File name:

e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1

Full analysis: https://app.any.run/tasks/603c7b24-a6ba-43b9-a5fb-60b235a00f94
Verdict: Malicious activity
Analysis date: January 10, 2025, 20:04:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

FF72B0DEFCB604E86DA3E8447825BEC7

SHA1:

F1FC41E5F6DCCA525531C02D785F5CBA94D901F3

SHA256:

E664C97EF5D1865A68822DD79E9E3C2E893DE3B34F35C76394E71229F8C2A1A1

SSDEEP:

49152:4HlGAXWQkC2R/QORBt7QjFtmcaTH/vU4do9Pcjq1GvXB1sgPR8N32+Rr181vWDZ+:pAGQX21RBt7QjTmcaTH/vU4do9Pcjq16

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Executes application which crashes

      • e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe (PID: 6512)
  • INFO

    • The sample compiled with english language support

      • e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe (PID: 6512)
    • Reads mouse settings

      • e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe (PID: 6512)
    • Create files in a temporary directory

      • e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe (PID: 6512)
    • Checks supported languages

      • e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe (PID: 6512)
    • The process uses AutoIt

      • e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe (PID: 6512)
    • Checks proxy server information

      • WerFault.exe (PID: 6820)
    • Reads the software policy settings

      • WerFault.exe (PID: 6820)
    • Creates files or folders in the user directory

      • WerFault.exe (PID: 6820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

CharacterSet: Unicode
LanguageCode: English (British)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 0.0.0.0
FileVersionNumber: 0.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x27dcd
UninitializedDataSize: -
InitializedDataSize: 642560
CodeSize: 581120
LinkerVersion: 12
PEType: PE32
ImageFileCharacteristics: Executable, Large address aware, 32-bit
TimeStamp: 2024:12:04 11:34:53+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe svchost.exe no specs werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6512"C:\Users\admin\AppData\Local\Temp\e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe" C:\Users\admin\AppData\Local\Temp\e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6648"C:\Users\admin\AppData\Local\Temp\e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe" C:\Windows\SysWOW64\svchost.exee664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6820C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6512 -s 768C:\Windows\SysWOW64\WerFault.exe
e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 094
Read events
3 094
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
8
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6820WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_e664c97ef5d1865a_59c55082c026689e24b54ac7a07a2faebbfe7dc8_8f7830e1_57968290-92b4-48ce-8567-0cc2b498bf77\Report.wer
MD5:
SHA256:
6820WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEbinary
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6820WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7F66.tmp.xmlxml
MD5:E375A6E19B46AD2C81857744703757EF
SHA256:4E559388603544DD9DA8BB19E430C6BC84A3145506C9A04B7160A357D4195F6D
6512e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exeC:\Users\admin\AppData\Local\Temp\aut5A58.tmpbinary
MD5:933CBC363A14F1704018A39EF70575D1
SHA256:D1B73C936B022620503ECE06031A755D49F53166CD618E3620A9565C72FF8B19
6512e664c97ef5d1865a68822dd79e9e3c2e893de3b34f35c76394e71229f8c2a1a1.exeC:\Users\admin\AppData\Local\Temp\indivisibilitybinary
MD5:933CBC363A14F1704018A39EF70575D1
SHA256:D1B73C936B022620503ECE06031A755D49F53166CD618E3620A9565C72FF8B19
6820WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:462EF627C9F8913EB6DEAD67B0850043
SHA256:02D566FC3E8ED3C03924E3BB321E364B8DA88C4E1F7DB4A5ED137EA877D978EB
6820WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7C57.tmp.dmpbinary
MD5:32D8CCFEBD56FB9DECDF3A9A2647DD11
SHA256:18BFBE6AF19601B2D968FE4BCB2487A96A91B67C62DB4127FE5A66C4A4C9F947
6820WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785der
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6820WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:B976A920E6EFCE22B1D1AE5F65068C3F
SHA256:648ABDAD1C757EDCB2CAC9C51E1E18D1251186B5021361E55CAD54701835244E
6820WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7EF8.tmp.WERInternalMetadata.xmlxml
MD5:8F5F590C9709BCB4A5128BBD4C8FC84E
SHA256:266C5D77232DBEE592F8628DD4BDAAFEFCD41DEFA6C2A5AB4C243AA19714E632
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
37
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
6820
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5736
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
5736
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
3612
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
3612
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
6360
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
92.123.104.38:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5736
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5736
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
www.bing.com
  • 92.123.104.38
  • 92.123.104.34
  • 92.123.104.32
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
google.com
  • 172.217.16.206
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.76
  • 40.126.32.72
  • 20.190.160.14
  • 20.190.160.17
  • 40.126.32.133
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted

Threats

No threats detected
No debug info