File name:

d6b9d4b8f1baca0b5282d11dde4269b6

Full analysis: https://app.any.run/tasks/808fd63e-aa5c-4bbd-bc87-6925e2447aeb
Verdict: Malicious activity
Analysis date: February 12, 2024, 18:15:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D6B9D4B8F1BACA0B5282D11DDE4269B6

SHA1:

62AD656B07F5C3B53300231CD09A5491EC584EC1

SHA256:

E3C6A2246582DDE0A48812844DA162DB0E814F98988F8B44E76FCCA4CD8ED31B

SSDEEP:

98304:RumKe94qumSvEPrt2twfCt+ZaaoVBfG+8VhJLFMa+GC+sdZ9YYHAdUQH1xvR61ci:PCrHiocsEpKxsO9f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • d6b9d4b8f1baca0b5282d11dde4269b6.exe (PID: 4052)
      • coregen.exe (PID: 3180)
      • coregen.exe (PID: 3684)
      • coregen.exe (PID: 1560)
      • coregen.exe (PID: 1644)
      • coregen.exe (PID: 2728)
      • coregen.exe (PID: 3404)
      • coregen.exe (PID: 2244)
      • coregen.exe (PID: 2900)
      • coregen.exe (PID: 1864)
      • coregen.exe (PID: 1892)
      • coregen.exe (PID: 2324)
      • coregen.exe (PID: 2992)
      • coregen.exe (PID: 1584)
      • coregen.exe (PID: 2052)
      • coregen.exe (PID: 1404)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • d6b9d4b8f1baca0b5282d11dde4269b6.exe (PID: 4052)
      • coregen.exe (PID: 3180)
      • coregen.exe (PID: 3684)
      • coregen.exe (PID: 1560)
      • coregen.exe (PID: 1644)
      • coregen.exe (PID: 2728)
      • coregen.exe (PID: 2244)
      • coregen.exe (PID: 2900)
      • coregen.exe (PID: 1404)
      • coregen.exe (PID: 1584)
      • coregen.exe (PID: 2052)

    • Executable content was dropped or overwritten

      • d6b9d4b8f1baca0b5282d11dde4269b6.exe (PID: 4052)
      • coregen.exe (PID: 3180)
      • coregen.exe (PID: 3684)
      • coregen.exe (PID: 1560)
      • coregen.exe (PID: 1644)
      • coregen.exe (PID: 2244)
      • coregen.exe (PID: 2728)
      • coregen.exe (PID: 3404)
      • coregen.exe (PID: 1864)
      • coregen.exe (PID: 2900)
      • coregen.exe (PID: 1892)
      • coregen.exe (PID: 1404)
      • coregen.exe (PID: 2324)
      • coregen.exe (PID: 2992)
      • coregen.exe (PID: 1584)
      • coregen.exe (PID: 2052)

    • Starts a Microsoft application from unusual location

      • d6b9d4b8f1baca0b5282d11dde4269b6.exe (PID: 4052)

    • Reads the Internet Settings

      • install.exe (PID: 3464)

    • Reads security settings of Internet Explorer

      • install.exe (PID: 3464)

    • Uses RUNDLL32.EXE to load library

      • install.exe (PID: 3464)

  • INFO

    • Checks supported languages

      • d6b9d4b8f1baca0b5282d11dde4269b6.exe (PID: 4052)
      • install.exe (PID: 3464)
      • coregen.exe (PID: 3180)
      • coregen.exe (PID: 3684)
      • coregen.exe (PID: 1560)
      • coregen.exe (PID: 1644)
      • coregen.exe (PID: 2900)
      • coregen.exe (PID: 2728)
      • coregen.exe (PID: 3404)
      • coregen.exe (PID: 2244)
      • coregen.exe (PID: 1864)
      • coregen.exe (PID: 2324)
      • coregen.exe (PID: 1404)
      • coregen.exe (PID: 1892)
      • coregen.exe (PID: 2052)
      • Silverlight.Configuration.exe (PID: 2480)
      • coregen.exe (PID: 2992)
      • coregen.exe (PID: 1584)

    • Reads the computer name

      • d6b9d4b8f1baca0b5282d11dde4269b6.exe (PID: 4052)
      • install.exe (PID: 3464)
      • Silverlight.Configuration.exe (PID: 2480)

    • Reads Environment values

      • d6b9d4b8f1baca0b5282d11dde4269b6.exe (PID: 4052)

    • Reads the machine GUID from the registry

      • d6b9d4b8f1baca0b5282d11dde4269b6.exe (PID: 4052)
      • install.exe (PID: 3464)
      • Silverlight.Configuration.exe (PID: 2480)
      • coregen.exe (PID: 1404)

    • Create files in a temporary directory

      • install.exe (PID: 3464)

    • Creates files in the program directory

      • coregen.exe (PID: 3180)
      • coregen.exe (PID: 2900)
      • coregen.exe (PID: 3684)
      • coregen.exe (PID: 1560)
      • coregen.exe (PID: 1644)
      • coregen.exe (PID: 2728)
      • coregen.exe (PID: 2244)
      • coregen.exe (PID: 3404)
      • coregen.exe (PID: 1864)
      • coregen.exe (PID: 2324)
      • coregen.exe (PID: 1892)
      • coregen.exe (PID: 1404)
      • coregen.exe (PID: 2992)
      • coregen.exe (PID: 2052)
      • coregen.exe (PID: 1584)

