Malware analysis moving_motivators_cards_pdf.7z Malicious activity

Add for printing

File name:	moving_motivators_cards_pdf.7z
Full analysis:	https://app.any.run/tasks/79e252fb-efc3-4103-bec2-da5fb789c307
Verdict:	Malicious activity
Analysis date:	April 29, 2025, 13:35:22
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	autoit autoit-loader
Indicators:
MIME:	application/x-7z-compressed
File info:	7-zip archive data, version 0.4
MD5:	261D58563CA668433B630A26A1A818B8
SHA1:	17A7E59A384DD7C1DBB4DC784DFB75BDF0997EC9
SHA256:	093FB652F50DF707E7A26C65A09602C612C68680247B447CA0E53BFEA4FE201C
SSDEEP:	98304:lPyev85rIT7v2MxFhdISIM698nqWX7t5iRYb7LVTlHQ3Eu3NVDhwVp0bk4Dg95WZ:vJRCx3EbfYLL2GHFGcc0MJts8CV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- AutoIt loader has been detected (YARA)
  - Dispatched.com (PID: 8156)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - WinRAR.exe (PID: 5156)
  - moving_motivators_cards_pdf.exe (PID: 7680)
- Executing commands from a ".bat" file
  - moving_motivators_cards_pdf.exe (PID: 7680)
- Get information on the list of running processes
  - cmd.exe (PID: 7836)
- Using 'findstr.exe' to search for text patterns in files and output
  - cmd.exe (PID: 7836)
- Starts CMD.EXE for commands execution
  - moving_motivators_cards_pdf.exe (PID: 7680)
  - cmd.exe (PID: 7836)
- Application launched itself
  - cmd.exe (PID: 7836)
- Starts the AutoIt3 executable file
  - cmd.exe (PID: 7836)
- The executable file from the user directory is run by the CMD process
  - Dispatched.com (PID: 8156)
- Starts application with an unusual extension
  - cmd.exe (PID: 7836)
- There is functionality for taking screenshot (YARA)
  - Dispatched.com (PID: 8156)
  - moving_motivators_cards_pdf.exe (PID: 7680)
INFO
- Reads the computer name
  - moving_motivators_cards_pdf.exe (PID: 7680)
  - extrac32.exe (PID: 8056)
  - Dispatched.com (PID: 8156)
- Checks supported languages
  - moving_motivators_cards_pdf.exe (PID: 7680)
  - extrac32.exe (PID: 8056)
  - Dispatched.com (PID: 8156)
- Process checks computer location settings
  - moving_motivators_cards_pdf.exe (PID: 7680)
- Create files in a temporary directory
  - moving_motivators_cards_pdf.exe (PID: 7680)
  - extrac32.exe (PID: 8056)
- Creates a new folder
  - cmd.exe (PID: 8036)
- Reads mouse settings
  - Dispatched.com (PID: 8156)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.7z	\|	7-Zip compressed archive (v0.4) (57.1)
.7z	\|	7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion:	7z v0.04

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

147

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

300

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

2196

C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache

C:\Windows\System32\svchost.exe

services.exe

User:

NETWORK SERVICE

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Host Process for Windows Services

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll

5156

"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\AppData\Local\Temp\moving_motivators_cards_pdf.7z

C:\Program Files\WinRAR\WinRAR.exe

—

explorer.exe

User:

admin

Company:

Alexander Roshal

Integrity Level:

MEDIUM

Description:

WinRAR archiver

Version:

5.91.0

Modules

Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll

7680

"C:\Users\admin\AppData\Local\Temp\Rar$EXb5156.5223\moving_motivators_cards_pdf.exe"

C:\Users\admin\AppData\Local\Temp\Rar$EXb5156.5223\moving_motivators_cards_pdf.exe

—

WinRAR.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

Modules

Images
c:\users\admin\appdata\local\temp\rar$exb5156.5223\moving_motivators_cards_pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll

7836

"C:\WINDOWS\System32\cmd.exe" /c copy Alabama.mid Alabama.mid.bat & Alabama.mid.bat

C:\Windows\SysWOW64\cmd.exe

—

moving_motivators_cards_pdf.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Command Processor

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll

7844

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

7924

tasklist

C:\Windows\SysWOW64\tasklist.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Lists the current running tasks

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll

7936

findstr /I "opssvc wrsa"

C:\Windows\SysWOW64\findstr.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Find String (QGREP) Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll

7980

tasklist

C:\Windows\SysWOW64\tasklist.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Lists the current running tasks

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll

7988

findstr "SophosHealth bdservicehost AvastUI AVGUI nsWscSvc ekrn"

C:\Windows\SysWOW64\findstr.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Find String (QGREP) Utility

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll

Add for printing

Total events

3 357

Read events

3 348

Write events

Delete events

Modification events


(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:	write	Name:	ShowPassword
Value: 0
(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	3
Value: C:\Users\admin\Desktop\preferences.zip
(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	2
Value: C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	1
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:	write	Name:	0
Value: C:\Users\admin\AppData\Local\Temp\moving_motivators_cards_pdf.7z
(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	name
Value: 120
(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	size
Value: 80
(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	type
Value: 120
(PID) Process:	(5156) WinRAR.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:	write	Name:	mtime
Value: 100

