File name:

SPLTOON3USANSwTcHBASENSPCONVZiperto...exe

Full analysis: https://app.any.run/tasks/86ed425b-ee9e-4106-b1e7-c3659c606176
Verdict: Malicious activity
Analysis date: April 26, 2023, 18:13:13
OS: Windows 10 Professional (build: 19044, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

96BD65D6A85C40E7B16CB33D7E7FE7A6

SHA1:

6BA21897890FD6637AAF8E4F6F8D8704E531B0C4

SHA256:

FA8B150A06D2CCEE4AEE81EE84FDA0E1269B8AED5EFDB0F3C22F2D0B154E470A

SSDEEP:

1536:CXsOju8jOOUfu5HFjElAfzyneSMPuKbvzUllKGzFDOWgoxrq7JjMHUOVOFcKh:h0ucOOUolryn8HbzUl5DONZ7J4rV6r

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 1924)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Manual execution by a user

      • WINWORD.EXE (PID: 1924)

    • Checks supported languages

      • SPLTOON3USANSwTcHBASENSPCONVZiperto...exe (PID: 32)
      • ai.exe (PID: 740)

    • Reads Microsoft Office registry keys

      • ai.exe (PID: 740)

    • Reads the computer name

      • ai.exe (PID: 740)

    • The process checks LSA protection

      • SppExtComObj.Exe (PID: 868)
      • slui.exe (PID: 4768)
      • ai.exe (PID: 740)
      • slui.exe (PID: 6056)

    • Checks proxy server information

      • slui.exe (PID: 4768)

    • Reads the software policy settings

      • slui.exe (PID: 4768)
      • slui.exe (PID: 6056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5
ImageVersion: -
OSVersion: 5
EntryPoint: 0x2b86
UninitializedDataSize: -
InitializedDataSize: 140288
CodeSize: 9216
LinkerVersion: 9
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2023:04:19 07:34:05+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Apr-2023 07:34:05
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 19-Apr-2023 07:34:05
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000238B
0x00002400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.21669
.rdata
0x00004000
0x00001E2E
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.46271
.data
0x00006000
0x0000BE70
0x0000BC00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
7.93056
.rsrc
0x00012000
0x00013E88
0x00014000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.94592
.reloc
0x00026000
0x000006DE
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.75644

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.01004
609
Latin 1 / Western European
English - United States
RT_MANIFEST
2
1.98658
1640
Latin 1 / Western European
English - United States
RT_ICON
3
2.01586
744
Latin 1 / Western European
English - United States
RT_ICON
4
2.1704
296
Latin 1 / Western European
English - United States
RT_ICON
5
1.912
5672
Latin 1 / Western European
English - United States
RT_ICON
6
1.8663
3752
Latin 1 / Western European
English - United States
RT_ICON
7
2.22794
80
Latin 1 / Western European
English - United States
RT_STRING
8
0.972379
1384
Latin 1 / Western European
English - United States
RT_ICON
9
7.68913
4837
Latin 1 / Western European
English - United States
RT_ICON
10
2.03031
16936
Latin 1 / Western European
English - United States
RT_ICON

Imports

KERNEL32.dll
MSVCP90.dll
MSVCR90.dll
SHELL32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start spltoon3usanswtchbasenspconvziperto...exe winword.exe ai.exe no specs sppextcomobj.exe no specs slui.exe slui.exe spltoon3usanswtchbasenspconvziperto...exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\Users\admin\AppData\Local\Temp\SPLTOON3USANSwTcHBASENSPCONVZiperto...exe" C:\Users\admin\AppData\Local\Temp\SPLTOON3USANSwTcHBASENSPCONVZiperto...exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\spltoon3usanswtchbasenspconvziperto...exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
740"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ai.exe" "DB73ADE0-A1FA-4445-8F0E-FAA121E922F9" "D54FF642-CFA6-4BED-9C97-5773BCD576F5" "1924"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x86.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
868C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
1924"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\asiabelow.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
4768C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
6056"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
6064"C:\Users\admin\AppData\Local\Temp\SPLTOON3USANSwTcHBASENSPCONVZiperto...exe" C:\Users\admin\AppData\Local\Temp\SPLTOON3USANSwTcHBASENSPCONVZiperto...exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\spltoon3usanswtchbasenspconvziperto...exe
c:\windows\system32\ntdll.dll
Total events
10 782
Read events
10 358
Write events
350
Delete events
74

