File name:

TornadoSCF.exe

Full analysis: https://app.any.run/tasks/96354b8d-befe-43a5-8efd-64806ad1817b
Verdict: Malicious activity
Analysis date: December 18, 2023, 20:25:43
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

1298CFD372D2C10E8BE04A143797DCED

SHA1:

13F5D9ED15B180F3DF7D6836EC33BE4615BF8697

SHA256:

DA7473A4BAFDFFE9A0DC9E283E28CD609652C9D40FCF95F09970219F9CAA8863

SSDEEP:

6144:kIW+jhOJOTWB2bN0atVcDcQ8gvq5O1lmfn1lrjmWmmgDmmWmmmmeLCSmmmmm9Hmf:kch4F2bOarcAQ895O1lmfjr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • TornadoSCF.exe (PID: 2040)

    • Reads the BIOS version

      • TornadoSCF.exe (PID: 2040)

    • Reads security settings of Internet Explorer

      • TornadoSCF.exe (PID: 2040)

    • Checks Windows Trust Settings

      • TornadoSCF.exe (PID: 2040)

    • Reads settings of System Certificates

      • TornadoSCF.exe (PID: 2040)

  • INFO

    • Checks supported languages

      • TornadoSCF.exe (PID: 2040)
      • wmpnscfg.exe (PID: 1836)

    • Reads the computer name

      • TornadoSCF.exe (PID: 2040)
      • wmpnscfg.exe (PID: 1836)

    • Checks proxy server information

      • TornadoSCF.exe (PID: 2040)

    • Reads Environment values

      • TornadoSCF.exe (PID: 2040)

    • Reads the machine GUID from the registry

      • TornadoSCF.exe (PID: 2040)

    • Reads CPU info

      • TornadoSCF.exe (PID: 2040)

    • Reads product name

      • TornadoSCF.exe (PID: 2040)

    • Creates files or folders in the user directory

      • TornadoSCF.exe (PID: 2040)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1836)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.7)
.exe | Generic Win/DOS Executable (23.4)
.exe | DOS Executable Generic (23.4)
.vxd | VXD Driver (0.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:20 00:22:17+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 204800
InitializedDataSize: 28672
UninitializedDataSize: 393216
EntryPoint: 0x91e50
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.4.0
ProductVersionNumber: 1.0.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Windows, Cyrillic
CompanyName: Tornado Software
FileDescription: Tornado Shutter Counter Free
FileVersion: 1.0.4.0
InternalName: Tornado SCF
LegalCopyright: Tornado Software
OriginalFileName: TornadoSCF.exe
ProductName: Tornado SCF
ProductVersion: 1.0.4.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start tornadoscf.exe wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1836"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2040"C:\Users\admin\AppData\Local\Temp\TornadoSCF.exe" C:\Users\admin\AppData\Local\Temp\TornadoSCF.exe
explorer.exe
User:
admin
Company:
Tornado Software
Integrity Level:
MEDIUM
Description:
Tornado Shutter Counter Free
Exit code:
0
Version:
1.0.4.0
Modules
Images
c:\users\admin\appdata\local\temp\tornadoscf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\gdi32.dll
Total events
7 586
Read events
7 560
Write events
26
Delete events
0

Modification events

(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005B010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2040) TornadoSCF.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
6
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
2040TornadoSCF.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:47BF9D81349BBE897B56920FA3A618AA
SHA256:7B7328544FF6D617C3FEE600C94265C9C5EBF80C49A9AC5F43B9101E2F9B7739
2040TornadoSCF.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
2040TornadoSCF.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Banner02[1].pngimage
MD5:6E054F02A0CBD5949149172B5B50F71E
SHA256:DCB0EF53CB7374DC96C0C370FF7EE036478B855AECBA526344BC7A54A4D21808
2040TornadoSCF.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\FWVers_Canon[1].csvtext
MD5:FF42F73E9CA1A4728CBEB2F8FE9A416F
SHA256:09292FF54C876D632295FAFD25B7A3C775C86016BBF2CDA54042F616CCA4B534
2040TornadoSCF.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7Cbinary
MD5:BB890458D00B720D62DE054245035928
SHA256:36FB2F4C70DF327994AE695B0FF7233B99565F96A1D1503C5C4EFF58CEACF8DF
2040TornadoSCF.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_96EEC010953ED454BBCDFA69FC071E7Cbinary
MD5:4DC26D6FDD38B7D1AA1F9E860EB7C3EC
SHA256:92599816127D4CD9D084009E86618482754340B52DC1981097031B71A246A91A
2040TornadoSCF.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4B3D1CD03E2BE9D4F9CDDE390F5EFE31_991173961C56921918662FF757B268E9binary
MD5:ADF1D50949789C578EE28F30EA5DD85F
SHA256:DFCA7FDE0AFE30867F4D284A7AD909679DE58E053EC9AFA3286B04ABDC8795BD
2040TornadoSCF.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4B3D1CD03E2BE9D4F9CDDE390F5EFE31_991173961C56921918662FF757B268E9binary
MD5:036271E833DC477D7191446963BABF8D
SHA256:7B9EBC3B5CE00F38CFDDB48DDBF6758B89332990A120E0E78F248DCFFDEA646F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
12
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2040
TornadoSCF.exe
GET
200
23.32.238.147:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a1bf14c117ccbf21
unknown
compressed
4.66 Kb
unknown
2040
TornadoSCF.exe
GET
200
23.32.238.147:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f60ca29af6835190
unknown
compressed
4.66 Kb
unknown
2040
TornadoSCF.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/rootr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEH1NQqkrQx1%2BZFPnwZqNWHc%3D
unknown
binary
1.41 Kb
unknown
2040
TornadoSCF.exe
GET
200
151.101.2.133:80
http://ocsp.globalsign.com/alphasslcasha256g4/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBSPdwLcDiHQXlVfp8h37hrpMerTggQUT8usqMLvq92Db2u%2Fzpg9XFgldhUCDBzLQgcCmmNxsre0Ww%3D%3D
unknown
binary
1.40 Kb
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?eca8823d6d0692d6
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2040
TornadoSCF.exe
95.216.216.96:443
tornadosw.com
Hetzner Online GmbH
FI
unknown
2040
TornadoSCF.exe
23.32.238.147:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2040
TornadoSCF.exe
151.101.2.133:80
ocsp.globalsign.com
FASTLY
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted

DNS requests

Domain
IP
Reputation
tornadosw.com
  • 95.216.216.96
unknown
ctldl.windowsupdate.com
  • 23.32.238.147
  • 23.32.238.163
  • 2.19.198.41
  • 23.32.238.144
  • 23.32.238.130
  • 23.32.238.162
  • 23.32.238.155
  • 23.32.238.121
  • 23.32.238.145
  • 93.184.221.240
whitelisted
ocsp.globalsign.com
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.130.133
  • 151.101.194.133
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
TornadoSCF.exe