analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3

Full analysis: https://app.any.run/tasks/e200dfbb-acbe-4443-980a-fbf091ac5b1f
Verdict: Malicious activity
Analysis date: October 05, 2022, 07:24:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

CC2501714328E4103A82FD9A0585855C

SHA1:

A9B6B96B24BF5983B9BF67DF165CA2ABCF221CBF

SHA256:

30A531DAA107C2AC749E111D5F8F7CE4C4DFE9CA6E36B7EF26FF1E7048219CD3

SSDEEP:

6144:/OB+pgUtGGGGGGbGGGGGzGGGGGRGGGGGGUGGGGGGG+GGGGGGzGGGGGGBGGGGGGGI:WgYJToCI54QCdMo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)

    • Loads dropped or rewritten executable

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)

    • Drops a file with too old compile date

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)

    • Executes PowerShell scripts

      • nsBF1D.tmp (PID: 1116)
      • nsC076.tmp (PID: 1616)
      • nsC451.tmp (PID: 2432)
      • nsC1BF.tmp (PID: 2464)
      • nsC308.tmp (PID: 3116)
      • nsC82D.tmp (PID: 2372)
      • nsC59A.tmp (PID: 2188)
      • nsC6E4.tmp (PID: 2596)
      • nsC976.tmp (PID: 3664)
      • nsCABF.tmp (PID: 2340)
      • nsCE9A.tmp (PID: 3876)
      • nsCD51.tmp (PID: 1968)
      • nsCC08.tmp (PID: 552)
      • nsD12D.tmp (PID: 2900)
      • nsD3BF.tmp (PID: 3872)
      • nsD508.tmp (PID: 3852)
      • nsCFE3.tmp (PID: 420)
      • nsD276.tmp (PID: 3312)
      • nsD651.tmp (PID: 2472)
      • nsDA2C.tmp (PID: 2880)
      • nsD79A.tmp (PID: 3048)
      • nsD8E3.tmp (PID: 4024)
      • nsDB76.tmp (PID: 3700)
      • nsDCBF.tmp (PID: 1260)
      • nsDE08.tmp (PID: 672)
      • nsE1E3.tmp (PID: 3712)
      • nsE32C.tmp (PID: 684)
      • nsE09A.tmp (PID: 1712)
      • nsDF51.tmp (PID: 680)
      • nsE5BF.tmp (PID: 3248)
      • nsE99A.tmp (PID: 2888)
      • nsE475.tmp (PID: 2356)
      • nsEAE3.tmp (PID: 3556)
      • nsE708.tmp (PID: 2560)
      • nsE851.tmp (PID: 3748)
      • nsF008.tmp (PID: 1096)
      • nsED75.tmp (PID: 2192)
      • nsF52C.tmp (PID: 860)
      • nsEC2C.tmp (PID: 832)
      • nsF3E3.tmp (PID: 2960)
      • nsF29A.tmp (PID: 1240)
      • nsEEBE.tmp (PID: 2696)
      • nsF151.tmp (PID: 2268)
      • nsF907.tmp (PID: 3244)
      • nsF7BE.tmp (PID: 2008)
      • nsFB9A.tmp (PID: 2388)
      • nsF675.tmp (PID: 2312)
      • nsFA51.tmp (PID: 3920)
      • nsFE2C.tmp (PID: 2408)
      • nsFCE3.tmp (PID: 2260)
      • ns207.tmp (PID: 2976)
      • ns49A.tmp (PID: 4076)
      • ns5E3.tmp (PID: 2164)
      • nsFF75.tmp (PID: 1996)
      • nsBE.tmp (PID: 3876)
      • ns350.tmp (PID: 1388)
      • ns72C.tmp (PID: 3072)
      • ns875.tmp (PID: 2512)
      • ns9BE.tmp (PID: 3504)
      • nsEE3.tmp (PID: 452)
      • ns1407.tmp (PID: 3660)
      • nsD99.tmp (PID: 3104)
      • nsB07.tmp (PID: 508)
      • nsC50.tmp (PID: 872)
      • ns12BE.tmp (PID: 3312)
      • ns1175.tmp (PID: 676)
      • ns102C.tmp (PID: 420)
      • ns1550.tmp (PID: 2220)
      • ns1699.tmp (PID: 1400)
      • ns1D07.tmp (PID: 1264)
      • ns192C.tmp (PID: 3804)
      • ns17E2.tmp (PID: 2476)
      • ns1A75.tmp (PID: 3800)
      • ns1BBE.tmp (PID: 2212)

    • Starts application with an unusual extension

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)

  • INFO

    • Process checks LSA protection

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)

    • Checks supported languages

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)
      • nsBF1D.tmp (PID: 1116)
      • nsC1BF.tmp (PID: 2464)
      • nsC076.tmp (PID: 1616)
      • nsC308.tmp (PID: 3116)
      • nsC6E4.tmp (PID: 2596)
      • nsC451.tmp (PID: 2432)
      • nsC59A.tmp (PID: 2188)
      • nsC82D.tmp (PID: 2372)
      • nsCABF.tmp (PID: 2340)
      • nsC976.tmp (PID: 3664)
      • nsCC08.tmp (PID: 552)
      • nsCD51.tmp (PID: 1968)
      • nsCE9A.tmp (PID: 3876)
      • nsD276.tmp (PID: 3312)
      • nsD12D.tmp (PID: 2900)
      • nsCFE3.tmp (PID: 420)
      • nsD3BF.tmp (PID: 3872)
      • nsD651.tmp (PID: 2472)
      • nsDB76.tmp (PID: 3700)
      • nsDA2C.tmp (PID: 2880)
      • nsD508.tmp (PID: 3852)
      • nsD8E3.tmp (PID: 4024)
      • nsD79A.tmp (PID: 3048)
      • nsDE08.tmp (PID: 672)
      • nsDCBF.tmp (PID: 1260)
      • nsE32C.tmp (PID: 684)
      • nsE09A.tmp (PID: 1712)
      • nsDF51.tmp (PID: 680)
      • nsE1E3.tmp (PID: 3712)
      • nsE99A.tmp (PID: 2888)
      • nsE5BF.tmp (PID: 3248)
      • nsE475.tmp (PID: 2356)
      • nsE851.tmp (PID: 3748)
      • nsE708.tmp (PID: 2560)
      • nsEAE3.tmp (PID: 3556)
      • nsEC2C.tmp (PID: 832)
      • nsF008.tmp (PID: 1096)
      • nsEEBE.tmp (PID: 2696)
      • nsF151.tmp (PID: 2268)
      • nsF29A.tmp (PID: 1240)
      • nsF3E3.tmp (PID: 2960)
      • nsED75.tmp (PID: 2192)
      • nsF52C.tmp (PID: 860)
      • nsF675.tmp (PID: 2312)
      • nsF7BE.tmp (PID: 2008)
      • nsFA51.tmp (PID: 3920)
      • nsF907.tmp (PID: 3244)
      • nsFCE3.tmp (PID: 2260)
      • nsFB9A.tmp (PID: 2388)
      • nsFE2C.tmp (PID: 2408)
      • nsBE.tmp (PID: 3876)
      • ns207.tmp (PID: 2976)
      • ns350.tmp (PID: 1388)
      • ns49A.tmp (PID: 4076)
      • ns72C.tmp (PID: 3072)
      • nsFF75.tmp (PID: 1996)
      • ns5E3.tmp (PID: 2164)
      • ns875.tmp (PID: 2512)
      • nsC50.tmp (PID: 872)
      • nsEE3.tmp (PID: 452)
      • ns1175.tmp (PID: 676)
      • ns9BE.tmp (PID: 3504)
      • nsB07.tmp (PID: 508)
      • ns102C.tmp (PID: 420)
      • nsD99.tmp (PID: 3104)
      • ns12BE.tmp (PID: 3312)
      • ns1407.tmp (PID: 3660)
      • ns1699.tmp (PID: 1400)
      • ns17E2.tmp (PID: 2476)
      • ns1550.tmp (PID: 2220)
      • ns192C.tmp (PID: 3804)
      • ns1D07.tmp (PID: 1264)
      • ns1A75.tmp (PID: 3800)
      • ns1BBE.tmp (PID: 2212)

    • Reads the computer name

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)

    • Creates files in the user directory

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)

    • Creates a file in a temporary directory

      • 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe (PID: 3068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2016-Jul-09 04:21:41
Detected languages:
  • English - United States
Comments: Duchies Traumatiserede Skags
CompanyName: Finanskoncerner Epiblemata
LegalCopyright: magtapparaternes
OriginalFilename: Quentise.exe

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 200

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 5
TimeDateStamp: 2016-Jul-09 04:21:41
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
4096
24925
25088
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.45023
.rdata
32768
5028
5120
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.163
.data
40960
131896
1536
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.9824
.ndata
176128
212992
0
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc
389120
95384
95744
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.09142

