File name:

Rufus.notexe

Full analysis: https://app.any.run/tasks/b1ec8f00-2671-43b9-b0ca-a0a715d3390c
Verdict: Malicious activity
Analysis date: April 14, 2025, 06:26:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

4D67BE29E650FD5A091053E4D176E0F0

SHA1:

490381BBA97810E7161F80052050E4A5A3217147

SHA256:

CF79751E7240ACA7B1DDCD316471A6612C83163E1182FAC22BB0294E278BC971

SSDEEP:

98304:/kckp4NovdZSarkU1xws+z0SHJevLbM6AJwzC68xteppWPjeGbS4XqBIjw349:msP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the Windows auto-update feature

      • Update.exe (PID: 7200)

    • GENERIC has been found (auto)

      • Rufus.notexe.exe (PID: 672)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Rufus.notexe.exe (PID: 672)

    • Reads the date of Windows installation

      • Rufus.notexe.exe (PID: 672)

    • Executes as Windows Service

      • vds.exe (PID: 7284)

    • Reads security settings of Internet Explorer

      • Update.exe (PID: 7200)
      • Rufus.notexe.exe (PID: 672)

    • There is functionality for taking screenshot (YARA)

      • Rufus.notexe.exe (PID: 672)

  • INFO

    • Disables trace logs

      • Rufus.notexe.exe (PID: 672)

    • Reads Environment values

      • Rufus.notexe.exe (PID: 672)

    • Reads the computer name

      • Rufus.notexe.exe (PID: 672)
      • Update.exe (PID: 7200)

    • Checks proxy server information

      • Rufus.notexe.exe (PID: 672)
      • Update.exe (PID: 7200)

    • Reads the machine GUID from the registry

      • Rufus.notexe.exe (PID: 672)
      • Update.exe (PID: 7200)

    • Reads the software policy settings

      • Rufus.notexe.exe (PID: 672)
      • Update.exe (PID: 7200)

    • Create files in a temporary directory

      • Rufus.notexe.exe (PID: 672)
      • Update.exe (PID: 7200)

    • Process checks computer location settings

      • Rufus.notexe.exe (PID: 672)

    • Checks supported languages

      • Update.exe (PID: 7200)
      • Rufus.notexe.exe (PID: 672)

    • Process checks whether UAC notifications are on

      • Update.exe (PID: 7200)

    • UPX packer has been detected

      • Rufus.notexe.exe (PID: 672)

    • Creates files or folders in the user directory

      • Update.exe (PID: 7200)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (47)
.exe | UPX compressed Win32 Executable (46.1)
.exe | Generic Win/DOS Executable (3.4)
.exe | DOS Executable Generic (3.4)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2047:01:19 11:19:14+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 1800192
InitializedDataSize: 27136
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: CInstaller
FileVersion: 1.0.0.0
InternalName: CInstaller.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: CInstaller.exe
ProductName: CInstaller
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #GENERIC rufus.notexe.exe update.exe no specs update.exe vdsldr.exe no specs vds.exe no specs sppextcomobj.exe no specs slui.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Users\admin\AppData\Local\Temp\Rufus.notexe.exe" C:\Users\admin\AppData\Local\Temp\Rufus.notexe.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
CInstaller
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rufus.notexe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2096"C:\Users\admin\AppData\Local\Temp\Update.exe" C:\Users\admin\AppData\Local\Temp\Update.exe—Rufus.notexe.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
MEDIUM
Description:
Rufus
Exit code:
3221226540
Version:
4.6.2208
Modules
Images
c:\users\admin\appdata\local\temp\update.exe
c:\windows\system32\ntdll.dll
6112C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7200"C:\Users\admin\AppData\Local\Temp\Update.exe" C:\Users\admin\AppData\Local\Temp\Update.exe
Rufus.notexe.exe
User:
admin
Company:
Akeo Consulting
Integrity Level:
HIGH
Description:
Rufus
Version:
4.6.2208
Modules
Images
c:\users\admin\appdata\local\temp\update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7248C:\WINDOWS\System32\vdsldr.exe -EmbeddingC:\Windows\System32\vdsldr.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Virtual Disk Service Loader
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7284C:\WINDOWS\System32\vds.exeC:\Windows\System32\vds.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Virtual Disk Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7392C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7432"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 366
Read events
5 257
Write events
76
Delete events
33

