File name:

windows.exe

Full analysis: https://app.any.run/tasks/d4068c74-73b2-4586-b4ef-32c5c66686ca
Verdict: Malicious activity
Threats:

INC Ransomware is a ransomware-as-a-service (RaaS) spotted in mid-2023. It targets industries like retail, real estate, finance, healthcare, and education, primarily in the U.S. and UK. It encrypts and exfiltrates data demanding a ransom. It employs advanced evasion techniques, destroys backup, and abuses legitimate system tools at all the stages of the kill chain.

Malware Trends Tracker     >>>
Analysis date: January 13, 2025, 14:40:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
inc
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

38ECA0067E68A296B6142CDC9F43F5A5

SHA1:

E58763611A199E785A7A492BE9F6EC7628DED535

SHA256:

CB320D0C18A399F8473B69C0E472180A0AA21B3936BDCC5FC290620412265C61

SSDEEP:

3072:BUViX88MYMorfeSEQvVYxVZ/cY+aci6V5SoksuJBrfuaOxlMEZsPeB2D4ecGzMWX:OiLCSEVcio5S0kByvQEMNX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • INC has been detected (YARA)

      • windows.exe (PID: 6376)

    • INC has been detected

      • windows.exe (PID: 6376)

    • Renames files like ransomware

      • windows.exe (PID: 6376)

    • INC note has been found

      • windows.exe (PID: 6376)

  • SUSPICIOUS

    • Executes as Windows Service

      • FXSSVC.exe (PID: 9668)

    • Changes the desktop background image

      • windows.exe (PID: 6376)

    • Reads security settings of Internet Explorer

      • ONENOTE.EXE (PID: 9784)

  • INFO

    • Reads the computer name

      • windows.exe (PID: 6376)
      • ONENOTE.EXE (PID: 9784)

    • Checks supported languages

      • windows.exe (PID: 6376)
      • ONENOTE.EXE (PID: 9784)

    • Creates files or folders in the user directory

      • windows.exe (PID: 6376)
      • ONENOTE.EXE (PID: 9784)

    • Reads the machine GUID from the registry

      • windows.exe (PID: 6376)
      • ONENOTE.EXE (PID: 9784)

    • Creates files in the program directory

      • windows.exe (PID: 6376)

    • Reads security settings of Internet Explorer

      • printfilterpipelinesvc.exe (PID: 9556)

    • Create files in a temporary directory

      • windows.exe (PID: 6376)

    • Reads Microsoft Office registry keys

      • ONENOTE.EXE (PID: 9784)

    • Reads Environment values

      • ONENOTE.EXE (PID: 9784)

    • Checks proxy server information

      • ONENOTE.EXE (PID: 9784)

    • Reads the software policy settings

      • ONENOTE.EXE (PID: 9784)

    • Sends debugging messages

      • ONENOTE.EXE (PID: 9784)

    • Reads product name

      • ONENOTE.EXE (PID: 9784)

    • Reads CPU info

      • ONENOTE.EXE (PID: 9784)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:04:09 08:25:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 105472
InitializedDataSize: 61952
UninitializedDataSize: -
EntryPoint: 0x9a34
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #INC windows.exe no specs conhost.exe no specs printfilterpipelinesvc.exe no specs fxssvc.exe no specs onenote.exe onenotem.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6376"C:\Users\admin\Desktop\windows.exe" C:\Users\admin\Desktop\windows.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\windows.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—windows.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6464/tsrC:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE—ONENOTE.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Send to OneNote Tool
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\onenotem.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
9556C:\WINDOWS\system32\printfilterpipelinesvc.exe -EmbeddingC:\Windows\System32\printfilterpipelinesvc.exe—svchost.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Print Filter Pipeline Host
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\printfilterpipelinesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
9668C:\WINDOWS\system32\fxssvc.exeC:\Windows\System32\FXSSVC.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Fax Service
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\fxssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shlwapi.dll
9784/insertdoc "C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\{69B8D48F-45DC-48DF-B0BB-40BF17414B4F}.xps" 133812529432450000C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
printfilterpipelinesvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneNote
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\onenote.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
Total events
9 535
Read events
9 268
Write events
237
Delete events
30

