ANY.RUN: public sandbox report for Monoxide x64.exe (seen in a search listing on this date; the page itself was not opened, used only to say that such files exist)

3072:7/yvAAdLz9aha9RMXtdf+IBC2nQ4oUehONFlT7vJ333AlOi9E3AAqgm7:z6dLzgiMXzBTJTDqlOi9E3AAqgm7

Internet Explorer 11.3636.19041.0

Adobe Acrobat (64-bit) (23.001.20093)

Adobe Flash Player 32 NPAPI (32.0.0.465)

Adobe Flash Player 32 PPAPI (32.0.0.465)

FileZilla 3.65.0 (3.65.0)

Google Chrome (122.0.6261.70)

Google Update Helper (1.3.36.51)

Java 8 Update 271 (64-bit) (8.0.2710.9)

Java Auto Updater (2.8.271.9)

Microsoft Edge (122.0.2365.59)

Microsoft Edge Update (1.3.185.17)

Microsoft Office Professional 2019 - de-de (16.0.16026.20146)

Microsoft Office Professional 2019 - en-us (16.0.16026.20146)

Microsoft Office Professional 2019 - es-es (16.0.16026.20146)

Microsoft Office Professional 2019 - it-it (16.0.16026.20146)

Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)

Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)

Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)

Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)

Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)

Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)

Microsoft OneNote - en-us (16.0.16026.20146)

Microsoft Update Health Tools (3.74.0.0)

Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)

Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)

Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)

Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)

Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)

Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)

Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)

Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)

Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)

Mozilla Firefox (x64 en-US) (123.0)

Mozilla Maintenance Service (123.0)

Notepad++ (64-bit x64) (7.9.1)

Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)

Office 16 Click-to-Run Licensing Component (16.0.16026.20146)

Office 16 Click-to-Run Localization Component (16.0.15726.20202)

Office 16 Click-to-Run Localization Component (16.0.15928.20198)

PowerShell 7-x64 (7.3.5.0)

Skype version 8.104 (8.104)

Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)

Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)

Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)

Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)

VLC media player (3.0.11)

WinRAR 5.91 (64-bit) (5.91.0)

Windows PC Health Check (3.6.2204.08001)

Client LanguagePack Package

InternetExplorer Optional Package

LanguageFeatures Basic en us Package

LanguageFeatures Handwriting en us Package

LanguageFeatures OCR en us Package

LanguageFeatures Speech en us Package

LanguageFeatures TextToSpeech en us Package

Microsoft OneCore ApplicationModel Sync Desktop FOD Package

Microsoft OneCore DirectX Database FOD Package

NetFx3 OnDemand Package

OpenSSH Client Package

PowerShell ISE FOD Package

Printing PMCPPC FoD Package

Printing WFS FoD Package

StepsRecorder Package

UserExperience Desktop Package

MALICIOUS Drops the executable file immediately after the start Monoxide x64.exe (PID: 2708) Monoxide mutex has been found 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Drops the executable file immediately after the start Monoxide x64.exe (PID: 2708)

Drops the executable file immediately after the start

Monoxide x64.exe (PID: 2708)

Monoxide mutex has been found 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Monoxide mutex has been found

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

SUSPICIOUS Executable content was dropped or overwritten Monoxide x64.exe (PID: 2708) Starts itself from another location Monoxide x64.exe (PID: 2708) Reads the date of Windows installation 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752) Creates file in the systems drive root 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752) Start notepad (likely ransomware note) 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752) Reads security settings of Internet Explorer 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752) The process executes JS scripts 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Executable content was dropped or overwritten Monoxide x64.exe (PID: 2708)

Executable content was dropped or overwritten

Monoxide x64.exe (PID: 2708)

Starts itself from another location Monoxide x64.exe (PID: 2708)

Starts itself from another location

Monoxide x64.exe (PID: 2708)

Reads the date of Windows installation 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Reads the date of Windows installation

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Creates file in the systems drive root 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Creates file in the systems drive root

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Start notepad (likely ransomware note) 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Start notepad (likely ransomware note)

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Reads security settings of Internet Explorer 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Reads security settings of Internet Explorer

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

The process executes JS scripts 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

The process executes JS scripts

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

INFO Create files in a temporary directory Monoxide x64.exe (PID: 2708) Reads the computer name 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752) Checks supported languages 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752) Monoxide x64.exe (PID: 2708) Process checks computer location settings 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752) Reads security settings of Internet Explorer notepad.exe (PID: 6668) Reads Microsoft Office registry keys OpenWith.exe (PID: 4304) Application launched itself msedge.exe (PID: 7360) msedge.exe (PID: 7772) Manual execution by a user msedge.exe (PID: 7772)

Create files in a temporary directory Monoxide x64.exe (PID: 2708)

Create files in a temporary directory

Monoxide x64.exe (PID: 2708)

Reads the computer name 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Reads the computer name

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Checks supported languages 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752) Monoxide x64.exe (PID: 2708)

Checks supported languages

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Monoxide x64.exe (PID: 2708)

Process checks computer location settings 颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Process checks computer location settings

颋制趓禇躍漧昱澒躺輆鷺艸湷疽譌脞.exe (PID: 752)

Reads security settings of Internet Explorer notepad.exe (PID: 6668)

Reads security settings of Internet Explorer

notepad.exe (PID: 6668)

Reads Microsoft Office registry keys OpenWith.exe (PID: 4304)

Reads Microsoft Office registry keys

OpenWith.exe (PID: 4304)

Application launched itself msedge.exe (PID: 7360) msedge.exe (PID: 7772)

Application launched itself

msedge.exe (PID: 7360)

msedge.exe (PID: 7772)

Manual execution by a user msedge.exe (PID: 7772)

Manual execution by a user

msedge.exe (PID: 7772)

Program did not start

Low-level access to the HDD

Process was added to the startup

Debug information is available

Probably Tor was used

Behavior similar to spam

Task has injected processes

Executable file was dropped

Network attacks were detected

Integrity level elevation

Connects to the network

Process starts the services

Task contains several apps running

Application downloaded the executable file

Actions similar to stealing personal data

Task has apps ended with an error

File is detected by antivirus software

Inspected object has suspicious PE structure

Behavior similar to exploiting the vulnerability

Task contains an error or was rebooted

The process has the malware config