File name:

f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce

Full analysis: https://app.any.run/tasks/0e05e6d7-16f1-491c-a5da-381cc9426dde
Verdict: Malicious activity
Analysis date: January 10, 2025, 23:48:26
OS: Windows 10 Professional (build: 19045, 64 bit)
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

79E059E518B08ADBF428180B3E05495E

SHA1:

53DEC3A16758AEB96A1AFCE4245B26C56D53D40A

SHA256:

F55861FDFAB03622D2E522711B19B3EDFA6D50906AB712CFAE0810639205B0CE

SSDEEP:

12288:4Nq6wvyO5KPePHHQ0dZ6QncCQrc1IGKPWCaU6juGalxgRtw2PveMmWe/tI4tUJem:JCQSlKXeUiHYS6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Executing a file with an untrusted certificate

      • f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe (PID: 1556)
  • SUSPICIOUS

    No suspicious indicators.
  • INFO

    • Disables trace logs

      • f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe (PID: 1556)
    • Reads the computer name

      • f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe (PID: 1556)
    • Reads the machine GUID from the registry

      • f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe (PID: 1556)
    • Checks supported languages

      • f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe (PID: 1556)
    • Checks proxy server information

      • f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe (PID: 1556)
    • Reads the software policy settings

      • f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe (PID: 1556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:17 23:41:39+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 1044992
InitializedDataSize: 18944
UninitializedDataSize: -
EntryPoint: 0x10114e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.6.0.108
ProductVersionNumber: 6.6.0.108
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: DucFabulous Co,ltd
FileDescription: -
FileVersion: 6.6.0.108
InternalName: ref.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: ref.exe
ProductName: UltraViewer
ProductVersion: 6.6.0.108
AssemblyVersion: 6.6.0.108
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
2
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1556"C:\Users\admin\AppData\Local\Temp\f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe" C:\Users\admin\AppData\Local\Temp\f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe
explorer.exe
User:
admin
Company:
DucFabulous Co,ltd
Integrity Level:
MEDIUM
Version:
6.6.0.108
Modules
Images
c:\users\admin\appdata\local\temp\f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
847
Read events
833
Write events
14
Delete events
0

Modification events

(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1556) f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
35
DNS requests
18
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3652
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
whitelisted
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
7056
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
7056
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
whitelisted
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3700
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
1556
f55861fdfab03622d2e522711b19b3edfa6d50906ab712cfae0810639205b0ce.exe
194.15.112.248:443
oshi.at
International Hosting Solutions Llp
GB
suspicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.163
  • 104.126.37.176
  • 104.126.37.139
  • 104.126.37.145
  • 104.126.37.131
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
oshi.at
  • 194.15.112.248
  • 5.253.86.15
unknown
login.live.com
  • 20.190.160.22
  • 40.126.32.74
  • 40.126.32.136
  • 40.126.32.138
  • 20.190.160.14
  • 20.190.160.20
  • 40.126.32.133
  • 40.126.32.140
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted

Threats

Found threats are available for the paid subscriptions
4 ETPRO signatures available at the full report
No debug info