File name:

Autoruns64.exe

Full analysis: https://app.any.run/tasks/0ec400a7-d7dc-4b63-99fd-51059cc160cd
Verdict: Malicious activity
Analysis date: July 06, 2024, 11:45:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

6AE8E963B33EE52DF761412B451B2962

SHA1:

F7AB1987848A91AF2C77A72583211DCADEED420A

SHA256:

F59056339DE56820E57C961D6DDD9032BD78AF9F2333797944F4EE57B77EE2CA

SSDEEP:

24576:qU8EqexVDmS0d1ARkxDRlzmYj0tYC/5JReKq1QMcXEkb9fzTXJe:qHEqexVDmSOxxDI5JRhMIFT4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Autoruns64.exe (PID: 3972)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Autoruns64.exe (PID: 3972)

    • Checks Windows Trust Settings

      • Autoruns64.exe (PID: 3972)

    • Read startup parameters

      • Autoruns64.exe (PID: 3972)

  • INFO

    • Reads product name

      • Autoruns64.exe (PID: 3972)

    • Checks supported languages

      • Autoruns64.exe (PID: 3972)

    • Reads the computer name

      • Autoruns64.exe (PID: 3972)

    • Reads Microsoft Office registry keys

      • Autoruns64.exe (PID: 3972)

    • Reads the machine GUID from the registry

      • Autoruns64.exe (PID: 3972)

    • Checks proxy server information

      • Autoruns64.exe (PID: 3972)

    • Reads Environment values

      • Autoruns64.exe (PID: 3972)

    • Creates files or folders in the user directory

      • Autoruns64.exe (PID: 3972)

    • Reads the software policy settings

      • Autoruns64.exe (PID: 3972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:06:27 08:46:43+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.36
CodeSize: 865280
InitializedDataSize: 1178624
UninitializedDataSize: -
EntryPoint: 0x9cd64
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 14.10.0.0
ProductVersionNumber: 14.10.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Sysinternals - www.sysinternals.com
FileDescription: Autostart program viewer
FileVersion: 14.1
InternalName: Sysinternals Autoruns
LegalCopyright: Copyright (C) 2002-2023 Mark Russinovich
OriginalFileName: autoruns.exe
ProductName: Sysinternals autoruns
ProductVersion: 14.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start autoruns64.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3972"C:\Users\admin\AppData\Local\Temp\Autoruns64.exe" C:\Users\admin\AppData\Local\Temp\Autoruns64.exe
explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Autostart program viewer
Version:
14.10
Modules
Images
c:\users\admin\appdata\local\temp\autoruns64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6724C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6756"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
42 688
Read events
42 634
Write events
54
Delete events
0

Modification events

(PID) Process:(3972) Autoruns64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Sysinternals\Autoruns
Operation:writeName:EulaAccepted
Value:
1
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\mswsock.dll,-60100
Value:
MSAFD Tcpip [TCP/IP]
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\mswsock.dll,-60101
Value:
MSAFD Tcpip [UDP/IP]
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\mswsock.dll,-60102
Value:
MSAFD Tcpip [RAW/IP]
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\mswsock.dll,-60200
Value:
MSAFD Tcpip [TCP/IPv6]
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\mswsock.dll,-60201
Value:
MSAFD Tcpip [UDP/IPv6]
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\mswsock.dll,-60202
Value:
MSAFD Tcpip [RAW/IPv6]
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\wshqos.dll,-100
Value:
RSVP TCPv6 Service Provider
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\wshqos.dll,-101
Value:
RSVP TCP Service Provider
(PID) Process:(3972) Autoruns64.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\3c\52C64B7E
Operation:writeName:@%SystemRoot%\System32\wshqos.dll,-102
Value:
RSVP UDPv6 Service Provider
Executable files
0
Suspicious files
52
Text files
0
Unknown types
10

Dropped files

PID
Process
Filename
Type
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\45AE547469FB7137480E06153457A2DDbinary
MD5:7A2FBA626E15C82E7839DCD0B943B2C5
SHA256:DBC7B9DE360F49125435F73DBBECDC9950D810CC7F640605F86920119C8D77D5
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\36AC0BE60E1243344AE145F746D881FEder
MD5:A20961D8BD1A5A7D241026D0011751FB
SHA256:4D6AE5BBEF0EACFDC09D5ADE4D145E883CF41B131E4C6988738769F1D32E12F3
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4C7F163ED126D5C3CB9457F68EC64E9Eder
MD5:92EAB03C771E2873C170D7835E98FC93
SHA256:B13036F0FEC353CDBF9B73F2B7C28B1AFD3331DF5D5E12A4A9EA592B3B4353C6
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0B8A20E1F3F4D73D52A19929F922C892der
MD5:09E5AA2B1903859E6FA248FC0EE3B3B4
SHA256:A963DA4FCDC475B2B367819A3F54002864E22BEF83C1D5BCEACB2A9B66B69F65
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_EB45B4DDD2CA201E87E40B2FB5245AEFbinary
MD5:2D71EDC0E96049FA536D4EA82CB24CB3
SHA256:0174A2D8A409C09EB59306FF7A48BC213E53201F906BAF3B92590D4390CEAA58
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\45AE547469FB7137480E06153457A2DDder
MD5:6B769DB3020C81D2E526159023B9859E
SHA256:1E929D06F06A034171AB4F6C015C97C8927E5FB43C6DA2FDE645AD16CAE7CDEF
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4C7F163ED126D5C3CB9457F68EC64E9Ebinary
MD5:6AC9CA83D73C9CEBADC3EB1A48E8FA71
SHA256:81F4A184B126B497BB353B2B6177829487545917F301C6D114E34A9F390D1D3D
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBbinary
MD5:183F188E8C019C9F652C25CA85B0E4A4
SHA256:F0B96A32E728034A63FD55B01839CEE8E8EB5CDAE9E38912FEA3AE9CB5EDDCF6
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEBder
MD5:7FA363228851D1CBD8EE43ADB07262D5
SHA256:03E39BB99446CD3B0AC328492C470A766437861A1FBF424B812083580DB421ED
3972Autoruns64.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141der
MD5:5B885C9FD2CA6B1E93F63DA0D31EC981
SHA256:FEC59E47FABE7387AD28BDF9BAAE905EBF628BE99DB7851B75159AA833C10C15
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
45
TCP/UDP connections
75
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3972
Autoruns64.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
unknown
—
—
unknown
3972
Autoruns64.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
unknown
3944
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
3972
Autoruns64.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
unknown
3972
Autoruns64.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEAQJGBtf1btmdVNDtW%2BVUAg%3D
unknown
—
—
unknown
3972
Autoruns64.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEAV14ffsm9imej9hicY%2Bl7s%3D
unknown
—
—
unknown
3972
Autoruns64.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnR4FoxLLkI7vkvsUIFlZt%2BlGH3gQUWsS5eyoKo6XqcQPAYPkt9mV1DlgCEAkQWITrlZ07yLmU%2BRintu4%3D
unknown
—
—
unknown
1928
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
3972
Autoruns64.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D
unknown
—
—
unknown
3972
Autoruns64.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2140
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1828
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3944
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3944
svchost.exe
192.229.221.95:80
crl.verisign.com
EDGECAST
US
whitelisted
1928
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1060
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
52.111.243.30:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3972
Autoruns64.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.74
  • 40.126.32.68
  • 40.126.32.72
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.verisign.com
  • 192.229.221.95
whitelisted
ocsp.verisign.com
  • 152.199.19.74
whitelisted
csc3-2004-crl.verisign.com
  • —
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Autoruns64.exe