File name:

TornadoSCF.exe

Full analysis: https://app.any.run/tasks/7e046d7b-7f4f-4f9a-a1b1-626cc52edfa8
Verdict: Malicious activity
Analysis date: November 16, 2024, 18:52:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

1298CFD372D2C10E8BE04A143797DCED

SHA1:

13F5D9ED15B180F3DF7D6836EC33BE4615BF8697

SHA256:

DA7473A4BAFDFFE9A0DC9E283E28CD609652C9D40FCF95F09970219F9CAA8863

SSDEEP:

6144:kIW+jhOJOTWB2bN0atVcDcQ8gvq5O1lmfn1lrjmWmmgDmmWmmmmeLCSmmmmm9Hmf:kch4F2bOarcAQ895O1lmfjr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the BIOS version

      • TornadoSCF.exe (PID: 2380)

    • Reads security settings of Internet Explorer

      • TornadoSCF.exe (PID: 2380)

    • There is functionality for taking screenshot (YARA)

      • TornadoSCF.exe (PID: 2380)

    • Checks Windows Trust Settings

      • TornadoSCF.exe (PID: 2380)

  • INFO

    • Reads Environment values

      • TornadoSCF.exe (PID: 2380)

    • Reads CPU info

      • TornadoSCF.exe (PID: 2380)

    • Reads the computer name

      • TornadoSCF.exe (PID: 2380)

    • Reads the machine GUID from the registry

      • TornadoSCF.exe (PID: 2380)

    • Creates files or folders in the user directory

      • TornadoSCF.exe (PID: 2380)

    • UPX packer has been detected

      • TornadoSCF.exe (PID: 2380)

    • Checks proxy server information

      • TornadoSCF.exe (PID: 2380)

    • Checks supported languages

      • TornadoSCF.exe (PID: 2380)

    • Reads the software policy settings

      • TornadoSCF.exe (PID: 2380)

    • Reads product name

      • TornadoSCF.exe (PID: 2380)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.7)
.exe | Generic Win/DOS Executable (23.4)
.exe | DOS Executable Generic (23.4)
.vxd | VXD Driver (0.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 204800
InitializedDataSize: 28672
UninitializedDataSize: 393216
EntryPoint: 0x91e50
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.4.0
ProductVersionNumber: 1.0.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Windows, Cyrillic
CompanyName: Tornado Software
FileDescription: Tornado Shutter Counter Free
FileVersion: 1.0.4.0
InternalName: Tornado SCF
LegalCopyright: Tornado Software
OriginalFileName: TornadoSCF.exe
ProductName: Tornado SCF
ProductVersion: 1.0.4.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start tornadoscf.exe

Process information

PID
CMD
Path
Indicators
Parent process
2380"C:\Users\admin\Desktop\TornadoSCF.exe" C:\Users\admin\Desktop\TornadoSCF.exe
explorer.exe
User:
admin
Company:
Tornado Software
Integrity Level:
MEDIUM
Description:
Tornado Shutter Counter Free
Version:
1.0.4.0
Modules
Images
c:\users\admin\desktop\tornadoscf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
3 615
Read events
3 612
Write events
3
Delete events
0

