File name:

e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4

Full analysis: https://app.any.run/tasks/c8b446de-9eba-4932-895c-4c782572fd5b
Verdict: Malicious activity
Analysis date: January 10, 2025, 21:20:07
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D5E2B983594F972F4862EE76051B4ED7

SHA1:

57707C333F7219E5BD29A6C07B68D2A2F6A84301

SHA256:

E55B08EDF5E8B725AA741F2ADBB34E9B1C8BFC19460260AB14C54FEED37FFEA4

SSDEEP:

49152:CHlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZh:TAGQX21RBt7QjTmcaTH/vU4do9Pcjq1I

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executes application which crashes

      • e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe (PID: 1480)
  • INFO

    • Reads mouse settings

      • e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe (PID: 1480)
    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6452)
    • Checks supported languages

      • e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe (PID: 1480)
    • The process uses AutoIt

      • e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe (PID: 1480)
    • Checks proxy server information

      • WerFault.exe (PID: 6452)
    • The sample compiled with english language support

      • e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe (PID: 1480)
    • Reads the software policy settings

      • WerFault.exe (PID: 6452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:09 02:40:57+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 631296
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe svchost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1480"C:\Users\admin\AppData\Local\Temp\e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe" C:\Users\admin\AppData\Local\Temp\e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6340"C:\Users\admin\AppData\Local\Temp\e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe" C:\Windows\SysWOW64\svchost.exee55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6452C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1480 -s 780C:\Windows\SysWOW64\WerFault.exe
e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 094
Read events
3 094
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6452WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_e55b08edf5e8b725_b1946c2939168934acf9e41b53e9dfcf29f32_a04cfc2d_6a6faf80-b643-4810-b2dc-8e1398ae19fb\Report.wer
MD5:
SHA256:
6452WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5F0D.tmp.xmlxml
MD5:853FAF79B71BFE0EA6EB6B15F5D15555
SHA256:02F2622EEBAA863471D894164A3CDB9E0025A4C9FCF32028598127D4991E210D
1480e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exeC:\Users\admin\AppData\Local\Temp\aut540F.tmpbinary
MD5:254899B0B653E05505BC9B1F399AB837
SHA256:109D4639EA8148CB27992EF0CDF7C23D327DF979906C93227A966BEDC67D54A6
6452WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5DB3.tmp.dmpbinary
MD5:C3ED59D563B04D955D8AAE25211BBD0B
SHA256:1C9C897D5A80FD114A10ED0F16C4154FADA6E33ACC5FCBA4234EE6FF7630473F
6452WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5EDD.tmp.WERInternalMetadata.xmlxml
MD5:62A507305A57EEC58A2926CF2513E8CB
SHA256:9706508320137266EC37486FE5A9CCD0CD9C6B6C4BBFF652CCB74EAE82780744
6452WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
1480e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exeC:\Users\admin\AppData\Local\Temp\demonetisingbinary
MD5:254899B0B653E05505BC9B1F399AB837
SHA256:109D4639EA8148CB27992EF0CDF7C23D327DF979906C93227A966BEDC67D54A6
6452WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6452WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:DA932DFA26AAADEECA62FB58B2B3C465
SHA256:BE8438C30690D31CE90A746B3CF34E22AC88DE36853F99AC37D3C94BCC804B36
6452WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\e55b08edf5e8b725aa741f2adbb34e9b1c8bfc19460260ab14c54feed37ffea4.exe.1480.dmpbinary
MD5:8A7CE249DD91A86564EF3A2DB88C35F0
SHA256:D5377CC0939DDE0CA51C31738817F984B960A43702D156F52B82580FCCC6F536
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.150:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
3220
svchost.exe
GET
200
23.48.23.150:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
6452
WerFault.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6452
WerFault.exe
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
6216
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
3220
svchost.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
7072
SIHClient.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.150:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3220
svchost.exe
23.48.23.150:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3220
svchost.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.16.204.148:443
www.bing.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
whitelisted
1176
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.150
  • 23.48.23.156
  • 23.48.23.155
  • 23.48.23.158
  • 23.48.23.153
  • 23.48.23.147
  • 23.48.23.148
  • 23.48.23.164
  • 23.48.23.165
  • 23.48.23.138
  • 23.48.23.195
  • 23.48.23.146
  • 23.48.23.143
  • 23.48.23.193
  • 23.48.23.191
  • 23.48.23.137
  • 23.48.23.139
  • 23.48.23.188
whitelisted
www.microsoft.com
  • 23.37.237.227
whitelisted
google.com
  • 142.250.184.238
whitelisted
www.bing.com
  • 2.16.204.148
  • 2.16.204.134
  • 2.16.204.138
  • 2.16.204.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.0
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.73
  • 20.190.159.68
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
watson.events.data.microsoft.com
  • 20.189.173.22
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info