File name:

d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07

Full analysis: https://app.any.run/tasks/bec561db-6dd6-4f45-a8dc-b0105fe11713
Verdict: Malicious activity
Analysis date: January 03, 2025, 04:05:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

829ECC80D8246BE38ADD680762425162

SHA1:

ADDEE915B475A25F75AD3FC3DCC63A7A36AE616E

SHA256:

D49656C69AFA69B93E60A74A52F1653248B1C4AF7D137295C10DF46FD618AB07

SSDEEP:

384:982w+Xa+UPj/seGZJ0GQJgGPibM7wq/40sIABo6lE:982NXzUrszjYgGPig7FWo6lE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe (PID: 5392)

  • SUSPICIOUS

    • Uses TASKKILL.EXE to kill process

      • d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe (PID: 5392)

    • Executable content was dropped or overwritten

      • d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe (PID: 5392)

  • INFO

    • Checks supported languages

      • d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe (PID: 5392)

    • The sample compiled with english language support

      • d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe (PID: 5392)

    • Create files in a temporary directory

      • d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe (PID: 5392)

    • Failed to create an executable file in Windows directory

      • d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe (PID: 5392)

    • Creates files or folders in the user directory

      • d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe (PID: 5392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2006:01:26 23:27:38+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 12288
InitializedDataSize: 8192
UninitializedDataSize: 36864
EntryPoint: 0xc470
OSVersion: 4
ImageVersion: 1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Word Document
CompanyName: |“~|~|~|•~|~|Œ~O…„
FileDescription: Word Document
ProductName: |“~|~|~|•~|~|Œ~O…„
FileVersion: 1
ProductVersion: 1
InternalName: Document
OriginalFileName: Document.exe
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
29
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe taskkill.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
836TASKKILL /S COMPUTERNAME /F /IM lsass.exe /TC:\Windows\SysWOW64\taskkill.exe—d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1296\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512TASKKILL /S COMPUTERNAME /F /IM smss.exe /TC:\Windows\SysWOW64\taskkill.exe—d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1580TASKKILL /S COMPUTERNAME /F /IM winlogon.exe /TC:\Windows\SysWOW64\taskkill.exe—d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2100\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2212TASKKILL /S COMPUTERNAME /F /IM services.exe /TC:\Windows\SysWOW64\taskkill.exe—d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2736TASKKILL /S COMPUTERNAME /F /IM services.exe /TC:\Windows\SysWOW64\taskkill.exe—d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3000\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3144\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 133
Read events
4 126
Write events
4
Delete events
3

Modification events

(PID) Process:(5392) d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Bron-Spizaetus
Value:
(PID) Process:(5392) d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Tok-Cirrhatus
Value:
(PID) Process:(5392) d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Tok-Cirrhatus-1860
Value:
(PID) Process:(5392) d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Security\status
Operation:writeName:last-check
Value:
RfYSceYO†™†
(PID) Process:(5392) d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Security\status
Operation:writeName:last-check7
Value:
RfYSceYrvrwtxO†™†
(PID) Process:(5392) d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:1E82BD8.exe
Value:
C:\WINDOWS\1E82BD8.exe
(PID) Process:(5392) d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeKey:HKEY_CURRENT_USER\SOFTWARE\VB and VBA Program Settings\Security\status
Operation:writeName:value
Value:
”†„–“†X
Executable files
1
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
5392d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeC:\Users\admin\AppData\Roaming\[r][o][n][t][o][k].dochtml
MD5:16E7774F34DDAC0F2C10E105B0F6D261
SHA256:78E6E26B5B8BBCBAF00D78505B9E65E890A908C57C600A8EA54BC8B0C9232CFD
5392d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeC:\Users\Public\Documents\Sejarah Pembuat Virus Brontok.exeexecutable
MD5:AEC884C0B341987B8AFD306964E98468
SHA256:8E3EB3A51EE224D0406EB6924D108064C167C20630426078BCA25F87E07F2414
5392d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07.exeC:\Users\admin\AppData\Local\Temp\~DF4CC06B6014C57150.TMPbinary
MD5:39CF34F9BF1473E9D8CC720678A0B16F
SHA256:FD35B74234E0EB02BA24BADC284C660C887D8E533A26EDBDF23CD845FF331060
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
60
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1380
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4804
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1380
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4804
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1380
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4804
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2192
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2192
svchost.exe
224.0.0.251:5353
—
—
—
unknown
1380
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4804
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
self.events.data.microsoft.com
  • 20.42.72.131
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
d49656c69afa69b93e60a74a52f1653248b1c4af7d137295c10df46fd618ab07