File name:

Runtime Broker.exe

Full analysis: https://app.any.run/tasks/52961c32-3da8-47c1-9865-cb0984e82c87
Verdict: Malicious activity
Analysis date: January 15, 2024, 12:21:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

1C0130B5CC011F887883A75439F41C59

SHA1:

FE4726ED4B1BB547EFACA52D76EAFDD46E07ECE5

SHA256:

FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7

SSDEEP:

768:WsPC5z9axRQsVDtcka1rqunKWaHGk3rSaowC7c1iajVQNPl1Rz4Rk3fsOdMTYBto:n4mtcd12GaHZOgC7kuZl1dDfSTYP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Runtime Broker.exe (PID: 2044)
      • svchost.exe (PID: 1216)
      • svchost.exe (PID: 2564)
      • server.exe (PID: 2308)
      • server.exe (PID: 1424)
      • svchost.exe (PID: 1000)
      • server.exe (PID: 2368)
      • svchost.exe (PID: 1408)
      • server.exe (PID: 3124)
      • server.exe (PID: 296)
      • svchost.exe (PID: 3328)
      • server.exe (PID: 3516)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 2160)
      • svchost.exe (PID: 2072)
      • svchost.exe (PID: 2636)
      • server.exe (PID: 1768)
      • server.exe (PID: 712)
      • svchost.exe (PID: 1956)
      • svchost.exe (PID: 2944)
      • server.exe (PID: 2860)
      • server.exe (PID: 3136)
      • svchost.exe (PID: 3352)
      • svchost.exe (PID: 3848)
      • server.exe (PID: 3504)
      • svchost.exe (PID: 2064)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • svchost.exe (PID: 1496)
      • server.exe (PID: 2580)
      • svchost.exe (PID: 1036)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • svchost.exe (PID: 2372)
      • svchost.exe (PID: 3224)
      • server.exe (PID: 1644)
      • svchost.exe (PID: 3360)
      • server.exe (PID: 3672)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • svchost.exe (PID: 1796)
      • svchost.exe (PID: 2404)
      • server.exe (PID: 1904)
      • svchost.exe (PID: 2492)
      • server.exe (PID: 3152)
      • svchost.exe (PID: 2832)

    • Create files in the Startup directory

      • server.exe (PID: 296)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Runtime Broker.exe (PID: 2044)
      • server.exe (PID: 296)
      • svchost.exe (PID: 1216)
      • server.exe (PID: 2308)
      • svchost.exe (PID: 2564)
      • server.exe (PID: 1424)
      • svchost.exe (PID: 1000)
      • server.exe (PID: 2368)
      • svchost.exe (PID: 1408)
      • server.exe (PID: 3124)
      • svchost.exe (PID: 3328)
      • server.exe (PID: 3516)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 2160)
      • svchost.exe (PID: 2072)
      • server.exe (PID: 712)
      • svchost.exe (PID: 2636)
      • server.exe (PID: 1768)
      • svchost.exe (PID: 1956)
      • server.exe (PID: 2860)
      • server.exe (PID: 3136)
      • svchost.exe (PID: 2944)
      • svchost.exe (PID: 3352)
      • svchost.exe (PID: 3848)
      • server.exe (PID: 3504)
      • server.exe (PID: 1876)
      • svchost.exe (PID: 2064)
      • server.exe (PID: 2948)
      • svchost.exe (PID: 1496)
      • server.exe (PID: 2580)
      • server.exe (PID: 2544)
      • svchost.exe (PID: 1036)
      • svchost.exe (PID: 2372)
      • server.exe (PID: 3104)
      • svchost.exe (PID: 3224)
      • server.exe (PID: 1644)
      • svchost.exe (PID: 3360)
      • server.exe (PID: 3672)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • svchost.exe (PID: 1796)
      • svchost.exe (PID: 2404)
      • svchost.exe (PID: 2492)
      • server.exe (PID: 1904)
      • svchost.exe (PID: 2832)
      • server.exe (PID: 3152)

    • Reads the Internet Settings

      • Runtime Broker.exe (PID: 2044)
      • server.exe (PID: 296)
      • svchost.exe (PID: 1216)
      • server.exe (PID: 2308)
      • svchost.exe (PID: 2564)
      • server.exe (PID: 1424)
      • svchost.exe (PID: 1000)
      • server.exe (PID: 2368)
      • svchost.exe (PID: 1408)
      • server.exe (PID: 3124)
      • svchost.exe (PID: 3328)
      • server.exe (PID: 3516)
      • svchost.exe (PID: 3852)
      • svchost.exe (PID: 2072)
      • server.exe (PID: 2160)
      • svchost.exe (PID: 2636)
      • server.exe (PID: 712)
      • svchost.exe (PID: 1956)
      • server.exe (PID: 1768)
      • server.exe (PID: 2860)
      • server.exe (PID: 3136)
      • svchost.exe (PID: 2944)
      • svchost.exe (PID: 3352)
      • svchost.exe (PID: 3848)
      • server.exe (PID: 3504)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • svchost.exe (PID: 2064)
      • server.exe (PID: 2580)
      • svchost.exe (PID: 1496)
      • svchost.exe (PID: 1036)
      • server.exe (PID: 2544)
      • svchost.exe (PID: 2372)
      • svchost.exe (PID: 3224)
      • server.exe (PID: 3104)
      • svchost.exe (PID: 3360)
      • server.exe (PID: 1644)
      • server.exe (PID: 3672)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • svchost.exe (PID: 1796)
      • svchost.exe (PID: 2404)
      • svchost.exe (PID: 2492)
      • server.exe (PID: 1904)
      • server.exe (PID: 3152)
      • svchost.exe (PID: 2832)

    • Starts itself from another location

      • Runtime Broker.exe (PID: 2044)
      • svchost.exe (PID: 1216)
      • server.exe (PID: 296)
      • server.exe (PID: 2308)
      • svchost.exe (PID: 2564)
      • server.exe (PID: 1424)
      • svchost.exe (PID: 1000)
      • server.exe (PID: 2368)
      • svchost.exe (PID: 1408)
      • server.exe (PID: 3124)
      • svchost.exe (PID: 3328)
      • server.exe (PID: 3516)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 2160)
      • svchost.exe (PID: 2072)
      • svchost.exe (PID: 2636)
      • server.exe (PID: 712)
      • svchost.exe (PID: 1956)
      • server.exe (PID: 1768)
      • server.exe (PID: 2860)
      • svchost.exe (PID: 2944)
      • svchost.exe (PID: 3352)
      • server.exe (PID: 3136)
      • server.exe (PID: 3504)
      • server.exe (PID: 1876)
      • svchost.exe (PID: 2064)
      • svchost.exe (PID: 3848)
      • server.exe (PID: 2948)
      • server.exe (PID: 2580)
      • svchost.exe (PID: 1496)
      • svchost.exe (PID: 1036)
      • server.exe (PID: 2544)
      • svchost.exe (PID: 2372)
      • server.exe (PID: 3104)
      • svchost.exe (PID: 3224)
      • svchost.exe (PID: 3360)
      • server.exe (PID: 1644)
      • server.exe (PID: 3672)
      • server.exe (PID: 864)
      • svchost.exe (PID: 3852)
      • svchost.exe (PID: 1796)
      • svchost.exe (PID: 2404)
      • server.exe (PID: 696)
      • svchost.exe (PID: 2492)
      • server.exe (PID: 1904)
      • server.exe (PID: 3152)
      • svchost.exe (PID: 2832)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • server.exe (PID: 296)
      • server.exe (PID: 2308)
      • server.exe (PID: 1424)
      • server.exe (PID: 2368)
      • server.exe (PID: 3124)
      • server.exe (PID: 3516)
      • server.exe (PID: 2160)
      • server.exe (PID: 712)
      • server.exe (PID: 1768)
      • server.exe (PID: 2860)
      • server.exe (PID: 3136)
      • server.exe (PID: 3504)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • server.exe (PID: 2580)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • server.exe (PID: 1644)
      • server.exe (PID: 3672)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • server.exe (PID: 1904)
      • server.exe (PID: 3152)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • server.exe (PID: 296)
      • server.exe (PID: 2308)
      • server.exe (PID: 1424)
      • server.exe (PID: 2368)
      • server.exe (PID: 3124)
      • server.exe (PID: 3516)
      • server.exe (PID: 2160)
      • server.exe (PID: 712)
      • server.exe (PID: 1768)
      • server.exe (PID: 2860)
      • server.exe (PID: 3136)
      • server.exe (PID: 3504)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • server.exe (PID: 2580)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • server.exe (PID: 1644)
      • server.exe (PID: 3672)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • server.exe (PID: 1904)
      • server.exe (PID: 3152)

    • The process creates files with name similar to system file names

      • server.exe (PID: 2308)
      • server.exe (PID: 1424)
      • server.exe (PID: 2368)
      • server.exe (PID: 3124)
      • server.exe (PID: 296)
      • server.exe (PID: 3516)
      • server.exe (PID: 2160)
      • server.exe (PID: 712)
      • server.exe (PID: 1768)
      • server.exe (PID: 2860)
      • server.exe (PID: 3136)
      • server.exe (PID: 3504)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • server.exe (PID: 2580)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • server.exe (PID: 1644)
      • server.exe (PID: 3672)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • server.exe (PID: 1904)
      • server.exe (PID: 3152)

  • INFO

    • Create files in a temporary directory

      • Runtime Broker.exe (PID: 2044)
      • server.exe (PID: 296)
      • server.exe (PID: 2308)
      • svchost.exe (PID: 1216)
      • svchost.exe (PID: 2564)
      • svchost.exe (PID: 1000)
      • server.exe (PID: 1424)
      • server.exe (PID: 2368)
      • svchost.exe (PID: 1408)
      • server.exe (PID: 3124)
      • svchost.exe (PID: 3328)
      • server.exe (PID: 3516)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 2160)
      • svchost.exe (PID: 2072)
      • server.exe (PID: 712)
      • svchost.exe (PID: 2636)
      • server.exe (PID: 1768)
      • server.exe (PID: 2860)
      • svchost.exe (PID: 2944)
      • svchost.exe (PID: 1956)
      • server.exe (PID: 3136)
      • svchost.exe (PID: 3352)
      • svchost.exe (PID: 3848)
      • server.exe (PID: 3504)
      • svchost.exe (PID: 2064)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • svchost.exe (PID: 1496)
      • server.exe (PID: 2580)
      • svchost.exe (PID: 1036)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • svchost.exe (PID: 2372)
      • svchost.exe (PID: 3224)
      • server.exe (PID: 1644)
      • svchost.exe (PID: 3360)
      • server.exe (PID: 3672)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 864)
      • svchost.exe (PID: 1796)
      • server.exe (PID: 696)
      • server.exe (PID: 1904)
      • svchost.exe (PID: 2404)
      • svchost.exe (PID: 2492)
      • server.exe (PID: 3152)
      • svchost.exe (PID: 2832)
      • server.exe (PID: 3080)

