File name:

DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe

Full analysis: https://app.any.run/tasks/706ab4e8-6b1e-4b1f-a8bd-7214e80fedcc
Verdict: Malicious activity
Analysis date: July 27, 2024, 15:15:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

01015C09ECAC7AA2183E28B0A7411534

SHA1:

2BE58E37D1BAA54976FEA24C77808B1E8627A13D

SHA256:

D8CADD14BAE26D3FDE3D53A1EEEFB0AABA7696FB68D66608023A3E26A8BA642D

SSDEEP:

49152:3NWb4ELMN4/kcICRQ3oZ6xYJ1DeEFiDsxW8fdzIdssOFIoyRUB2+IssTEqJeS2uF:3NmXLD2Eqtjdz1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 4384)
      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)
      • ProfituApplication.exe (PID: 7124)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 4384)
      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)

    • Reads the date of Windows installation

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 4384)
      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)

    • Drops 7-zip archiver for unpacking

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)
      • ProfituApplication.exe (PID: 7124)

    • Application launched itself

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 4384)

    • Executable content was dropped or overwritten

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)
      • ProfituApplication.exe (PID: 7124)

    • Creates/Modifies COM task schedule object

      • ProfituApplication.exe (PID: 7124)

    • Creates a software uninstall entry

      • ProfituApplication.exe (PID: 7124)

  • INFO

    • Creates files in the program directory

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)
      • ProfituApplication.exe (PID: 7124)

    • Process checks computer location settings

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 4384)
      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)

    • Checks supported languages

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)
      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 4384)
      • ProfituApplication.exe (PID: 7124)

    • Reads the computer name

      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 4384)
      • DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe (PID: 2668)
      • ProfituApplication.exe (PID: 7124)

    • Reads the software policy settings

      • slui.exe (PID: 6324)

    • Checks proxy server information

      • slui.exe (PID: 6324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:08 08:12:52+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 4759552
InitializedDataSize: 413696
UninitializedDataSize: -
EntryPoint: 0x43ac3a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Profit Application Company Solutions
FileDescription: Profit Application
FileVersion: 1, 0, 0, 0
InternalName: ProfitApplication.exe
LegalCopyright: © 2024
LegalTrademarks: -
OriginalFileName: ProfitApplication.exe
ProductName: Profit Application
ProductVersion: 1, 0, 0, 0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
4
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start deadpool-and-wolverine-2024-1080p-v1-clean-hdt_319762.exe no specs deadpool-and-wolverine-2024-1080p-v1-clean-hdt_319762.exe profituapplication.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2668"C:\Users\admin\AppData\Local\Temp\DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe" /upC:\Users\admin\AppData\Local\Temp\DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe
DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe
User:
admin
Company:
Profit Application Company Solutions
Integrity Level:
HIGH
Description:
Profit Application
Exit code:
0
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\appdata\local\temp\deadpool-and-wolverine-2024-1080p-v1-clean-hdt_319762.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4384"C:\Users\admin\AppData\Local\Temp\DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe" C:\Users\admin\AppData\Local\Temp\DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe—explorer.exe
User:
admin
Company:
Profit Application Company Solutions
Integrity Level:
MEDIUM
Description:
Profit Application
Exit code:
0
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\appdata\local\temp\deadpool-and-wolverine-2024-1080p-v1-clean-hdt_319762.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6324C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7124"C:\Program Files (x86)\ProfitutnApplication\ProfituApplication.exe" C:\Program Files (x86)\ProfitutnApplication\ProfituApplication.exe
DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Installer
Exit code:
0
Version:
22.01
Modules
Images
c:\program files (x86)\profitutnapplication\profituapplication.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
Total events
6 533
Read events
6 496
Write events
37
Delete events
0

Modification events

(PID) Process:(4384) DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4384) DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4384) DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4384) DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2668) DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2668) DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2668) DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2668) DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7124) ProfituApplication.exeKey:HKEY_CURRENT_USER\SOFTWARE\7-Zip
Operation:writeName:Path64
Value:
C:\Program Files\7-Zip\
(PID) Process:(7124) ProfituApplication.exeKey:HKEY_CURRENT_USER\SOFTWARE\7-Zip
Operation:writeName:Path
Value:
C:\Program Files\7-Zip\
Executable files
10
Suspicious files
1
Text files
97
Unknown types
2

