| File name: | 123.txt |
| Full analysis: | https://app.any.run/tasks/f7bd4f77-35d6-461f-a7bd-2b8a06b1a213 |
| Verdict: | Malicious activity |
| Threats: | Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns. |
| Analysis date: | December 14, 2024, 00:22:38 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/x-msdos-batch |
| File info: | DOS batch file, ASCII text, with very long lines (424), with CRLF line terminators |
| MD5: | 27D782EACCCB2A76774EB1109C03AF6F |
| SHA1: | C8BF807D0726710911D584225CD5354AE1292CC0 |
| SHA256: | 0700FB8950DE3D3C68D60733D69209AB9EA4EE7ACB1E7D87ED68C080B4416AA9 |
| SSDEEP: | 24:foV7Pl0o+Fn0bt8w4yECKzZ1qBdyV7Pl0o+u3NtvDfyEFd:foRlH+FTTZ1qBdyRlH+Ip |
MALICIOUS
Actions looks like stealing of personal data
- cmd.exe (PID: 2280)
Deletes shadow copies
- cmd.exe (PID: 2280)
SUSPICIOUS
Creates file in the systems drive root
- cmd.exe (PID: 2280)
Deletes system .NET executable
- cmd.exe (PID: 2280)
Reads the Internet Settings
- SearchProtocolHost.exe (PID: 1048)
- WMIC.exe (PID: 532)
- WMIC.exe (PID: 3312)
Uses WMIC.EXE to obtain data on processes
- cmd.exe (PID: 2280)
INFO
Manual execution by a user
- wmpnscfg.exe (PID: 828)
- cmd.exe (PID: 2280)
Checks supported languages
- wmpnscfg.exe (PID: 828)
Reads the computer name
- wmpnscfg.exe (PID: 828)
Executes as Windows Service
- SearchIndexer.exe (PID: 1380)
- SearchIndexer.exe (PID: 3108)
Creates files in the program directory
- SearchIndexer.exe (PID: 1380)
- SearchIndexer.exe (PID: 3108)
Creates files or folders in the user directory
- SearchProtocolHost.exe (PID: 1048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
52
Monitored processes
10
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 532 | WMIC PROCESS WHERE NAME="SYSTEM" DELETE | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: WMI Commandline Utility Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 828 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1048 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
| 1380 | C:\Windows\system32\SearchIndexer.exe /Embedding | C:\Windows\System32\SearchIndexer.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Indexer Exit code: 0 Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1560 | "C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\123.txt | C:\Windows\System32\notepad.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1972 | "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" | C:\Windows\System32\SearchProtocolHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Protocol Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
| 2280 | "C:\Windows\System32\cmd.exe" | C:\Windows\System32\cmd.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3108 | C:\Windows\system32\SearchIndexer.exe /Embedding | C:\Windows\System32\SearchIndexer.exe | — | services.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft Windows Search Indexer Version: 7.00.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 3304 | "C:\Windows\system32\SearchFilterHost.exe" 0 524 528 536 65536 532 | C:\Windows\System32\SearchFilterHost.exe | — | SearchIndexer.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Windows Search Filter Host Version: 7.00.7601.24542 (win7sp1_ldr_escrow.191209-2211) Modules
| |||||||||||||||
| 3312 | WMIC PROCESS WHERE NAME="SMSS.exe" DELETE | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: WMI Commandline Utility Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
5 375
Read events
3 728
Write events
1 421
Delete events
226
Modification events
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Tracing\EventThrottleState |
| Operation: | delete value | Name: | 000003f5 |
Value: | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Tracing\EventThrottleLastReported |
| Operation: | delete value | Name: | 000003f5 |
Value: | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Tracing\EventThrottleState |
| Operation: | delete value | Name: | 000003eb |
Value: | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Tracing\EventThrottleLastReported |
| Operation: | delete value | Name: | 000003eb |
Value: | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Tracing\EventThrottleState |
| Operation: | delete value | Name: | 00000bdc |
Value: | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Tracing\EventThrottleLastReported |
| Operation: | delete value | Name: | 00000bdc |
Value: | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Search\Preferences |
| Operation: | delete value | Name: | DataDirectory |
Value: | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Gathering Manager |
| Operation: | write | Name: | UseSystemTemp |
Value: 0 | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search\Tracing\EventThrottleState |
| Operation: | write | Name: | 00001b80 |
Value: 01000000FB6343F32A0C00000100000000000000 | |||
| (PID) Process: | (1380) SearchIndexer.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Search |
| Operation: | write | Name: | RebuildIndex |
Value: 3 | |||
Executable files
0
Suspicious files
25
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2280 | cmd.exe | C:\Windows\System32\winevt\Logs\Application.evtx | — | |
MD5:— | SHA256:— | |||
| 1380 | SearchIndexer.exe | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb | — | |
MD5:— | SHA256:— | |||
| 1380 | SearchIndexer.exe | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb | — | |
MD5:— | SHA256:— | |||
| 2280 | cmd.exe | C:\Windows\System32\winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx | evtx | |
MD5:61FCA096530BFA24A1A81E28812AE29E | SHA256:FE48F5F5B4C2B55722C508C867AF89DDA1EE0F8D3FC1BE2906C07453000376FB | |||
| 1380 | SearchIndexer.exe | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.chk | binary | |
MD5:C407BDC6E97077B9E702BF355F6F09FA | SHA256:BD5F38648CB0CBB4C1DB510EE1D9CAD88A33494EAF52E72799AB7D6706E8C064 | |||
| 1380 | SearchIndexer.exe | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSSres00001.jrs | binary | |
MD5:87E50E8586DBA6B53A60855024388427 | SHA256:4EC923270DB17DB7609FE39206BEBBCE31483D4AEEE6A7D69D854BD89910B8B0 | |||
| 1380 | SearchIndexer.exe | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSSres00002.jrs | binary | |
MD5:87E50E8586DBA6B53A60855024388427 | SHA256:4EC923270DB17DB7609FE39206BEBBCE31483D4AEEE6A7D69D854BD89910B8B0 | |||
| 3108 | SearchIndexer.exe | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSSres00002.jrs | binary | |
MD5:87E50E8586DBA6B53A60855024388427 | SHA256:4EC923270DB17DB7609FE39206BEBBCE31483D4AEEE6A7D69D854BD89910B8B0 | |||
| 3108 | SearchIndexer.exe | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSSres00001.jrs | binary | |
MD5:87E50E8586DBA6B53A60855024388427 | SHA256:4EC923270DB17DB7609FE39206BEBBCE31483D4AEEE6A7D69D854BD89910B8B0 | |||
| 3108 | SearchIndexer.exe | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.002 | binary | |
MD5:D55C0CFDACD324A50B20D82C23AE957C | SHA256:70C336472B02A29928327DBBF62E8DE9886F2A163D206B2C687D9C76A407F4CA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1108 | svchost.exe | 224.0.0.252:5355 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |