File name:

Atac4D.exe

Full analysis: https://app.any.run/tasks/2b7be2b4-d889-44f3-acb4-4662b5bdd483
Verdict: Malicious activity
Analysis date: December 04, 2023, 08:14:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

CD7B43FF2658AE0182D9F828BECE1C3D

SHA1:

038E0032214034F9B6EC7CFCEC28D110880B0CCB

SHA256:

B60F1BD75C97909983DD79576869146D23AAD8BBB7E96BDCA943C502A5312DC9

SSDEEP:

98304:bBDPcsFsCtw4VZ149XMnYhSd3334CpjBjhxztIR/QQpuGkT8i66+Y5Br7y1CUO0Z:Zd3334+Q3hbWMsA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • TiWorker.exe (PID: 644)

  • SUSPICIOUS

    • Searches for installed software

      • TiWorker.exe (PID: 644)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6968)

    • Process drops legitimate windows executable

      • TiWorker.exe (PID: 644)

  • INFO

    • Checks supported languages

      • Atac4D.exe (PID: 5220)

    • Reads the computer name

      • Atac4D.exe (PID: 5220)

    • Reads the software policy settings

      • TiWorker.exe (PID: 644)

    • Manual execution by a user

      • cmd.exe (PID: 6780)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.ax | DirectShow filter (46.4)
.exe | Win32 EXE PECompact compressed (generic) (9.5)
.exe | Win32 Executable MS Visual C++ (generic) (7.1)
.exe | Win64 Executable (generic) (6.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:11:22 01:19:15+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 86016
InitializedDataSize: 51200
UninitializedDataSize: -
EntryPoint: 0x11690
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Atac4D
FileDescription: Atac4D
FileVersion: 1.0.0.0
InternalName: Atac4D.dll
LegalCopyright:
OriginalFileName: Atac4D.dll
ProductName: Atac4D
ProductVersion: 1.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
12
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start atac4d.exe conhost.exe no specs tiworker.exe no specs sppextcomobj.exe no specs slui.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs tiworker.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1852_none_7de3b01c7cacf858\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1852_none_7de3b01c7cacf858\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Exit code:
0
Version:
10.0.19041.1852 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1852_none_7de3b01c7cacf858\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Atac4D.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3644C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.2180_none_7e328fe47c714aab\TiWorker.exe -EmbeddingC:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.2180_none_7e328fe47c714aab\TiWorker.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Modules Installer Worker
Exit code:
0
Version:
10.0.19041.2180 (WinBuild.160101.0800)
Modules
Images
c:\windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.2180_none_7e328fe47c714aab\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
5220"C:\Users\admin\Desktop\Atac4D.exe" C:\Users\admin\Desktop\Atac4D.exe
explorer.exe
User:
admin
Company:
Atac4D
Integrity Level:
MEDIUM
Description:
Atac4D
Exit code:
2147516576
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\atac4d.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6492C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.1806 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
6524"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
6524\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6532C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:3C:\Windows\System32\SrTasks.exe—TiWorker.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
6760"C:\WINDOWS\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
6780"C:\WINDOWS\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
Total events
96 301
Read events
78 615
Write events
17 573
Delete events
113

Modification events

(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SideBySide
Operation:writeName:LastScavengingStarvationReport
Value:
730D61270A0BD901
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31001382
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31073929
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\COMPONENTS\ServicingStackVersions
Operation:writeName:10.0.19041.1852 (WinBuild.160101.0800)
Value:
2022/12/8:17:3:0.266 10.0.19041.1852 (WinBuild.160101.0800)
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:DoqTime
Value:
0
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:DoqCount
Value:
0
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:PoqTime
Value:
0
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:PoqCount
Value:
0
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:RptTime
Value:
0
(PID) Process:(644) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:RptCount
Value:
0
Executable files
612
Suspicious files
276
Text files
315
Unknown types
8

Dropped files

PID
Process
Filename
Type
644TiWorker.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
644TiWorker.exeC:\WINDOWS\CbsTemp\31073930_114083739\update.mumxml
MD5:100FDABED327B8E0B072A471D1F8F2DA
SHA256:BFDF1C008102B0CB046943D39F3300EEC5FE7915AAA8FB4544232A2EA6DDE41E
644TiWorker.exeC:\Windows\CbsTemp\31073930_114083739\Package_for_ServicingStack_2180~31bf3856ad364e35~amd64~~19041.2180.1.0.catbinary
MD5:5567A485727602AE38136D4175363B7D
SHA256:91C2520F5EB264B730A6526852FD51017428A64D3B884D68D730DC6258936299
644TiWorker.exeC:\Windows\CbsTemp\31073930_114083739\SSU-19041.2180-x64.cab\update.mumxml
MD5:100FDABED327B8E0B072A471D1F8F2DA
SHA256:BFDF1C008102B0CB046943D39F3300EEC5FE7915AAA8FB4544232A2EA6DDE41E
644TiWorker.exeC:\System Volume Information\SPP\OnlineMetadataCache\{9c462b46-0f0b-4430-8529-2bebae37e8ad}_OnDiskSnapshotPropbinary
MD5:4C0464C8014BA2641A2C508782078D46
SHA256:9980F86417989C87CD9B51CDA083A2291F153D542A1CEA800D477C2D0B06AE54
644TiWorker.exeC:\Windows\CbsTemp\31073930_114083739\SSU-19041.2180-x64.cab\x86_microsoft-windows-s..rmers-windows-extra_31bf3856ad364e35_10.0.19041.2180_none_d9af888a9097c1b1.manifestxml
MD5:D4EC9CC50EA99240CD14D3E6F1C05B52
SHA256:7949B678BD6322C69593AC8540076FBD3FABAF368BF7EB7B08DDE595B433F512
644TiWorker.exeC:\Windows\CbsTemp\31073930_114083739\Package_for_ServicingStack_2180~31bf3856ad364e35~amd64~~19041.2180.1.0.mumxml
MD5:100FDABED327B8E0B072A471D1F8F2DA
SHA256:BFDF1C008102B0CB046943D39F3300EEC5FE7915AAA8FB4544232A2EA6DDE41E
644TiWorker.exeC:\Windows\CbsTemp\31073930_114083739\SSU-19041.2180-x64.cab\x86_microsoft-windows-s..rmers-onecore-extra_31bf3856ad364e35_10.0.19041.2180_none_7a1a2a9a15f7b125.manifestxml
MD5:49C49608EEDC478C29B8255E1A54D60E
SHA256:8F56CA760B372BC038F6F09FA66F4AC9197CF9104F0205DFB04E07D72D5A35A7
644TiWorker.exeC:\WINDOWS\Servicing\Sessions\31073930_114083739.xmlxml
MD5:0027C7F0968162E752F1C49EC7AA6F02
SHA256:7D0EB3EE8241D0C5BD117C64E294E501DDF32DA49E602A482A74138D4F02B2DB
644TiWorker.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:4C0464C8014BA2641A2C508782078D46
SHA256:9980F86417989C87CD9B51CDA083A2291F153D542A1CEA800D477C2D0B06AE54
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
259
TCP/UDP connections
98
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
binary
814 b
unknown
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
unknown
binary
813 b
unknown
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
binary
418 b
unknown
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
binary
409 b
unknown
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
unknown
binary
402 b
unknown
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
binary
813 b
unknown
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
binary
401 b
unknown
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
binary
813 b
unknown
2452
svchost.exe
GET
200
23.216.77.75:80
http://download.windowsupdate.com/c/msdownload/update/others/2023/11/40062548_e31f4c07e29aceec114ab33049667dae6f4f23f1.cab
unknown
compressed
7.04 Kb
unknown
2452
svchost.exe
GET
200
23.218.209.163:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
binary
401 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2452
svchost.exe
23.218.209.163:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2452
svchost.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2452
svchost.exe
20.163.45.183:443
fe2cr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2452
svchost.exe
23.216.77.75:80
download.windowsupdate.com
Akamai International B.V.
DE
unknown
624
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3800
svchost.exe
239.255.255.250:1900
—
—
—
unknown
2452
svchost.exe
2.21.20.137:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
3772
MpSigStub.exe
20.189.173.22:443
umwatson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 23.218.209.163
  • 95.101.149.131
  • 184.30.21.171
whitelisted
fe2cr.update.microsoft.com
  • 20.163.45.183
  • 52.152.180.152
whitelisted
download.windowsupdate.com
  • 23.216.77.75
  • 23.216.77.81
  • 23.216.77.44
  • 23.216.77.80
  • 23.216.77.72
  • 23.216.77.48
  • 23.216.77.45
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.76
  • 40.126.32.134
  • 20.190.160.17
  • 20.190.160.22
whitelisted
crl.microsoft.com
  • 2.21.20.137
  • 2.21.20.133
  • 2.16.164.120
  • 2.16.164.49
whitelisted
umwatson.events.data.microsoft.com
  • 20.189.173.22
whitelisted
licensing.mp.microsoft.com
  • 20.123.104.105
whitelisted
fs.microsoft.com
  • 23.35.236.109
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
Process
Message
Atac4D.exe
A fatal error was encountered. Could not extract contents of the bundle
Atac4D.exe
Failure processing application bundle; possible file corruption.
Atac4D.exe
I/O failure reading contents of the bundle.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Atac4D.exe