    • Checks supported languages

      • Runtime Broker.exe (PID: 2044)
      • server.exe (PID: 296)
      • svchost.exe (PID: 1216)
      • server.exe (PID: 2308)
      • svchost.exe (PID: 2564)
      • server.exe (PID: 1424)
      • svchost.exe (PID: 1000)
      • svchost.exe (PID: 1408)
      • server.exe (PID: 2368)
      • server.exe (PID: 3124)
      • svchost.exe (PID: 3328)
      • server.exe (PID: 3516)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 2160)
      • svchost.exe (PID: 2072)
      • server.exe (PID: 712)
      • svchost.exe (PID: 2636)
      • server.exe (PID: 1768)
      • svchost.exe (PID: 1956)
      • server.exe (PID: 2860)
      • svchost.exe (PID: 2944)
      • server.exe (PID: 3136)
      • server.exe (PID: 3504)
      • svchost.exe (PID: 3352)
      • svchost.exe (PID: 3848)
      • svchost.exe (PID: 2064)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • svchost.exe (PID: 1496)
      • server.exe (PID: 2580)
      • svchost.exe (PID: 1036)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • svchost.exe (PID: 2372)
      • server.exe (PID: 1644)
      • svchost.exe (PID: 3224)
      • svchost.exe (PID: 3360)
      • server.exe (PID: 3672)
      • svchost.exe (PID: 3852)
      • svchost.exe (PID: 1796)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • server.exe (PID: 1904)
      • svchost.exe (PID: 2404)
      • svchost.exe (PID: 2492)
      • server.exe (PID: 3152)
      • svchost.exe (PID: 2832)
      • server.exe (PID: 3080)

    • Reads the machine GUID from the registry

      • Runtime Broker.exe (PID: 2044)
      • server.exe (PID: 296)
      • svchost.exe (PID: 1216)
      • server.exe (PID: 2308)
      • svchost.exe (PID: 2564)
      • server.exe (PID: 1424)
      • svchost.exe (PID: 1000)
      • server.exe (PID: 2368)
      • svchost.exe (PID: 1408)
      • server.exe (PID: 3124)
      • svchost.exe (PID: 3328)
      • server.exe (PID: 3516)
      • server.exe (PID: 2160)
      • svchost.exe (PID: 3852)
      • svchost.exe (PID: 2072)
      • server.exe (PID: 712)
      • svchost.exe (PID: 2636)
      • server.exe (PID: 1768)
      • svchost.exe (PID: 1956)
      • svchost.exe (PID: 2944)
      • server.exe (PID: 2860)
      • server.exe (PID: 3136)
      • svchost.exe (PID: 3352)
      • server.exe (PID: 3504)
      • svchost.exe (PID: 3848)
      • svchost.exe (PID: 2064)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • svchost.exe (PID: 1496)
      • server.exe (PID: 2580)
      • svchost.exe (PID: 1036)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • svchost.exe (PID: 2372)
      • svchost.exe (PID: 3224)
      • server.exe (PID: 1644)
      • svchost.exe (PID: 3360)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 3672)
      • svchost.exe (PID: 1796)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • server.exe (PID: 1904)
      • svchost.exe (PID: 2404)
      • svchost.exe (PID: 2492)
      • server.exe (PID: 3152)
      • svchost.exe (PID: 2832)
      • server.exe (PID: 3080)

    • Reads the computer name

      • Runtime Broker.exe (PID: 2044)
      • server.exe (PID: 296)
      • svchost.exe (PID: 1216)
      • server.exe (PID: 2308)
      • svchost.exe (PID: 2564)
      • server.exe (PID: 1424)
      • svchost.exe (PID: 1000)
      • server.exe (PID: 2368)
      • svchost.exe (PID: 1408)
      • server.exe (PID: 3124)
      • svchost.exe (PID: 3328)
      • server.exe (PID: 3516)
      • svchost.exe (PID: 3852)
      • server.exe (PID: 2160)
      • server.exe (PID: 712)
      • svchost.exe (PID: 2072)
      • svchost.exe (PID: 2636)
      • server.exe (PID: 1768)
      • svchost.exe (PID: 1956)
      • server.exe (PID: 2860)
      • svchost.exe (PID: 2944)
      • server.exe (PID: 3136)
      • server.exe (PID: 3504)
      • svchost.exe (PID: 3352)
      • svchost.exe (PID: 3848)
      • svchost.exe (PID: 2064)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • svchost.exe (PID: 1496)
      • svchost.exe (PID: 1036)
      • server.exe (PID: 2580)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • svchost.exe (PID: 2372)
      • svchost.exe (PID: 3224)
      • svchost.exe (PID: 3360)
      • server.exe (PID: 3672)
      • server.exe (PID: 1644)
      • svchost.exe (PID: 3852)
      • svchost.exe (PID: 1796)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • svchost.exe (PID: 2404)
      • server.exe (PID: 1904)
      • server.exe (PID: 3152)
      • svchost.exe (PID: 2492)
      • svchost.exe (PID: 2832)
      • server.exe (PID: 3080)

