We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
24 January 2025, 00:46
Analysis environment:
Windows 10 Pro, build 19045, x64
https://microsoft.teams-live.com/en/index.html?msclkid=624d2bd6f228126bcc664c47b2293aea
MD5:
6726D898859804EE1F06D52CC961C37E
SHA1:
DDECF631D6898C72CB937C74A31712E96C41A101
SHA256:
39F66690AAE07BF9F1F4A5470409F187AFF4EB3CD4A1A9CE6B76E88C263A5ADB
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis https://microsoft.teams-live.com/en/index.html?msclkid=624d2bd6f228126bcc664c47b2293aea Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Gets information about running processes via WMI (SCRIPT)
wscript.exe (PID: 6012)
Execute application with conhost.exe as parent process
powershell.exe (PID: 7380)
SUSPICIOUS
The process executes JS scripts
msedge.exe (PID: 6380)
Executed via WMI
conhost.exe (PID: 7352)
Creates an object to access WMI (SCRIPT)
wscript.exe (PID: 6012)
Starts POWERSHELL.EXE for commands execution
conhost.exe (PID: 7352)
INFO
Checks supported languages
identity_helper.exe (PID: 7784)
identity_helper.exe (PID: 4672)
The process uses the downloaded file
iexplore.exe (PID: 6164)
msedge.exe (PID: 7248)
msedge.exe (PID: 6380)
Reads Environment values
identity_helper.exe (PID: 7784)
identity_helper.exe (PID: 4672)
Reads the computer name
identity_helper.exe (PID: 7784)
identity_helper.exe (PID: 4672)
Reads Microsoft Office registry keys
msedge.exe (PID: 6380)
Disables trace logs
powershell.exe (PID: 7380)
Script raised an exception (POWERSHELL)
powershell.exe (PID: 7380)
Checks proxy server information
powershell.exe (PID: 7380)
Application launched itself
msedge.exe (PID: 3836)
msedge.exe (PID: 6380)
Manual execution by a user
notepad.exe (PID: 3820)
Executable content was dropped or overwritten
msedge.exe (PID: 6424)
The sample compiled with english language support
msedge.exe (PID: 6424)
Reads security settings of Internet Explorer
notepad.exe (PID: 3820)
Failed to connect to remote server (POWERSHELL)
powershell.exe (PID: 7380)
Threats
PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile