File name:

payload.ps1

Full analysis: https://app.any.run/tasks/c122df9a-70aa-4c3b-a031-a11bd09275fe
Verdict: Malicious activity
Analysis date: December 02, 2023, 03:48:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

BF1DA2CDD450782FF946066C6BDC3E7F

SHA1:

49D6E384A9A8EF8D54F7D20A025D08F7E42F9440

SHA256:

53A7733AC88C21C33A7D93DFF3C396B0B216E548E4B1709390DDAF8A9FE21A5D

SSDEEP:

192:BxN1zCIhmOCR9yfWXzuAxuQXiZoEn4K++o5LLcjXXDzC59f04g:BxbzsfGYzuA0eiGK+/cbDS84g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • powershell.exe (PID: 3060)
      • powershell.exe (PID: 3664)
      • powershell.exe (PID: 3236)

    • Drops the executable file immediately after the start

      • csc.exe (PID: 4032)
      • csc.exe (PID: 3380)
      • csc.exe (PID: 968)

  • SUSPICIOUS

    • Uses .NET C# to load dll

      • powershell.exe (PID: 3060)
      • powershell.exe (PID: 3664)
      • powershell.exe (PID: 3236)

    • Reads the Internet Settings

      • powershell.exe (PID: 3060)
      • dw20.exe (PID: 1884)
      • powershell.exe (PID: 3664)
      • powershell.exe (PID: 3236)
      • dw20.exe (PID: 3860)

    • Powershell version downgrade attack

      • powershell.exe (PID: 3060)
      • powershell.exe (PID: 3664)
      • powershell.exe (PID: 3236)

    • The process creates files with name similar to system file names

      • dw20.exe (PID: 1884)
      • dw20.exe (PID: 1420)
      • dw20.exe (PID: 3860)

  • INFO

    • Create files in a temporary directory

      • csc.exe (PID: 4032)
      • cvtres.exe (PID: 1228)
      • dw20.exe (PID: 1884)
      • csc.exe (PID: 3380)
      • cvtres.exe (PID: 1452)
      • csc.exe (PID: 968)
      • cvtres.exe (PID: 2488)
      • dw20.exe (PID: 3860)

    • Checks supported languages

      • csc.exe (PID: 4032)
      • cvtres.exe (PID: 1228)
      • dw20.exe (PID: 1884)
      • wmpnscfg.exe (PID: 1560)
      • csc.exe (PID: 3380)
      • cvtres.exe (PID: 1452)
      • csc.exe (PID: 968)
      • cvtres.exe (PID: 2488)
      • dw20.exe (PID: 3860)
      • dw20.exe (PID: 1420)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 4032)
      • cvtres.exe (PID: 1228)
      • dw20.exe (PID: 1884)
      • cvtres.exe (PID: 1452)
      • csc.exe (PID: 3380)
      • csc.exe (PID: 968)
      • cvtres.exe (PID: 2488)
      • dw20.exe (PID: 1420)
      • dw20.exe (PID: 3860)

    • Reads the computer name

      • dw20.exe (PID: 1884)
      • wmpnscfg.exe (PID: 1560)
      • dw20.exe (PID: 1420)
      • dw20.exe (PID: 3860)

    • Reads Environment values

      • dw20.exe (PID: 1884)
      • dw20.exe (PID: 3860)

    • Reads product name

      • dw20.exe (PID: 1884)
      • dw20.exe (PID: 3860)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1560)
      • explorer.exe (PID: 1988)
      • powershell.exe (PID: 3664)
      • powershell.exe (PID: 3236)

    • Creates files or folders in the user directory

      • dw20.exe (PID: 1884)
      • dw20.exe (PID: 1420)
      • dw20.exe (PID: 3860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start powershell.exe csc.exe cvtres.exe no specs dw20.exe wmpnscfg.exe no specs explorer.exe no specs powershell.exe csc.exe cvtres.exe no specs dw20.exe no specs powershell.exe csc.exe cvtres.exe no specs dw20.exe