Modification events

(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
01DC000000000010004C4F992E02000000000000000700000000000000
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
1
(PID) Process:(1924) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ru-ru
Value:
1
Executable files
1
Suspicious files
42
Text files
13
Unknown types
2

Dropped files

PID
Process
Filename
Type
1924WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\asiabelow.rtf.LNKbinary
MD5:CBF299981E72CD526BED30A2932815A1
SHA256:F76FFD26E72869DC3464B7DCA149E9715534DC6E9BBF61CCD912B7F60F2FBAC0
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:F7135812779D549642208DBDB86E2145
SHA256:DD07A5A8FC00502A97A1694C6258128CE095780B70401EF9871E202065594B72
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:C921A94CC225D0863DE47DB46B7C84FC
SHA256:515C87E21E6FBDE8D0DB938C36C63BD770CCA59EFDFDEEF08A1D57B7E70EDD32
1924WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\App1682532849558040600_C65E7219-897A-4CF2-8277-9D87DA6EEA51.log —
MD5:—
SHA256:—
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\Features\6FeatureCache.txtbinary
MD5:096D6CF1FC8AE46269251588F67FA043
SHA256:CF68A4917FE2B9A1FF7F018BF8E03A801DD8751DDAC1253155F97469EBF7474F
1924WINWORD.EXEC:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\OFFICE\16.0\FLOODGATE\WORD.SURVEYHISTORYSTATS.JSONtext
MD5:6CA4960355E4951C72AA5F6364E459D5
SHA256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
1924WINWORD.EXEC:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\OFFICE\16.0\FLOODGATE\WORD.SETTINGS.JSONbinary
MD5:E4E83F8123E9740B8AA3C3DFA77C1C04
SHA256:6034F27B0823B2A6A76FE296E851939FD05324D0AF9D55F249C79AF118B0EB31
1924WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{D159E8DE-603B-424D-AAA8-481277870B3F}.tmpbinary
MD5:D87ADD8EE97084A5478BA2B114B99BB2
SHA256:A3463E2A71A684720EAA8C3FC8E702AC8BB02494E5512F8E3349C0543257A84E
1924WINWORD.EXEC:\USERS\ADMIN\APPDATA\LOCAL\MICROSOFT\OFFICE\16.0\FLOODGATE\WORD.SURVEYEVENTACTIVITYSTATS.JSONtext
MD5:6CA4960355E4951C72AA5F6364E459D5
SHA256:88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
1924WINWORD.EXEC:\Users\admin\AppData\Local\Temp\35C4F056.tmpbinary
MD5:096D6CF1FC8AE46269251588F67FA043
SHA256:CF68A4917FE2B9A1FF7F018BF8E03A801DD8751DDAC1253155F97469EBF7474F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
8
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1924
WINWORD.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1924
WINWORD.EXE
20.42.65.84:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
1924
WINWORD.EXE
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1924
WINWORD.EXE
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
4768
slui.exe
52.161.91.37:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
1924
WINWORD.EXE
52.111.236.4:443
messaging.lifecycle.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
suspicious
6056
slui.exe
52.161.91.37:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
suspicious
1924
WINWORD.EXE
52.109.52.148:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
JP
whitelisted
1924
WINWORD.EXE
23.48.23.30:443
omex.cdn.office.net
Akamai International B.V.
DE
suspicious

DNS requests

Domain
IP
Reputation
officeclient.microsoft.com
  • 52.109.32.24
  • 52.109.52.148
whitelisted
omex.cdn.office.net
  • 23.48.23.30
  • 23.48.23.18
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
activation-v2.sls.microsoft.com
  • 52.161.91.37
whitelisted
messaging.lifecycle.office.com
  • 52.111.236.4
whitelisted
self.events.data.microsoft.com
  • 20.42.65.84
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SPLTOON3USANSwTcHBASENSPCONVZiperto...exe