File name:

SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942

Full analysis: https://app.any.run/tasks/f5a2c572-3a48-40ee-ac49-32754803fb0c
Verdict: Malicious activity
Threats:

Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.

Malware Trends Tracker     >>>
Analysis date: November 09, 2023, 06:50:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
opendir
loader
gcleaner
stealc
stealer
rhadamanthys
amadey
botnet
onlylogger
smoke
phishing
neoreklami
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

65ACBF192DDEF924085504F07E559AD7

SHA1:

991FFA6FAE12E521118BF1800FB9D534037C04FC

SHA256:

CCCC4690ACE16E44F44473C2DF179B5B17E27F863B33ABDA126199014CB224D8

SSDEEP:

6144:lWtuykMCEGs7e4IaLLWCfxMRhU+G36vzgymktD2FqJFCS7tQPD7f8u4GnfF5Kuwj:otuykbEGs7e4IWyCob6LHEB5rMT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • explorer.exe (PID: 1944)

    • Create files in the Startup directory

      • CasPol.exe (PID: 1088)

    • Drops the executable file immediately after the start

      • CasPol.exe (PID: 1088)
      • eOHA2VCsfCBKKMh0RzO51F2N.exe (PID: 2308)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • 5922194382.exe (PID: 1176)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)
      • Install.exe (PID: 1764)
      • Utsysc.exe (PID: 2272)
      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)
      • Install.exe (PID: 3044)
      • updater.exe (PID: 2748)

    • STEALC has been detected (SURICATA)

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • GCLEANER has been detected (SURICATA)

      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Connects to the CnC server

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • explorer.exe (PID: 1944)

    • Runs injected code in another process

      • qfrl0VezEeVkYQAg00KQpUKx.exe (PID: 2820)

    • Application was injected by another process

      • explorer.exe (PID: 1944)

    • Steals credentials

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • rundll32.exe (PID: 1192)

    • RHADAMANTHYS has been detected (SURICATA)

      • dialer.exe (PID: 1180)

    • Changes the autorun value in the registry

      • Utsysc.exe (PID: 2272)

    • Uses Task Scheduler to run other applications

      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 3044)
      • explorer.exe (PID: 1944)
      • hXOvTzQ.exe (PID: 2084)

    • AMADEY has been detected (SURICATA)

      • Utsysc.exe (PID: 2272)

    • Starts CMD.EXE for self-deleting

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Steals credentials from Web Browsers

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)

    • ONLYLOGGER has been detected (YARA)

      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Run PowerShell with an invisible window

      • powershell.EXE (PID: 1824)
      • powershell.EXE (PID: 2868)
      • powershell.EXE (PID: 600)
      • powershell.EXE (PID: 2276)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 1944)

    • Modifies hosts file to block updates

      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)

    • Unusual connection from system programs

      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)
      • rundll32.exe (PID: 2920)
      • rundll32.exe (PID: 2268)

    • Actions looks like stealing of personal data

      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)
      • dllhost.exe (PID: 648)
      • hXOvTzQ.exe (PID: 2084)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Creates a writable file the system directory

      • powershell.exe (PID: 2952)
      • hXOvTzQ.exe (PID: 2084)

    • Neoreklami has been detected

      • hXOvTzQ.exe (PID: 2084)

    • Modifies exclusions in Windows Defender

      • reg.exe (PID: 1448)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • CasPol.exe (PID: 1088)
      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • 5922194382.exe (PID: 1176)
      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 3044)
      • cmd.exe (PID: 2460)
      • powershell.EXE (PID: 1824)
      • powershell.exe (PID: 3068)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)
      • rundll32.exe (PID: 2268)
      • rundll32.exe (PID: 2920)
      • powershell.EXE (PID: 2868)
      • powershell.EXE (PID: 600)
      • Utsysc.exe (PID: 2956)
      • powershell.EXE (PID: 2276)

    • Script adds exclusion path to Windows Defender

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • explorer.exe (PID: 1944)

    • Reads settings of System Certificates

      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Connects to the server without a host name

      • CasPol.exe (PID: 1088)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)

