File name:

cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3

Full analysis: https://app.any.run/tasks/c0d7c07c-947d-452e-a589-6cec1434b5b2
Verdict: Malicious activity
Analysis date: January 10, 2025, 23:43:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

B88BAB75A48B9FEFCD3395AFA9891D69

SHA1:

D35D41A4330B17B8518204A483B8F4800012718A

SHA256:

CB8928597D08E9BB6C3C7EE9DF7EB836DF1F85A9668054765DD6EB75A33516A3

SSDEEP:

49152:CPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtDBo2:oP/mp7t3T4+B/btosJwIA4hHmZlKH2TB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executes application which crashes

      • cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe (PID: 6416)
  • INFO

    • Checks supported languages

      • cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe (PID: 6416)
    • The sample compiled with english language support

      • cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe (PID: 6416)
    • Reads mouse settings

      • cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe (PID: 6416)
    • Create files in a temporary directory

      • cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe (PID: 6416)
    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6640)
    • Reads the software policy settings

      • WerFault.exe (PID: 6640)
    • The process uses AutoIt

      • cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe (PID: 6416)
    • Checks proxy server information

      • WerFault.exe (PID: 6640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x20577
UninitializedDataSize: -
InitializedDataSize: 766464
CodeSize: 633856
LinkerVersion: 14.16
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:18 01:58:20+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe svchost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6416"C:\Users\admin\AppData\Local\Temp\cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe" C:\Users\admin\AppData\Local\Temp\cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6444"C:\Users\admin\AppData\Local\Temp\cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe" C:\Windows\SysWOW64\svchost.execb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6640C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6416 -s 780C:\Windows\SysWOW64\WerFault.exe
cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 095
Read events
3 095
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6640WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_cb8928597d08e9bb_e0df952f5143526731d9a44d3e894db9283884_1682e34d_4610a4cf-af17-48e4-b885-dcc42f2ca17b\Report.wer
MD5:
SHA256:
6640WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6640WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:A0A4C236D1C40DBD9DE2BE2629EF25F6
SHA256:77180945E0EC3A1766C71A954ADA1DD405AF5D986EDFF70ADAB6D56F02C1E74F
6640WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exe.6416.dmpbinary
MD5:7C11771E06163F3E81ED69F6497563E1
SHA256:2EDE5965BC3E518D541383C3352440F2E52228A2CE048EED99809E4EFE87BBA6
6640WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6416cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exeC:\Users\admin\AppData\Local\Temp\chiffonsbinary
MD5:74432259BF5893C866138E3F6F4A795E
SHA256:0619895F80E34FFFA96BC3A207F7AF32433DFFD277FCB91CE071BEC1A41499B3
6416cb8928597d08e9bb6c3c7ee9df7eb836df1f85a9668054765dd6eb75a33516a3.exeC:\Users\admin\AppData\Local\Temp\aut5B04.tmpbinary
MD5:74432259BF5893C866138E3F6F4A795E
SHA256:0619895F80E34FFFA96BC3A207F7AF32433DFFD277FCB91CE071BEC1A41499B3
6640WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:170338F902FB21F4A5F3942DCC80A96B
SHA256:CE66C75D18D9C56FD7C19AC180F0ECA70E42EA76E2941D9BB85728712D0A2945
6640WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER614F.tmp.xmlxml
MD5:39DE19134DA680FC9F7E944716DE3EDC
SHA256:5F93D5D5D36C2528C2FF16DDBF9022D8D74A72305B30B457FAF30F150AE46CBA
6640WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5FA7.tmp.dmpbinary
MD5:D1F865B256FBA45165B1E0467BFB4313
SHA256:9AA9A2CB54DECECDF7F670AD33C609E15BC13BB97F259B537ACCE3268EB12B1F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
33
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6204
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6204
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6640
WerFault.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6640
WerFault.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
5156
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
whitelisted
1176
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.bing.com
  • 104.126.37.128
  • 104.126.37.130
  • 104.126.37.131
  • 104.126.37.145
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.73
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.75
  • 20.190.159.4
  • 20.190.159.71
  • 20.190.159.2
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info