File name:

pdq-connect-agent.exe.lol

Full analysis: https://app.any.run/tasks/3079b45e-713c-4cef-815f-7aea9112fd6c
Verdict: Malicious activity
Analysis date: August 07, 2024, 19:34:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (console) x86-64, for MS Windows
MD5:

8360872D4F1C76D6E5BDD12D9FB9CEE7

SHA1:

D66A43E2B23C10BBF23F8DB6C9C876BDDFB896E9

SHA256:

22629D545AF8FE48D6F0E41FC37A3EA643BCFED59D3F462F448C0AA897366018

SSDEEP:

98304:ANNRdFTRVcMQWgLpPa7QwOhhPew4V3hmXwLR+1VNz7vvyAHKF/pQKD+/en4hWNWE:GhAa7QwOhIw4VExt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6616)

    • Changes powershell execution policy (Bypass)

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • The process bypasses the loading of PowerShell profile settings

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • The process hide an interactive prompt from the user

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • The process hides Powershell's copyright startup banner

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

  • INFO

    • Checks proxy server information

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • Checks supported languages

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6616)

    • Reads Environment values

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • Reads product name

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • Reads the computer name

      • pdq-connect-agent.exe.lol.exe (PID: 6528)

    • Reads the software policy settings

      • pdq-connect-agent.exe.lol.exe (PID: 6528)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:07:15 18:17:11+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 5986816
InitializedDataSize: 3104256
UninitializedDataSize: -
EntryPoint: 0x59727c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 5.4.4.0
ProductVersionNumber: 5.4.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
LegalCopyright: PDQ.com
FileVersion: 5.4.4
ProductVersion: 5.4.4
ProductName: PDQConnectAgent
FileDescription: PDQ Connect Agent
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start pdq-connect-agent.exe.lol.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6528"C:\Users\admin\AppData\Local\Temp\pdq-connect-agent.exe.lol.exe" C:\Users\admin\AppData\Local\Temp\pdq-connect-agent.exe.lol.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PDQ Connect Agent
Version:
5.4.4
Modules
Images
c:\users\admin\appdata\local\temp\pdq-connect-agent.exe.lol.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
6536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—pdq-connect-agent.exe.lol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6616"powershell" -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -Command -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—pdq-connect-agent.exe.lol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
6636\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 081
Read events
5 081
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6616powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_n1xnzuxm.n3w.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6616powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_323wumys.ump.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6616powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:28E5B2BC71ADC66893B7D61E1951A8B7
SHA256:56D099C3BC84F63EEB4893BE3D58E9288EAC994A7A4F59E54EF50D51738CB5AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
42
DNS requests
15
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2456
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2456
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7044
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
7092
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4560
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4708
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4708
svchost.exe
52.183.220.149:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
5336
SearchApp.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2456
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
settings-win.data.microsoft.com
  • 52.183.220.149
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.185
  • 2.23.209.133
  • 2.23.209.140
  • 2.23.209.187
  • 2.23.209.193
  • 2.23.209.135
  • 2.23.209.130
  • 2.23.209.189
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.0
  • 20.190.159.68
  • 40.126.31.71
  • 20.190.159.75
  • 40.126.31.73
  • 20.190.159.71
  • 20.190.159.2
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 2.23.209.135
  • 2.23.209.149
  • 2.23.209.140
  • 2.23.209.179
  • 2.23.209.182
  • 2.23.209.150
  • 2.23.209.177
  • 2.23.209.158
  • 2.23.209.176
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] An application monitoring request to sentry .io
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pdq-connect-agent.exe.lol