File name:

SPLTOON3USANSwTcHBASENSPCONVZiperto...exe

Full analysis: https://app.any.run/tasks/86ed425b-ee9e-4106-b1e7-c3659c606176
Verdict: Malicious activity
Analysis date: April 26, 2023, 18:13:13
OS: Windows 10 Professional (build: 19044, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

96BD65D6A85C40E7B16CB33D7E7FE7A6

SHA1:

6BA21897890FD6637AAF8E4F6F8D8704E531B0C4

SHA256:

FA8B150A06D2CCEE4AEE81EE84FDA0E1269B8AED5EFDB0F3C22F2D0B154E470A

SSDEEP:

1536:CXsOju8jOOUfu5HFjElAfzyneSMPuKbvzUllKGzFDOWgoxrq7JjMHUOVOFcKh:h0ucOOUolryn8HbzUl5DONZ7J4rV6r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 1924)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • SPLTOON3USANSwTcHBASENSPCONVZiperto...exe (PID: 32)
      • ai.exe (PID: 740)

    • Reads the computer name

      • ai.exe (PID: 740)

    • Manual execution by a user

      • WINWORD.EXE (PID: 1924)

    • Reads Microsoft Office registry keys

      • ai.exe (PID: 740)

    • The process checks LSA protection

      • ai.exe (PID: 740)
      • SppExtComObj.Exe (PID: 868)
      • slui.exe (PID: 6056)
      • slui.exe (PID: 4768)

    • Reads the software policy settings

      • slui.exe (PID: 4768)
      • slui.exe (PID: 6056)

    • Checks proxy server information

      • slui.exe (PID: 4768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x2b86
UninitializedDataSize: -
InitializedDataSize: 140288
CodeSize: 9216
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:04:19 07:34:05+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Apr-2023 07:34:05
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 19-Apr-2023 07:34:05
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000238B
0x00002400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.21669
.rdata
0x00004000
0x00001E2E
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.46271
.data
0x00006000
0x0000BE70
0x0000BC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93056
.rsrc
0x00012000
0x00013E88
0x00014000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.94592
.reloc
0x00026000
0x000006DE
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.75644

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.01004
609
Latin 1 / Western European
English - United States
RT_MANIFEST
2
1.98658
1640
Latin 1 / Western European
English - United States
RT_ICON
3
2.01586
744
Latin 1 / Western European
English - United States
RT_ICON
4
2.1704
296
Latin 1 / Western European
English - United States
RT_ICON
5
1.912
5672
Latin 1 / Western European
English - United States
RT_ICON
6
1.8663
3752
Latin 1 / Western European
English - United States
RT_ICON
7
2.22794
80
Latin 1 / Western European
English - United States
RT_STRING
8
0.972379
1384
Latin 1 / Western European
English - United States
RT_ICON
9
7.68913
4837
Latin 1 / Western European
English - United States
RT_ICON
10
2.03031
16936
Latin 1 / Western European
English - United States
RT_ICON

Imports

KERNEL32.dll
MSVCP90.dll
MSVCR90.dll
SHELL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start spltoon3usanswtchbasenspconvziperto...exe winword.exe ai.exe no specs sppextcomobj.exe no specs slui.exe slui.exe spltoon3usanswtchbasenspconvziperto...exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\Users\admin\AppData\Local\Temp\SPLTOON3USANSwTcHBASENSPCONVZiperto...exe" C:\Users\admin\AppData\Local\Temp\SPLTOON3USANSwTcHBASENSPCONVZiperto...exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\spltoon3usanswtchbasenspconvziperto...exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
740"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ai.exe" "DB73ADE0-A1FA-4445-8F0E-FAA121E922F9" "D54FF642-CFA6-4BED-9C97-5773BCD576F5" "1924"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x86.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
868C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
1924"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\asiabelow.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
4768C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
6056"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
6064"C:\Users\admin\AppData\Local\Temp\SPLTOON3USANSwTcHBASENSPCONVZiperto...exe" C:\Users\admin\AppData\Local\Temp\SPLTOON3USANSwTcHBASENSPCONVZiperto...exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\spltoon3usanswtchbasenspconvziperto...exe
c:\windows\system32\ntdll.dll
Total events
10 782
Read events
10 358
Write events
350
Delete events
74

Modification events

(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
01DC000000000010004C4F992E02000000000000000700000000000000
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ru-ru
Value:
1
Executable files
1
Suspicious files
42
Text files
13
Unknown types
2

Dropped files

PID
Process
Filename
Type
1924WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:81EFB775C9C77B65ADDAEDF73DB24875
SHA256:69BC143A32590890E47BB0FE35C5D7E915102E2360F5B731C6DAB64538CA4E6D
1924WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\asiabelow.rtf.LNKbinary
MD5:CBF299981E72CD526BED30A2932815A1
SHA256:F76FFD26E72869DC3464B7DCA149E9715534DC6E9BBF61CCD912B7F60F2FBAC0
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:F7135812779D549642208DBDB86E2145
SHA256:DD07A5A8FC00502A97A1694C6258128CE095780B70401EF9871E202065594B72
1924WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\App1682532849558040600_C65E7219-897A-4CF2-8277-9D87DA6EEA51.log —
MD5:—
SHA256:—
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:F64735C115BF56881E64687DCBD48A8C
SHA256:8BCD830338B1783683E587FE8A2899A804B3E34BC506A638042BB586A70FD96A
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\2F3C0728-D285-407E-9FFA-EB90C3344E3Fxml
MD5:5D3982487820CFAC36D39179DD3F3742
SHA256:AF744CF8EF618738BA62AAA4E179717C94C671C1D0FAC1273B0205D117C6FBCA
1924WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datini
MD5:61D0C7A1332E48D1E9669DCCABF1FEEF
SHA256:2774FD4EC1D2D058EE2C282F17E0E1A7AE5D3F598ECEE4D167896BBF4B9AF635
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
1924WINWORD.EXEC:\Users\admin\Desktop\~$iabelow.rtfbinary
MD5:CCA48BA26D2082C6F2AAB9F38C9F0A05
SHA256:AF2A9430353C9DB287F46AE9590F29E2575A0E420338695CC378411D12B58CAC
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D159E8DE-603B-424D-AAA8-481277870B3F}.tmpbinary
MD5:D87ADD8EE97084A5478BA2B114B99BB2
SHA256:A3463E2A71A684720EAA8C3FC8E702AC8BB02494E5512F8E3349C0543257A84E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
WINWORD.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1924
WINWORD.EXE
52.109.52.148:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
JP
whitelisted
1924
WINWORD.EXE
23.48.23.30:443
omex.cdn.office.net
Akamai International B.V.
DE
suspicious
1924
WINWORD.EXE
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
1924
WINWORD.EXE
52.111.236.4:443
messaging.lifecycle.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
suspicious
1924
WINWORD.EXE
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4768
slui.exe
52.161.91.37:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
1924
WINWORD.EXE
20.42.65.84:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
6056
slui.exe
52.161.91.37:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious

DNS requests

Domain
IP
Reputation
officeclient.microsoft.com
  • 52.109.32.24
  • 52.109.52.148
whitelisted
omex.cdn.office.net
  • 23.48.23.30
  • 23.48.23.18
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
activation-v2.sls.microsoft.com
  • 52.161.91.37
whitelisted
messaging.lifecycle.office.com
  • 52.111.236.4
whitelisted
self.events.data.microsoft.com
  • 20.42.65.84
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SPLTOON3USANSwTcHBASENSPCONVZiperto...exe