File name:

alanis.exe

Full analysis: https://app.any.run/tasks/f9836a48-44d1-4fc3-aaf1-a8644f81b0e6
Verdict: Malicious activity
Analysis date: December 13, 2023, 16:37:24
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

CA6F11C1F1F538136DB78A75EA6A6B11

SHA1:

DAABD1053E8200F3B3A881555AC325080A9CADC2

SHA256:

DB724E03E971F4B4E30E471ACABBC5F9F628CAA093E13A7EC81185D87E6EEB1E

SSDEEP:

768:q9yNTyAKgg/3iJwTm6EXU6knBhyfdqb5jxG:qAZyAPg/S2m86kBGklE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file in the system directory

      • alanis.exe (PID: 3264)

    • Changes the login/logoff helper path in the registry

      • alanis.exe (PID: 3264)

    • Drops the executable file immediately after the start

      • alanis.exe (PID: 3264)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads the machine GUID from the registry

      • alanis.exe (PID: 3264)
      • alanis.exe (PID: 2100)

    • Checks supported languages

      • alanis.exe (PID: 3264)
      • alanis.exe (PID: 2100)

    • Create files in a temporary directory

      • alanis.exe (PID: 3264)
      • alanis.exe (PID: 2100)

    • Creates files or folders in the user directory

      • alanis.exe (PID: 3264)

    • Manual execution by a user

      • explorer.exe (PID: 1088)
      • alanis.exe (PID: 2100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:09:27 04:48:43+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 20480
InitializedDataSize: 4096
UninitializedDataSize: 94208
EntryPoint: 0x1c8c0
OSVersion: 4
ImageVersion: 0.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.1.0.0
ProductVersionNumber: 0.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Spanish (Modern)
CharacterSet: Unicode
Comments: por que te quiero tanto fiorela
CompanyName: ISTPA
LegalCopyright: [DemionKlaz] [DK]
ProductName: fioro
FileVersion: 0.01
ProductVersion: 0.01
InternalName: alanis
OriginalFileName: alanis.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
41
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start alanis.exe explorer.exe no specs alanis.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1088"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2100"C:\Users\admin\AppData\Local\Temp\alanis.exe" C:\Users\admin\AppData\Local\Temp\alanis.exe—explorer.exe
User:
admin
Company:
ISTPA
Integrity Level:
MEDIUM
Exit code:
0
Version:
0.01
Modules
Images
c:\users\admin\appdata\local\temp\alanis.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3264"C:\Users\admin\AppData\Local\Temp\alanis.exe" C:\Users\admin\AppData\Local\Temp\alanis.exe
explorer.exe
User:
admin
Company:
ISTPA
Integrity Level:
MEDIUM
Exit code:
0
Version:
0.01
Modules
Images
c:\users\admin\appdata\local\temp\alanis.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
120
Read events
119
Write events
1
Delete events
0

Modification events

(PID) Process:(3264) alanis.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:shell
Value:
explorer.exe
Executable files
3
Suspicious files
0
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\nemo.htmltext
MD5:197F8C6B2DA56FFB475E735528C10D45
SHA256:3E20A85A0FA66C6F462703418F4B05C175F67984EA732A3FB3F64492BA71D7B6
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\tazmania.txttext
MD5:E987EB1F01359216F348D65247D99D3A
SHA256:A45B601DE5C47A0C7041455FC691514005AAABDF0B247C0EC432EC5437EF44A5
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\alanis.htmltext
MD5:197F8C6B2DA56FFB475E735528C10D45
SHA256:3E20A85A0FA66C6F462703418F4B05C175F67984EA732A3FB3F64492BA71D7B6
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\System32\Cleanmgr.mcgexecutable
MD5:CA6F11C1F1F538136DB78A75EA6A6B11
SHA256:DB724E03E971F4B4E30E471ACABBC5F9F628CAA093E13A7EC81185D87E6EEB1E
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\pamelaXXX.htmltext
MD5:197F8C6B2DA56FFB475E735528C10D45
SHA256:3E20A85A0FA66C6F462703418F4B05C175F67984EA732A3FB3F64492BA71D7B6
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\evan.htmltext
MD5:197F8C6B2DA56FFB475E735528C10D45
SHA256:3E20A85A0FA66C6F462703418F4B05C175F67984EA732A3FB3F64492BA71D7B6
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\avril.htmltext
MD5:197F8C6B2DA56FFB475E735528C10D45
SHA256:3E20A85A0FA66C6F462703418F4B05C175F67984EA732A3FB3F64492BA71D7B6
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\System32\kerneldll32.apiexecutable
MD5:CA6F11C1F1F538136DB78A75EA6A6B11
SHA256:DB724E03E971F4B4E30E471ACABBC5F9F628CAA093E13A7EC81185D87E6EEB1E
3264alanis.exeC:\Users\admin\AppData\Local\VirtualStore\Windows\Cleanmgr.mcgexecutable
MD5:CA6F11C1F1F538136DB78A75EA6A6B11
SHA256:DB724E03E971F4B4E30E471ACABBC5F9F628CAA093E13A7EC81185D87E6EEB1E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
alanis.exe