File name:

sys.exe

Full analysis: https://app.any.run/tasks/7463ff94-084c-4eae-a46b-3435593887e9
Verdict: Malicious activity
Analysis date: April 05, 2025, 18:56:20
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
golang
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 8 sections
MD5:

3A10179D48EB4F25F36F581391FAFF26

SHA1:

343140C487120BEB5704AAF2BAE89CD84DAA44A6

SHA256:

BE4F01B3D537B17C5BA7DC1BB7CD4078251364398565A0CA1E96982CFF820B6D

SSDEEP:

98304:3rmPcuP7AwzZFt6KOOMkfCtvZZ23aOhoFsjnhfwF5ALoTgNduNH/6ZSCKY:Bx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 5304)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1188)

    • Create files in the Startup directory

      • powershell.exe (PID: 1188)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • sys.exe (PID: 2100)

    • Starts CMD.EXE for commands execution

      • sys.exe (PID: 2100)

    • Connects to unusual port

      • sys.exe (PID: 2100)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5304)

    • The process executes Powershell scripts

      • cmd.exe (PID: 5304)

  • INFO

    • Drops encrypted JS script (Microsoft Script Encoder)

      • sys.exe (PID: 2100)

    • Detects GO elliptic curve encryption (YARA)

      • sys.exe (PID: 2100)

    • Checks supported languages

      • sys.exe (PID: 2100)

    • Checks operating system version

      • sys.exe (PID: 2100)

    • Application based on Golang

      • sys.exe (PID: 2100)

    • Create files in a temporary directory

      • sys.exe (PID: 2100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 3
CodeSize: 2934272
InitializedDataSize: 351232
UninitializedDataSize: -
EntryPoint: 0x77a80
OSVersion: 6.1
ImageVersion: 1
SubsystemVersion: 6.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
8
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start sys.exe sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1188powershell -ExecutionPolicy Bypass -File create_shortcut.ps1 -targetPath "C:\Users\admin\AppData\Local\Temp\sys.exe" -shortcutPath "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyApp.lnk" -description "MyApp"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2100"C:\Users\admin\AppData\Local\Temp\sys.exe" C:\Users\admin\AppData\Local\Temp\sys.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\sys.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
2692cmd verC:\Windows\System32\cmd.exe—sys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
4200"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4620C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5124\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5304cmd /C powershell -ExecutionPolicy Bypass -File create_shortcut.ps1 -targetPath "C:\Users\admin\AppData\Local\Temp\sys.exe" -shortcutPath "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyApp.lnk" -description "MyApp"C:\Windows\System32\cmd.exe—sys.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
4 774
Read events
4 774
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1188powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyApp.lnkbinary
MD5:5BDF5E432BDBBEF9491885B821376E4A
SHA256:AC5A47F77A5BC24F95C4F65679030C7C0FE3E6992F16262F8151F6D735F12AF0
1188powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pjxbbqok.55k.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1188powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:5EB8A2806816E41C863EF08331CC7B49
SHA256:D87129E6C88DEC7CEE8BA5EE06F2E8DE40A6A32FFB4C9586DF879A49B2481CC7
1188powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ag3ordcw.wv3.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2100sys.exeC:\Users\admin\AppData\Local\Temp\create_shortcut.ps1text
MD5:8609FF5BEE2C73BB6D4C9AA474E937A8
SHA256:C4761D86BD402A13A5242D54B128B2D3A076EB105BDCB7FEB9620516DAB928B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
33
TCP/UDP connections
46
DNS requests
12
Threats
61

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2100
sys.exe
GET
404
40.113.161.85:5000
http://40.113.161.85:5000/helppppiscofebabe23
unknown
—
—
unknown
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2100
sys.exe
POST
400
40.113.161.85:5000
http://40.113.161.85:5000/config
unknown
—
—
unknown
2100
sys.exe
POST
500
40.113.161.85:5000
http://40.113.161.85:5000/login
unknown
—
—
unknown
2100
sys.exe
GET
401
40.113.161.85:5000
http://40.113.161.85:5000/heartbeat
unknown
—
—
unknown
2100
sys.exe
GET
401
40.113.161.85:5000
http://40.113.161.85:5000/tasks
unknown
—
—
unknown
2100
sys.exe
GET
401
40.113.161.85:5000
http://40.113.161.85:5000/tasks
unknown
—
—
unknown
2100
sys.exe
GET
401
40.113.161.85:5000
http://40.113.161.85:5000/tasks
unknown
—
—
unknown
2100
sys.exe
GET
401
40.113.161.85:5000
http://40.113.161.85:5000/tasks
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.141:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2100
sys.exe
40.113.161.85:5000
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
5024
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
40.126.31.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.141
  • 23.48.23.143
  • 23.48.23.173
  • 23.48.23.159
  • 23.48.23.169
  • 23.48.23.166
  • 23.48.23.180
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 40.126.31.128
  • 40.126.31.0
  • 20.190.159.128
  • 40.126.31.1
  • 20.190.159.71
  • 20.190.159.130
  • 40.126.31.67
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2100
sys.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
2100
sys.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
2100
sys.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
2100
sys.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
2100
sys.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
2100
sys.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
2100
sys.exe
Misc activity
SUSPICIOUS [ANY.RUN] Sent Host Name in HTTP POST Body
2100
sys.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
2100
sys.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
2100
sys.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
sys.exe