File name:

Artifacts-2024-12-14_23-24-37Z.zip

Full analysis: https://app.any.run/tasks/08f1858c-d551-4f9f-bd6f-aad5cfde8158
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: December 14, 2024, 23:41:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
snake
keylogger
stealer
m0yv
loader
netreactor
expiro
truesight
mal-driver
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=AES Encrypted
MD5:

F2E82419A915B3BEA219F38BB4578FD4

SHA1:

791AD075721255C4D0E1F4E397A52F3728FD74F7

SHA256:

EF58489C1856B4813EC29876AA9589839C7137E9D253595143097322EFBE8124

SSDEEP:

24576:sbY7OOGc9aH8k6ZydTuaNdUuekWH+aETpkNMpUlVcBAC:sbY7OOGc9aH8k6ZydTuaNdUuekWH+aEZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts PowerShell from an unusual location

      • alpha.pif (PID: 1200)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 6400)
      • alpha.pif (PID: 1200)

    • M0YV mutex has been found

      • hzvqnwzI.pif (PID: 2572)
      • FlashPlayerUpdateService.exe (PID: 7152)
      • Native_Apihost_Nova.exe (PID: 5392)
      • AppVClient.exe (PID: 5192)
      • alg.exe (PID: 5916)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 720)
      • FXSSVC.exe (PID: 3540)
      • elevation_service.exe (PID: 6652)
      • msdtc.exe (PID: 5076)
      • maintenanceservice.exe (PID: 5112)
      • PerceptionSimulationService.exe (PID: 3560)
      • PSEXESVC.exe (PID: 5544)
      • Locator.exe (PID: 4540)
      • SensorDataService.exe (PID: 3540)
      • Spectrum.exe (PID: 6456)
      • vds.exe (PID: 7188)
      • VSSVC.exe (PID: 7220)
      • snmptrap.exe (PID: 6668)
      • ssh-agent.exe (PID: 2124)
      • TieringEngineService.exe (PID: 6808)
      • AgentService.exe (PID: 6828)
      • WmiApSrv.exe (PID: 7340)
      • SearchIndexer.exe (PID: 7420)
      • elevation_service.exe (PID: 6840)
      • wbengine.exe (PID: 7284)

    • Changes the autorun value in the registry

      • x.exe (PID: 3288)
      • setup.exe (PID: 6512)

    • Actions looks like stealing of personal data

      • ST-CLIENT.exe (PID: 1616)
      • Native_Apihost_Nova.exe (PID: 5392)
      • alg.exe (PID: 5916)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 720)
      • elevation_service.exe (PID: 6652)

    • Steals credentials from Web Browsers

      • ST-CLIENT.exe (PID: 1616)
      • Native_Apihost_Nova.exe (PID: 5392)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • Native_Apihost_Nova.exe (PID: 5392)

    • M0YV has been detected (YARA)

      • armsvc.exe (PID: 1380)
      • MicrosoftEdgeUpdate.exe (PID: 4764)
      • alg.exe (PID: 5916)
      • MicrosoftEdgeUpdate.exe (PID: 5192)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 720)
      • GameInputSvc.exe (PID: 6412)
      • elevation_service.exe (PID: 6652)
      • GameInputSvc.exe (PID: 7052)
      • Spectrum.exe (PID: 6456)
      • MicrosoftEdgeUpdate.exe (PID: 4992)
      • Native_Apihost_Nova.exe (PID: 5392)

    • EXPIRO has been detected (SURICATA)

      • alg.exe (PID: 5916)

    • Connects to the CnC server

      • alg.exe (PID: 5916)

  • SUSPICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 1864)

    • Application launched itself

      • WinRAR.exe (PID: 1864)
      • MicrosoftEdgeUpdate.exe (PID: 2280)
      • MicrosoftEdgeUpdate.exe (PID: 4764)
      • GameInputSvc.exe (PID: 6412)
      • GoogleUpdate.exe (PID: 2120)
      • GoogleUpdate.exe (PID: 6456)
      • MicrosoftEdgeUpdate.exe (PID: 5192)
      • GoogleUpdate.exe (PID: 8056)
      • updater.exe (PID: 7596)
      • updater.exe (PID: 1224)
      • updater.exe (PID: 444)
      • updater.exe (PID: 6232)
      • updater.exe (PID: 3724)
      • setup.exe (PID: 7644)
      • setup.exe (PID: 6512)
      • setup.exe (PID: 6312)
      • setup.exe (PID: 7352)
      • MicrosoftEdgeUpdate.exe (PID: 3608)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1864)
      • WinRAR.exe (PID: 6724)
      • x.exe (PID: 3288)
      • aken.pif (PID: 4872)
      • hzvqnwzI.pif (PID: 2572)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 6724)
      • x.exe (PID: 3288)

    • Executing commands from ".cmd" file

      • WinRAR.exe (PID: 6724)
      • x.exe (PID: 3288)

    • Executable content was dropped or overwritten

      • extrac32.exe (PID: 5096)
      • extrac32.exe (PID: 6664)
      • extrac32.exe (PID: 6516)
      • x.exe (PID: 3288)
      • hzvqnwzI.pif (PID: 2572)
      • Native_Apihost_Nova.exe (PID: 5392)
      • svchost.exe (PID: 6812)
      • GoogleUpdate.exe (PID: 8056)
      • updater.exe (PID: 7596)
      • updater.exe (PID: 6232)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 7348)
      • setup.exe (PID: 6512)
      • 131.0.6778.140_chrome_installer.exe (PID: 6476)
      • setup.exe (PID: 7644)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 720)
      • svchost.exe (PID: 7468)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe (PID: 7064)
      • elevation_service.exe (PID: 6652)

    • The executable file from the user directory is run by the CMD process

      • x.exe (PID: 3544)
      • x.exe (PID: 5872)
      • x.exe (PID: 3288)

    • Likely accesses (executes) a file from the Public directory

      • extrac32.exe (PID: 6516)
      • cmd.exe (PID: 6400)
      • alpha.pif (PID: 6496)
      • alpha.pif (PID: 6520)
      • alpha.pif (PID: 6680)
      • alpha.pif (PID: 6536)
      • extrac32.exe (PID: 6664)
      • alpha.pif (PID: 1200)
      • aken.pif (PID: 4872)
      • hzvqnwzI.pif (PID: 2572)

    • Drops a file with a rarely used extension (PIF)

      • extrac32.exe (PID: 6516)
      • extrac32.exe (PID: 6664)
      • x.exe (PID: 3288)

    • Process drops legitimate windows executable

      • extrac32.exe (PID: 6516)
      • extrac32.exe (PID: 6664)
      • Native_Apihost_Nova.exe (PID: 5392)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 7348)
      • setup.exe (PID: 7644)
      • MicrosoftEdgeUpdate.exe (PID: 3608)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe (PID: 7064)
      • MicrosoftEdgeUpdate.exe (PID: 7580)
      • elevation_service.exe (PID: 6652)

    • Starts a Microsoft application from unusual location

      • alpha.pif (PID: 6496)
      • alpha.pif (PID: 6520)
      • alpha.pif (PID: 6680)
      • alpha.pif (PID: 6536)
      • alpha.pif (PID: 1200)
      • aken.pif (PID: 4872)
      • MicrosoftEdgeUpdate.exe (PID: 7580)

    • Created directory related to system

      • alpha.pif (PID: 6496)

    • Starts itself from another location

      • cmd.exe (PID: 6400)
      • setup.exe (PID: 6512)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6400)
      • alpha.pif (PID: 1200)
      • x.exe (PID: 3288)

    • Checks Windows Trust Settings

      • aken.pif (PID: 4872)
      • MicrosoftEdgeUpdate.exe (PID: 5192)
      • MicrosoftEdgeUpdate.exe (PID: 3608)