    • Application launched itself

      • qfrl0VezEeVkYQAg00KQpUKx.exe (PID: 2800)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2476)
      • explorer.exe (PID: 1944)

    • Checks Windows Trust Settings

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Reads security settings of Internet Explorer

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Process requests binary or script from the Internet

      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • Utsysc.exe (PID: 2272)

    • Connects to unusual port

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • dialer.exe (PID: 1180)
      • dllhost.exe (PID: 648)
      • explorer.exe (PID: 2852)

    • The process checks if it is being run in the virtual environment

      • dialer.exe (PID: 1180)

    • Searches for installed software

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • dllhost.exe (PID: 648)

    • The process drops Mozilla's DLL files

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Starts CMD.EXE for commands execution

      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • forfiles.exe (PID: 1092)
      • forfiles.exe (PID: 2732)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • explorer.exe (PID: 1944)
      • hXOvTzQ.exe (PID: 2084)

    • Drops 7-zip archiver for unpacking

      • CasPol.exe (PID: 1088)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)

    • The process drops C-runtime libraries

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Starts itself from another location

      • 5922194382.exe (PID: 1176)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)

    • Process drops legitimate windows executable

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Reads the BIOS version

      • Install.exe (PID: 3044)

    • Found strings related to reading or modifying Windows Defender settings

      • forfiles.exe (PID: 1092)
      • forfiles.exe (PID: 2732)
      • hXOvTzQ.exe (PID: 2084)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1012)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 2864)
      • cmd.exe (PID: 2748)
      • cmd.exe (PID: 1448)
      • cmd.exe (PID: 2160)
      • cmd.exe (PID: 1092)
      • cmd.exe (PID: 1072)
      • wscript.exe (PID: 2112)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 312)

    • Reads browser cookies

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Loads DLL from Mozilla Firefox

      • dllhost.exe (PID: 648)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)

    • The process executes via Task Scheduler

      • powershell.EXE (PID: 1824)
      • hXOvTzQ.exe (PID: 2084)
      • Utsysc.exe (PID: 2956)
      • powershell.EXE (PID: 600)
      • powershell.EXE (PID: 2868)
      • powershell.EXE (PID: 2276)

    • Accesses Microsoft Outlook profiles

      • dllhost.exe (PID: 648)
      • rundll32.exe (PID: 1192)
      • rundll32.exe (PID: 1560)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1176)
      • cmd.exe (PID: 1584)

    • Uses powercfg.exe to modify the power settings

      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2380)

    • Executes as Windows Service

      • updater.exe (PID: 2748)
      • raserver.exe (PID: 2940)
      • raserver.exe (PID: 2736)
      • raserver.exe (PID: 2660)

    • Uses NETSH.EXE to obtain data on the network

      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 2380)
      • rundll32.exe (PID: 1092)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1692)

    • Drops a system driver (possible attempt to evade defenses)

      • updater.exe (PID: 2748)

    • Unusual connection from system programs

      • powershell.exe (PID: 2952)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2952)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2112)

  • INFO

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • 5922194382.exe (PID: 1176)
      • khecpDjRjuqIukWbLZDmUWnY.exe (PID: 2744)
      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 3044)

    • Reads the computer name

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • 325VOYHzbgqGiCT0hueR3jb6.exe (PID: 2396)
      • 5922194382.exe (PID: 1176)
      • khecpDjRjuqIukWbLZDmUWnY.exe (PID: 2744)
      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 3044)

    • Checks supported languages

      • SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe (PID: 3020)
      • CasPol.exe (PID: 1088)
      • qfrl0VezEeVkYQAg00KQpUKx.exe (PID: 2800)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2476)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • dm1vwqYFK8abRFgZn7nbzp4z.exe (PID: 2284)
      • AppLaunch.exe (PID: 2676)
      • qfrl0VezEeVkYQAg00KQpUKx.exe (PID: 2820)
      • eOHA2VCsfCBKKMh0RzO51F2N.exe (PID: 2308)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • 325VOYHzbgqGiCT0hueR3jb6.exe (PID: 2396)
      • khecpDjRjuqIukWbLZDmUWnY.exe (PID: 2744)
      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)
      • 5922194382.exe (PID: 1176)
      • Utsysc.exe (PID: 2272)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)
      • Install.exe (PID: 1764)
      • Install.exe (PID: 3044)
      • updater.exe (PID: 2748)
      • hXOvTzQ.exe (PID: 2084)
      • Utsysc.exe (PID: 2956)