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
5156	WinRAR.exe	C:\Users\admin\AppData\Local\Temp\Rar$EXb5156.5223\moving_motivators_cards_pdf.exe		—
		MD5:—	SHA256:—
7680	moving_motivators_cards_pdf.exe	C:\Users\admin\AppData\Local\Temp\Provisions.mid		binary
		MD5:B948F050C4B8B61A2ADA8FB36BD2EE7A	SHA256:B2BBCFEC2A025981F68939C4182D61E7DFEA80B606C28C9A0F8C211BAA823AF2
7680	moving_motivators_cards_pdf.exe	C:\Users\admin\AppData\Local\Temp\Deal.mid		pgc
		MD5:AE8A32725C76B5FC8B261753AA49A6C9	SHA256:C9CFBEF9A56C3C1C2B9BD608C3C008C7824668139C056AD7AE68D8DC3992030E
7680	moving_motivators_cards_pdf.exe	C:\Users\admin\AppData\Local\Temp\Alabama.mid		text
		MD5:BCAD756C329332DFFA34013E2A01A5E2	SHA256:4DF80D34577FED23339298E9333D6339E6AEACB9B9AD939EFB115E527DB4635C
7680	moving_motivators_cards_pdf.exe	C:\Users\admin\AppData\Local\Temp\Bulletin.mid		binary
		MD5:83610D60D66729CBF77BB4F5616B1FEB	SHA256:8B164C99E560B6D3443FD30F81FAEFAD082EB9A440D7F0FB2CF08A684AEDEA43
7680	moving_motivators_cards_pdf.exe	C:\Users\admin\AppData\Local\Temp\Sublime.mid		binary
		MD5:44B363CB90EFB6441B884AC9B44973FD	SHA256:1E3091EF0F89999E02C484331662F41CC7E971B1326C6524349A3A39607EE730
7680	moving_motivators_cards_pdf.exe	C:\Users\admin\AppData\Local\Temp\Vendors.mid		binary
		MD5:D28DC7B17E647CB706258648D7EDD523	SHA256:06EAE641F88DFE312FD1B5765E27C3406E8E0AEDC08EAAE0DEEA26961D6BAC89
7836	cmd.exe	C:\Users\admin\AppData\Local\Temp\Alabama.mid.bat		text
		MD5:BCAD756C329332DFFA34013E2A01A5E2	SHA256:4DF80D34577FED23339298E9333D6339E6AEACB9B9AD939EFB115E527DB4635C
8056	extrac32.exe	C:\Users\admin\AppData\Local\Temp\Exit		binary
		MD5:3D1FE3DDD8B93D95888B922EBA87B3D1	SHA256:1E1E78DF54BA727414DDD1D053A91800E9F697DB9BCCD10AA859B86950C470E0
8056	extrac32.exe	C:\Users\admin\AppData\Local\Temp\Instrumentation		binary
		MD5:3A75829BA30C9D62C85CE006A9A53276	SHA256:D9B127AFDB8EACBB14685678FBCA1E8F8F43C4D336F8EC995510F66D0EF15CD4

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5496	MoUsoCoreWorker.exe	GET	200	23.216.77.41:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5496	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6544	svchost.exe	GET	200	184.30.131.245:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
7708	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
7708	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5496	MoUsoCoreWorker.exe	23.216.77.41:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5496	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
3216	svchost.exe	172.211.123.249:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	FR	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
6544	svchost.exe	20.190.159.128:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6544	svchost.exe	184.30.131.245:80	ocsp.digicert.com	AKAMAI-AS	US	whitelisted
2104	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
7708	SIHClient.exe	172.202.163.200:443	slscr.update.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	GB	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.124.78.146	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	23.216.77.41 23.216.77.32 23.216.77.38 23.216.77.37 23.216.77.18 23.216.77.28	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
client.wns.windows.com	172.211.123.249 172.211.123.248	whitelisted
login.live.com	20.190.159.128 20.190.159.131 40.126.31.129 20.190.159.73 40.126.31.1 20.190.159.71 20.190.159.68 20.190.159.64	whitelisted
ocsp.digicert.com	184.30.131.245	whitelisted
slscr.update.microsoft.com	172.202.163.200	whitelisted
fe3cr.delivery.mp.microsoft.com	52.165.164.15	whitelisted
lcpYrDuoqTjy.lcpYrDuoqTjy	—	unknown

Threats

PID	Process	Class	Message
2196	svchost.exe	Potentially Bad Traffic	ET DNS Query to a *.top domain - Likely Hostile

Add for printing

No debug info

General Info

moving_motivators_cards_pdf.7z

261D58563CA668433B630A26A1A818B8

17A7E59A384DD7C1DBB4DC784DFB75BDF0997EC9

093FB652F50DF707E7A26C65A09602C612C68680247B447CA0E53BFEA4FE201C

98304:lPyev85rIT7v2MxFhdISIM698nqWX7t5iRYb7LVTlHQ3Eu3NVDhwVp0bk4Dg95WZ:vJRCx3EbfYLL2GHFGcc0MJts8CV

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

AutoIt loader has been detected (YARA)

SUSPICIOUS

Reads security settings of Internet Explorer

Executing commands from a ".bat" file

Get information on the list of running processes

Using 'findstr.exe' to search for text patterns in files and output

Starts CMD.EXE for commands execution

Application launched itself

Starts the AutoIt3 executable file

The executable file from the user directory is run by the CMD process

Starts application with an unusual extension

There is functionality for taking screenshot (YARA)

INFO

Reads the computer name

Checks supported languages

Process checks computer location settings

Create files in a temporary directory

Creates a new folder

Reads mouse settings

Malware configuration

Static information

TRiD

EXIF

ZIP

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings