File name:

arr.ps1

Full analysis: https://app.any.run/tasks/246f9780-9548-4332-acdb-554d5aad588b
Verdict: Malicious activity
Analysis date: December 14, 2024, 12:17:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text
MD5:

98C71724C54E16AD3A7C825067DBF6FB

SHA1:

1046F0CEED5287312FE72F65319F3E12DC0321AE

SHA256:

4B575BB18A886CD5021FDA088784912B3C6FE5EFDBCE5024072CE0994021ADC2

SSDEEP:

24:CgiZod7a40qK0+LwgCbV8TovK2IPeCz5y8V1em7c:ZBd+rqvgsXvK7PPNy8Pc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6376)

    • Modifies registry (POWERSHELL)

      • powershell.exe (PID: 6376)

  • SUSPICIOUS

    • Changes the desktop background image

      • powershell.exe (PID: 6376)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6376)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 6376)

  • INFO

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6376)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 6376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
121
Monitored processes
2
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6376"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\arr.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
6384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 576
Read events
4 574
Write events
2
Delete events
0

Modification events

(PID) Process:(6376) powershell.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:Wallpaper
Value:
(PID) Process:(6376) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Themes
Operation:writeName:CurrentTheme
Value:
C:\Windows\Resources\Themes\Aero.theme
Executable files
0
Suspicious files
4
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
6376powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:2DCF12ADD6F36F7EAFCA4BB3A72F3570
SHA256:4021F5A4A7DCDFFC1D94EC83F196D2C0741487C044CE967B7DCB8BC59F433DB6
6376powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LOMOERPIX4AV5LGJITHX.tempbinary
MD5:2DCF12ADD6F36F7EAFCA4BB3A72F3570
SHA256:4021F5A4A7DCDFFC1D94EC83F196D2C0741487C044CE967B7DCB8BC59F433DB6
6376powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF135f3a.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6376powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tx2jgqts.ms4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6376powershell.exeC:\Users\admin\Desktop\demandher.rtftext
MD5:9F27F838AC207D2F6B7834B9D083B210
SHA256:8F893F83CAC5A7BA50E45091595BB5A338E1F458913A4405B4E030595EC00A45
6376powershell.exeC:\Users\admin\Desktop\meaninteresting.rtftext
MD5:91A4FD6D60DAD7FFD1754A15F46042BD
SHA256:7AD5E935FB5257C913AA3473EDA6A8B3AD948285386D75154B055ED3FD09A910
6376powershell.exeC:\Users\admin\Desktop\pressuresomeone.jpgtext
MD5:EC20F622485C04DC4047F0DF5D4749BF
SHA256:21932FB958D1FBF75503D7E453373D86E987458868D7DAD48FC88F2A5E777FDE
6376powershell.exeC:\Users\admin\Desktop\businesscold.rtftext
MD5:47AA4161F08418F85ABAEAAE805D0795
SHA256:D84F4D776100D1D7B1DF834CBC39DAA34D3A5D199630E050493A110646CFFD2A
6376powershell.exeC:\Users\admin\Desktop\unlessforeign.rtftext
MD5:3137B0611935ACA558F2D337756EE9DD
SHA256:DE8540BA24941040884896071F30F39837C5FA171F75144311B6D39507BD045F
6376powershell.exeC:\Users\admin\Desktop\gradeelectric.pngtext
MD5:C8EBF6D58A5B134A6092A6F342F38018
SHA256:884AEFFE0FC436DB2E3D90E09B2C22C898EADF36023C3DEE2442EDF2860A7C8C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1488
svchost.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5964
RUXIMICS.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5964
RUXIMICS.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1488
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5964
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.21.110.146:443
www.bing.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5964
RUXIMICS.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5964
RUXIMICS.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
www.bing.com
  • 2.21.110.146
  • 2.21.110.139
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.138
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
self.events.data.microsoft.com
  • 51.132.193.105
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
arr.ps1