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.82668
67624
UNKNOWN
English - United States
RT_ICON
2
4.10893
9640
UNKNOWN
English - United States
RT_ICON
3
4.42221
4264
UNKNOWN
English - United States
RT_ICON
4
5.11785
3752
UNKNOWN
English - United States
RT_ICON
5
4.57498
2440
UNKNOWN
English - United States
RT_ICON
6
5.69865
2216
UNKNOWN
English - United States
RT_ICON
7
3.52983
1384
UNKNOWN
English - United States
RT_ICON
8
4.86078
1128
UNKNOWN
English - United States
RT_ICON
103
2.89179
118
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
256
Monitored processes
149
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe nsbf1d.tmp no specs powershell.exe no specs nsc076.tmp no specs powershell.exe no specs nsc1bf.tmp no specs powershell.exe no specs nsc308.tmp no specs powershell.exe no specs nsc451.tmp no specs powershell.exe no specs nsc59a.tmp no specs powershell.exe no specs nsc6e4.tmp no specs powershell.exe no specs nsc82d.tmp no specs powershell.exe no specs nsc976.tmp no specs powershell.exe no specs nscabf.tmp no specs powershell.exe no specs nscc08.tmp no specs powershell.exe no specs nscd51.tmp no specs powershell.exe no specs nsce9a.tmp no specs powershell.exe no specs nscfe3.tmp no specs powershell.exe no specs nsd12d.tmp no specs powershell.exe no specs nsd276.tmp no specs powershell.exe no specs nsd3bf.tmp no specs powershell.exe no specs nsd508.tmp no specs powershell.exe no specs nsd651.tmp no specs powershell.exe no specs nsd79a.tmp no specs powershell.exe no specs nsd8e3.tmp no specs powershell.exe no specs nsda2c.tmp no specs powershell.exe no specs nsdb76.tmp no specs powershell.exe no specs nsdcbf.tmp no specs powershell.exe no specs nsde08.tmp no specs powershell.exe no specs nsdf51.tmp no specs powershell.exe no specs nse09a.tmp no specs powershell.exe no specs nse1e3.tmp no specs powershell.exe no specs nse32c.tmp no specs powershell.exe no specs nse475.tmp no specs powershell.exe no specs nse5bf.tmp no specs powershell.exe no specs nse708.tmp no specs powershell.exe no specs nse851.tmp no specs powershell.exe no specs nse99a.tmp no specs powershell.exe no specs nseae3.tmp no specs powershell.exe no specs nsec2c.tmp no specs powershell.exe no specs nsed75.tmp no specs powershell.exe no specs nseebe.tmp no specs powershell.exe no specs nsf008.tmp no specs powershell.exe no specs nsf151.tmp no specs powershell.exe no specs nsf29a.tmp no specs powershell.exe no specs nsf3e3.tmp no specs powershell.exe no specs nsf52c.tmp no specs powershell.exe no specs nsf675.tmp no specs powershell.exe no specs nsf7be.tmp no specs powershell.exe no specs nsf907.tmp no specs powershell.exe no specs nsfa51.tmp no specs powershell.exe no specs nsfb9a.tmp no specs powershell.exe no specs nsfce3.tmp no specs powershell.exe no specs nsfe2c.tmp no specs powershell.exe no specs nsff75.tmp no specs powershell.exe no specs nsbe.tmp no specs powershell.exe no specs ns207.tmp no specs powershell.exe no specs ns350.tmp no specs powershell.exe no specs ns49a.tmp no specs powershell.exe no specs ns5e3.tmp no specs powershell.exe no specs ns72c.tmp no specs powershell.exe no specs ns875.tmp no specs powershell.exe no specs ns9be.tmp no specs powershell.exe no specs nsb07.tmp no specs powershell.exe no specs nsc50.tmp no specs powershell.exe no specs nsd99.tmp no specs powershell.exe no specs nsee3.tmp no specs powershell.exe no specs ns102c.tmp no specs powershell.exe no specs ns1175.tmp no specs powershell.exe no specs ns12be.tmp no specs powershell.exe no specs ns1407.tmp no specs powershell.exe no specs ns1550.tmp no specs powershell.exe no specs ns1699.tmp no specs powershell.exe no specs ns17e2.tmp no specs powershell.exe no specs ns192c.tmp no specs powershell.exe no specs ns1a75.tmp no specs powershell.exe no specs ns1bbe.tmp no specs powershell.exe no specs ns1d07.tmp no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3068"C:\Users\admin\AppData\Local\Temp\30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe" C:\Users\admin\AppData\Local\Temp\30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe
Explorer.EXE
User:
admin
Company:
Finanskoncerner Epiblemata
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1116"C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsBF1D.tmp" powershell.exe 0xF8008EA4 -bxor -1287267094C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsBF1D.tmp—30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqbf1c.tmp\nsbf1d.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3708powershell.exe 0xF8008EA4 -bxor -1287267094C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—nsBF1D.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1616"C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsC076.tmp" powershell.exe 0xF609EFD8 -bxor -1287267094C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsC076.tmp—30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqbf1c.tmp\nsc076.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2240powershell.exe 0xF609EFD8 -bxor -1287267094C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—nsC076.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\atl.dll
c:\windows\system32\gdi32.dll
2464"C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsC1BF.tmp" powershell.exe 0x897F9F98 -bxor -1287267094C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsC1BF.tmp—30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqbf1c.tmp\nsc1bf.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2668powershell.exe 0x897F9F98 -bxor -1287267094C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—nsC1BF.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\gdi32.dll
3116"C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsC308.tmp" powershell.exe 0xD624A88F -bxor -1287267094C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsC308.tmp—30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqbf1c.tmp\nsc308.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
3188powershell.exe 0xD624A88F -bxor -1287267094C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—nsC308.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2432"C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsC451.tmp" powershell.exe 0xF52CB08F -bxor -1287267094C:\Users\admin\AppData\Local\Temp\nsqBF1C.tmp\nsC451.tmp—30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsqbf1c.tmp\nsc451.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
39 705
Read events
39 122
Write events
0
Delete events
0

Modification events

No data
Executable files
77
Suspicious files
149
Text files
19
Unknown types
3

Dropped files

PID
Process
Filename
Type
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Stvnemdernes20\Rajoguna\Seepages.Lut150text
MD5:8B8D10D0EF083915F157643B0D46F47D
SHA256:FEB68C4FC3B96FAE55DF43063A23B2729E0EB3E8B6829B59F31E9317156C087E
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Slippes2.lnklnk
MD5:7F6F8E648072ABE383E728DB2A162861
SHA256:53ECEA9458DD8012725BEE3722C8A60E9BADA3AD64C607D0482BADF97B9C0AB3
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\anordn.lnklnk
MD5:686B3279718C57247DAEA7170DF8F102
SHA256:F9F731EFC139EB50217110AD48A35F479B2B635D4FC6E6FB668469E2C7EACFEA
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Stvnemdernes20\Rajoguna\albaers\edit-redo-rtl.pngimage
MD5:48A5B42ABBC493498865087F9D407668
SHA256:8F99A89C10C819F5A476DE32A247A7BDB89A5751D0516BC75E666BB8A9D6232C
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Stvnemdernes20\Rajoguna\Ridderbegrebets\Nuncupate\Diskless\Fyringsanlg\SysTool.dllexecutable
MD5:4C39B55B8E8E26CC515AB8C72460036A
SHA256:456C8625C1211495C02C516589F7F6D655C328E649DF1FE5D42771A82E2C9290
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Stvnemdernes20\Rajoguna\Furore.Sambinary
MD5:764B9D76BD551DC7DFEA1FA1CDF86024
SHA256:F4C155AC15B7C4A073DDD3CC1C86B973346BAA87AF9D8ABE5ED5054B92DE118F
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Stvnemdernes20\Rajoguna\Adventure_5.bmpimage
MD5:7BE64DC3AE1391E20FFCFF3C4C745D85
SHA256:C8CE3513DDA0A68D3573A33390C7DFA7AEB68D668271FEB455FA4FEAD8494BFC
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Stvnemdernes20\Rajoguna\krabber\input-dialpad-symbolic.svgimage
MD5:5962EAF3FCC1E65C4AAE4FD4BC3C2BDC
SHA256:DA00272A04F9705429148A623720F14CCCD36893AAE1F00D6EA9885922950720
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Stvnemdernes20\Rajoguna\Forumets\Dolbysystemerne\Tenderometres\orientation-portrait-left-symbolic.svgimage
MD5:E4BF336E381C86A8BE44316CAB4E3FAA
SHA256:F8DD3CE92A43BDC322041F9864608EEC3C4413C8ABE04B14AC4B63F6FBC4F0F0
306830a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Stvnemdernes20\Rajoguna\Ridderbegrebets\Nuncupate\Diskless\Fyringsanlg\battery-level-0-symbolic.symbolic.pngimage
MD5:8126688C9FBFDD9F0959A1435E06F341
SHA256:E6A5DAC292EEFD8F2644264B020FCB9FDA0F0CBA2AFCC132E15E59D102EEB07B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
30a531daa107c2ac749e111d5f8f7ce4c4dfe9ca6e36b7ef26ff1e7048219cd3