Modification events

(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(672) Rufus.notexe.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Rufus_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
14
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
7200Update.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D9CA54E0FA212456E1DB00704A97658Ebinary
MD5:51530DBCDCF2730539E98A703E6DB61F
SHA256:44A223BDF80749C681C5C9A1A485FFB715C3FB0E5E65F47866D1448EE978AA49
672Rufus.notexe.exeC:\Users\admin\AppData\Local\Temp\Update.exeexecutable
MD5:8FE64DA09AF371B02A31828415ECE8F3
SHA256:8279696C1D78B14618500E9135886A3667B9DECC65946F3729002E4BFDBB20AB
7200Update.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:EE48EF0623BEC477C6F35206C8BE1E8F
SHA256:C1AE2AA16896963EB70D01F15E076D2AEC9AF10AB846E24E8D3732002E468B2B
7200Update.exeC:\Users\admin\AppData\Local\Temp\rufus.initext
MD5:25F951ACCB182500A1A135F7556724C3
SHA256:DEE26225B0313E2A75B3A5B75C615E67C6C20617D50C5A0C17B2A425EAD98609
7200Update.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\sbat_level[1].txttext
MD5:33EB7878275DB3768FE3D6EDFC3097AF
SHA256:0C10AAC051E53C4FBB06492F81FBB4726233C87B38954A68038E1FE68E642B93
7200Update.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Fido[1].vertext
MD5:BE6A01C04E95172B7DFAAD1B15209C29
SHA256:3D2538AEA0FD186FF6C2BFD5659763CD1DA923A2D6A9F3AD24B74D13881246D7
7200Update.exeC:\Users\admin\AppData\Local\Temp\rufus.ini~text
MD5:25F951ACCB182500A1A135F7556724C3
SHA256:DEE26225B0313E2A75B3A5B75C615E67C6C20617D50C5A0C17B2A425EAD98609
7200Update.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25binary
MD5:6624CA1458AAD5C6B0BA336A55CDA114
SHA256:68BEBF32962558A35C1F1B2450F4F0C094015A9D38E8DCF89B704E724A93ECAE
7200Update.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:0C014C71A70DC7758BFDC822E974F1F3
SHA256:8EBD915268E16B55A3ABDE6F612363576FAB5DF656F955D672CCE8889C5FF9CA
7200Update.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90binary
MD5:07E1A2AA6F370AE8AEE20F8F2BA9AAB0
SHA256:D177449F03EB0757AF4D798B03BB2ACECB1E6DA13A49B5CE398E02F96D260BA3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
27
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7200
Update.exe
GET
200
2.16.252.233:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7200
Update.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
7200
Update.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
7200
Update.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
7200
Update.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
7200
Update.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
904
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
904
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
672
Rufus.notexe.exe
104.21.80.1:443
mediumfrier.com
CLOUDFLARENET
—
unknown
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2196
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2196
svchost.exe
224.0.0.251:5353
—
—
—
unknown
7200
Update.exe
185.199.108.153:443
rufus.ie
FASTLY
US
shared
7200
Update.exe
2.16.252.233:80
x1.c.lencr.org
Akamai International B.V.
NL
whitelisted
7200
Update.exe
140.82.121.3:443
github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
google.com
  • 142.250.186.78
whitelisted
mediumfrier.com
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.48.1
  • 104.21.16.1
  • 104.21.112.1
unknown
client.wns.windows.com
  • 172.211.123.248
whitelisted
rufus.ie
  • 185.199.108.153
  • 185.199.109.153
  • 185.199.111.153
  • 185.199.110.153
unknown
x1.c.lencr.org
  • 2.16.252.233
whitelisted
github.com
  • 140.82.121.3
whitelisted
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Rufus.notexe