| File name: | WACT_AIO.bat |
| Full analysis: | https://app.any.run/tasks/d983a259-2dbe-4c6a-804f-19fad72e9ab8 |
| Verdict: | Malicious activity |
| Analysis date: | May 17, 2025, 21:00:48 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Indicators: | |
| MIME: | text/x-msdos-batch |
| File info: | DOS batch file, ASCII text, with CRLF line terminators |
| MD5: | 79D81FFE01D8D526736E58C9D48324B3 |
| SHA1: | 450BCA55C673A17B9B8FD69799842755D0E2E2E0 |
| SHA256: | 30217AC7B9C113AEE33DAEFFB5B7ACA9C62F9F0A75E5636B2ECBB1F6ADCBD941 |
| SSDEEP: | 6144:I96cEqR1F6sCKKztZlKoi1PpNpNxUXE+v+5Ur:YVDVCKH1hNq0+W5Ur |
MALICIOUS
No malicious indicators.SUSPICIOUS
Starts CMD.EXE for commands execution
- wscript.exe (PID: 7224)
- cmd.exe (PID: 7352)
The process executes VB scripts
- cmd.exe (PID: 5072)
- cmd.exe (PID: 7352)
Executing commands from a ".bat" file
- wscript.exe (PID: 7224)
Runs shell command (SCRIPT)
- wscript.exe (PID: 7224)
Starts application with an unusual extension
- cmd.exe (PID: 7352)
Manipulates environment variables
- powershell.exe (PID: 7548)
Probably obfuscated PowerShell command line is found
- cmd.exe (PID: 7352)
The process bypasses the loading of PowerShell profile settings
- cmd.exe (PID: 7352)
Possibly malicious use of IEX has been detected
- cmd.exe (PID: 7352)
Executes script without checking the security policy
- powershell.exe (PID: 7548)
CSC.EXE is used to compile C# code
- csc.exe (PID: 7908)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 7352)
Executable content was dropped or overwritten
- csc.exe (PID: 7908)
- expand.exe (PID: 7992)
- cmd.exe (PID: 7352)
Unpacks CAB file
- expand.exe (PID: 7992)
Process drops legitimate windows executable
- expand.exe (PID: 7992)
- cmd.exe (PID: 7352)
Gets full path of the running script (SCRIPT)
- cscript.exe (PID: 920)
- cscript.exe (PID: 7516)
- cscript.exe (PID: 7836)
Uses WMI to retrieve WMI-managed resources (SCRIPT)
- cscript.exe (PID: 920)
- cscript.exe (PID: 7516)
- cscript.exe (PID: 7836)
Hides command output
- cmd.exe (PID: 516)
Application launched itself
- ClipUp.exe (PID: 5244)
- cmd.exe (PID: 7352)
Reads data from a binary Stream object (SCRIPT)
- cscript.exe (PID: 7516)
- cscript.exe (PID: 920)
- cscript.exe (PID: 7836)
INFO
Starts MODE.COM to configure console settings
- mode.com (PID: 1116)
- mode.com (PID: 7432)
- mode.com (PID: 7504)
Checks supported languages
- mode.com (PID: 1116)
- mode.com (PID: 7432)
- mode.com (PID: 7504)
- chcp.com (PID: 7528)
- csc.exe (PID: 7908)
- cvtres.exe (PID: 7944)
- expand.exe (PID: 7992)
- gatherosstatemodified.exe (PID: 1628)
Changes the display of characters in the console
- cmd.exe (PID: 7352)
Reads the machine GUID from the registry
- csc.exe (PID: 7908)
- expand.exe (PID: 7992)
- gatherosstatemodified.exe (PID: 1628)
Create files in a temporary directory
- csc.exe (PID: 7908)
- cvtres.exe (PID: 7944)
- ClipUp.exe (PID: 7448)
The sample compiled with english language support
- expand.exe (PID: 7992)
- cmd.exe (PID: 7352)
Reads security settings of Internet Explorer
- cscript.exe (PID: 920)
- cscript.exe (PID: 7836)
- cscript.exe (PID: 7516)
Reads the computer name
- gatherosstatemodified.exe (PID: 1628)
Creates files in the program directory
- ClipUp.exe (PID: 7448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
162
Monitored processes
33
Malicious processes
7
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 516 | C:\WINDOWS\system32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 920 | cscript //nologo C:\WINDOWS\system32\slmgr.vbs -ipk VK7JG-NPHTM-C97JM-9MPGT-3V66T | C:\Windows\System32\cscript.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 1116 | mode 76, 30 | C:\Windows\System32\mode.com | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: DOS Device MODE Utility Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1196 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1628 | C:\WACTFILES\gatherosstatemodified.exe Pfn=Microsoft.Windows.48.X19-98841_8wekyb3d8bbwe;DownlevelGenuineState=1 | C:\WACTFILES\gatherosstatemodified.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Gather Downlevel OS Activation State Exit code: 0 Version: 10.0.14393.0 (rs1_release.160715-1616) Modules
| |||||||||||||||
| 2284 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5072 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\Desktop\WACT_AIO.bat" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5244 | clipup -v -o -altto C:\WACTFILES | C:\Windows\System32\ClipUp.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Client License Platform migration tool Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6712 | reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7176 | NET FILE | C:\Windows\System32\net.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
20 578
Read events
20 576
Write events
2
Delete events
0
Modification events
| (PID) Process: | (7224) wscript.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.FriendlyAppName |
Value: Windows Command Processor | |||
| (PID) Process: | (7224) wscript.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache |
| Operation: | write | Name: | C:\WINDOWS\System32\cmd.exe.ApplicationCompany |
Value: Microsoft Corporation | |||
Executable files
4
Suspicious files
5
Text files
15
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7548 | powershell.exe | C:\Users\admin\AppData\Local\Temp\z5yens0q\z5yens0q.cmdline | text | |
MD5:C838EA70E5C42BD2AFD42F7E01B98369 | SHA256:9A344602573BAFC9EB576FFDE662E621D10553148EA5396B912CA54315215348 | |||
| 7944 | cvtres.exe | C:\Users\admin\AppData\Local\Temp\RESC9BA.tmp | binary | |
MD5:BEF304E58B2F3E6BAD2A3C29D3DEC55C | SHA256:8D6B012853C6CF55DF84ED5D5F007987DE9D5812A904DE585D3951F6F16CE3CC | |||
| 7908 | csc.exe | C:\Users\admin\AppData\Local\Temp\z5yens0q\CSC8C46D91A24E3412EA53C816841F965DB.TMP | binary | |
MD5:0A43BE5554849DE0BB0B80A6AE8B34A4 | SHA256:F04A4C8713386A4C6146F03EB02CC3A87556716CA3699DF22571E1C7DBA85F2A | |||
| 7548 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0dbvmgjk.qjt.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7992 | expand.exe | C:\Windows\Logs\DPX\setupact.log | csv | |
MD5:18B0CCDD9A5FF40D96C2DBAE599BEABC | SHA256:B0296D916DC62D298863DAAF75896DC2B82A6010FFC81B02569BFDC16FEB301C | |||
| 7548 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_55fgodtx.b0w.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7548 | powershell.exe | C:\Users\admin\AppData\Local\Temp\z5yens0q\z5yens0q.0.cs | text | |
MD5:047F0CF592670E8FCA358F12E4CD5A89 | SHA256:32E77D9085AD9EA0FD1EB5A9556E29CB42F5D3016CCF9853F3C39D358F479978 | |||
| 7908 | csc.exe | C:\Users\admin\AppData\Local\Temp\z5yens0q\z5yens0q.out | text | |
MD5:2527959474C4A0383AD3B57E02662087 | SHA256:E5692AD2E592EDFC6FE2E7CE93A9CD5ED8A5B795FA8EA6BDB4BC3E16DF6BD48C | |||
| 7908 | csc.exe | C:\Users\admin\AppData\Local\Temp\z5yens0q\z5yens0q.dll | executable | |
MD5:B072599626B4AB6F13E8E6730A8F59C9 | SHA256:8B406F05A7E476811C6D5D5EE876066A022D5E2A848DD9C8F1D23BD5364125AA | |||
| 7548 | powershell.exe | C:\Users\admin\Desktop\1 | compressed | |
MD5:7492829A6D0BD32B501EB2C4938FE2EE | SHA256:1A258168F2B78A246D7C7A5F15CB07BF40564C08A18D9C9970AEE5191AFD00CC | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
15
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.216.77.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5156 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
5156 | SIHClient.exe | GET | 200 | 23.35.229.160:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.216.77.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 23.35.229.160:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2112 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.211.123.249:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 20.190.159.0:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
nexusrules.officeapps.live.com |
| whitelisted |