Process information

PID
CMD
Path
Indicators
Parent process
968"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ddruh6is.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1228C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES66DD.tmp" "c:\Users\admin\AppData\Local\Temp\CSC66DC.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1420dw20.exe -x -s 1128C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1452C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESD62C.tmp" "c:\Users\admin\AppData\Local\Temp\CSCD61C.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
1560"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1884dw20.exe -x -s 1124C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.5483 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
1988"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2488C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESEF90.tmp" "c:\Users\admin\AppData\Local\Temp\CSCEF8F.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.5003 (Win7SP1GDR.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
3060"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\payload.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
3221225477
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3236"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\payload.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
3221225477
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
6 487
Read events
6 288
Write events
199
Delete events
0

Modification events

(PID) Process:(3060) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3060) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3060) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3060) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3060) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1884) dw20.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles
Operation:writeName:FirstLevelConsentDialog
Value:
7603050000000000
(PID) Process:(1884) dw20.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles
Operation:writeName:FirstLevelConsentDialog
Value:
7603050000000000
(PID) Process:(1884) dw20.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\Windows Error Reporting\Debug
Operation:writeName:StoreLocation
Value:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aga.exe_b1af04294ac80144576abfc50b4daa16fd011ca_cab_059b2052
(PID) Process:(1884) dw20.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\Debug
Operation:writeName:StoreLocation
Value:
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aga.exe_b1af04294ac80144576abfc50b4daa16fd011ca_cab_059b2052
(PID) Process:(3664) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
3
Suspicious files
18
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
1884dw20.exeC:\Users\admin\AppData\Local\Temp\WER78DA.tmp.hdmp —
MD5:—
SHA256:—
1884dw20.exeC:\Users\admin\AppData\Local\Temp\WER7BD8.tmp.mdmp —
MD5:—
SHA256:—
1884dw20.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_powershell.exe_cb8d6d0786374a16528c922639dcb6afd07427_cab_077d7d0f\WER78DA.tmp.hdmp —
MD5:—
SHA256:—
1884dw20.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_powershell.exe_cb8d6d0786374a16528c922639dcb6afd07427_cab_077d7d0f\WER7BD8.tmp.mdmp —
MD5:—
SHA256:—
1884dw20.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_powershell.exe_cb8d6d0786374a16528c922639dcb6afd07427_cab_077d7d0f\Report.wer —
MD5:—
SHA256:—
3060powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF206507.TMPbinary
MD5:16F6D260068B85896C0EBB2E1B2A60D1
SHA256:6E3B1EF1FB4736A9BF18FADF8E42935CC5053478B6F403A38EFBA8500E819984
3060powershell.exeC:\Users\admin\AppData\Local\Temp\nk8y4wqt.cmdlinetext
MD5:8BF73D7E130B82DC6971931FD8537279
SHA256:F5DAF2E665DD763A4A8758682710F099467039CFA60F7CE557E6E87F84BC3842
4032csc.exeC:\Users\admin\AppData\Local\Temp\nk8y4wqt.pdbbinary
MD5:A253AF81D0A3286C5AC2CCB5E937BCF2
SHA256:6C4BD9E2D5C28FC6065FF13919C9D741E3EF207B2AA11F9D815E6DBD561AC351
1420dw20.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_powershell.exe_c2457a4441ef89a47289f7282c6d69d33928_05addf53\Report.wer —
MD5:—
SHA256:—
1884dw20.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\AppCrash_powershell.exe_cb8d6d0786374a16528c922639dcb6afd07427_cab_077d7d0f\WER7639.tmp.WERInternalMetadata.xmlxml
MD5:3BDD6E08B2CBC5D4E3BDF8501593A0CC
SHA256:BE6C23A6465E77A10E66A893E2428375D3D1B2D74AA31105776126F768D2C782
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
3
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1884
dw20.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3860
dw20.exe
104.208.16.93:443
watson.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
watson.microsoft.com
  • 104.208.16.93
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

No threats detected
Process
Message
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
payload.ps1