File name:	2025-07-06_e0fa6271e1b3d329194ab15f7a8289d6_elex_mafia
Full analysis:	https://app.any.run/tasks/57e3df21-9cfe-4773-8913-f1dd2ad730de
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 04:10:41
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	E0FA6271E1B3D329194AB15F7A8289D6
SHA1:	1ED0565DAC07E1D366DFBBF004B8E4941826C9D0
SHA256:	E0BE747BFE7604F76A79F727D929D277A6EA3DC9F2134E95A77613F86B465F3B
SSDEEP:	24576:cbY7DncCSimjHnahb3l5tG+CEUB0TG0VyzY:cbY7DncCSimjH6b3l5tG+CES0TG0VyzY

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
6648	5C68.tmp	C:\Users\admin\AppData\Local\Temp\5CC6.tmp		executable
		MD5:F23F3ABD1E123D977E2D45D31BE7387B	SHA256:23ABF8225A367538A5F196453ACF3379788540CD7DD88DECDB92CEB9152412D1
6716	5CC6.tmp	C:\Users\admin\AppData\Local\Temp\5D23.tmp		executable
		MD5:879097C1CCCA30F8055872F185752C40	SHA256:DCA657EB36805428618915D26BC7A83FB9438B1772BE7AB000B648A0A07D9B0A
4692	5D91.tmp	C:\Users\admin\AppData\Local\Temp\5DEF.tmp		executable
		MD5:BFC6C582796EF1316CEFE468D922F2F4	SHA256:BC1DD423677D75C60CC7C12E7A2D67A50B751796DCBF1BAD33F3E428BCAD7C05
4224	5D23.tmp	C:\Users\admin\AppData\Local\Temp\5D91.tmp		executable
		MD5:2E483068DCDCFD0CE5BDB03566CC19A3	SHA256:42D9D5E5D4444B0BF3781E99874AD3B9F33DFCDD258DD5CBD250CE19B2511F5A
4084	611B.tmp	C:\Users\admin\AppData\Local\Temp\668A.tmp		executable
		MD5:C8D0E7368CC890EB9417E6D05712984C	SHA256:3B275822AC898DE9B5FF2823F113A25904993202FF7348A4C1C64F0C5DC80F58
6200	5DEF.tmp	C:\Users\admin\AppData\Local\Temp\5E5C.tmp		executable
		MD5:B94150D5167D02639C434B82AE66E082	SHA256:3462842EA8E2FA1E49CDB046B4FCDF1A33722AD3C8B5B61922F3C96F3A702EC8
5548	67E1.tmp	C:\Users\admin\AppData\Local\Temp\6830.tmp		executable
		MD5:C4459840F98F81CBA4EC245E4D865497	SHA256:68969D1D348BCEAFCF22FE1A2473690EF60B88889BDE166AA254E99136910E13
984	5E5C.tmp	C:\Users\admin\AppData\Local\Temp\5EBA.tmp		executable
		MD5:A466BBE16779914885592F343CAB8915	SHA256:FF4A8D654A9638C072BE77B15F9A65A0AC2AEEFEE1E410A74ADC995E6212B1AD
5432	5F75.tmp	C:\Users\admin\AppData\Local\Temp\5FC3.tmp		executable
		MD5:D5DF7B7F6B8192C41F05EF4FCF1695F9	SHA256:E141609790EE84AB71B27ACB0E768A78988B8090773E92F57C752E59E77D0850
5952	6011.tmp	C:\Users\admin\AppData\Local\Temp\606F.tmp		executable
		MD5:86E6725913B14F8DA0C69E5BFEA59A65	SHA256:6BA9810921EA91BD60BD019FC4744671C47185C0054A040E0932F40EF76966F3

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6732	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5944	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6732	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	2.20.245.139:80	crl.microsoft.com	Akamai International B.V.	SE	whitelisted
5944	MoUsoCoreWorker.exe	2.20.245.139:80	crl.microsoft.com	Akamai International B.V.	SE	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
6732	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.124.78.146	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	2.20.245.139 2.20.245.137	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
self.events.data.microsoft.com	20.189.173.12	whitelisted

General Info

2025-07-06_e0fa6271e1b3d329194ab15f7a8289d6_elex_mafia

E0FA6271E1B3D329194AB15F7A8289D6

1ED0565DAC07E1D366DFBBF004B8E4941826C9D0

E0BE747BFE7604F76A79F727D929D277A6EA3DC9F2134E95A77613F86B465F3B

24576:cbY7DncCSimjHnahb3l5tG+CEUB0TG0VyzY:cbY7DncCSimjH6b3l5tG+CES0TG0VyzY

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts itself from another location

Starts application with an unusual extension

Executable content was dropped or overwritten

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

INFO

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings