analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Archivo_c.cmd

Full analysis: https://app.any.run/tasks/4e8c1a47-892d-4ed8-96da-b8e80a1b6041
Verdict: Malicious activity
Analysis date: March 14, 2019, 21:33:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

7C49FF9A353343D96815757771A0E84D

SHA1:

ACF150F95354BC95BCEA006BBF7798A0F9739E93

SHA256:

4587E1A9C5ECFCF8C961E003BC36C672857FC5A1C998BE789C4BA414994D4B0E

SSDEEP:

96:WTxrjlQeBjCdFoHPt6FoH8zjGvahlpjfiPk2pCj7fj6jXhLJ4puP2:WFlQ2jwFoHPUFoH8z6va2N4vi9/2

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • hAY_fgk.exe (PID: 3124)
      • hAY_fgk.exe (PID: 3500)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2908)

    • Changes settings of System certificates

      • wscript.exe (PID: 2064)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1724)
      • hAY_fgk.exe (PID: 3124)
      • hAY_fgk.exe (PID: 3500)

  • SUSPICIOUS

    • Creates files in the user directory

      • wscript.exe (PID: 2064)

    • Uses WMIC.EXE to create a new process

      • wscript.exe (PID: 2064)

    • Executes scripts

      • cmd.exe (PID: 2908)

    • Executable content was dropped or overwritten

      • wscript.exe (PID: 2064)

    • Adds / modifies Windows certificates

      • wscript.exe (PID: 2064)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2064)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • wscript.exe (PID: 2064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
8
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs ping.exe no specs wscript.exe wmic.exe no specs hay_fgk.exe no specs searchprotocolhost.exe no specs cmd.exe no specs hay_fgk.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2908cmd /c ""C:\Users\admin\AppData\Local\Temp\Archivo_c.cmd" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3728ping 127.0.0.1 -n 1 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2064wscript //Nologo "C:\Users\admin\admin\admin.vbs" t6LevwOojGHcGSntDM7EI9cvnd0wo3FjR3h8yq C:\Windows\system32\wscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2732"C:\Windows\System32\wbem\WMIC.exe" process call create C:\Users\admin\hAY_fgk\hAY_fgk.exeC:\Windows\System32\wbem\WMIC.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3124C:\Users\admin\hAY_fgk\hAY_fgk.exeC:\Users\admin\hAY_fgk\hAY_fgk.exe—wmiprvse.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NVIDIA Smart Maximise Helper Host
Version:
6.14.10.100.03
1724"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe6_ Global\UsGthrCtrlFltPipeMssGthrPipe6 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3360"C:\Windows\system32\cmd.exe" /c start C:\Users\admin\hAY_fgk\hAY_fgk.exeC:\Windows\system32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3500C:\Users\admin\hAY_fgk\hAY_fgk.exe C:\Users\admin\hAY_fgk\hAY_fgk.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NVIDIA Smart Maximise Helper Host
Exit code:
0
Version:
6.14.10.100.03
Total events
876
Read events
836
Write events
37
Delete events
3

Modification events

(PID) Process:(1724) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1724) SearchProtocolHost.exeKey:HKEY_USERS\.DEFAULT\Software\Classes\Local Settings\MuiCache\5F\52C64B7E
Operation:writeName:@C:\Windows\System32\wshext.dll,-4802
Value:
VBScript Script File
(PID) Process:(2064) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wscript_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2064) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wscript_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2064) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wscript_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2064) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wscript_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2064) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wscript_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2064) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wscript_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2064) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wscript_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2064) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\wscript_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
3
Suspicious files
6
Text files
68
Unknown types
1

Dropped files

PID
Process
Filename
Type
2908cmd.exeC:\Users\admin\admin\admin.vbstext
MD5:DA2298E2DA54B5A08F00249AB7DEEF73
SHA256:2CACF3B7B615E979FBC5C3D7817CF1FA97CB85187E66A15703C5370516FE483D
2064wscript.exeC:\Users\admin\AppData\Local\Temp\CabEF09.tmp —
MD5:—
SHA256:—
2064wscript.exeC:\Users\admin\AppData\Local\Temp\TarEF0A.tmp —
MD5:—
SHA256:—
2064wscript.exeC:\Users\admin\AppData\Local\Temp\CabEF2B.tmp —
MD5:—
SHA256:—
2064wscript.exeC:\Users\admin\AppData\Local\Temp\TarEF2C.tmp —
MD5:—
SHA256:—
2064wscript.exeC:\Users\admin\AppData\Local\Temp\CabEFD8.tmp —
MD5:—
SHA256:—
2064wscript.exeC:\Users\admin\AppData\Local\Temp\TarEFD9.tmp —
MD5:—
SHA256:—
2064wscript.exeC:\Users\admin\hAY_fgk\WPA4V0CPZ8OET10ZIM0WKC1PLARGFQZKJKUZTDA —
MD5:—
SHA256:—
2064wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\y169[1].zipcompressed
MD5:888669F533239E103373FA5F1192E7E5
SHA256:19FE575FDE25E59AB60419CA075A49A440A5A8B378258FC101E660201E516B93
2064wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015compressed
MD5:02C1120F28378FD32B58CEC3BB9458C2
SHA256:F3C77083FE5D71225CEEA0337E819ED7049E2A5692E6C662C5A0EAA97DB3DFF9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2064
wscript.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
2064
wscript.exe
GET
200
205.185.216.10:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/47BEABC922EAE80E78783462A79F45C254FDE68B.crt
US
der
969 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2064
wscript.exe
205.185.216.10:80
www.download.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2064
wscript.exe
132.148.244.194:443
politecnicointernacional.edu.co
GoDaddy.com, LLC
US
unknown

DNS requests

Domain
IP
Reputation
politecnicointernacional.edu.co
  • 132.148.244.194
unknown
www.download.windowsupdate.com
  • 205.185.216.10
  • 205.185.216.10
  • 205.185.216.42
  • 205.185.216.10
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Archivo_c.cmd