    • Executes as Windows Service

      • armsvc.exe (PID: 1380)
      • FlashPlayerUpdateService.exe (PID: 7152)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 720)
      • alg.exe (PID: 5916)
      • AppVClient.exe (PID: 5192)
      • MicrosoftEdgeUpdate.exe (PID: 2280)
      • FXSSVC.exe (PID: 3540)
      • GameInputSvc.exe (PID: 6412)
      • GoogleUpdate.exe (PID: 6456)
      • maintenanceservice.exe (PID: 5112)
      • msdtc.exe (PID: 5076)
      • MicrosoftEdgeUpdate.exe (PID: 5192)
      • PSEXESVC.exe (PID: 5544)
      • Locator.exe (PID: 4540)
      • SensorDataService.exe (PID: 3540)
      • PerceptionSimulationService.exe (PID: 3560)
      • perfhost.exe (PID: 7028)
      • snmptrap.exe (PID: 6668)
      • VSSVC.exe (PID: 7220)
      • ssh-agent.exe (PID: 2124)
      • Spectrum.exe (PID: 6456)
      • TieringEngineService.exe (PID: 6808)
      • AgentService.exe (PID: 6828)
      • vds.exe (PID: 7188)
      • wbengine.exe (PID: 7284)
      • WmiApSrv.exe (PID: 7340)
      • GoogleUpdate.exe (PID: 8056)
      • updater.exe (PID: 1224)
      • updater.exe (PID: 3724)
      • updater.exe (PID: 6232)
      • MicrosoftEdgeUpdate.exe (PID: 3608)

    • Loads DLL from Mozilla Firefox

      • ST-CLIENT.exe (PID: 1616)

    • Creates/Modifies COM task schedule object

      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3436)
      • MicrosoftEdgeUpdate.exe (PID: 5616)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 444)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6592)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1080)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5448)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 2120)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • Native_Apihost_Nova.exe (PID: 5392)

    • The process verifies whether the antivirus software is installed

      • Native_Apihost_Nova.exe (PID: 5392)

    • Connects to SMTP port

      • ST-CLIENT.exe (PID: 1616)

    • Process requests binary or script from the Internet

      • svchost.exe (PID: 6812)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 6812)
      • svchost.exe (PID: 7468)

    • Contacting a server suspected of hosting an CnC

      • alg.exe (PID: 5916)

    • Creates a software uninstall entry

      • setup.exe (PID: 6512)
      • setup.exe (PID: 7644)

    • Searches for installed software

      • setup.exe (PID: 7644)
      • setup.exe (PID: 6512)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 7580)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 1864)
      • WinRAR.exe (PID: 6724)
      • cmd.exe (PID: 3988)
      • aken.pif (PID: 4872)
      • hzvqnwzI.pif (PID: 2572)

    • Checks supported languages

      • extrac32.exe (PID: 5096)
      • x.exe (PID: 3288)
      • extrac32.exe (PID: 6516)
      • extrac32.exe (PID: 6664)
      • alpha.pif (PID: 6520)
      • alpha.pif (PID: 6496)
      • alpha.pif (PID: 6680)
      • alpha.pif (PID: 1200)
      • aken.pif (PID: 4872)
      • alpha.pif (PID: 6536)
      • hzvqnwzI.pif (PID: 2572)
      • armsvc.exe (PID: 1380)
      • FlashPlayerUpdateService.exe (PID: 7152)
      • ST-CLIENT.exe (PID: 1616)
      • Native_Apihost_Nova.exe (PID: 5392)
      • MicrosoftEdgeUpdate.exe (PID: 2280)
      • MicrosoftEdgeUpdate.exe (PID: 5616)
      • MicrosoftEdgeUpdate.exe (PID: 4764)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3436)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 444)
      • elevation_service.exe (PID: 6652)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6592)
      • MicrosoftEdgeUpdate.exe (PID: 4992)
      • GoogleUpdate.exe (PID: 6456)
      • GoogleUpdate.exe (PID: 2120)
      • GoogleCrashHandler.exe (PID: 1216)
      • elevation_service.exe (PID: 6840)
      • GoogleCrashHandler64.exe (PID: 1620)
      • maintenanceservice.exe (PID: 5112)
      • GoogleUpdate.exe (PID: 2260)
      • PSEXESVC.exe (PID: 5544)
      • GoogleUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdgeUpdate.exe (PID: 5192)
      • ssh-agent.exe (PID: 2124)
      • GoogleUpdate.exe (PID: 8056)
      • GoogleUpdate.exe (PID: 7176)
      • UpdaterSetup.exe (PID: 8176)
      • updater.exe (PID: 7596)
      • updater.exe (PID: 4980)
      • updater.exe (PID: 1224)
      • updater.exe (PID: 4444)
      • updater.exe (PID: 6620)
      • updater.exe (PID: 6348)
      • updater.exe (PID: 6280)
      • updater.exe (PID: 444)
      • updater.exe (PID: 3724)
      • updater.exe (PID: 6232)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 7348)
      • setup.exe (PID: 7644)
      • setup.exe (PID: 4704)
      • 131.0.6778.140_chrome_installer.exe (PID: 6476)
      • setup.exe (PID: 6512)
      • setup.exe (PID: 7884)
      • setup.exe (PID: 6312)
      • setup.exe (PID: 1536)
      • setup.exe (PID: 6952)
      • MicrosoftEdgeUpdate.exe (PID: 1344)
      • setup.exe (PID: 7352)
      • MicrosoftEdgeUpdate.exe (PID: 3608)
      • MicrosoftEdgeUpdate.exe (PID: 6552)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe (PID: 7064)
      • MicrosoftEdgeUpdate.exe (PID: 4980)
      • MicrosoftEdgeUpdate.exe (PID: 2120)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1080)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7164)
      • MicrosoftEdgeUpdate.exe (PID: 7580)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5448)
      • MicrosoftEdgeUpdate.exe (PID: 6344)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6724)

    • Reads the computer name

      • extrac32.exe (PID: 5096)
      • x.exe (PID: 3288)
      • extrac32.exe (PID: 6516)
      • extrac32.exe (PID: 6664)
      • aken.pif (PID: 4872)
      • hzvqnwzI.pif (PID: 2572)
      • armsvc.exe (PID: 1380)
      • FlashPlayerUpdateService.exe (PID: 7152)
      • Native_Apihost_Nova.exe (PID: 5392)
      • ST-CLIENT.exe (PID: 1616)
      • MicrosoftEdgeUpdate.exe (PID: 4764)
      • MicrosoftEdgeUpdate.exe (PID: 2280)
      • MicrosoftEdgeUpdate.exe (PID: 5616)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 3436)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 444)
      • MicrosoftEdgeUpdate.exe (PID: 4992)
      • GoogleUpdate.exe (PID: 6456)
      • GoogleUpdate.exe (PID: 2120)
      • elevation_service.exe (PID: 6840)
      • elevation_service.exe (PID: 6652)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 6592)
      • GoogleUpdate.exe (PID: 6860)
      • GoogleCrashHandler.exe (PID: 1216)
      • maintenanceservice.exe (PID: 5112)
      • GoogleUpdate.exe (PID: 2260)
      • GoogleCrashHandler64.exe (PID: 1620)
      • MicrosoftEdgeUpdate.exe (PID: 5192)
      • PSEXESVC.exe (PID: 5544)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • ssh-agent.exe (PID: 2124)
      • GoogleUpdate.exe (PID: 8056)
      • GoogleUpdate.exe (PID: 7176)
      • updater.exe (PID: 7596)
      • updater.exe (PID: 1224)
      • updater.exe (PID: 444)
      • updater.exe (PID: 3724)
      • updater.exe (PID: 6232)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 7348)
      • setup.exe (PID: 7644)
      • 131.0.6778.140_chrome_installer.exe (PID: 6476)
      • setup.exe (PID: 6512)
      • setup.exe (PID: 6312)
      • setup.exe (PID: 7352)
      • MicrosoftEdgeUpdate.exe (PID: 1344)
      • MicrosoftEdgeUpdate.exe (PID: 3608)
      • MicrosoftEdgeUpdate.exe (PID: 6552)
      • MicrosoftEdgeUpdate.exe (PID: 7580)
      • MicrosoftEdgeUpdate.exe (PID: 4980)
      • MicrosoftEdgeUpdate.exe (PID: 2120)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 1080)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 5448)
      • MicrosoftEdgeUpdate.exe (PID: 6344)
      • MicrosoftEdgeUpdateComRegisterShell64.exe (PID: 7164)

    • Create files in a temporary directory

      • extrac32.exe (PID: 5096)
      • aken.pif (PID: 4872)
      • hzvqnwzI.pif (PID: 2572)
      • svchost.exe (PID: 7468)
      • svchost.exe (PID: 6812)

