download:

/vir/Email-Worm.Win32.Klez.j

Full analysis: https://app.any.run/tasks/281fc921-33f1-494f-85c8-b838ec683b4b
Verdict: Malicious activity
Analysis date: November 29, 2024, 19:04:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

F477642546DD6689C82AC94F9FC759ED

SHA1:

E597F2022267F3FA501E8CE028EDFB8B78701148

SHA256:

CA4F2482A20213A18223C0DF962F80E5C0B9DCB8BEB6D487CA421EBFFEAB7AF7

SSDEEP:

768:NiSaRtej7M/ilW4OWoRZJxVEe61NlBgfBIaFMzaTZl7Rw0MsWfN501oWr5noVr/D:NGilW41c68bFzTC7sWedoVr/kk3j9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the AppInit_DLLs value (autorun option)

      • Ms8649.exe (PID: 3204)
      • Winkihp.exe (PID: 2248)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Winkihp.exe (PID: 2248)
      • Ms8649.exe (PID: 3204)
      • Email-Worm.Win32.Klez.j.exe (PID: 2292)

    • Process drops legitimate windows executable

      • Winkihp.exe (PID: 2248)

    • Detected use of alternative data streams (AltDS)

      • Winkihp.exe (PID: 2248)

    • Executes as Windows Service

      • Winkihp.exe (PID: 2248)

  • INFO

    • Reads the computer name

      • Email-Worm.Win32.Klez.j.exe (PID: 1936)
      • Email-Worm.Win32.Klez.j.exe (PID: 2292)
      • Winkihp.exe (PID: 2248)
      • Ms8649.exe (PID: 3204)

    • Checks supported languages

      • Winkihp.exe (PID: 2248)
      • Ms8649.exe (PID: 3204)
      • Email-Worm.Win32.Klez.j.exe (PID: 1936)
      • Email-Worm.Win32.Klez.j.exe (PID: 2292)

    • Creates files in the program directory

      • Winkihp.exe (PID: 2248)

    • Checks proxy server information

      • Winkihp.exe (PID: 2248)

    • Manual execution by a user

      • Email-Worm.Win32.Klez.j.exe (PID: 2292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2002:01:18 01:22:13+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 49152
InitializedDataSize: 557056
UninitializedDataSize: -
EntryPoint: 0x80c8
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
4
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start email-worm.win32.klez.j.exe no specs email-worm.win32.klez.j.exe winkihp.exe ms8649.exe

Process information

PID
CMD
Path
Indicators
Parent process
1936"C:\Users\admin\Desktop\Email-Worm.Win32.Klez.j.exe" C:\Users\admin\Desktop\Email-Worm.Win32.Klez.j.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\email-worm.win32.klez.j.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
2248C:\Windows\system32\Winkihp.exeC:\Windows\System32\Winkihp.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\windows\system32\winkihp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
2292"C:\Users\admin\Desktop\Email-Worm.Win32.Klez.j.exe" C:\Users\admin\Desktop\Email-Worm.Win32.Klez.j.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\email-worm.win32.klez.j.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
3204"C:\Windows\TEMP\Ms8649.exe"C:\Windows\Temp\Ms8649.exe
Winkihp.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\temp\ms8649.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
c:\windows\system32\sfc.dll
Total events
745
Read events
664
Write events
77
Delete events
4

Modification events

(PID) Process:(3204) Ms8649.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Operation:writeName:AppInit_DLLs
Value:
Wqk.dll
(PID) Process:(2248) Winkihp.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2248) Winkihp.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2248) Winkihp.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2248) Winkihp.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2248) Winkihp.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2248) Winkihp.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000000A00000009000000000000000000000000000000040000000000000000000000000000000000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2248) Winkihp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Operation:writeName:AppInit_DLLs
Value:
Wqk.dll
Executable files
24
Suspicious files
12
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2248Winkihp.exe —
MD5:—
SHA256:—
2248Winkihp.exeC:\Windows\Temp\Ms8649.exeexecutable
MD5:A1C5D27CF366E27E4BD6F14A9436CBD5
SHA256:A828596F42BF4279F4E822F036842A7C126633962220E919D2484CBF28633D4B
3204Ms8649.exeC:\Windows\System32\Wqk.dllexecutable
MD5:A1C5D27CF366E27E4BD6F14A9436CBD5
SHA256:A828596F42BF4279F4E822F036842A7C126633962220E919D2484CBF28633D4B
2248Winkihp.exeC:\Windows\Temp\TaBE19.exeexecutable
MD5:A3296BF2AF57D5B0C751B97B05FEBE94
SHA256:E1C79219414D3C5ACCD89047CA7B8E8BE4252F9C90799B00D0AAF38B6714CA10
2248Winkihp.exeC:\Windows\Temp\Okd86B8.exeexecutable
MD5:A3296BF2AF57D5B0C751B97B05FEBE94
SHA256:E1C79219414D3C5ACCD89047CA7B8E8BE4252F9C90799B00D0AAF38B6714CA10
2248Winkihp.exeC:\Program Files\Java\jre1.8.0_271\bin\javaws.exeexecutable
MD5:4979B8B23DEE646D94886CD1942304E3
SHA256:3202609A6F325ED9D0425561C6020CE34B11271A9BFE789C81F66F9EDC03A743
2248Winkihp.exeC:\Windows\Temp\ZlxAA23.exeexecutable
MD5:A3296BF2AF57D5B0C751B97B05FEBE94
SHA256:E1C79219414D3C5ACCD89047CA7B8E8BE4252F9C90799B00D0AAF38B6714CA10
2248Winkihp.exeC:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.qvsbinary
MD5:34082166B7D60F7BA4FF1BBE6EFCD332
SHA256:F40CE708B380EBC8DE3F590A574CD829C8F3F6C275B651612C2CE8F47CEA1186
2248Winkihp.exeC:\Windows\Temp\Ohu86A7.exeexecutable
MD5:A3296BF2AF57D5B0C751B97B05FEBE94
SHA256:E1C79219414D3C5ACCD89047CA7B8E8BE4252F9C90799B00D0AAF38B6714CA10
2248Winkihp.exeC:\Program Files\Java\jre1.8.0_271\bin\javaws.bmrbinary
MD5:B8171F10D03D4442CD33956CF8AD729F
SHA256:B1BAAA73F10EFCD59E540493265CADC8E2F52960976F5FA1CE5BB1ECAA412528
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/vir/Email-Worm.Win32.Klez.j