Suspicious
Old unsigned EXE with low-trust heuristic flags and suspicious MITRE techniques but no tier-1 detections or confirmed malice.
1284106bcfc820bc98…594cfd076bThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The engine picture is overwhelmingly clean except for one low-trust detection, satisfying the low-trust-only FP pattern. However the sandbox observed genuine offensive MITRE techniques and direct-IP C2-style behaviour that benign software rarely exhibits without DNS. Prevalence as common_old since 2011 and absence of external intel or malicious children are positive, but the unsigned status and three prior suspicious imphash verdicts keep the file in the borderline zone. No single signal is decisive; the combination warrants suspicious.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 1/75 malicious (SentinelOne low_trust 'Static AI - Suspicious PE'), tier1Malicious=0, onlyLowTrustFlagging=true
behaviour.offensiveTechniques: T1055 and T1562.001 observed; DirectIpC2 heuristic on 14 IPs/0 domains
prevalence.classification: common_old (137 submitters since 2011-06-09); similarHashes shows 3/5 prior suspicious verdicts on imphash
signing.verified=false; no externalIntel hits or malicious sandbox verdicts
- Only low-trust detection; zero tier-1 malicious
- Common_old prevalence since 2011
- Clean sandbox verdict and no malicious dropped children or hosts
- Process injection (T1055) and defense impairment (T1562.001) observed
- Direct IP contacts with zero domains
- Unsigned binary
- Mixed similar-hash verdicts (mostly suspicious)
Treat as suspicious; do not execute on production systems without further verification or sandboxing.
1 contradiction resolved by the scoring engine
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- a83f:8110:9d59:ff:995a:ff:9759:ff
- 72.21.81.240
- 20.99.132.105
- 192.229.211.108
- 23.40.197.184
- 20.99.133.109
- 20.99.184.37
- a83f:8110:0:0:64ca:1f00:0:0
- 20.99.185.48
- 23.198.146.35
- C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll
- C:\Users\user\AppData\Roaming
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E60.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E61.tmp.WERInternalMetadata.xml
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F3C.tmp.csv
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F6C.tmp.txt
- C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F3B.tmp.csv
- CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
- CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
- CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
- CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
- CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Users\<USER>\Desktop\software.exe"Sample contacted 14 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidencea83f:8110:9d59:ff:995a:ff:9759:ff · 72.21.81.240 · 20.99.132.105
1 detection across 75 engines
Section entropy & packers
Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.
How often this file shows up in the wild
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Forensic fingerprint
- File name
- RegOwnit.exe
- Size
- 3.60 MB
- MIME type
- (unknown)
- Detected type
- Win32 EXE
- SHA-256
- 1284106bcfc820bc983810a3bacbfc8f3db96af945013642a6078e594cfd076b
- MD5
- 31d2286967caddc168b2a08845cd36ad
- SHA-1
- 2e210eb46ec87c901205d9bf818de13f25b10f1d
- PE imphash
- f34d5f2d4577ed6d9ceec516c1f5a744
- First seen (VT)
- 6/9/2011, 12:52:55 PM
- Last analysis (VT)
- 5/20/2026, 4:22:01 AM
- First scan (MalwareTips)
- 5/22/2026, 7:03:39 AM
- Last scan (MalwareTips)
- 5/22/2026, 7:03:39 AM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.