    • The sample compiled with english language support

      • extrac32.exe (PID: 5096)
      • extrac32.exe (PID: 6516)
      • extrac32.exe (PID: 6664)
      • x.exe (PID: 3288)
      • hzvqnwzI.pif (PID: 2572)
      • Native_Apihost_Nova.exe (PID: 5392)
      • svchost.exe (PID: 6812)
      • GoogleUpdate.exe (PID: 8056)
      • updater.exe (PID: 7596)
      • updater.exe (PID: 6232)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 7348)
      • 131.0.6778.140_chrome_installer.exe (PID: 6476)
      • setup.exe (PID: 6512)
      • setup.exe (PID: 7644)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 720)
      • MicrosoftEdgeUpdate.exe (PID: 3608)
      • svchost.exe (PID: 7468)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe (PID: 7064)
      • MicrosoftEdgeUpdate.exe (PID: 7580)
      • elevation_service.exe (PID: 6652)

    • Checks proxy server information

      • x.exe (PID: 3288)
      • Native_Apihost_Nova.exe (PID: 5392)

    • Reads the software policy settings

      • x.exe (PID: 3288)
      • aken.pif (PID: 4872)
      • GameInputSvc.exe (PID: 7052)
      • GoogleUpdate.exe (PID: 6860)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdgeUpdate.exe (PID: 5192)
      • ST-CLIENT.exe (PID: 1616)
      • Native_Apihost_Nova.exe (PID: 5392)
      • GoogleUpdate.exe (PID: 7176)
      • GoogleUpdate.exe (PID: 8056)
      • updater.exe (PID: 3724)
      • MicrosoftEdgeUpdate.exe (PID: 3608)
      • MicrosoftEdgeUpdate.exe (PID: 1344)
      • MicrosoftEdgeUpdate.exe (PID: 6552)
      • MicrosoftEdgeUpdate.exe (PID: 6344)

    • Reads the machine GUID from the registry

      • aken.pif (PID: 4872)
      • x.exe (PID: 3288)
      • ST-CLIENT.exe (PID: 1616)
      • Native_Apihost_Nova.exe (PID: 5392)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • aken.pif (PID: 4872)

    • Script raised an exception (POWERSHELL)

      • aken.pif (PID: 4872)

    • Creates files or folders in the user directory

      • hzvqnwzI.pif (PID: 2572)
      • GoogleUpdate.exe (PID: 6860)

    • Process checks computer location settings

      • hzvqnwzI.pif (PID: 2572)
      • setup.exe (PID: 7644)

    • Disables trace logs

      • Native_Apihost_Nova.exe (PID: 5392)

    • Creates files in the program directory

      • FXSSVC.exe (PID: 3540)
      • GoogleUpdate.exe (PID: 6456)
      • GoogleUpdate.exe (PID: 2120)
      • GoogleUpdate.exe (PID: 6860)
      • maintenanceservice.exe (PID: 5112)
      • GoogleUpdate.exe (PID: 2260)
      • SearchIndexer.exe (PID: 7420)
      • GoogleUpdate.exe (PID: 8056)
      • UpdaterSetup.exe (PID: 8176)
      • GoogleUpdate.exe (PID: 7176)
      • updater.exe (PID: 7596)
      • updater.exe (PID: 6620)
      • updater.exe (PID: 6232)
      • updater.exe (PID: 3724)
      • setup.exe (PID: 7644)
      • MicrosoftEdge_X64_131.0.2903.99.exe (PID: 7348)
      • setup.exe (PID: 6512)
      • setup.exe (PID: 6312)
      • MicrosoftEdgeUpdateSetup_X86_1.3.195.39.exe (PID: 7064)

    • Executes as Windows Service

      • elevation_service.exe (PID: 6652)
      • elevation_service.exe (PID: 6840)
      • SearchIndexer.exe (PID: 7420)

    • Reads Environment values

      • ST-CLIENT.exe (PID: 1616)
      • MicrosoftEdgeUpdate.exe (PID: 4556)
      • MicrosoftEdgeUpdate.exe (PID: 1344)
      • MicrosoftEdgeUpdate.exe (PID: 4992)
      • MicrosoftEdgeUpdate.exe (PID: 6552)
      • MicrosoftEdgeUpdate.exe (PID: 6344)

