File name:

e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d

Full analysis: https://app.any.run/tasks/64bcb0d3-c650-477f-9ffe-62e49f512485
Verdict: Malicious activity
Analysis date: May 18, 2025, 16:23:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
autoit
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 9 sections
MD5:

8FB19C3D4CB103C9C135B8CB66A3B69F

SHA1:

B16E6B15410DA8EC3E35FDA27D6950FAEECAEFFF

SHA256:

E7F0E5B269709E0C1038F76D1073BF614308DFC5CAC8BEB1C2C39D6704EB804D

SSDEEP:

49152:G/jl2RygKsMAsBQZmiGUG+pBris1csiKveI8vQ2pGw3CiL9XXQJKPWbVt+IjN/Je:CRgrsSmSTrHuhK6q4D9Xirht+IjN/JA3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 5608)
      • findstr.exe (PID: 2904)

    • Create files in the Startup directory

      • cmd.exe (PID: 4408)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exe (PID: 5868)
      • cmd.exe (PID: 5512)
      • Households.pif (PID: 2108)

    • There is functionality for taking screenshot (YARA)

      • e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exe (PID: 5868)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 1056)
      • e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exe (PID: 5868)
      • cmd.exe (PID: 6184)

    • Application launched itself

      • cmd.exe (PID: 1056)
      • cmd.exe (PID: 6184)

    • Get information on the list of running processes

      • cmd.exe (PID: 6184)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6184)

    • Suspicious file concatenation

      • cmd.exe (PID: 5512)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 5512)
      • Households.pif (PID: 2108)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6184)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6184)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 6184)

    • Starts a Microsoft application from unusual location

      • jsc.exe (PID: 6108)

    • The executable file from the user directory is run by the CMD process

      • Households.pif (PID: 2108)

    • Process drops legitimate windows executable

      • Households.pif (PID: 2108)

  • INFO

    • Create files in a temporary directory

      • e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exe (PID: 5868)
      • Households.pif (PID: 2108)

    • Compiled with Borland Delphi (YARA)

      • e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exe (PID: 5868)

    • The sample compiled with english language support

      • e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exe (PID: 5868)
      • cmd.exe (PID: 5512)
      • Households.pif (PID: 2108)

    • Creates a new folder

      • cmd.exe (PID: 4932)

    • Reads the computer name

      • Households.pif (PID: 2108)
      • jsc.exe (PID: 6108)

    • Reads mouse settings

      • Households.pif (PID: 2108)

    • Creates files or folders in the user directory

      • Households.pif (PID: 2108)

    • Checks supported languages

      • Households.pif (PID: 2108)
      • jsc.exe (PID: 6108)

    • Manual execution by a user

      • cmd.exe (PID: 4408)
      • jsc.exe (PID: 6108)

    • Reads the machine GUID from the registry

      • jsc.exe (PID: 6108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (37.4)
.scr | Windows screen saver (34.5)
.exe | Win32 Executable (generic) (11.9)
.exe | Win16/32 Executable Delphi generic (5.4)
.exe | Generic Win/DOS Executable (5.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 428544
InitializedDataSize: 802304
UninitializedDataSize: -
EntryPoint: 0x6a714
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 4.8592.0.47546
ProductVersionNumber: 4.8592.0.47546
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: Advanced photo blending and editing
CompanyName: PhotoFusionX
FileDescription: Advanced photo blending and editing
FileVersion: 4.8592.0.47546
InternalName: PhotoFusionX
LegalCopyright: Copyright © Natalie Mitchell 2018
ProductName: PhotoFusionX
ProductVersion: 4.8592.0.47546
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
16
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exe conhost.exe no specs cmd.exe no specs cmd.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe cmd.exe no specs households.pif ping.exe no specs cmd.exe conhost.exe no specs jsc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1056cmd /k cmd < Incident & exitC:\Windows\SysWOW64\cmd.exe—e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1300ping -n 5 localhostC:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1812tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
21083794\Households.pif 3794\m C:\Users\admin\AppData\Local\Temp\54580\3794\Households.pif
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script (Beta)
Exit code:
0
Version:
3, 3, 15, 4
Modules
Images
c:\users\admin\appdata\local\temp\54580\3794\households.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
2904findstr /I "wrsa.exe"C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4408cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhotoFusionX.url" & echo URL="C:\Users\admin\AppData\Local\Natalie Mitchell\PhotoFusionX.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PhotoFusionX.url" & exitC:\Windows\SysWOW64\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4620tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4932cmd /c mkdir 3794C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5392cmd /c copy /b Joan 3794\m C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5512cmd /c copy /b Cio + Asks + Gnu + Able + Nov + Rt 3794\Households.pifC:\Windows\SysWOW64\cmd.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
1 118
Read events
1 118
Write events
0
Delete events
0

Modification events

No data
Executable files
5
Suspicious files
5
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
5868e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exeC:\Users\admin\AppData\Local\Temp\54580\Cioexecutable
MD5:1BA107D3E8D90334D4C59DFB51AB5779
SHA256:16F0AB5E6A6574868A538223D9539A084D60D4249EF834E2EE084B7467C1C37D
5868e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exeC:\Users\admin\AppData\Local\Temp\54580\Incidenttext
MD5:C308FCE63EAEB0964204EE344E74C530
SHA256:95B11D335117DB2A17ED7313EAEFF4BA5631787D0A5BEA0B0C21527B47FBA006
5868e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exeC:\Users\admin\AppData\Local\Temp\54580\Rtbinary
MD5:E0CE0608F7D9C00E386462FC9BC982EF
SHA256:39C5A08DF71151027538F77DF3164A0DDE1E82AF24E1C49E95E8E841B960EBAE
5868e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exeC:\Users\admin\AppData\Local\Temp\54580\Ablebinary
MD5:B18B63A85CDCF60914260CFAE0AE4957
SHA256:AA28B7DDC712C0AF41D66059F4E12DDAAA6029374435F6A0FFB3C78B52CE19FA
5868e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exeC:\Users\admin\AppData\Local\Temp\54580\Asksbinary
MD5:AAD6C578267939659E3DF7D42A7A8783
SHA256:77661944A98FECC707D67075D5DFBEDD6ABF50165EAEF7993267FD89CC526A72
2108Households.pifC:\Users\admin\AppData\Local\Natalie Mitchell\ztext
MD5:35E1231AB34F283787BC9869E2D081FC
SHA256:9806A7ED5A2F26F6146768182C935F3CB58AA7AC268CA0F2846F7FFD901271A4
5868e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exeC:\Users\admin\AppData\Local\Temp\54580\Gnubinary
MD5:6B26517C639069470BBF1BBEA3F6F7E9
SHA256:4B77E166A7ABA7435FAF11534FAFA1D4B10B34D138BD2BDFDAD0C42B1FDD8A35
5868e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d.exeC:\Users\admin\AppData\Local\Temp\54580\Joantext
MD5:35E1231AB34F283787BC9869E2D081FC
SHA256:9806A7ED5A2F26F6146768182C935F3CB58AA7AC268CA0F2846F7FFD901271A4
2108Households.pifC:\Users\admin\AppData\Local\Temp\54580\3794\jsc.exeexecutable
MD5:319F58BC07CB7AA8C5ADCD75BF0AAF8F
SHA256:9415E66A36AB70C6998ACB4AB5FAD63C4D18B9949B8EE02B2EBC8F3B07FEF6B1
5512cmd.exeC:\Users\admin\AppData\Local\Temp\54580\3794\Households.pifexecutable
MD5:848164D084384C49937F99D5B894253E
SHA256:F58D3A4B2F3F7F10815C24586FAE91964EEED830369E7E0701B43895B0CEFBD3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
208
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
208
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
208
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.3
  • 40.126.32.133
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
eGHMXLVnHBYQzOE.eGHMXLVnHBYQzOE
  • —
unknown
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
e7f0e5b269709e0c1038f76d1073bf614308dfc5cac8beb1c2c39d6704eb804d