| File name: | test.ps1 |
| Full analysis: | https://app.any.run/tasks/8c1b26e1-d1c6-4004-af41-8d9ec1cfb812 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | July 15, 2025, 14:39:32 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text |
| MD5: | C6E71F9283D68887DA8DD07008A29101 |
| SHA1: | 7C1F354C0CDACF62BC6CFD1FBE2E36AE3214ECA2 |
| SHA256: | 2001B9D9A6407D6B94DCC8E192E21201C52081EC50A178B42054AC57348B8902 |
| SSDEEP: | 12:66/sDLdvGHDHzKwtlHLhEoyXnqfxvRbw2NltAAH+LgyaISH/sypnm:MsHDHPcnIvZw2W0+Lwfs2m |
MALICIOUS
Bypass execution policy to execute commands
- powershell.exe (PID: 6648)
Actions looks like stealing of personal data
- LaZagne.exe (PID: 3864)
Steals credentials from Web Browsers
- LaZagne.exe (PID: 3864)
SUSPICIOUS
Executable content was dropped or overwritten
- powershell.exe (PID: 6648)
- LaZagne.exe (PID: 3876)
Process drops legitimate windows executable
- LaZagne.exe (PID: 3876)
Process drops python dynamic module
- LaZagne.exe (PID: 3876)
Application launched itself
- LaZagne.exe (PID: 3876)
The process drops C-runtime libraries
- LaZagne.exe (PID: 3876)
Loads Python modules
- LaZagne.exe (PID: 3864)
Starts CMD.EXE for commands execution
- LaZagne.exe (PID: 3864)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 6648)
INFO
Create files in a temporary directory
- LaZagne.exe (PID: 3876)
- LaZagne.exe (PID: 3864)
Checks supported languages
- LaZagne.exe (PID: 3876)
- LaZagne.exe (PID: 3864)
The executable file from the user directory is run by the Powershell process
- LaZagne.exe (PID: 3876)
Checks proxy server information
- powershell.exe (PID: 6648)
- slui.exe (PID: 7032)
Disables trace logs
- powershell.exe (PID: 6648)
The sample compiled with english language support
- LaZagne.exe (PID: 3876)
Reads the computer name
- LaZagne.exe (PID: 3876)
- LaZagne.exe (PID: 3864)
Reads the machine GUID from the registry
- LaZagne.exe (PID: 3864)
Checks operating system version
- LaZagne.exe (PID: 3864)
ULTRAVNC has been detected
- LaZagne.exe (PID: 3864)
Remote server returned an error (POWERSHELL)
- powershell.exe (PID: 6648)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 6648)
Reads the software policy settings
- slui.exe (PID: 7032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
140
Monitored processes
6
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1976 | C:\WINDOWS\system32\cmd.exe /c "ver" | C:\Windows\System32\cmd.exe | — | LaZagne.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2780 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3864 | "C:\Users\admin\AppData\Local\Temp\LaZagne.exe" all | C:\Users\admin\AppData\Local\Temp\LaZagne.exe | LaZagne.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 3876 | "C:\Users\admin\AppData\Local\Temp\LaZagne.exe" all | C:\Users\admin\AppData\Local\Temp\LaZagne.exe | powershell.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 6648 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\test.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7032 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | svchost.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
8 918
Read events
8 918
Write events
0
Delete events
0
Modification events
Executable files
60
Suspicious files
5
Text files
4
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6648 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_okwiiigl.q3x.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6648 | powershell.exe | C:\Users\admin\AppData\Local\Temp\LaZagne.exe | executable | |
MD5:81448745B5D62608B37888B38E9F276A | SHA256:DC06D62EE95062E714F2566C95B8EDAABFD387023B1BF98A09078B84007D5268 | |||
| 6648 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F4SHEEM992TEAZGGZMOJ.temp | binary | |
MD5:5F406F5CAB4FCB6FF7101FF53BA06BD4 | SHA256:8E93AACBFA9EF0B086B1392717FCF71F3C533AD918BD699A1F67CBAAC8619246 | |||
| 3876 | LaZagne.exe | C:\Users\admin\AppData\Local\Temp\_MEI38762\_hashlib.pyd | executable | |
MD5:4FB84E5D3F58453D7CCBF7BCC06266A0 | SHA256:DF47255C100D9CC033A14C7D60051ABE89C24DA9C60362FE33CDF24C19651F7C | |||
| 3876 | LaZagne.exe | C:\Users\admin\AppData\Local\Temp\_MEI38762\_ctypes.pyd | executable | |
MD5:C8F57695AF24A4F71DAFA887CE731EBC | SHA256:E3B69285F27A8AD97555BEBEA29628A93333DE203EE2FAE95B73B6B6D6C162B1 | |||
| 3876 | LaZagne.exe | C:\Users\admin\AppData\Local\Temp\_MEI38762\VCRUNTIME140.dll | executable | |
MD5:A87575E7CF8967E481241F13940EE4F7 | SHA256:DED5ADAA94341E6C62AEA03845762591666381DCA30EB7C17261DD154121B83E | |||
| 3876 | LaZagne.exe | C:\Users\admin\AppData\Local\Temp\_MEI38762\_elementtree.pyd | executable | |
MD5:C25EC046C0C7A2FE9E10A3B059F77436 | SHA256:F93B90ABFFB837FD024E2A9A5DEC8C9C79B275AE128065DAC7623A2F9D974319 | |||
| 3876 | LaZagne.exe | C:\Users\admin\AppData\Local\Temp\_MEI38762\_decimal.pyd | executable | |
MD5:95F1BE8C2D46AA4B5AD13F4FBB228C31 | SHA256:F7864B8B37715A87F4F11D5CBFEFD5F1489399E064F7662FA0E0D7C5DF59D5E4 | |||
| 6648 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | binary | |
MD5:5F406F5CAB4FCB6FF7101FF53BA06BD4 | SHA256:8E93AACBFA9EF0B086B1392717FCF71F3C533AD918BD699A1F67CBAAC8619246 | |||
| 3876 | LaZagne.exe | C:\Users\admin\AppData\Local\Temp\_MEI38762\_socket.pyd | executable | |
MD5:7F25AB4019E6C759FC77383F523EF9AF | SHA256:D0497B79345B2C255F6274BAEA6AC44B74F345E111AB25BF6C91AF9B2A3F3B95 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
45
DNS requests
20
Threats
2
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | GET | 200 | 23.55.110.211:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5012 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
6256 | RUXIMICS.exe | GET | 200 | 23.55.110.211:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 302 | 140.82.121.3:443 | https://github.com/AlessandroZ/LaZagne/releases/download/v2.4.7/LaZagne.exe | unknown | — | — | unknown |
1268 | svchost.exe | GET | 200 | 23.55.110.211:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6256 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 40.69.42.241:443 | https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping | unknown | — | — | unknown |
5012 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1268 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6256 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5944 | MoUsoCoreWorker.exe | 23.55.110.211:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 23.55.110.211:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6256 | RUXIMICS.exe | 23.55.110.211:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5944 | MoUsoCoreWorker.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
1268 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
github.com |
| whitelisted |
release-assets.githubusercontent.com |
| unknown |
login.live.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2200 | svchost.exe | Misc activity | ET FILE_SHARING File Sharing Related Domain in DNS Lookup (0x0 .st) |
6648 | powershell.exe | Misc activity | ET FILE_SHARING File Sharing Domain Observed in TLS SNI (0x0 .st) |