| File name: | Mxs_win7-11_MSTerams_2.36.exe |
| Full analysis: | https://app.any.run/tasks/4d4dc2a7-3a45-45d0-989c-25df5edbf521 |
| Verdict: | Malicious activity |
| Threats: | A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices. |
| Analysis date: | June 01, 2025, 15:15:06 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections |
| MD5: | 5365A0E786C2772BE3D642AFABFB6525 |
| SHA1: | 09AFE24EE212EE0978FD9C8A89F6945C8046C30D |
| SHA256: | C88AB130CE39EB602B71AA22312B20C9485C86AE6680B2081701312E5321F780 |
| SSDEEP: | 196608:Xtj6gO0DG99C9jJoiXEgzzmNq020YVQ3MJxDmTmqazY+E3NCcqLZE3OAltbS:XYg5yOJo2zzmQlBFCTWbCNHtOx |
MALICIOUS
XORed URL has been found (YARA)
- Sioixerozzy.exe (PID: 1512)
Vulnerable driver has been detected
- Sioixerozzy.exe (PID: 1512)
Changes Windows Defender settings
- Sioixerozzy.exe (PID: 1512)
Adds path to the Windows Defender exclusion list
- Sioixerozzy.exe (PID: 1512)
SILVERFOX has been detected (SURICATA)
- QMUpload.exe (PID: 5360)
Connects to the CnC server
- QMUpload.exe (PID: 5360)
WINOS has been detected (YARA)
- QMUpload.exe (PID: 5360)
SUSPICIOUS
Reads security settings of Internet Explorer
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 2332)
Executable content was dropped or overwritten
- Mxs_win7-11_MSTerams_2.36.exe (PID: 7484)
- Mxs_win7-11_MSTerams_2.36.exe (PID: 4892)
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
- Sioixerozzy.exe (PID: 1512)
Process drops legitimate windows executable
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
- Sioixerozzy.exe (PID: 1512)
The process drops C-runtime libraries
- Sioixerozzy.exe (PID: 1512)
Detected use of alternative data streams (AltDS)
- Sioixerozzy.exe (PID: 1512)
Executes as Windows Service
- QMUpload.exe (PID: 6368)
Script adds exclusion path to Windows Defender
- Sioixerozzy.exe (PID: 1512)
Starts POWERSHELL.EXE for commands execution
- Sioixerozzy.exe (PID: 1512)
Application launched itself
- QMUpload.exe (PID: 6368)
Connects to unusual port
- QMUpload.exe (PID: 5360)
There is functionality for taking screenshot (YARA)
- QMUpload.exe (PID: 5360)
Searches for installed software
- QMUpload.exe (PID: 5360)
Contacting a server suspected of hosting an CnC
- QMUpload.exe (PID: 5360)
Reads the Windows owner or organization settings
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
INFO
Process checks computer location settings
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 2332)
Checks supported languages
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 2332)
- Mxs_win7-11_MSTerams_2.36.exe (PID: 4892)
- Sioixerozzy.exe (PID: 1512)
- QMUpload.exe (PID: 6368)
- QMUpload.exe (PID: 5360)
- Mxs_win7-11_MSTerams_2.36.exe (PID: 7484)
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
Create files in a temporary directory
- Mxs_win7-11_MSTerams_2.36.exe (PID: 7484)
- Mxs_win7-11_MSTerams_2.36.exe (PID: 4892)
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
- Sioixerozzy.exe (PID: 1512)
Reads the computer name
- Mxs_win7-11_MSTerams_2.36.exe (PID: 7484)
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
- Sioixerozzy.exe (PID: 1512)
- QMUpload.exe (PID: 6368)
- QMUpload.exe (PID: 5360)
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 2332)
The sample compiled with english language support
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
- Sioixerozzy.exe (PID: 1512)
The sample compiled with chinese language support
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
- Sioixerozzy.exe (PID: 1512)
Creates files or folders in the user directory
- Mxs_win7-11_MSTerams_2.36.tmp (PID: 6584)
Reads the machine GUID from the registry
- Sioixerozzy.exe (PID: 1512)
Checks proxy server information
- Sioixerozzy.exe (PID: 1512)
- slui.exe (PID: 7504)
Creates files in the program directory
- Sioixerozzy.exe (PID: 1512)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 4228)