    • Reads Environment values

      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Create files in a temporary directory

      • CasPol.exe (PID: 1088)
      • eOHA2VCsfCBKKMh0RzO51F2N.exe (PID: 2308)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • 5922194382.exe (PID: 1176)
      • Y9WclbSmTRO0ryLdJ6aV3Xi6.exe (PID: 1660)
      • Utsysc.exe (PID: 2272)
      • Install.exe (PID: 1764)
      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)
      • Install.exe (PID: 3044)

    • Creates files or folders in the user directory

      • CasPol.exe (PID: 1088)
      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • explorer.exe (PID: 1944)
      • Utsysc.exe (PID: 2272)

    • Checks proxy server information

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • IBYXbieN81AJAXFofh4mSEmZ.exe (PID: 2408)
      • Utsysc.exe (PID: 2272)
      • rundll32.exe (PID: 1560)
      • rundll32.exe (PID: 1192)
      • rundll32.exe (PID: 2268)
      • rundll32.exe (PID: 2920)

    • Reads product name

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Reads CPU info

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)

    • Creates files in the program directory

      • mHMPa76o5Y1e2xa5vGD4kYCd.exe (PID: 2160)
      • vrMlHFrJEre4vJcGRewvCkDG.exe (PID: 244)

    • The executable file from the user directory is run by the CMD process

      • 5922194382.exe (PID: 1176)

    • Manual execution by a user

      • dllhost.exe (PID: 648)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 1944)

    • Reads the Internet Settings

      • explorer.exe (PID: 1944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

OnlyLogger

(PID) Process(2408) IBYXbieN81AJAXFofh4mSEmZ.exe
C285.209.11.204
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (49.4)
.scr | Windows screen saver (23.4)
.dll | Win32 Dynamic Link Library (generic) (11.7)
.exe | Win32 Executable (generic) (8)
.exe | Generic Win/DOS Executable (3.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:07 19:07:31+01:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 433075
InitializedDataSize: 3584
UninitializedDataSize: -
EntryPoint: 0x6bbad
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.34.311.48
ProductVersionNumber: 6.34.311.48
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: IWaYiCOgA
FileDescription: AvOvEma AKiJoAaGI eUUwUNaAiwE AKeuIkiv EVAfA uzUlaLu edayu OLEPuP.
FileVersion: 6.34.311.48
InternalName: AnAZUXoX
LegalCopyright: © 2023 IWaYiCOgA.
OriginalFileName: aEoJOoA
ProductName: iEOKapuooy
ProductVersion: 6.34.311.48
Comments: OhaOOb UhiVoVi uTInusA IPok EDeHiI isedOcOj aOExIV oqIJeNeu IrOraIExU.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
288
Monitored processes
157
Malicious processes
31
Suspicious processes
7

