File name:

cw1.exe

Full analysis: https://app.any.run/tasks/d84974d4-6c8d-49ea-a15f-6b9a86fdd4cd
Verdict: Malicious activity
Analysis date: March 07, 2024, 17:21:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

51D3A136BBC6A5C90A400D238EA4210C

SHA1:

630CD304036F52C9CCD93454174117F7BBE8A639

SHA256:

E96F8EAEF7A46A8B6F96252378071C2A2F3B8D281A4BF01B85E4484DE10407EC

SSDEEP:

192:OHl/OTIc3RahVhkR+aI9b5h/BN+S0A4V7E5pz6dVrMYY:cFhfkMf9b/PkA4V7XM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • cw1.exe (PID: 2160)

    • Starts CMD.EXE for self-deleting

      • cw1.exe (PID: 2160)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • cw1.exe (PID: 2160)

    • Reads settings of System Certificates

      • msdt.exe (PID: 2148)

    • Process uses IPCONFIG to discover network configuration

      • sdiagnhost.exe (PID: 3308)

    • Starts CMD.EXE for commands execution

      • cw1.exe (PID: 2160)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2332)

    • Process drops legitimate windows executable

      • msdt.exe (PID: 2148)

    • Reads the Internet Settings

      • sdiagnhost.exe (PID: 3308)
      • cw1.exe (PID: 2160)

    • Uses ROUTE.EXE to obtain the routing table information

      • sdiagnhost.exe (PID: 3308)

    • Hides command output

      • cmd.exe (PID: 2332)

  • INFO

    • Reads the computer name

      • cw1.exe (PID: 2160)

    • Checks supported languages

      • cw1.exe (PID: 2160)

    • Drops the executable file immediately after the start

      • msdt.exe (PID: 2148)

    • Reads the software policy settings

      • msdt.exe (PID: 2148)

    • Reads security settings of Internet Explorer

      • msdt.exe (PID: 2148)
      • sdiagnhost.exe (PID: 3308)

    • Create files in a temporary directory

      • sdiagnhost.exe (PID: 3308)
      • makecab.exe (PID: 1772)
      • msdt.exe (PID: 2148)

    • Creates files or folders in the user directory

      • msdt.exe (PID: 2148)

    • Manual execution by a user

      • msdt.exe (PID: 2148)

    • Checks proxy server information

      • cw1.exe (PID: 2160)

    • Reads the machine GUID from the registry

      • cw1.exe (PID: 2160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:09:04 18:11:12+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.28
CodeSize: 5632
InitializedDataSize: 6144
UninitializedDataSize: -
EntryPoint: 0x15f1
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cw1.exe cmd.exe no specs ping.exe no specs Connection Manager LUA Host Object no specs rundll32.exe no specs msdt.exe no specs sdiagnhost.exe no specs ipconfig.exe no specs route.exe no specs makecab.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116C:\Windows\system32\DllHost.exe /Processid:{BA126F01-2166-11D1-B1D0-00805FC1270E}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
980"C:\Windows\system32\ipconfig.exe" /allC:\Windows\System32\ipconfig.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1772"C:\Windows\system32\makecab.exe" /f NetworkConfiguration.ddfC:\Windows\System32\makecab.exe—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Cabinet Maker
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2148 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\admin\AppData\Local\Temp\NDF211B.tmp -ep NetworkDiagnosticsConnectivityC:\Windows\System32\msdt.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2160"C:\Users\admin\AppData\Local\Temp\cw1.exe" C:\Users\admin\AppData\Local\Temp\cw1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
2332cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\admin\AppData\Local\Temp\cw1.exe"C:\Windows\System32\cmd.exe—cw1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2804"C:\Windows\system32\ROUTE.EXE" printC:\Windows\System32\ROUTE.EXE—sdiagnhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Route Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2960C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3212ping 1.1.1.1 -n 1 -w 3000 C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3308C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
13
Text files
26
Unknown types
5

Dropped files

PID
Process
Filename
Type
2148msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_4b951ef9-22ef-4dc6-9d75-d9dba2c752db\HTInteractiveRes.ps1text
MD5:C25ED2111C6EE9299E6D9BF51012F2F5
SHA256:8E326EE0475208D4C943D885035058FAD7146BBA02B66305F7C9F31F6A57E81B
2148msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_4b951ef9-22ef-4dc6-9d75-d9dba2c752db\InteractiveRes.ps1text
MD5:25B8543DBF571F040118423BC3C7A75E
SHA256:D78E6291D6F27AC6FEBDCF0A4D5A34521E7F033AF8875E026DF21BA7513AB64A
2148msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_4b951ef9-22ef-4dc6-9d75-d9dba2c752db\UtilityFirewall.ps1text
MD5:B004AFC224E9216115EC3B0BF5D43BA2
SHA256:31B97632CA31D1BB21917A07757B2FF415DBB6A4E7DD7B533ECC52431ACF65B5
2148msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_4b951ef9-22ef-4dc6-9d75-d9dba2c752db\DiagPackage.diagpkgxml
MD5:C9FB87FA3460FAE6D5D599236CFD77E2
SHA256:CDE728C08A4E50A02FCFF35C90EE2B3B33AB24C8B858F180B6A67BFA94DEF35F
2148msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_4b951ef9-22ef-4dc6-9d75-d9dba2c752db\NetworkDiagnosticsVerify.ps1text
MD5:C0BB6343BD0F6F9B46B33E4B66106953
SHA256:EB9BC61668A93759D0127A11CDFC03E924100D69C7E6457FEAA89330474C90C3
2148msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_4b951ef9-22ef-4dc6-9d75-d9dba2c752db\StartDPSService.ps1text
MD5:A660422059D953C6D681B53A6977100E
SHA256:D19677234127C38A52AEC23686775A8EB3F4E3A406F4A11804D97602D6C31813
2148msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_4b951ef9-22ef-4dc6-9d75-d9dba2c752db\DiagPackage.dllexecutable
MD5:2433E09C08C21455000F7E36D7653759
SHA256:EA9400E719FB15CD82D5DAB4B7D8E3870BB375BBE11BB95B0D957A84FEE2891C
2148msdt.exeC:\Users\admin\AppData\Local\Temp\SDIAG_4b951ef9-22ef-4dc6-9d75-d9dba2c752db\NetworkDiagnosticsResolve.ps1text
MD5:A7B957F221C643580184665BE57E6AC8
SHA256:8582EF50174CB74233F196F193E04C0CCBBEE2AED5CE50964CBB95822C218E7F
3308sdiagnhost.exeC:\Users\admin\AppData\Local\Temp\8889D4F3-3057-4408-AA98-06257AFADE3E.Diagnose.0.etletl
MD5:FC465BC14190C9C93B99C7A7A799B4C2
SHA256:5FDD4BB07766C6376B23730A1E085EE400560D5B4394243BA01F56FB19BBA1A0
3308sdiagnhost.exeC:\Users\admin\AppData\Local\Temp\tmp27C2.tmp\route.print.txttext
MD5:D6BAB7F03D228D75D5CD49BC0C892C8C
SHA256:C1BA19C19145DC9B4AB22569596C73EF911F05AEE04AF6E23ADD784BCC92438F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2160
cw1.exe
49.13.77.253:80
ssl-6582datamanager.hellotherehi.local
Hetzner Online GmbH
DE
unknown

DNS requests

Domain
IP
Reputation
ssl-6582datamanager.hellotherehi.local
  • 49.13.77.253
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
cw1.exe