File name:

script.ps1

Full analysis: https://app.any.run/tasks/2c7562e0-2a88-4f87-96ee-673f50415632
Verdict: Malicious activity
Analysis date: January 22, 2024, 09:37:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: UTF-8 Unicode text, with CRLF line terminators
MD5:

A0296FF750A6E390576467EDE3C61EF3

SHA1:

25712311B1D24E2CCD0415909D58815DFD82A3B5

SHA256:

1E3C4E8BE1DD218A9F4A9B2983849532C34CFE8C2522C2A054E2DDC2E4CACD38

SSDEEP:

24:VLmIULR6L9hAlu2OxvthLgMqp92hFzFXzY3FgNdliQ8/CFqfFgNP:ZmFRO9fDxVhop92Fs3FgfliQ8KFqfFgB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • powershell.exe (PID: 1652)
      • csc.exe (PID: 2340)

    • Starts Visual C# compiler

      • powershell.exe (PID: 1652)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1652)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 2040)

  • SUSPICIOUS

    • Reads the Internet Settings

      • powershell.exe (PID: 2040)
      • powershell.exe (PID: 696)
      • powershell.exe (PID: 1652)
      • choco.exe (PID: 2572)
      • choco.exe (PID: 1424)
      • choco.exe (PID: 240)
      • choco.exe (PID: 908)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 1652)
      • powershell.exe (PID: 2040)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 696)
      • powershell.exe (PID: 1652)

    • Unusual connection from system programs

      • powershell.exe (PID: 1652)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 1652)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1652)
      • csc.exe (PID: 2340)

    • Drops 7-zip archiver for unpacking

      • powershell.exe (PID: 1652)

    • Uses .NET C# to load dll

      • powershell.exe (PID: 1652)

    • Application launched itself

      • powershell.exe (PID: 2040)
      • powershell.exe (PID: 1652)

    • The process executes Powershell scripts

      • powershell.exe (PID: 2040)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 2040)

  • INFO

    • Checks supported languages

      • csc.exe (PID: 2340)
      • cvtres.exe (PID: 2448)
      • choco.exe (PID: 1892)
      • choco.exe (PID: 2440)
      • choco.exe (PID: 2644)
      • choco.exe (PID: 1924)
      • choco.exe (PID: 2572)
      • choco.exe (PID: 2760)
      • choco.exe (PID: 1424)
      • choco.exe (PID: 240)
      • choco.exe (PID: 2524)
      • choco.exe (PID: 908)
      • choco.exe (PID: 2792)
      • choco.exe (PID: 3068)
      • choco.exe (PID: 948)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 2340)
      • cvtres.exe (PID: 2448)
      • choco.exe (PID: 1892)
      • choco.exe (PID: 2644)
      • choco.exe (PID: 2572)
      • choco.exe (PID: 1424)
      • choco.exe (PID: 240)
      • choco.exe (PID: 908)
      • choco.exe (PID: 948)

    • Create files in a temporary directory

      • csc.exe (PID: 2340)
      • cvtres.exe (PID: 2448)

    • Creates files in the program directory

      • powershell.exe (PID: 1652)
      • choco.exe (PID: 1892)
      • choco.exe (PID: 2644)

    • Reads the computer name

      • choco.exe (PID: 1892)
      • choco.exe (PID: 2440)
      • choco.exe (PID: 2644)
      • choco.exe (PID: 1924)
      • choco.exe (PID: 2572)
      • choco.exe (PID: 2760)
      • choco.exe (PID: 1424)
      • choco.exe (PID: 2792)
      • choco.exe (PID: 240)
      • choco.exe (PID: 2524)
      • choco.exe (PID: 908)
      • choco.exe (PID: 3068)
      • choco.exe (PID: 948)

    • Reads Environment values

      • choco.exe (PID: 2572)
      • choco.exe (PID: 1424)
      • choco.exe (PID: 2644)
      • choco.exe (PID: 240)
      • choco.exe (PID: 908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
20
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs powershell.exe powershell.exe no specs csc.exe cvtres.exe no specs setx.exe no specs setx.exe no specs choco.exe no specs choco.exe no specs choco.exe no specs choco.exe no specs choco.exe choco.exe no specs choco.exe choco.exe no specs choco.exe choco.exe no specs choco.exe choco.exe no specs choco.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\ProgramData\chocolatey\choco.exe" install steamC:\ProgramData\chocolatey\choco.exe
choco.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
Exit code:
1
Version:
2.2.2.0
Modules
Images
c:\programdata\chocolatey\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
696"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -command "Set-WinUserLanguageList -Force 'nb-NO'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
908"C:\ProgramData\chocolatey\choco.exe" install epicgameslauncherC:\ProgramData\chocolatey\choco.exe
choco.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
Exit code:
1
Version:
2.2.2.0
Modules
Images
c:\programdata\chocolatey\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
948"C:\ProgramData\chocolatey\choco.exe" install firefoxC:\ProgramData\chocolatey\choco.exe—choco.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
2.2.2.0
Modules
Images
c:\programdata\chocolatey\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1424"C:\ProgramData\chocolatey\choco.exe" install geforce-game-ready-driverC:\ProgramData\chocolatey\choco.exe
choco.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
Exit code:
1
Version:
2.2.2.0
Modules
Images
c:\programdata\chocolatey\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1652"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\script.ps1" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1892"C:\ProgramData\chocolatey\choco.exe" -vC:\ProgramData\chocolatey\choco.exe—powershell.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
2.2.2.0
Modules
Images
c:\programdata\chocolatey\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1924"C:\ProgramData\chocolatey\bin\choco.exe" upgrade chocolateyC:\ProgramData\chocolatey\bin\choco.exe—powershell.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
chocolatey - Chocolatey Shim
Exit code:
0
Version:
0.12.1.0
Modules
Images
c:\programdata\chocolatey\bin\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2040"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\script.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2096"C:\Windows\System32\setx.exe" ChocolateyLastPathUpdate "133503898779627500"C:\Windows\System32\setx.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setx - Sets environment variables
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\setx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
11 686
Read events
11 538
Write events
148
Delete events
0

Modification events

(PID) Process:(2040) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2040) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2040) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2040) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2040) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1652) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(696) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(696) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(696) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(696) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
14
Suspicious files
18
Text files
134
Unknown types
0

Dropped files

PID
Process
Filename
Type
2040powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IU9VISJH8TGNXMKNR9OX.tempbinary
MD5:F500255BDC0DD45A0934243E38529D10
SHA256:AD4304402753CEF71770C63692428001309617BDA00D87E229D197721D29496E
1652powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SYY6YFSM6YLRYUD5FP3K.tempbinary
MD5:F500255BDC0DD45A0934243E38529D10
SHA256:AD4304402753CEF71770C63692428001309617BDA00D87E229D197721D29496E
2040powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:F500255BDC0DD45A0934243E38529D10
SHA256:AD4304402753CEF71770C63692428001309617BDA00D87E229D197721D29496E
2040powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFdf6d4.TMPbinary
MD5:0268C3470C936E6FBAC2945B9E1C2099
SHA256:DF2AF58E8879B48826D8A418ED3B02CC8D484BCFC231C5B7A11BD153ED3998E9
1652powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFdfca0.TMPbinary
MD5:F500255BDC0DD45A0934243E38529D10
SHA256:AD4304402753CEF71770C63692428001309617BDA00D87E229D197721D29496E
2040powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
2040powershell.exeC:\Users\admin\AppData\Local\Temp\vxik4p22.g2h.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1652powershell.exeC:\Users\admin\AppData\Local\Temp\oqz130y5.lf0.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
1652powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.zipbinary
MD5:5A50D7B35241DE27298CB4CF8537B065
SHA256:4E1ACBDAC571719F90B2566566668C448A20074E7C2E3FAA37251C62AF4EFD86
696powershell.exeC:\Users\admin\AppData\Local\Temp\iuzzt1hu.5sv.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
23
DNS requests
2
Threats
25

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1652
powershell.exe
104.20.74.28:443
community.chocolatey.org
CLOUDFLARENET
—
shared
2572
choco.exe
104.20.74.28:443
community.chocolatey.org
CLOUDFLARENET
—
shared
1424
choco.exe
104.20.74.28:443
community.chocolatey.org
CLOUDFLARENET
—
shared
240
choco.exe
104.20.74.28:443
community.chocolatey.org
CLOUDFLARENET
—
shared

DNS requests

Domain
IP
Reputation
community.chocolatey.org
  • 104.20.74.28
  • 104.20.73.28
unknown
packages.chocolatey.org
  • 104.20.74.28
  • 104.20.73.28
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
—
—
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
script.ps1