    • Creates files or folders in the user directory

      • Runtime Broker.exe (PID: 2044)
      • server.exe (PID: 296)
      • server.exe (PID: 2308)
      • server.exe (PID: 1424)
      • server.exe (PID: 2368)
      • server.exe (PID: 3124)
      • server.exe (PID: 3516)
      • server.exe (PID: 2160)
      • server.exe (PID: 712)
      • server.exe (PID: 1768)
      • server.exe (PID: 2860)
      • server.exe (PID: 3136)
      • server.exe (PID: 3504)
      • server.exe (PID: 1876)
      • server.exe (PID: 2948)
      • server.exe (PID: 2580)
      • server.exe (PID: 2544)
      • server.exe (PID: 3104)
      • server.exe (PID: 1644)
      • server.exe (PID: 3672)
      • server.exe (PID: 864)
      • server.exe (PID: 696)
      • server.exe (PID: 1904)
      • server.exe (PID: 3152)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:15 13:21:18+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 94208
InitializedDataSize: 512
UninitializedDataSize: -
EntryPoint: 0x18f3e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
219
Monitored processes
117
Malicious processes
45
Suspicious processes
2

Behavior graph

Click at the process to see the details
start runtime broker.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs svchost.exe server.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
Runtime Broker.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
296netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe" "server.exe" ENABLEC:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
316netsh firewall delete allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe"C:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
492netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe" "server.exe" ENABLEC:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
548netsh firewall delete allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe"C:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
696"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
712"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
748netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe" "server.exe" ENABLEC:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
864"C:\Users\admin\AppData\Local\Temp\server.exe" C:\Users\admin\AppData\Local\Temp\server.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
876netsh firewall delete allowedprogram "C:\Users\admin\AppData\Local\Temp\server.exe"C:\Windows\System32\netsh.exe—server.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
Total events
73 525
Read events
69 953
Write events
3 572
Delete events
0

Modification events

(PID) Process:(2044) Runtime Broker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2044) Runtime Broker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2044) Runtime Broker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2044) Runtime Broker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2268) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(296) server.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(296) server.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(296) server.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(296) server.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1652) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
57
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
296server.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bb73109025376b06874b13456541e5fcWindows Update.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
296server.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
296server.exeC:\Users\admin\AppData\Local\Explower.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
2044Runtime Broker.exeC:\Users\admin\AppData\Roaming\apptext
MD5:AA3CCE4F6C83D5ADFCFC45934B274CC6
SHA256:57A8FF317E913B7E08C0A1758997ED0FFC2F1ABA0A3B3310C7697BC207FD15E5
1424server.exeC:\Users\admin\AppData\Roaming\Microsoft\svchost.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
296server.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explower.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
296server.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Explower.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
296server.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Explower.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
1216svchost.exeC:\Users\admin\AppData\Local\Temp\server.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
296server.exeC:\Users\admin\Favorites\Explower.exeexecutable
MD5:1C0130B5CC011F887883A75439F41C59
SHA256:FE0DD8248FE9BCCB65A098CAD74EAFF90707112A0EDB959B4ADEA6215F7AA3D7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Runtime Broker.exe