D34AA3CECAD72ECE6F85DB280AC
SHA256:186C804BC1260AEFACB951EF394BB5E8E748A5B5AA5CC9608F6748827D979217
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\cabinet.dllexecutable
MD5:A14FA4AB41FB4825651682FC797D9223
SHA256:0CC35F915A58B16587D4EDAA9F7F852D760895FF1DD3D6A8E321BF70DB646BAD
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dasetup.exeexecutable
MD5:9D720F62492B989FE0E9F82F0C5DEDF6
SHA256:07F5E870BA899608166F208912EE06C1ADE72F0063EDD6E31862AFE4FDF92C0E
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\advpack.dllexecutable
MD5:B19CC5CDCBA6FD7254BF00E71C7BE0FA
SHA256:C2CF3936ABC24480F2E813C76FBA4B59B0B4F0F24274154D700523D7C33FE9A7
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mdactwo.cabcompressed
MD5:A280428B1B3EE3CD1DD7DE5C11A71431
SHA256:5319928B9FF307E54A36C9916D62AB4B4E3102BE121F303A9C9C44C8753B622A
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mdaceula.txttext
MD5:F58FED4B0A2FD63314675310815A9BD2
SHA256:B292D22BA74D01CC8B5D9D416B9D58AD612FD6DBE3DBC87BAC1AD2DC272A01E3
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\mtxfiles.cabcompressed
MD5:900DB52B82EC4C8EFDEE8DCFB0DCECB9
SHA256:89538F02A22595B5DCDCF0569643FC1BF5C232A30DB02BFEA4F08603BB883222
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\msvcrt.cabcompressed
MD5:C82AC0D57A93E68CBC1DFB9FD98BC677
SHA256:278DED81C335072D95A8D67C57DEAE8350D4171A855ADFBDE6E5004E71002527
6428Mdac_typ.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\setupapi.dllexecutable
MD5:A38A5767FED8AF75C886EC13899A94F7
SHA256:85E14D5A7AD31615C553B974A44142E7011EA04EEC89471FBD47872B850D8A51
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6908
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5916
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5916
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3560
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3560
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.104.136.2
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.144
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.123
  • 104.126.37.185
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.179
whitelisted
google.com
  • 172.217.18.14
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Mdac_typ.exe