File name:

Core_protected.exe

Full analysis: https://app.any.run/tasks/9fea7274-5b5b-4d81-aced-b24a28ee90ea
Verdict: Malicious activity
Analysis date: March 22, 2024, 18:05:32
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A5F2A064BD4AA9AFCF847FB285D41F8D

SHA1:

040FA3EF5304F7D229F105047B7F34088B49E30A

SHA256:

F644360FA620DD885F82372A6ACB199EFEEB4E9A392023941E27D2FA647C2061

SSDEEP:

98304:TBw2WP50rRFewFigMMcK5/YAE0shO4e9v4dGvOG//kwzYv+j7V9Rj8sYDvLLQ1eT:JpYT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Core_protected.exe (PID: 2124)

  • SUSPICIOUS

    • Reads the BIOS version

      • Core_protected.exe (PID: 2124)

    • Reads the Internet Settings

      • Core_protected.exe (PID: 2124)

    • Reads security settings of Internet Explorer

      • Core_protected.exe (PID: 2124)

    • Reads settings of System Certificates

      • Core_protected.exe (PID: 2124)

    • Checks Windows Trust Settings

      • Core_protected.exe (PID: 2124)

  • INFO

    • Checks supported languages

      • Core_protected.exe (PID: 2124)

    • Checks proxy server information

      • Core_protected.exe (PID: 2124)

    • Reads the computer name

      • Core_protected.exe (PID: 2124)

    • Reads the machine GUID from the registry

      • Core_protected.exe (PID: 2124)

    • Reads the software policy settings

      • Core_protected.exe (PID: 2124)

    • Creates files or folders in the user directory

      • Core_protected.exe (PID: 2124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:22 18:04:24+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 11264
InitializedDataSize: 12288
UninitializedDataSize: -
EntryPoint: 0x457058
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start core_protected.exe

Process information

PID
CMD
Path
Indicators
Parent process
2124"C:\Users\admin\AppData\Local\Temp\Core_protected.exe" C:\Users\admin\AppData\Local\Temp\Core_protected.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\core_protected.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
Total events
5 845
Read events
5 805
Write events
34
Delete events
6

Modification events

(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2124) Core_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
7
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2124Core_protected.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:1785784FD1E0A54CC828B13D6F3C7CB6
SHA256:33BB1B79628300E3CD04FA5D393B3EA53C8F25E5D4E57F6624BDFEC14AEA8C82
2124Core_protected.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:F2DC96025FDE6E53A2A8ED12A8013599
SHA256:95C958B231D6C48BC504A6AE265715F74B379FA22017CA41757BEA520059008B
2124Core_protected.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\X0EEIJWC.htmhtml
MD5:C6201B8F5C509AD9507EDD3E31AEAA87
SHA256:407A061D0BDE557BC6558BC9FD4C8391472360EE9998F9B552CB0C0FC4034A08
2124Core_protected.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\FRXHSIDN.htmhtml
MD5:C6201B8F5C509AD9507EDD3E31AEAA87
SHA256:407A061D0BDE557BC6558BC9FD4C8391472360EE9998F9B552CB0C0FC4034A08
2124Core_protected.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63binary
MD5:F1F00250A420D306CE67FBB07AC9E6FF
SHA256:F72097F20C2F14C5123119C016DDB8C01D0876CBA30CE71D03516818E1BACAF2
2124Core_protected.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:91CEA795B2D03704D5CDC570AB1C1C41
SHA256:4BB2E78ADB10271145A81FA39057AFAEB51AA06304C4C6335175034E5410DB01
2124Core_protected.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\98ZIA9CE.htmhtml
MD5:C6201B8F5C509AD9507EDD3E31AEAA87
SHA256:407A061D0BDE557BC6558BC9FD4C8391472360EE9998F9B552CB0C0FC4034A08
2124Core_protected.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:62CA81C78155BB92FA355337C9D26BBB
SHA256:486511A857EB4A215FECE940B52CC79BC3924E157F79E58294027FDDE05EDCA9
2124Core_protected.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:3A325B3C4108584F8B1A989B9C7E4F7B
SHA256:C92CFACA08ED13CAF8B2CF1D3238779F6C0F7FCCE7FC6990B036AEF193621458
2124Core_protected.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63der
MD5:B913416C218B5301E05B42B1DB959ADE
SHA256:9C7740CF3520B35ADA70FC35D3910DA5B99E98ED90F31718CFFD00F7EE674657
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
86
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2124
Core_protected.exe
GET
404
40.78.107.249:80
http://fe2.update.microsoft.com/
unknown
html
1.22 Kb
unknown
2124
Core_protected.exe
GET
403
173.222.108.243:80
http://tlu.dl.delivery.mp.microsoft.com/
unknown
html
293 b
unknown
2124
Core_protected.exe
GET
200
88.221.110.112:80
http://download.windowsupdate.com/
unknown
html
402 b
unknown
2124
Core_protected.exe
GET
404
40.78.107.249:80
http://fe2.update.microsoft.com/
unknown
html
1.22 Kb
unknown
2124
Core_protected.exe
GET
403
173.222.108.243:80
http://tlu.dl.delivery.mp.microsoft.com/
unknown
html
293 b
unknown
2124
Core_protected.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?5cb8f9358d2f9c29
unknown
—
—
unknown
2124
Core_protected.exe
GET
403
173.222.108.243:80
http://tlu.dl.delivery.mp.microsoft.com/
unknown
html
293 b
unknown
2124
Core_protected.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?cacfdd4bc0a9544d
unknown
compressed
67.5 Kb
unknown
2124
Core_protected.exe
GET
400
152.199.21.175:80
http://officecdn.microsoft.com/
unknown
text
24 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2124
Core_protected.exe
173.222.108.243:80
tlu.dl.delivery.mp.microsoft.com
Akamai International B.V.
CH
unknown
2124
Core_protected.exe
88.221.110.112:80
download.windowsupdate.com
Akamai International B.V.
DE
unknown
2124
Core_protected.exe
40.78.107.249:80
fe2.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
2124
Core_protected.exe
20.190.190.99:443
graph.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
DE
unknown
2124
Core_protected.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2124
Core_protected.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
tlu.dl.delivery.mp.microsoft.com
  • 173.222.108.243
  • 80.67.82.203
whitelisted
download.windowsupdate.com
  • 88.221.110.112
  • 2.16.100.155
  • 88.221.110.72
  • 88.221.110.96
  • 2.16.100.138
  • 88.221.110.106
  • 88.221.110.91
  • 88.221.110.64
whitelisted
fe2.update.microsoft.com
  • 40.78.107.249
  • 52.152.180.151
whitelisted
graph.microsoft.com
  • 20.190.190.99
  • 20.190.190.101
  • 20.190.190.96
  • 20.190.190.102
  • 20.190.190.103
  • 20.190.190.100
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
officecdn.microsoft.com
  • 152.199.21.175
whitelisted
myaccount.blob.core.windows.net
  • 52.239.202.68
unknown
storeedgefd.dsx.mp.microsoft.com
  • 23.35.237.194
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Core_protected.exe