| File name: | d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a |
| Full analysis: | https://app.any.run/tasks/118f6927-b516-463d-bb21-12f269c3758a |
| Verdict: | Malicious activity |
| Analysis date: | January 10, 2025, 23:21:52 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections |
| MD5: | B97DBB6214E6E4FE973A955F746BB596 |
| SHA1: | E00292FB4FC9A18002A1EEBB3617677A184CBF66 |
| SHA256: | D11EE620483C0E54C1CAB3C5ADB8464A07B501F30A482EBD1025C4841E7C548A |
| SSDEEP: | 49152:PPPkzemqoSut3Jh4+QQ/btosJwIA4hHmZlKH2Tw/Pq83zw0bCjvk9G661QGtc0d1:nP/mp7t3T4+B/btosJwIA4hHmZlKH2Tj |
MALICIOUS
No malicious indicators.SUSPICIOUS
Executes application which crashes
- d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe (PID: 6260)
INFO
Creates files or folders in the user directory
- WerFault.exe (PID: 6588)
Reads mouse settings
- d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe (PID: 6260)
The process uses AutoIt
- d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe (PID: 6260)
Checks supported languages
- d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe (PID: 6260)
The sample compiled with english language support
- d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe (PID: 6260)
Reads the software policy settings
- WerFault.exe (PID: 6588)
Create files in a temporary directory
- d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe (PID: 6260)
Checks proxy server information
- WerFault.exe (PID: 6588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (76.4) |
|---|---|---|
| .exe | | | Win32 Executable (generic) (12.4) |
| .exe | | | Generic Win/DOS Executable (5.5) |
| .exe | | | DOS Executable Generic (5.5) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:12:18 03:02:56+00:00 |
| ImageFileCharacteristics: | Executable, Large address aware, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.16 |
| CodeSize: | 633856 |
| InitializedDataSize: | 630784 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x20577 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 0.0.0.0 |
| ProductVersionNumber: | 0.0.0.0 |
| FileFlagsMask: | 0x0000 |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (British) |
| CharacterSet: | Unicode |
Total processes
130
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 6260 | "C:\Users\admin\AppData\Local\Temp\d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe" | C:\Users\admin\AppData\Local\Temp\d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225477 Modules
| |||||||||||||||
| 6588 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6260 -s 724 | C:\Windows\SysWOW64\WerFault.exe | d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
2 067
Read events
2 067
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
6
Text files
2
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6588 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_d11ee620483c0e54_692b26a2e1e3486cda9d61eb365d1070c1734a_9bbf4086_0ea2036a-d981-4c8f-837f-14b3377f7d1e\Report.wer | — | |
MD5:— | SHA256:— | |||
| 6588 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D37.tmp.WERInternalMetadata.xml | xml | |
MD5:DB56A85FD113713701DBD88D55F46EB7 | SHA256:F2D98ABB8F149AA8CBE1123732634C73F61B4B0A7DEDD7436F0554FB08DC045B | |||
| 6588 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER5D67.tmp.xml | xml | |
MD5:E7F7A7F5FD5BEF212268B19B7C52E62A | SHA256:9F87DEAA3A607DBAAD2955CF83212790E6706F66C5927E759235E8705AC159A9 | |||
| 6588 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785 | der | |
MD5:F6F53CD09A41E968C363419B279D3112 | SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892 | |||
| 6588 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FE | der | |
MD5:FA84E4BCC92AA5DB735AB50711040CDE | SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33 | |||
| 6260 | d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe | C:\Users\admin\AppData\Local\Temp\unbarricadoed | binary | |
MD5:CD0B137374AFADD675B3D6CE4CB93937 | SHA256:770135273F294C7D7E84B58CB1EF0F56A5B2AFDA657E245E3465FF62C4D2C849 | |||
| 6588 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WER5BEE.tmp.dmp | binary | |
MD5:B394E1C35334AC14E28DFB1719FA10CB | SHA256:F0300B83BC60E43D2B8B43631502F2E67C47DC54DCAF8EF8660D00F0670B63F7 | |||
| 6260 | d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe | C:\Users\admin\AppData\Local\Temp\aut571C.tmp | binary | |
MD5:CD0B137374AFADD675B3D6CE4CB93937 | SHA256:770135273F294C7D7E84B58CB1EF0F56A5B2AFDA657E245E3465FF62C4D2C849 | |||
| 6588 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\d11ee620483c0e54c1cab3c5adb8464a07b501f30a482ebd1025c4841e7c548a.exe.6260.dmp | binary | |
MD5:16E93321385DA3550DC050EE6BF4BCB8 | SHA256:CB3201E87CECE1BBC61EA7BC358B8D57A7647BDCEF97863E3FD57CFE814B1E4A | |||
| 6588 | WerFault.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785 | binary | |
MD5:398B9B6E448F69A26CBBF311DFFA6C11 | SHA256:ADEC5211CB426EF2D74C2860DAA3D2B0B2AC9A745F07289DF9EDEA2E0E238DA3 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
35
DNS requests
21
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6588 | WerFault.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
6588 | WerFault.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
6348 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
4684 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4684 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
— | — | 104.126.37.131:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
— | — | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 20.190.160.17:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1076 | svchost.exe | 23.35.238.131:443 | go.microsoft.com | AKAMAI-AS | DE | whitelisted |
1176 | svchost.exe | 40.126.32.134:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
watson.events.data.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |