File name: | dsadsa.bat |
Full analysis: | https://app.any.run/tasks/799a3a8f-b4db-490d-b926-38e607259d67 |
Verdict: | Malicious activity |
Analysis date: | November 08, 2019, 17:06:05 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/x-msdos-batch |
File info: | DOS batch file, ASCII text, with CRLF line terminators |
MD5: | 00A79AE5340C3D9A150338695B9086CC |
SHA1: | A109C42E66592E104AA9577FC67F967DD23A4375 |
SHA256: | 32A0AE905D8D425E30C3728E62A94D346BC74103474237D5A543A227460DB47F |
SSDEEP: | 48:sumexJsbcBKOXblzymJoT8F3egRquEIpz9kxeTKBS:meEIB9qgdePexjeQ |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2232 | cmd /c ""C:\Users\admin\AppData\Local\Temp\dsadsa.bat" " | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
272 | C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1528 | subst ': "C:\Users\admin\AppData\Local\Temp" | C:\Windows\system32\subst.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Subst Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2248 | findstr /a:0E /f:colorPrint.txt "." | C:\Windows\system32\findstr.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3776 | C:\Windows\system32\cmd.exe /c "prompt $H&for %B in (1) do rem" | C:\Windows\system32\cmd.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
4000 | subst ': "C:\Users\admin\AppData\Local\Temp" | C:\Windows\system32\subst.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Subst Utility Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
492 | findstr /a:0E /f:colorPrint.txt "." | C:\Windows\system32\findstr.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
1848 | findstr /a:0E "." "\'" nul | C:\Windows\system32\findstr.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3628 | findstr /a:0E /f:colorPrint.txt "." | C:\Windows\system32\findstr.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3576 | findstr /a:0E "." "/.\'" nul | C:\Windows\system32\findstr.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Find String (QGREP) Utility Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
2232 | cmd.exe | C:\Users\admin\AppData\Local\Temp\colorPrint.txt | text | |
MD5:1B32166FC5BABE2E5D215763B2F069A0 | SHA256:A454CF1DADD0704A702F0DC0FA2399E0EB349F61F633240EA31DE26CF3B61F4D | |||
2232 | cmd.exe | C:\Users\admin\AppData\Local\Temp\' | binary | |
MD5:5058F1AF8388633F609CADB75A75DC9D | SHA256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8 |