Dropped files

PID
Process
Filename
Type
7124ProfituApplication.exeC:\Program Files\7-Zip\Lang\ast.txttext
MD5:1F86AE235BC747A279C9E9EC72675CE4
SHA256:8FCD1B8CE6FED05F406C4B81AEA821132800BC494D3FD6F42A4258A81F8998EC
7124ProfituApplication.exeC:\Program Files\7-Zip\Lang\af.txttext
MD5:FBBE51ACB879B525CC6B19D386697924
SHA256:3793FB69EE9FD958CF15A272B1ED54E4B3D75592836EBCD085DC0E7B1400D1CB
7124ProfituApplication.exeC:\Program Files\7-Zip\descript.iontext
MD5:EB7E322BDC62614E49DED60E0FB23845
SHA256:1DA513F5A4E8018B9AE143884EB3EAF72454B606FD51F2401B7CFD9BE4DBBF4F
7124ProfituApplication.exeC:\Program Files\7-Zip\Lang\ba.txttext
MD5:D83B65AC086DA0C94D6EB57BEE669C2B
SHA256:2901B54F7621C95429658CB4EDB28ABD0CB5B6E257C7D9A364FC468A8B86BAAE
7124ProfituApplication.exeC:\Program Files\7-Zip\Lang\bg.txttext
MD5:833AFB4F88FDB5F48245C9B65577DC19
SHA256:4DCABCC8AB8069DB79143E4C62B6B76D2CF42666A09389EACFC35074B61779E3
7124ProfituApplication.exeC:\Program Files\7-Zip\7-zip.chmchm
MD5:34208890A28244903621CD32CC3FBDFC
SHA256:4B6939646570C9DDB5BFD39B8503EED99D8C64337E72F6DD4F9DDCFB4AC76703
7124ProfituApplication.exeC:\Program Files\7-Zip\Lang\bn.txttext
MD5:D0E788F64268D15B4391F052B1F4B18A
SHA256:216CC780E371DC318C8B15B84DE8A5EC0E28F712B3109A991C8A09CDDAA2A81A
2668DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exeC:\Program Files (x86)\ProfitutnApplication\ProfituApplication.exeexecutable
MD5:A6A0F7C173094F8DAFEF996157751ECF
SHA256:B055FEE85472921575071464A97A79540E489C1C3A14B9BDFBDBAB60E17F36E4
7124ProfituApplication.exeC:\Program Files\7-Zip\Lang\co.txttext
MD5:8E9EBA50A1FD7469D183A3CF4E806BB3
SHA256:0F485681C606F422F6EB7311A1F151873B47EED2832A129C2550B868E6610CD9
7124ProfituApplication.exeC:\Program Files\7-Zip\Lang\de.txttext
MD5:40AE22F5BCBEAB6F622771562D584F2B
SHA256:06E5265A2B30807296480DC0B0D3A27E41F1381D61229E4EB239C4930D14A43E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
56
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4424
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5368
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
3548
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3676
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4132
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6064
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
131.253.33.254:443
a-ring-fallback.msedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
—
—
92.123.104.23:443
www.bing.com
Akamai International B.V.
DE
unknown
484
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6012
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6572
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3952
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4772
slui.exe
40.91.76.224:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
t-ring-fdv2.msedge.net
  • 13.107.237.254
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 51.104.136.2
whitelisted
a-ring-fallback.msedge.net
  • 131.253.33.254
unknown
www.bing.com
  • 92.123.104.23
  • 92.123.104.41
  • 92.123.104.30
  • 92.123.104.39
  • 92.123.104.29
  • 92.123.104.37
  • 92.123.104.32
  • 92.123.104.31
  • 92.123.104.34
whitelisted
google.com
  • 142.250.185.174
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.76
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fp-afd-nocache-ccp.azureedge.net
  • 13.107.246.45
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DeadPool-and-Wolverine-2024-1080p-V1-Clean-HDT_319762.exe