Modification events

(PID) Process:(6376) windows.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:Wallpaper
Value:
C:\Users\admin\AppData\Local\Temp\\background-image.jpg
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Security
Operation:writeName:Descriptor
Value:
010004805C000000680000000000000014000000020048000300000000001800E7020E000102000000000005200000002002000000001400030002000101000000000001000000000000140027020200010100000000000504000000010100000000000514000000010100000000000514000000
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax
Operation:writeName:RedirectionGuard
Value:
1
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:Password
Value:
00
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:delete valueName:Password
Value:
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:Server
Value:
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:From
Value:
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Receipts
Operation:writeName:User
Value:
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Outbound Routing\Groups\<All devices>
Operation:writeName:Devices
Value:
(PID) Process:(9668) FXSSVC.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fax\Outbound Routing\Rules\0:0
Operation:writeName:CountryCode
Value:
0
Executable files
0
Suspicious files
499
Text files
271
Unknown types
32

Dropped files

PID
Process
Filename
Type
6376windows.exeC:\Users\admin\AppData\Local\VirtualStore\INC-README.html —
MD5:—
SHA256:—
6376windows.exeC:\Users\admin\AppData\Local\VirtualStore\INC-README.txt —
MD5:—
SHA256:—
6376windows.exeC:\ProgramData\INC-README.html —
MD5:—
SHA256:—
6376windows.exeC:\ProgramData\INC-README.txt —
MD5:—
SHA256:—
6376windows.exeC:\ProgramData\Adobe\INC-README.html —
MD5:—
SHA256:—
6376windows.exeC:\ProgramData\Adobe\INC-README.txt —
MD5:—
SHA256:—
6376windows.exeC:\ProgramData\Adobe\ARM\INC-README.html —
MD5:—
SHA256:—
6376windows.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\INC-README.html —
MD5:—
SHA256:—
6376windows.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\INC-README.txt —
MD5:—
SHA256:—
6376windows.exeC:\ProgramData\Adobe\ARM\Acrobat_23.001.20093\AcroRdrDCx64Upd2300820470_MUI.msp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
23
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
svchost.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
svchost.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
52.109.89.18:443
https://officeclient.microsoft.com/config16/?lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3
unknown
xml
178 Kb
whitelisted
—
—
POST
200
40.79.167.8:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
—
—
whitelisted
—
—
GET
200
52.113.194.132:443
https://ecs.office.com/config/v2/Office/onenote/16.0.16026.20146/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=onenote&Platform=win32&Version=16.0.16026.20146&MsoVersion=16.0.16026.20002&SDX=fa000000002.2.0.1907.31003&SDX=fa000000005.1.0.1909.30011&SDX=fa000000006.1.0.1909.13002&SDX=fa000000008.1.0.1908.16006&SDX=fa000000009.1.0.1908.6002&SDX=fa000000016.1.0.1810.13001&SDX=fa000000029.1.0.1906.25001&SDX=fa000000033.1.0.1908.24001&SDX=wa104381125.1.0.1810.9001&ProcessName=onenote.exe&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=6&LicenseSKU=OneNoteFreeRetail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7bDEE50CB8-CEAE-4720-946C-EE5F9FA6CA8D%7d&LabMachine=false
unknown
tss
368 Kb
whitelisted
—
—
POST
200
20.189.173.6:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
binary
10 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.19.122.63:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
svchost.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
svchost.exe
23.209.214.100:80
www.microsoft.com
PT. Telekomunikasi Selular
ID
whitelisted
—
—
23.209.214.100:80
www.microsoft.com
PT. Telekomunikasi Selular
ID
whitelisted
4712
MoUsoCoreWorker.exe
23.209.214.100:80
www.microsoft.com
PT. Telekomunikasi Selular
ID
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.19.122.63
  • 2.19.122.13
  • 2.19.122.9
  • 2.19.122.60
  • 2.19.122.8
  • 2.19.122.5
  • 2.19.122.65
  • 2.19.122.7
  • 2.19.122.64
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 23.209.214.100
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
self.events.data.microsoft.com
  • 20.189.173.6
  • 13.89.179.8
whitelisted

Threats

No threats detected
Process
Message
ONENOTE.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
ONENOTE.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
ONENOTE.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
ONENOTE.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
ONENOTE.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
ONENOTE.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
windows.exe