    • Checks transactions between databases Windows and Oracle

      • msdtc.exe (PID: 5076)

    • Reads the time zone

      • TieringEngineService.exe (PID: 6808)

    • .NET Reactor protector has been detected

      • Native_Apihost_Nova.exe (PID: 5392)

    • The sample compiled with bulgarian language support

      • Native_Apihost_Nova.exe (PID: 5392)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • Native_Apihost_Nova.exe (PID: 5392)
      • alg.exe (PID: 5916)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 720)
      • elevation_service.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • SearchProtocolHost.exe (PID: 7968)
      • SearchFilterHost.exe (PID: 7996)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 7596)
      • updater.exe (PID: 1224)
      • updater.exe (PID: 444)
      • updater.exe (PID: 3724)
      • updater.exe (PID: 6232)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2024:12:14 23:24:36
ZipCRC: 0xa148223b
ZipCompressedSize: 462191
ZipUncompressedSize: 462606
ZipFileName: Ziraat_ETF_Swift_Message_GO938NB838.GZ
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
242
Monitored processes
107
Malicious processes
50
Suspicious processes
6

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe no specs mspaint.exe no specs cmd.exe no specs conhost.exe no specs extrac32.exe x.exe no specs x.exe no specs x.exe cmd.exe no specs conhost.exe no specs extrac32.exe extrac32.exe alpha.pif no specs alpha.pif no specs alpha.pif no specs sc.exe no specs alpha.pif no specs sc.exe no specs alpha.pif no specs aken.pif no specs #M0YV hzvqnwzi.pif #M0YV armsvc.exe no specs #M0YV flashplayerupdateservice.exe no specs #SNAKEKEYLOGGER native_apihost_nova.exe st-client.exe #M0YV alg.exe #M0YV appvclient.exe no specs #M0YV diagnosticshub.standardcollector.service.exe microsoftedgeupdate.exe no specs #M0YV microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs #M0YV fxssvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV gameinputsvc.exe no specs #M0YV gameinputsvc.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV elevation_service.exe microsoftedgeupdatecomregistershell64.exe no specs svchost.exe googleupdate.exe no specs #M0YV microsoftedgeupdate.exe no specs googleupdate.exe no specs #M0YV elevation_service.exe no specs googleupdate.exe googlecrashhandler.exe no specs googlecrashhandler64.exe no specs googleupdate.exe no specs #M0YV maintenanceservice.exe no specs #M0YV msdtc.exe no specs #M0YV perceptionsimulationservice.exe no specs perfhost.exe no specs #M0YV microsoftedgeupdate.exe #M0YV psexesvc.exe no specs #M0YV locator.exe no specs microsoftedgeupdate.exe #M0YV sensordataservice.exe no specs #M0YV snmptrap.exe no specs #M0YV spectrum.exe no specs #M0YV ssh-agent.exe no specs #M0YV tieringengineservice.exe no specs #M0YV agentservice.exe no specs #M0YV vds.exe no specs #M0YV vssvc.exe no specs #M0YV wbengine.exe no specs #M0YV wmiapsrv.exe no specs #M0YV searchindexer.exe no specs Delivery Optimization User no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs googleupdate.exe svchost.exe updatersetup.exe no specs googleupdate.exe updater.exe updater.exe no specs updater.exe no specs updater.exe no specs updater.exe no specs updater.exe no specs updater.exe updater.exe no specs updater.exe updater.exe no specs mspaint.exe no specs microsoftedge_x64_131.0.2903.99.exe setup.exe setup.exe no specs 131.0.6778.140_chrome_installer.exe setup.exe setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs microsoftedgeupdate.exe microsoftedgeupdate.exe svchost.exe microsoftedgeupdatesetup_x86_1.3.195.39.exe microsoftedgeupdate.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdate.exe

Process information

PID
CMD
Path
Indicators
Parent process
444"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateComRegisterShell64.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.185.17\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.185.17
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.185.17\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
444"C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
132.0.6833.0
Modules
Images
c:\program files (x86)\google\googleupdater\132.0.6833.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
720C:\WINDOWS\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft (R) Diagnostics Hub Standard Collector
Version:
11.00.19041.3930 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\sechost.dll
1080"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe" C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.39\MicrosoftEdgeUpdateComRegisterShell64.exe—MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update COM Registration Helper
Exit code:
0
Version:
1.3.195.39
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\1.3.195.39\microsoftedgeupdatecomregistershell64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1200C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\aken.pif -WindowStyle hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'" C:\Users\Public\alpha.pif—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\public\alpha.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1216"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler.exe"C:\Program Files (x86)\Google\Update\1.3.36.372\GoogleCrashHandler.exe—GoogleUpdate.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Crash Handler
Exit code:
0
Version:
1.3.36.371
Modules
Images
c:\program files (x86)\google\update\1.3.36.372\googlecrashhandler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1224"C:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe" --system --windows-service --service=update-internalC:\Program Files (x86)\Google\GoogleUpdater\132.0.6833.0\updater.exe—services.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
132.0.6833.0
Modules
Images
c:\program files (x86)\google\googleupdater\132.0.6833.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1344"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xODUuMTciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDcuMzciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7M0M0RjZDOUYtQkE0NC00NjQyLTgyMkYtN0REM0Q4NDdGNDFCfSIgdXNlcmlkPSJ7RkQ5ODQ3MzktQTEyMi00REIwLUJFNUItNDZFM0UwOUQ4NEU0fSIgaW5zdGFsbHNvdXJjZT0iY29yZSIgcmVxdWVzdGlkPSJ7NERDQ0Q4OTMtOERFRC00QjdELTkyQTgtQkMxNzdCRjhCNDk3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjQiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0NS40MDQ2IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRFTEwiIHByb2R1Y3RfbmFtZT0iREVMTCIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy45OSIgbGFuZz0iIiBicmFuZD0iRVVXViIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzMjU4NzIxNzk4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTMyNTg3MjE3OTgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDIxNzQ4MTM2NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzBmNmE2ZGQzLTBiMjItNGU3OC1iMDRmLTYwNDk0ZWI0YzRlOD9QMT0xNzM0ODI0NTQ0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PWlIUkVKJTJibEhCbXdudzQwRzh6NnVQYk50eHdNeCUyYjdEJTJicjhlbnV4QkdwS3VtVTNYZEM3dW9zQlh6YkVBb3Y5TiUyYkdTRjFxN090azQyNDdCbXc5ejZhJTJiUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE3Njg1NTY0OCIgdG90YWw9IjE3Njg1NTY0OCIgZG93bmxvYWRfdGltZV9tcz0iOTE5MjMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDIxNzYzODI0NCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjE0MjM4ODg4NDk1IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDkzNTQ2OTU1OCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjYwOSIgZG93bmxvYWRfdGltZV9tcz0iOTU4NzUiIGRvd25sb2FkZWQ9IjE3Njg1NTY0OCIgdG90YWw9IjE3Njg1NTY0OCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iNjk2NTgiLz48L2FwcD48L3JlcXVlc3Q-C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
MicrosoftEdgeUpdate.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Edge Update
Exit code:
0
Version:
1.3.147.37
Modules
Images
c:\program files (x86)\microsoft\edgeupdate\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
1380"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
services.exe
User:
SYSTEM
Company:
Adobe Inc.
Integrity Level:
SYSTEM
Description:
Acrobat Update Service
Version:
1.824.460.1042
Modules
Images
c:\program files (x86)\common files\adobe\arm\1.0\armsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1536C:\WINDOWS\SystemTemp\chrome_Unpacker_BeginUnzipping3724_2084043484\CR_A40CA.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=131.0.6778.140 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff7973c5d68,0x7ff7973c5d74,0x7ff7973c5d80C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3724_2084043484\CR_A40CA.tmp\setup.exe—setup.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Chrome Installer
Exit code:
0
Version:
131.0.6778.140
Modules
Images
c:\windows\systemtemp\chrome_unpacker_beginunzipping3724_2084043484\cr_a40ca.tmp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
63 198
Read events
55 705
Write events
7 257
Delete events
236

Modification events

(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Artifacts-2024-12-14_23-24-37Z.zip
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1864) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6724) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
Executable files
377
Suspicious files
46
Text files
22
Unknown types
1

Dropped files

PID
Process
Filename
Type
1864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb1864.49988\Ziraat_ETF_Swift_Message_GO938NB838.GZbinary
MD5:C3A963C7FBC565F62981F7E9E84A6913
SHA256:C1AF27E5BE539FBE4DFBC2CBD0EE91927F13AD935A262408DBE11789D04E494C
6516extrac32.exeC:\Users\Public\alpha.pifexecutable
MD5:D3348AC2130C7E754754A6E9CB053B09
SHA256:E9EF013238495BFFCE7459E059BFFE340A0F08B439EC94E7D4436F4E13714ECD
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6724.2566\Ziraat_ETF_Swift_Message_GO938NB838.cmdcompressed
MD5:60D85489385C358F248E9A87D6C2B7B5
SHA256:92DBC682CBEA39FB97532E9FC449D47607100D961F5962E91E6732125C6CF798
6724WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6724.933\Chine_ana386618D234892193D413011FF35473937FF487172loodatke.PNGimage
MD5:DC156637AEBF04336700A9BC71C78AAD
SHA256:E739A88AC8FB4FEFA998F8DBF4402A8D7A22EB079EDD05BEE412C4D4C99014EB
5096extrac32.exeC:\Users\admin\AppData\Local\Temp\x.exeexecutable
MD5:0A8427BFD965AB8ED73C888E39100E53
SHA256:6F90F301147D44679C0720A8769745A94D093F65BAFDDD7255C92B5618AE2CAF
3288x.exeC:\Users\Public\Libraries\Izwnqvzh.PIFexecutable
MD5:0A8427BFD965AB8ED73C888E39100E53
SHA256:6F90F301147D44679C0720A8769745A94D093F65BAFDDD7255C92B5618AE2CAF
2572hzvqnwzI.pifC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeexecutable
MD5:E98C542439F48C3AB47CEEBA7C1F4C17
SHA256:941B68FE5C86985AC88682F46CBAC6482011050FAC301AB3295BC570D936AF64
3288x.exeC:\Users\Public\Izwnqvzh.urlbinary
MD5:C1EC891F5C61695064E644DC7F22979B
SHA256:F967B604074150607B7EFE145FB61C0E8B54D66B8E7249F09718CB070B51F1E0
3288x.exeC:\Users\Public\Libraries\Izwnqvzhbinary
MD5:0B724A982424620A48D1289AB31CE3AD
SHA256:26FA85DEACCD5F36174023FBF0D954B14F66A0D4075DDBC6405BB96F1651966E
6664extrac32.exeC:\Users\Public\aken.pifexecutable
MD5:6BB54B2D7A3D63578559239A79700EA3
SHA256:870EDA04EA71CC066EC907F005E1D05CE592F04799C60E600E2CB986DC85B5EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
602
TCP/UDP connections
98
DNS requests
64
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6200
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6200
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7012
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5392
Native_Apihost_Nova.exe
GET
502
193.122.130.0:80
http://checkip.dyndns.org/
unknown
—
—
malicious
5392
Native_Apihost_Nova.exe
GET
200
193.122.130.0:80
http://checkip.dyndns.org/
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
640
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.136:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
www.bing.com
  • 104.126.37.136
  • 104.126.37.131
  • 104.126.37.145
  • 104.126.37.178
  • 104.126.37.130
  • 104.126.37.123
  • 104.126.37.139
  • 104.126.37.176
  • 104.126.37.128
whitelisted
login.live.com
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.140
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.32.136
  • 20.190.160.20
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)
5392
Native_Apihost_Nova.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
5392
Native_Apihost_Nova.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
2192
svchost.exe
Misc activity
ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org)
5392
Native_Apihost_Nova.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup - checkip.dyndns.org
5392
Native_Apihost_Nova.exe
Misc activity
ET INFO External IP Lookup Service Domain (reallyfreegeoip .org) in TLS SNI
6812
svchost.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6812
svchost.exe
Misc activity
ET INFO EXE - Served Attached HTTP
6812
svchost.exe
Misc activity
ET INFO Packed Executable Download
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Artifacts-2024-12-14_23-24-37Z.zip