File name:

SecuriteInfo.com.Win64.MalwareX-gen.28143.14946

Full analysis: https://app.any.run/tasks/62f6c8c1-375c-4e8c-b404-3dd0d5a54491
Verdict: Malicious activity
Analysis date: February 07, 2025, 07:49:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
websocket
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

EDB36F0B073880C0839BBFC52A47D9EA

SHA1:

CE9096CABD391217DA3CA77B57C790183572551C

SHA256:

D4ECAF00D4FAD4BB1CAEEA2A8998765552B4633DD415D4842A90AEF19DEAA1CE

SSDEEP:

98304:mF2y+AMXJHzOdJ4cljGmruOB4vO3aN+/y2JUAaekaVTybaOfHGDCyrgBcSn9wDZW:Og

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)

    • Starts SC.EXE for service management

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)

    • Executes as Windows Service

      • syslog.exe (PID: 3140)

    • Script adds exclusion path to Windows Defender

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)

    • Executable content was dropped or overwritten

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)

    • Creates a new Windows service

      • sc.exe (PID: 1392)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)
      • syslog.exe (PID: 3140)
      • syslog.exe (PID: 4204)

    • Reads the computer name

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)
      • syslog.exe (PID: 3140)

    • The sample compiled with english language support

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)

    • Creates files or folders in the user directory

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 6656)

    • Manual execution by a user

      • syslog.exe (PID: 4204)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6656)

    • Reads the machine GUID from the registry

      • SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe (PID: 6620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2048:07:09 16:48:46+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 12733440
InitializedDataSize: 171008
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 12.32.11.2
ProductVersionNumber: 12.32.11.2
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: By accessing or using the Services, you agree to our Privacy Policy
CompanyName: Meazure Learning’s
FileDescription: ProctorU
FileVersion: 12.32.11.2
InternalName: ProctorU.exe
LegalCopyright: California Consumer Privacy Act of 2019 as amended by the California Privacy Rights Act of 2020 (“CCPA”)
LegalTrademarks: ProctorU Inc.
OriginalFileName: ProctorU.exe
ProductName: ProctorU Test Taker
ProductVersion: 12.32.11.2
AssemblyVersion: 4.53.3.5
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
8
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start securiteinfo.com.win64.malwarex-gen.28143.14946.exe powershell.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs syslog.exe syslog.exe no specs securiteinfo.com.win64.malwarex-gen.28143.14946.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1392"sc.exe" create LogMgrv3 binPath= "C:\Users\admin\AppData\Local\packages\syslog.exe 9ZE+37yC8l6+xov/QPzfifFGpsrP50m0kNi4WezWmPIv0KzvySvOmw==" displayName= "LogMgrv3" start= autoC:\Windows\System32\sc.exe—SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3140C:\Users\admin\AppData\Local\packages\syslog.exe 9ZE+37yC8l6+xov/QPzfifFGpsrP50m0kNi4WezWmPIv0KzvySvOmw==C:\Users\admin\AppData\Local\Packages\syslog.exe
services.exe
User:
SYSTEM
Company:
Linker Corporation
Integrity Level:
SYSTEM
Description:
Linker Manager
Version:
10.1.19041.4124 (WinBuild.162101.00)
Modules
Images
c:\users\admin\appdata\local\packages\syslog.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
3840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4204"C:\Users\admin\Desktop\syslog.exe" C:\Users\admin\Desktop\syslog.exe—explorer.exe
User:
admin
Company:
Linker Corporation
Integrity Level:
MEDIUM
Description:
Linker Manager
Exit code:
0
Version:
10.1.19041.4124 (WinBuild.162101.00)
Modules
Images
c:\users\admin\desktop\syslog.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
6480"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe—explorer.exe
User:
admin
Company:
Meazure Learning’s
Integrity Level:
MEDIUM
Description:
ProctorU
Exit code:
3221226540
Version:
12.32.11.2
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win64.malwarex-gen.28143.14946.exe
c:\windows\system32\ntdll.dll
6620"C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe" C:\Users\admin\AppData\Local\Temp\SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe
explorer.exe
User:
admin
Company:
Meazure Learning’s
Integrity Level:
HIGH
Description:
ProctorU
Exit code:
0
Version:
12.32.11.2
Modules
Images
c:\users\admin\appdata\local\temp\securiteinfo.com.win64.malwarex-gen.28143.14946.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6656"powershell.exe" -Command "Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 600
Read events
5 600
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6620SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exeC:\Users\admin\AppData\Local\Packages\favicon06.png —
MD5:—
SHA256:—
6620SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exeC:\Users\admin\AppData\Local\Packages\syslog.exeexecutable
MD5:5CA07995BB258734D595E7AF0F7F41F9
SHA256:38F53E0706BF40CDFD638CA1EC5E8A2D35BE8C5143D0167AED1A7FFA14B8921D
6656powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_5htf2aie.pts.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6620SecuriteInfo.com.Win64.MalwareX-gen.28143.14946.exeC:\Users\admin\AppData\Local\Packages\beads.zipcompressed
MD5:6256AE4E0B2785CD1A435E3CA96BAF41
SHA256:E8A7E25363F8C6A05347F6C7ECC78CF28DEF4C1925BDD12C6D90FC779C30D328
6656powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:D7A780288163E6D6FFFD0680AE2CC82F
SHA256:53D2D10034F7DD322E6C83ACB43F35451F7624C0D6A3ACFA538F9E5D031CF6FA
6656powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_bgezlcgo.cuv.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
34
DNS requests
19
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3140
syslog.exe
GET
101
54.38.216.83:443
http://register.mspike.ca:443/ws
unknown
—
—
unknown
7052
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5388
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5388
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3928
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.164.72:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3928
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.21.65.157:443
www.bing.com
Akamai International B.V.
NL
whitelisted
1176
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.9
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.21.65.157
  • 2.21.65.154
  • 2.21.65.134
  • 2.21.65.146
  • 2.21.65.132
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.132
  • 40.126.32.138
  • 20.190.160.65
  • 20.190.160.14
  • 20.190.160.64
  • 40.126.32.68
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
3140
syslog.exe
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
3140
syslog.exe
Misc activity
ET INFO Cloudflare DNS Over HTTPS Certificate Inbound
Process
Message
syslog.exe
windows_service: service_main started
syslog.exe
try_run_service
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Win64.MalwareX-gen.28143.14946