File name:

AAM Updates Notifier.exe

Full analysis: https://app.any.run/tasks/9a73c546-53a1-4ad7-910c-56d27ddd163f
Verdict: Malicious activity
Analysis date: May 14, 2024, 01:05:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

B613E507997B250EFB1D1048B9525228

SHA1:

A68B7C9AA28FF4DEAE7BBABA50FE0A319C90DDD4

SHA256:

DD571CE2D111F2E9135D8539BA54F74711346171969795AC08962DD1A00F9AA6

SSDEEP:

1536:5HL4xj5ZX8TC7T/TyTl/AvGm2k2rYzLCudE:JL4BjsTYT/TyTl/AvGm2k8YzLCuE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AAM Updates Notifier.exe (PID: 3976)
      • AAM Updates Notifier.exe (PID: 4056)

    • Create files in the Startup directory

      • AAM Updates Notifier.exe (PID: 4056)

    • Changes the autorun value in the registry

      • AAM Updates Notifier.exe (PID: 4056)

    • Changes appearance of the Explorer extensions

      • AAM Updates Notifier.exe (PID: 4056)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • AAM Updates Notifier.exe (PID: 3976)
      • AAM Updates Notifier.exe (PID: 4056)

    • Starts itself from another location

      • AAM Updates Notifier.exe (PID: 3976)

    • Reads security settings of Internet Explorer

      • AAM Updates Notifier.exe (PID: 3976)

    • Reads the Internet Settings

      • AAM Updates Notifier.exe (PID: 3976)

    • Connects to unusual port

      • AAM Updates Notifier.exe (PID: 4056)

  • INFO

    • Checks supported languages

      • AAM Updates Notifier.exe (PID: 3976)
      • AAM Updates Notifier.exe (PID: 4056)

    • Reads the computer name

      • AAM Updates Notifier.exe (PID: 3976)
      • AAM Updates Notifier.exe (PID: 4056)

    • Create files in a temporary directory

      • AAM Updates Notifier.exe (PID: 3976)

    • Reads the machine GUID from the registry

      • AAM Updates Notifier.exe (PID: 3976)
      • AAM Updates Notifier.exe (PID: 4056)

    • Creates files or folders in the user directory

      • AAM Updates Notifier.exe (PID: 4056)

    • Reads Environment values

      • AAM Updates Notifier.exe (PID: 4056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.8)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:05:17 05:47:23+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 142336
InitializedDataSize: 20480
UninitializedDataSize: -
EntryPoint: 0x24a0e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 9.7.5.3
ProductVersionNumber: 9.7.5.3
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: rpdsvc
CompanyName: rpdsvc
FileDescription: rpdsvc
FileVersion: 9.7.5.3
InternalName: rpdsvc.exe
LegalCopyright: Copyright © 2023
LegalTrademarks: rpdsvc
OriginalFileName: rpdsvc.exe
ProductName: rpdsvc
ProductVersion: 9.7.5.3
AssemblyVersion: 2.4.6.8
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
34
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start aam updates notifier.exe aam updates notifier.exe

Process information

PID
CMD
Path
Indicators
Parent process
3976"C:\Users\admin\Desktop\AAM Updates Notifier.exe" C:\Users\admin\Desktop\AAM Updates Notifier.exe
explorer.exe
User:
admin
Company:
rpdsvc
Integrity Level:
MEDIUM
Description:
rpdsvc
Exit code:
0
Version:
9.7.5.3
Modules
Images
c:\users\admin\desktop\aam updates notifier.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
4056"C:\Users\admin\AppData\Local\Temp\AAM Updates Notifier.exe" C:\Users\admin\AppData\Local\Temp\AAM Updates Notifier.exe
AAM Updates Notifier.exe
User:
admin
Company:
rpdsvc
Integrity Level:
MEDIUM
Description:
rpdsvc
Version:
9.7.5.3
Modules
Images
c:\users\admin\appdata\local\temp\aam updates notifier.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
3 190
Read events
3 167
Write events
23
Delete events
0

Modification events

(PID) Process:(3976) AAM Updates Notifier.exeKey:HKEY_CURRENT_USER\Software\{PX89TUI9-611648-WD891A-WD891AP9P9}
Operation:writeName:H
Value:
ZnJlZXRpbWUudGhld29ya3BjLmNvbTo1NTUyLA==
(PID) Process:(3976) AAM Updates Notifier.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3976) AAM Updates Notifier.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3976) AAM Updates Notifier.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3976) AAM Updates Notifier.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4056) AAM Updates Notifier.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Operation:writeName:Hidden
Value:
0
(PID) Process:(4056) AAM Updates Notifier.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:{PX89TUI9-611648-WD891A-WD891AP9P9}
Value:
"C:\Users\admin\AppData\Local\Temp\AAM Updates Notifier.exe" ...
(PID) Process:(4056) AAM Updates Notifier.exeKey:HKEY_CURRENT_USER\Software\{PX89TUI9-611648-WD891A-WD891AP9P9}\log
Operation:writeName:5/14/2024
Value:
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3976AAM Updates Notifier.exeC:\Users\admin\AppData\Local\Temp\AAM Updates Notifier.exeexecutable
MD5:B613E507997B250EFB1D1048B9525228
SHA256:DD571CE2D111F2E9135D8539BA54F74711346171969795AC08962DD1A00F9AA6
4056AAM Updates Notifier.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\{PX89TUI9-611648-WD891A-WD891AP9P9}.exeexecutable
MD5:B613E507997B250EFB1D1048B9525228
SHA256:DD571CE2D111F2E9135D8539BA54F74711346171969795AC08962DD1A00F9AA6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4056
AAM Updates Notifier.exe
46.246.4.21:5552
freetime.theworkpc.com
GleSYS AB
SE
unknown

DNS requests

Domain
IP
Reputation
freetime.theworkpc.com
  • 46.246.4.21
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1088
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.theworkpc .com Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AAM Updates Notifier.exe