    • Creates files or folders in the user directory

      • Silverlight.Configuration.exe (PID: 2480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2004:06:25 00:14:00+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 7.1
CodeSize: 30720
InitializedDataSize: 3072
UninitializedDataSize: -
EntryPoint: 0x5892
OSVersion: 5.2
ImageVersion: 5.2
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.1.20513.0
ProductVersionNumber: 5.5.31.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Self-Extracting Cabinet
FileVersion: 5.1.20513.0
InternalName: SFXCAB.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: SFXCAB.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.5.0031.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
20
Malicious processes
2
Suspicious processes
10

Behavior graph

Click at the process to see the details
start d6b9d4b8f1baca0b5282d11dde4269b6.exe install.exe no specs install.exe rundll32.exe no specs coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe silverlight.configuration.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1404"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" System.ServiceModel.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1560"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" System.Core.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1584"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" System.Windows.RuntimeHost.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1644"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" System.Net.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1864"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" Microsoft.Xna.Framework.Graphics.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1892"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" Microsoft.Xna.Framework.Graphics.Shaders.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2052"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" System.Windows.Browser.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2244"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" System.ServiceModel.Web.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2324"C:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe" System.Windows.dllC:\Program Files\Microsoft Silverlight\5.1.20513.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.20513.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.20513.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2480"C:\Program Files\Microsoft Silverlight\5.1.20513.0\silverlight.configuration.exe" -enableMUC:\Program Files\Microsoft Silverlight\5.1.20513.0\Silverlight.Configuration.exe—install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Silverlight Configuration Utility
Exit code:
2147943458
Version:
5.1.20513.0
Modules
Images
c:\program files\microsoft silverlight\5.1.20513.0\silverlight.configuration.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
2 261
Read events
2 240
Write events
21
Delete events
0

Modification events

(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
116
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:Dll
Value:
C:\Program Files\Microsoft Silverlight\xapauthenticodesip.dll
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:FuncName
Value:
XAP_CryptSIPPutSignedDataMsg
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:Dll
Value:
C:\Program Files\Microsoft Silverlight\xapauthenticodesip.dll
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:FuncName
Value:
XAP_CryptSIPGetSignedDataMsg
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:Dll
Value:
C:\Program Files\Microsoft Silverlight\xapauthenticodesip.dll
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:FuncName
Value:
XAP_CryptSIPRemoveSignedDataMsg
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:Dll
Value:
C:\Program Files\Microsoft Silverlight\xapauthenticodesip.dll
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:FuncName
Value:
XAP_CryptSIPCreateIndirectData
(PID) Process:(3464) install.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{BA08A66F-113B-4D58-9329-A1B37AF30F0E}
Operation:writeName:Dll
Value:
C:\Program Files\Microsoft Silverlight\xapauthenticodesip.dll
Executable files
18
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4052d6b9d4b8f1baca0b5282d11dde4269b6.exeC:\12924f0b54c74474d364f0\silverlight.7z —
MD5:—
SHA256:—
4052d6b9d4b8f1baca0b5282d11dde4269b6.exeC:\12924f0b54c74474d364f0\silverlightdev.msp —
MD5:—
SHA256:—
3464install.exeC:\12924f0b54c74474d364f0\Silverlight.msp —
MD5:—
SHA256:—
4052d6b9d4b8f1baca0b5282d11dde4269b6.exeC:\12924f0b54c74474d364f0\install.exeexecutable
MD5:CB1EB4D693DBB4BFF85A5985D2A7CA12
SHA256:2DB962D10F3D0326BC8A35854185A74BC69B957AEBACAAA51AAEE270964B4F2A
4052d6b9d4b8f1baca0b5282d11dde4269b6.exeC:\12924f0b54c74474d364f0\silverlight.msiexecutable
MD5:561751AC20B90C8E8F4DB004C16F7959
SHA256:C5CDBEAB8A080FAFF40B882E601D4C8CD21DCC48DDC70C62E5725903E802E9EE
2244coregen.exeC:\Program Files\Microsoft Silverlight\5.1.20513.0\System.ServiceModel.Web.ni.dllexecutable
MD5:46E99B271A04AD9F55DCC5268F252B3D
SHA256:A0685900D2760885E3CDE5A007440D01A36222A88AF3A404BB687BF1E66E153E
3180coregen.exeC:\Program Files\Microsoft Silverlight\5.1.20513.0\mscorlib.ni.dllexecutable
MD5:3BC2C0496ECF0851C89823EB892EDF0C
SHA256:57D44C38571354E64E2D134018A2CD1D243D9F420455D6DFB2F008B16EB2D3FF
2728coregen.exeC:\Program Files\Microsoft Silverlight\5.1.20513.0\System.Runtime.Serialization.ni.dllexecutable
MD5:791492875E3F5970C40A4695C343DC26
SHA256:E2E2700713512D297214875F397E3B9C068BAB5D0D816DC728797542A5CAEC90
3684coregen.exeC:\Program Files\Microsoft Silverlight\5.1.20513.0\System.ni.dllexecutable
MD5:665C6C0EA9595D9167DEF0E9FDE758E1
SHA256:28FC311F2A6C96C69BF9E099A3D4640B81A489890A6C905D3E0466CB7BC3867D
1560coregen.exeC:\Program Files\Microsoft Silverlight\5.1.20513.0\System.Core.ni.dllexecutable
MD5:33390689FC00A7A41594774023EE024A
SHA256:1C195CEC9B04DB5376F737FDC83205A975889BBA7FF93FBE4C4A542C51993A14
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
d6b9d4b8f1baca0b5282d11dde4269b6