We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
23 March 2019, 14:48
Analysis environment:
Windows 7 Pro, build 7601, x86
Clean201903211242_xp_compress.exe
MD5:
1133537AF207AC1925C3E2B26C6D75B1
SHA1:
AAC7BD49CDAB50F6C206C9736614D39180535931
SHA256:
BAAF3D2485FF9FF393BD67DD3CE6E029D5F9F3580BF8379BBF8780C4283AE34C
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis Clean201903211242_xp_compress.exe (MD5: 1133537AF207AC1925C3E2B26C6D75B1) Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Starts NET.EXE to view/add/change user profiles
cmd.exe (PID: 2208)
Uses Task Scheduler to run other applications
cmd.exe (PID: 3632)
cmd.exe (PID: 2388)
cmd.exe (PID: 3192)
cmd.exe (PID: 4060)
cmd.exe (PID: 3684)
cmd.exe (PID: 2520)
cmd.exe (PID: 3296)
cmd.exe (PID: 2280)
cmd.exe (PID: 3128)
cmd.exe (PID: 2864)
cmd.exe (PID: 2260)
cmd.exe (PID: 4052)
cmd.exe (PID: 3660)
cmd.exe (PID: 1672)
cmd.exe (PID: 2924)
cmd.exe (PID: 3772)
cmd.exe (PID: 3664)
cmd.exe (PID: 2412)
cmd.exe (PID: 3236)
Loads the Task Scheduler COM API
schtasks.exe (PID: 3816)
schtasks.exe (PID: 2648)
schtasks.exe (PID: 3428)
schtasks.exe (PID: 2200)
schtasks.exe (PID: 3908)
schtasks.exe (PID: 2744)
schtasks.exe (PID: 3588)
schtasks.exe (PID: 2512)
schtasks.exe (PID: 3396)
schtasks.exe (PID: 3756)
schtasks.exe (PID: 3248)
schtasks.exe (PID: 3112)
schtasks.exe (PID: 2300)
schtasks.exe (PID: 3164)
schtasks.exe (PID: 2676)
schtasks.exe (PID: 2460)
schtasks.exe (PID: 3612)
schtasks.exe (PID: 2708)
schtasks.exe (PID: 3508)
SUSPICIOUS
Starts SC.EXE for service management
cmd.exe (PID: 2220)
cmd.exe (PID: 2760)
cmd.exe (PID: 3232)
cmd.exe (PID: 2764)
cmd.exe (PID: 3752)
cmd.exe (PID: 2236)
cmd.exe (PID: 3212)
cmd.exe (PID: 3748)
Starts CMD.EXE for commands execution
Clean201903211242_xp_compress.exe (PID: 3472)
Uses TASKKILL.EXE to kill process
cmd.exe (PID: 1512)
cmd.exe (PID: 3048)
Uses NETSH.EXE for network configuration
cmd.exe (PID: 3416)
cmd.exe (PID: 2648)
INFO
No info indicators.
Threats
No threats detected