File name:

arr.ps1

Full analysis: https://app.any.run/tasks/246f9780-9548-4332-acdb-554d5aad588b
Verdict: Malicious activity
Analysis date: December 14, 2024, 12:17:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text
MD5:

98C71724C54E16AD3A7C825067DBF6FB

SHA1:

1046F0CEED5287312FE72F65319F3E12DC0321AE

SHA256:

4B575BB18A886CD5021FDA088784912B3C6FE5EFDBCE5024072CE0994021ADC2

SSDEEP:

24:CgiZod7a40qK0+LwgCbV8TovK2IPeCz5y8V1em7c:ZBd+rqvgsXvK7PPNy8Pc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Modifies registry (POWERSHELL)

      • powershell.exe (PID: 6376)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6376)

  • SUSPICIOUS

    • Changes the desktop background image

      • powershell.exe (PID: 6376)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6376)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 6376)

  • INFO

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 6376)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6376"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\arr.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
6384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 576
Read events
4 574
Write events
2
Delete events
0

Modification events

(PID) Process:(6376) powershell.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:Wallpaper
Value:
(PID) Process:(6376) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes
Operation:writeName:CurrentTheme
Value:
C:\Windows\Resources\Themes\Aero.theme
Executable files
0
Suspicious files
4
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
6376powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF135f3a.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6376powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tx2jgqts.ms4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6376powershell.exeC:\Users\admin\Desktop\arr.ps1text
MD5:D807D4184A2A4D8989C4484A2B04F980
SHA256:084995438EACCD27E7A5D0D7338CC1C880BB9ACB236ADC5653C89AAB257E5246
6376powershell.exeC:\Users\admin\Desktop\churchlogin.rtftext
MD5:EB35B41FE95C51E4886984F6611254BE
SHA256:DAAC46C47655957DA5D6570365CD1A62631438C721993F6C19CDD8553FEB1B24
6376powershell.exeC:\Users\admin\Desktop\businesscold.rtftext
MD5:47AA4161F08418F85ABAEAAE805D0795
SHA256:D84F4D776100D1D7B1DF834CBC39DAA34D3A5D199630E050493A110646CFFD2A
6376powershell.exeC:\Users\admin\Desktop\effectit.rtftext
MD5:AE5C4886D0BB7A6BCE4CE2103DB94A1F
SHA256:7BF02A2F9710ED7A1F93078C9DF47486156060FA3E01DE60319634316F96E108
6376powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LOMOERPIX4AV5LGJITHX.tempbinary
MD5:2DCF12ADD6F36F7EAFCA4BB3A72F3570
SHA256:4021F5A4A7DCDFFC1D94EC83F196D2C0741487C044CE967B7DCB8BC59F433DB6
6376powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:2DCF12ADD6F36F7EAFCA4BB3A72F3570
SHA256:4021F5A4A7DCDFFC1D94EC83F196D2C0741487C044CE967B7DCB8BC59F433DB6
6376powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:EB269EFB52335B48ECFC5308B4649F13
SHA256:3AEAED6DE616DC97425FBFF50D8F2AFF92C328262C0CAACDC9D7AC4AAC597666
6376powershell.exeC:\Users\admin\Desktop\pressuresomeone.jpgtext
MD5:EC20F622485C04DC4047F0DF5D4749BF
SHA256:21932FB958D1FBF75503D7E453373D86E987458868D7DAD48FC88F2A5E777FDE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5964
RUXIMICS.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5964
RUXIMICS.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1488
svchost.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1488
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5964
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.21.110.146:443
www.bing.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5964
RUXIMICS.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5964
RUXIMICS.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.21.110.146
  • 2.21.110.139
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.138
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
self.events.data.microsoft.com
  • 51.132.193.105
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
arr.ps1