Reads Environment values
- QMUpload.exe (PID: 5360)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 4228)
Reads product name
- QMUpload.exe (PID: 5360)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
xor-url
(PID) Process(1512) Sioixerozzy.exe
Decrypted-URLs (31)http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
http://crl.globalsign.com/gs/gscodesigng2.crl0
http://crl.globalsign.com/gs/gstimestampingg2.crl0T
http://crl.globalsign.net/root.crl0
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
http://ocsp.digicert.com0
http://ocsp.digicert.com0A
http://ocsp.digicert.com0C
http://ocsp.digicert.com0X
http://ocsp2.globalsign.com/gscodesigng20
http://secure.globalsign.com/cacert/gscodesigng2.crt04
http://secure.globalsign.com/cacert/gstimestampingg2.crt0
http://www.digicert.com/CPS0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pkiops/Docs/Repository.htm0
http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0
http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crt0
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l
http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crl0
https://www.globalsign.com/repository/0
https://www.globalsign.com/repository/03
https://www.microsoft.com/en-us/windows
Decrypted-URLs (9)http://crl.globalsign.com/gs/gscodesigng2.crl0
http://crl.globalsign.com/gs/gstimestampingg2.crl0T
http://crl.globalsign.net/root.crl0
http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0
http://ocsp2.globalsign.com/gscodesigng20
http://secure.globalsign.com/cacert/gscodesigng2.crt04
http://secure.globalsign.com/cacert/gstimestampingg2.crt0
https://www.globalsign.com/repository/0
https://www.globalsign.com/repository/03
TRiD
| .exe | | | Inno Setup installer (67.7) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (25.6) |
| .exe | | | Win32 Executable (generic) (2.7) |
| .exe | | | Win16/32 Executable Delphi generic (1.2) |
| .exe | | | Generic Win/DOS Executable (1.2) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:07:12 07:26:53+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 685056 |
| InitializedDataSize: | 171520 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xa83bc |
| OSVersion: | 6.1 |
| ImageVersion: | - |
| SubsystemVersion: | 6.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | |
| FileDescription: | IEGKLSHJGHLKRHGLJKERH2003KLJSTHKLREHYKJGYK Setup |
| FileVersion: | |
| LegalCopyright: | |
| OriginalFileName: | |
| ProductName: | IEGKLSHJGHLKRHGLJKERH2003KLJSTHKLREHYKJGYK |
| ProductVersion: | 4.7.14.16 |
Total processes
137
Monitored processes
10
Malicious processes
7
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1512 | "C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\Sioixerozzy.exe" | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\Sioixerozzy.exe | Mxs_win7-11_MSTerams_2.36.tmp | ||||||||||||
User: admin Company: PF SKB Kontur AO Integrity Level: HIGH Description: Kontur.Plugin Exit code: 0 Version: 4.8.0.1504 Modules
xor-url(PID) Process(1512) Sioixerozzy.exe Decrypted-URLs (31)http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0 http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0 http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C http://crl.globalsign.com/gs/gscodesigng2.crl0 http://crl.globalsign.com/gs/gstimestampingg2.crl0T http://crl.globalsign.net/root.crl0 http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0 http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0 http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0 http://crl3.digicert.com/DigiCertTrustedRootG4.crl0 http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0 http://ocsp.digicert.com0 http://ocsp.digicert.com0A http://ocsp.digicert.com0C http://ocsp.digicert.com0X http://ocsp2.globalsign.com/gscodesigng20 http://secure.globalsign.com/cacert/gscodesigng2.crt04 http://secure.globalsign.com/cacert/gstimestampingg2.crt0 http://www.digicert.com/CPS0 http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0 http://www.microsoft.com/pkiops/Docs/Repository.htm0 http://www.microsoft.com/pkiops/certs/Microsoft%20Time-Stamp%20PCA%202010(1).crt0 http://www.microsoft.com/pkiops/certs/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crt0 http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl0l http://www.microsoft.com/pkiops/crl/Microsoft%20Windows%20Third%20Party%20Component%20CA%202014.crl0 https://www.globalsign.com/repository/0 https://www.globalsign.com/repository/03 https://www.microsoft.com/en-us/windows (PID) Process(1512) Sioixerozzy.exe Decrypted-URLs (9)http://crl.globalsign.com/gs/gscodesigng2.crl0 http://crl.globalsign.com/gs/gstimestampingg2.crl0T http://crl.globalsign.net/root.crl0 http://crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0 http://ocsp2.globalsign.com/gscodesigng20 http://secure.globalsign.com/cacert/gscodesigng2.crt04 http://secure.globalsign.com/cacert/gstimestampingg2.crt0 https://www.globalsign.com/repository/0 https://www.globalsign.com/repository/03 | |||||||||||||||
| 2332 | "C:\Users\admin\AppData\Local\Temp\is-MKIIS.tmp\Mxs_win7-11_MSTerams_2.36.tmp" /SL5="$60364,33385641,857600,C:\Users\admin\AppData\Local\Temp\Mxs_win7-11_MSTerams_2.36.exe" | C:\Users\admin\AppData\Local\Temp\is-MKIIS.tmp\Mxs_win7-11_MSTerams_2.36.tmp | — | Mxs_win7-11_MSTerams_2.36.exe | |||||||||||
User: admin Company: Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 4016 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4228 | powershell.exe -Command "Add-MpPreference -ExclusionPath "C:\ProgramData\5b3eOGXN"" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | Sioixerozzy.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4892 | "C:\Users\admin\AppData\Local\Temp\Mxs_win7-11_MSTerams_2.36.exe" | C:\Users\admin\AppData\Local\Temp\Mxs_win7-11_MSTerams_2.36.exe | explorer.exe | ||||||||||||
User: admin Company: Integrity Level: MEDIUM Description: IEGKLSHJGHLKRHGLJKERH2003KLJSTHKLREHYKJGYK Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 5360 | "C:\ProgramData\5b3eOGXN\QMUpload.exe" | C:\ProgramData\5b3eOGXN\QMUpload.exe | QMUpload.exe | ||||||||||||
User: SYSTEM Company: Tencent Integrity Level: SYSTEM Description: 腾讯电脑管家-下载中心 Version: 17.6.27115.207 Modules
| |||||||||||||||
| 6368 | C:\ProgramData\5b3eOGXN\QMUpload.exe | C:\ProgramData\5b3eOGXN\QMUpload.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Tencent Integrity Level: SYSTEM Description: 腾讯电脑管家-下载中心 Version: 17.6.27115.207 Modules
| |||||||||||||||
| 6584 | "C:\Users\admin\AppData\Local\Temp\is-7IT9B.tmp\Mxs_win7-11_MSTerams_2.36.tmp" /SL5="$140274,33385641,857600,C:\Users\admin\AppData\Local\Temp\Mxs_win7-11_MSTerams_2.36.exe" /SPAWNWND=$8031C /NOTIFYWND=$60364 | C:\Users\admin\AppData\Local\Temp\is-7IT9B.tmp\Mxs_win7-11_MSTerams_2.36.tmp | Mxs_win7-11_MSTerams_2.36.exe | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 7484 | "C:\Users\admin\AppData\Local\Temp\Mxs_win7-11_MSTerams_2.36.exe" /SPAWNWND=$8031C /NOTIFYWND=$60364 | C:\Users\admin\AppData\Local\Temp\Mxs_win7-11_MSTerams_2.36.exe | Mxs_win7-11_MSTerams_2.36.tmp | ||||||||||||
User: admin Company: Integrity Level: HIGH Description: IEGKLSHJGHLKRHGLJKERH2003KLJSTHKLREHYKJGYK Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 7504 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
6 926
Read events
6 923
Write events
3
Delete events
0
Modification events
| (PID) Process: | (1512) Sioixerozzy.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\SKBKontur |
| Operation: | write | Name: | clientId |
Value: dae02723-7300-4ac9-a856-1b511ae3cd8d | |||
| (PID) Process: | (5360) QMUpload.exe | Key: | HKEY_USERS\.DEFAULT\Software\Microsoft\ActiveMovie\devenum |
| Operation: | write | Name: | Version |
Value: 7 | |||
| (PID) Process: | (5360) QMUpload.exe | Key: | HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\Console |
| Operation: | write | Name: | InstallTime_ATK |
Value: 2025-06-01 15:15:50 | |||
Executable files
17
Suspicious files
7
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1512 | Sioixerozzy.exe | C:\ProgramData\5b3eOGXN\QMStuck.dll | — | |
MD5:— | SHA256:— | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\README.md | text | |
MD5:F10079BFE84A68E061DA63F6433AF922 | SHA256:F67855A06F828C7D90A181EAD88C1574F7EA3DF20C9B9D4C15B81C50B64B1104 | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\is-RA0AL.tmp | executable | |
MD5:A88CA8E2493936C370BBE4A9594B1228 | SHA256:0C95E113C7D53FD05AC8A9B5CE88AB9DA6330BD3DCB4407AEB6969625E9343AF | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\is-E48A3.tmp | text | |
MD5:F10079BFE84A68E061DA63F6433AF922 | SHA256:F67855A06F828C7D90A181EAD88C1574F7EA3DF20C9B9D4C15B81C50B64B1104 | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\Sioixerozzy.exe | executable | |
MD5:A88CA8E2493936C370BBE4A9594B1228 | SHA256:0C95E113C7D53FD05AC8A9B5CE88AB9DA6330BD3DCB4407AEB6969625E9343AF | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\is-3PVMN.tmp | binary | |
MD5:222609CBAE5F0229E95BCE8BBD5D0AED | SHA256:EE6F5B9ACF5F88A2F9615677844CE0AC0F605C28C45E198FDE7CF45518881157 | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\libdefr.dat | binary | |
MD5:781E429CFAF4200F9ADC1E936D3A442E | SHA256:3CC80D1168B2C693C2E04946D3DF32996E32F9AFB983F959BF8D16AA66C8E8AF | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\is-JR91A.tmp | binary | |
MD5:781E429CFAF4200F9ADC1E936D3A442E | SHA256:3CC80D1168B2C693C2E04946D3DF32996E32F9AFB983F959BF8D16AA66C8E8AF | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\is-UETTH.tmp | executable | |
MD5:7EE6219D0F497752AA7F1C129CA50BC1 | SHA256:C8DB62BED2305B35860BA601C926F664DA5C49CB58DB6E364F0ED2805AF511F0 | |||
| 6584 | Mxs_win7-11_MSTerams_2.36.tmp | C:\Users\admin\AppData\Roaming\fslkegjlksjhlkehsftjdrhyGYfuhkhesgdrhdrhdrtgykftjftjFTJFTJSEFgykGSDFDFHrdhrhdfgyjgyksgfftjtfjftjhulwesdgjek\unins000.dat | binary | |
MD5:222609CBAE5F0229E95BCE8BBD5D0AED | SHA256:EE6F5B9ACF5F88A2F9615677844CE0AC0F605C28C45E198FDE7CF45518881157 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
14
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1328 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
1328 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.164:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5056 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3176 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.164:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5056 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 40.126.32.68:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
activation-v2.sls.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5360 | QMUpload.exe | Malware Command and Control Activity Detected | ET MALWARE Winos4.0 Framework CnC Login Message |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | BACKDOOR [ANY.RUN] SilverFox Keep-Alive Client Packet |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | BACKDOOR [ANY.RUN] SilverFox Keep-Alive Client Packet |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | BACKDOOR [ANY.RUN] SilverFox Keep-Alive Client Packet |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | BACKDOOR [ANY.RUN] SilverFox Keep-Alive Client Packet |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | BACKDOOR [ANY.RUN] SilverFox Keep-Alive Client Packet |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | ET MALWARE Winos4.0 Framework CnC Login Message |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | BACKDOOR [ANY.RUN] SilverFox Keep-Alive Client Packet |
5360 | QMUpload.exe | Malware Command and Control Activity Detected | ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response |