File name:

f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe

Full analysis: https://app.any.run/tasks/8a100cd0-f338-4347-a0a5-d070f96eb587
Verdict: Malicious activity
Analysis date: May 21, 2024, 04:36:13
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upatre
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

311F4F130FAD70C7159CBAE042926BEE

SHA1:

81E6978BC064C0C745DC6B32BDF05EAFEB10FC31

SHA256:

F5185D4E070E8CF1120790D078DD9D3DC33539B59C33FFC607D88EE30E3E1DFF

SSDEEP:

768:8KLfvjQzEysJhbmGwdshsArzbYLDUGF+xDXBmIDm/6jR:8KLfvjQzCJhiJd/AD4VkDRHN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe (PID: 6216)

    • Steals credentials from Web Browsers

      • explorer.exe (PID: 7116)

    • UPATRE has been detected (SURICATA)

      • explorer.exe (PID: 4472)
      • explorer.exe (PID: 7148)
      • explorer.exe (PID: 7116)

    • Unusual connection from system programs

      • explorer.exe (PID: 7116)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 7116)

    • Runs injected code in another process

      • f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe (PID: 6216)

    • Application was injected by another process

      • explorer.exe (PID: 4472)

  • SUSPICIOUS

    • Loads DLL from Mozilla Firefox

      • explorer.exe (PID: 7148)

    • Executable content was dropped or overwritten

      • explorer.exe (PID: 4472)

  • INFO

    • Create files in a temporary directory

      • explorer.exe (PID: 7116)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 4472)

    • Checks proxy server information

      • explorer.exe (PID: 4472)
      • explorer.exe (PID: 7116)
      • explorer.exe (PID: 7148)

    • Manual execution by a user

      • explorer.exe (PID: 7116)
      • explorer.exe (PID: 7148)
      • explorer.exe (PID: 5372)
      • explorer.exe (PID: 2448)
      • explorer.exe (PID: 2084)
      • explorer.exe (PID: 4148)

    • Reads the software policy settings

      • explorer.exe (PID: 7116)
      • explorer.exe (PID: 7148)
      • explorer.exe (PID: 4472)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 7116)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 4472)

    • Checks supported languages

      • f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe (PID: 6216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.7)
.exe | Generic Win/DOS Executable (23.4)
.exe | DOS Executable Generic (23.4)
.vxd | VXD Driver (0.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:20 12:02:06+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 1.72
CodeSize: 37376
InitializedDataSize: -
UninitializedDataSize: -
EntryPoint: 0x328a
OSVersion: 1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe no specs #UPATRE explorer.exe #UPATRE explorer.exe #UPATRE explorer.exe explorer.exe no specs explorer.exe no specs explorer.exe no specs explorer.exe no specs filecoauth.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2084C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
c:\windows\syswow64\ucrtbase.dll
2448C:\WINDOWS\explorer.exeC:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\twinapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
3656C:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe -EmbeddingC:\Users\admin\AppData\Local\Microsoft\OneDrive\19.043.0304.0013\FileCoAuth.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft OneDriveFile Co-Authoring Executable
Exit code:
0
Version:
19.043.0304.0013
Modules
Images
c:\users\admin\appdata\local\microsoft\onedrive\19.043.0304.0013\filecoauth.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4148C:\WINDOWS\explorer.exeC:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\twinapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
4472C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
5372C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
c:\windows\syswow64\ucrtbase.dll
6216"C:\Users\admin\AppData\Local\Temp\f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe" C:\Users\admin\AppData\Local\Temp\f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7116C:\WINDOWS\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcp_win.dll
c:\windows\syswow64\ucrtbase.dll
7148C:\WINDOWS\explorer.exeC:\Windows\explorer.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
Total events
11 691
Read events
11 691
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
11
Text files
0
Unknown types
1

Dropped files

PID
Process
Filename
Type
4472explorer.exeC:\Users\admin\AppData\Roaming\cjcgshjexecutable
MD5:311F4F130FAD70C7159CBAE042926BEE
SHA256:F5185D4E070E8CF1120790D078DD9D3DC33539B59C33FFC607D88EE30E3E1DFF
7116explorer.exeC:\Users\admin\AppData\Local\Temp\8EEF.tmp-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7116explorer.exeC:\Users\admin\AppData\Local\Temp\8EEF.tmpsqlite
MD5:19BA68C3ECBCA72C2B90AFADDE745DC6
SHA256:8B3758EE2D2C0A07EE7003F902F0667ABE5D9667941F8617EDA3CDF94C78E7B8
7116explorer.exeC:\Users\admin\AppData\Local\Temp\8F8E.tmpbinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
7116explorer.exeC:\Users\admin\AppData\Local\Temp\8EF0.tmpbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
4472explorer.exeC:\Users\admin\AppData\Roaming\ftdcgjebinary
MD5:6513A0CEEFF9376932699AD83F0F42CA
SHA256:BFFC900618EC638D245779BB8AD5AF89D782F8CD73A481B57AE2ADD061047E57
7116explorer.exeC:\Users\admin\AppData\Local\Temp\911A.tmpbinary
MD5:77A1AFF2DA29DD2F8E9E6B2A0CDE8562
SHA256:C479E249237494E65B4D4220499072D69829E6649DEC2B4FB8762256A55D6AB6
7116explorer.exeC:\Users\admin\AppData\Local\Temp\908B.tmpbinary
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
7116explorer.exeC:\Users\admin\AppData\Local\Temp\8FDE.tmpbinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
3656FileCoAuth.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2024-05-21.0437.3656.1.aodlbinary
MD5:28DCA2FF4B34B5A52A2E59DF202A6ED3
SHA256:33BACCB7296F1ED1F995FC77A23049F261CF391AC0388F9E8DD161F8C17B7F94
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
52
DNS requests
19
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5004
svchost.exe
GET
200
2.21.97.24:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5004
svchost.exe
GET
200
23.34.233.128:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
1188
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4548
SIHClient.exe
GET
200
23.46.161.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
4548
SIHClient.exe
GET
200
23.46.161.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6724
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
unknown
5004
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1324
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5140
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5004
svchost.exe
2.21.97.24:80
crl.microsoft.com
Akamai International B.V.
SE
unknown
5004
svchost.exe
23.34.233.128:80
www.microsoft.com
Bezeq International
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4680
SearchApp.exe
2.21.96.34:443
www.bing.com
Akamai International B.V.
SE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4680
SearchApp.exe
2.21.96.16:443
www.bing.com
Akamai International B.V.
SE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.21.97.24
  • 2.21.97.42
whitelisted
www.microsoft.com
  • 23.34.233.128
  • 23.46.161.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.134
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.138
whitelisted
airwide-land.com
  • 23.227.203.30
unknown
go.microsoft.com
  • 23.34.234.76
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
  • 20.12.23.50
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
4472
explorer.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
4472
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Upatre Downloader SSL certificate (fake loc)
7116
explorer.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
7116
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Upatre Downloader SSL certificate (fake loc)
7148
explorer.exe
Not Suspicious Traffic
ET POLICY OpenSSL Demo CA - Internet Widgits Pty (O)
7148
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Upatre Downloader SSL certificate (fake loc)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f5185d4e070e8cf1120790d078dd9d3dc33539b59c33ffc607d88ee30e3e1dff.exe