Modification events

(PID) Process:(2380) TornadoSCF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2380) TornadoSCF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2380) TornadoSCF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
29
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
—
95.216.216.96:443
https://tornadosw.com/tss_scf/Data/DB/FWVers_Canon.csv
unknown
—
—
unknown
—
—
GET
200
95.216.216.96:443
https://tornadosw.com/tss_scf/telemetry.php?etext=O5wtvU7mdwmYKblK0mv79B6tP8ZYyXkKmiu6TNtt%2FI4XpzjIWelyBJMltEbVZvZ%2FEaAywVPiVeR%2BD5couEnZavqLFaQ1zV4Ip0noiSu6TNt1FtVn9rhp%2BIobqzzEVeV2CJchsELRW%2Bp7DZwuzd6AEaEywlv6jB29VuZ3Gag6yVrqcwWUJsVX5ngJkSKyQ9Jk84UWpi%2B%2FUOBxA6I0y1z8jf6%2FUfCSK7JE02X0hhenOMhpA5Irw2T8jUfmdwmYKrlD0mTzhRa2Z%2FaIKcli8g28Td1u%2Fp9B0GLxkjTDVfS1T95wiiOzRNR1NsZXCZgqyWoMkyW0Rurr%2BNHj4err4tHn6rOo6uv40fjr4Orh%2FLOo6uv40ePh6uvis6jq6%2FjR%2FeCzqOrr%2BNHt4%2BH90f3gs6j649Hh%2Fuv87%2Frn4eCz3dmu3frv%2FPqo%2BuPR4f7r%2FO%2F65%2BHg0erv%2Bu%2BzqPrj0f784er77frR4O%2Fj67Pa4fzg7%2Brhrt3m%2B%2Fr66%2FyuzeH74Prr%2FKj649H%2B%2FOHq%2B%2B360fjr%2FLP4v6C%2Bu6j649H99%2F366%2BPR5vnR5%2Bqzzd7btK7H4Prr4qbcp67N4fzrptrDp67nu6O4ur6%2Brs3e267Orrygub7JxvSDhNzPw66%2BvrSu38vD266uprqivq7JzKKursPm9KKu3cC0rqeDhNzPw67a4frv4q7d5%2FTrtK66or6uycyDhMPMyrSuysvCwq7Ky8LCg4TMx8HdtK7PoLq%2Boq6%2Bt6G%2FvqG8vr%2B2oq7P4%2Bv85%2B3v4K7D6%2Bnv%2Bvzr4Or9rsfg7aCDhMrdxa6%2BvrSu2crNrtnKvL7Lz9zdrs%2Faz67K6%2Fjn7euupq6hrvzr%2BLSuvKC7pa6hrsfKy66hrry7uKK%2BrsnMp4Oo%2BuPR%2Fff9%2Buvj0f350efqs9nn4Orh%2Bf2uv76uvL6%2Bt66m2Ov8rr%2B%2BoL6irsz75%2BLqtK6%2Ft766u6KuuLqj7Of6oq7e%2FOGnqPrj0f33%2Ffrr49Ht4fvg%2Bvz3s9vg5%2Frr6q7d%2Bu%2F66%2F2o%2BuPR%2Fff9%2Buvj0eLv4On77%2Bnrs8vg6eLn%2FebljxioaQoj23QFnSbGhxmoWel6HNts%2FI0fznABkTLpewycPfyOH69A8IETskvjdC7NZ%2FaHKRrRYwTDZfSGJ8dY4HEDomPzhC69T%2B6vQdBi8Zosu138jh%2FegCGxQtLj9LVW5nch4IFV%2FI4fr0jXafiaO9Nk9IUXxldgCqk74nsVtGb1hxioQeByA6M8zF39nl%2F3kCKxQtJj84QullDvkTLRY%2FKEFaVmB5co0GHxkjTDVOSWML9Z4HIDkzTTZfyeL794Cak6ylv7lDY%3D
unknown
—
—
unknown
6908
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.216.216.96:443
https://tornadosw.com/tss_scf/Data/TornadoSCF_ver.txt
unknown
text
5 b
unknown
—
—
GET
—
95.216.216.96:443
https://tornadosw.com/tss_scf/Data/Ads/Banner02.png
unknown
—
—
unknown
6944
svchost.exe
GET
200
184.24.77.35:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
52.140.118.28:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IN
whitelisted
6908
RUXIMICS.exe
52.140.118.28:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IN
whitelisted
5488
MoUsoCoreWorker.exe
52.140.118.28:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IN
whitelisted
—
—
2.23.209.185:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2380
TornadoSCF.exe
95.216.216.96:443
tornadosw.com
Hetzner Online GmbH
FI
unknown
6944
svchost.exe
184.24.77.35:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6944
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6908
RUXIMICS.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 52.140.118.28
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.185
  • 2.23.209.179
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.149
  • 2.23.209.133
  • 2.23.209.176
  • 2.23.209.182
  • 2.23.209.187
whitelisted
google.com
  • 142.250.184.206
whitelisted
tornadosw.com
  • 95.216.216.96
unknown
crl.microsoft.com
  • 184.24.77.35
  • 184.24.77.37
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
self.events.data.microsoft.com
  • 13.89.179.10
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TornadoSCF.exe