Behavior graph

Click at the process to see the details
start inject securiteinfo.com.il.trojan.msilzilla.30386.95.11942.exe no specs powershell.exe no specs caspol.exe qfrl0vezeevkyqag00kqpukx.exe no specs ibyxbien81ajaxfofh4msemz.exe no specs #STEALC mhmpa76o5y1e2xa5vgd4kycd.exe dm1vwqyfk8abrfgzn7nbzp4z.exe no specs applaunch.exe qfrl0vezeevkyqag00kqpukx.exe no specs eoha2vcsfcbkkmh0rzo51f2n.exe no specs #ONLYLOGGER ibyxbien81ajaxfofh4msemz.exe #RHADAMANTHYS dialer.exe 325voyhzbgqgict0huer3jb6.exe khecpdjrjuqiukwblzdmuwny.exe no specs vrmlhfrjere4vjcgrewvckdg.exe no specs vrmlhfrjere4vjcgrewvckdg.exe cmd.exe no specs 5922194382.exe no specs #AMADEY utsysc.exe y9wclbsmtro0ryldj6av3xi6.exe no specs y9wclbsmtro0ryldj6av3xi6.exe dllhost.exe schtasks.exe no specs install.exe no specs install.exe no specs forfiles.exe no specs forfiles.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs gpupdate.exe no specs #SMOKE explorer.exe powershell.exe cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs schtasks.exe cmd.exe powercfg.exe no specs schtasks.exe powercfg.exe no specs powercfg.exe no specs schtasks.exe powercfg.exe no specs updater.exe no specs rundll32.exe no specs rundll32.exe netsh.exe no specs rundll32.exe no specs rundll32.exe netsh.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs taskkill.exe no specs powershell.exe raserver.exe no specs cmd.exe sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs cmd.exe sc.exe no specs powercfg.exe no specs schtasks.exe powercfg.exe no specs conhost.exe powercfg.exe no specs powercfg.exe no specs explorer.exe rundll32.exe rundll32.exe #NEOREKLAMI hxovtzq.exe utsysc.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs gpupdate.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs raserver.exe no specs gpupdate.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs wscript.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs raserver.exe no specs gpupdate.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
244"C:\Users\admin\Pictures\vrMlHFrJEre4vJcGRewvCkDG.exe" C:\Users\admin\Pictures\vrMlHFrJEre4vJcGRewvCkDG.exe
CasPol.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\vrmlhfrjere4vjcgrewvckdg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
284"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64C:\Windows\SysWOW64\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
288"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VxrjVBYufVUn" /t REG_DWORD /d 0 /reg:32C:\Windows\SysWOW64\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
312"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\admin\Pictures\mHMPa76o5Y1e2xa5vGD4kYCd.exe" & del "C:\ProgramData\*.dll"" & exitC:\Windows\SysWOW64\cmd.exe—mHMPa76o5Y1e2xa5vGD4kYCd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
460sc stop wuauserv C:\Windows\System32\sc.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1062
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
584"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe" -ForceC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
600C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
648"C:\Windows\system32\dllhost.exe"C:\Windows\System32\dllhost.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
796"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NmcYmBndU" /t REG_DWORD /d 0 /reg:64C:\Windows\SysWOW64\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
952C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"C:\Windows\System32\schtasks.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
33 007
Read events
32 401
Write events
605
Delete events
1

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(3020) SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3020) SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3020) SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3020) SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1088) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1088) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1088) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1088) CasPol.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1088) CasPol.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
47
Suspicious files
56
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
584powershell.exeC:\Users\admin\AppData\Local\Temp\whsg3whd.uj3.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
584powershell.exeC:\Users\admin\AppData\Local\Temp\ol1wploz.hoa.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1088CasPol.exeC:\Users\admin\AppData\Local\qfjHtvN5u1Tb1jqoc19sLzZc.exehtml
MD5:FCAD815E470706329E4E327194ACC07C
SHA256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
1088CasPol.exeC:\Users\admin\AppData\Local\Temp\CabA8AA.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
1088CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SKzpki8Tqr48N3x5Yks7kgYz.battext
MD5:D26623166462B5C38F029F5172DA76D7
SHA256:175AD6A1C9F404C0B77B88F4B4B230506505104C28476FAE6CDF3C2449C60792
1088CasPol.exeC:\Users\admin\AppData\Local\Temp\TarA8DC.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
1088CasPol.exeC:\Users\admin\Pictures\Q55LBaQ0GHyj5hUM39vJpsbj.exehtml
MD5:FCAD815E470706329E4E327194ACC07C
SHA256:280D939A66A0107297091B3B6F86D6529EF6FAC222A85DBC82822C3D5DC372B8
1088CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BRETfSbWV4QmgcY9xvnbWv9S.battext
MD5:57DE6BA43A8460F69CAF82729E331A2C
SHA256:14B2213913C86C20715AB6ACD9EF46871790E7BED69C773375C8A5B4E7473DF4
1088CasPol.exeC:\Users\admin\Pictures\IBYXbieN81AJAXFofh4mSEmZ.exeexecutable
MD5:2969F0854C39B8675D1CC6FC184E466F
SHA256:10B1C07CDB1FCF27D73392369141B77671472DB7494B7234314C3DB3A7A10A79
1088CasPol.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\q95y0WADZ9dgu6sKOt1ONlub.battext
MD5:D6DAF94EF21334D7DB0488284F0E0A0E
SHA256:CB9C1D614FF3A754F7319F96BA0284972CEAA86D84369300D2334C01AB0F13D5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
57
DNS requests
31
Threats
116

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2160
mHMPa76o5Y1e2xa5vGD4kYCd.exe
GET
200
116.203.165.60:2087
http://116.203.165.60:2087/
unknown
—
—
—
1088
CasPol.exe
GET
200
194.49.94.67:80
http://194.49.94.67/files/My2.exe
unknown
executable
5.24 Mb
—
1088
CasPol.exe
GET
200
85.209.11.204:80
http://85.209.11.204/api/files/software/s5.exe
unknown
executable
326 Kb
—
2408
IBYXbieN81AJAXFofh4mSEmZ.exe
GET
200
85.209.11.204:80
http://85.209.11.204/api/files/client/s51
unknown
executable
887 Kb
—
1088
CasPol.exe
GET
200
5.42.67.10:80
http://5.42.67.10/setupdownload.exe
unknown
executable
1.41 Mb
—
1088
CasPol.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?56e02b563dbccaec
unknown
compressed
61.6 Kb
—
2408
IBYXbieN81AJAXFofh4mSEmZ.exe
GET
200
85.209.11.204:80
http://85.209.11.204/ip.php
unknown
text
13 b
—
1088
CasPol.exe
GET
301
185.26.182.112:80
http://net.geo.opera.com/opera/stable/windows/?utm_medium=apb&utm_source=mkt&utm_campaign=767
unknown
html
162 b
—
2160
mHMPa76o5Y1e2xa5vGD4kYCd.exe
POST
200
116.203.165.60:2087
http://116.203.165.60:2087/
unknown
text
2 b
—
2160
mHMPa76o5Y1e2xa5vGD4kYCd.exe
POST
200
116.203.165.60:2087
http://116.203.165.60:2087/
unknown
text
1.52 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1088
CasPol.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
4
System
192.168.100.255:137
—
—
—
unknown
1088
CasPol.exe
104.21.93.225:443
flyawayaero.net
CLOUDFLARENET
—
unknown
1088
CasPol.exe
194.49.94.85:443
632432.space
Enes Koken
DE
unknown
1088
CasPol.exe
104.21.32.208:443
lycheepanel.info
CLOUDFLARENET
—
unknown
1088
CasPol.exe
179.61.12.110:443
globalsystemperu.com
TECNOWEB PERU SAC
CL
unknown
1088
CasPol.exe
194.49.94.67:80
—
Enes Koken
DE
unknown
1088
CasPol.exe
85.209.11.204:80
—
LLC Baxet
RU
unknown
1088
CasPol.exe
5.42.67.10:80
—
CJSC Kolomna-Sviaz TV
RU
unknown
1088
CasPol.exe
185.26.182.112:80
net.geo.opera.com
Opera Software AS
—
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.68.143
  • 104.20.67.143
unknown
flyawayaero.net
  • 104.21.93.225
  • 172.67.216.81
unknown
gobo11fc.top
  • 89.191.234.21
unknown
632432.space
  • 194.49.94.85
unknown
galandskiyher5.com
  • 95.214.26.28
unknown
lycheepanel.info
  • 104.21.32.208
  • 172.67.187.122
unknown
net.geo.opera.com
  • 185.26.182.112
  • 185.26.182.111
unknown
globalsystemperu.com
  • 179.61.12.110
unknown
yip.su
  • 188.114.97.3
  • 188.114.96.3
unknown
ctldl.windowsupdate.com
  • 95.140.236.128
  • 178.79.242.128
  • 95.140.236.0
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
—
—
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
—
—
Misc activity
ET INFO Packed Executable Download
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
13 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.IL.Trojan.MSILZilla.30386.95.11942