File name:

Untitled.txt

Full analysis: https://app.any.run/tasks/02c31bb3-7e60-41c0-8e0d-709e1e01e483
Verdict: Malicious activity
Analysis date: January 24, 2025, 06:45:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: text/plain
File info: ASCII text
MD5:

124EBA15058065C5A118E981057AA83D

SHA1:

6077A09D2C3744CED2C451B97EC2867F447CB846

SHA256:

5BD520FD43EC8E2C3BBA6CAAB359A3D6C7BAA5D24F60402727C6A1638A734A90

SSDEEP:

96:DEj4LW/kQfbcM6ZTKeCDuOo2E3NB6seju:1LWcQfoBTKpztEd7ey

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 236)

  • SUSPICIOUS

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 6552)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 6552)
      • powershell.exe (PID: 236)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 236)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 236)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 236)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 236)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 236)

  • INFO

    • Create files in a temporary directory

      • csc.exe (PID: 6552)
      • cvtres.exe (PID: 6624)

    • Checks supported languages

      • csc.exe (PID: 6552)
      • cvtres.exe (PID: 6624)
      • ISDbg.exe (PID: 7112)
      • ISDbg.exe (PID: 736)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 6552)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 236)

    • Disables trace logs

      • powershell.exe (PID: 236)

    • The sample compiled with english language support

      • powershell.exe (PID: 236)

    • Checks proxy server information

      • powershell.exe (PID: 236)

    • The executable file from the user directory is run by the Powershell process

      • ISDbg.exe (PID: 7112)
      • ISDbg.exe (PID: 736)

    • Reads the computer name

      • ISDbg.exe (PID: 7112)
      • ISDbg.exe (PID: 736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs isdbg.exe no specs isdbg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\Untitled.txt.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Users\admin\AppData\Local\Temp\extract12_6165\ISDbg.exe" -ExecutionPolicy Bypass C:\Users\admin\AppData\Local\Temp\extract12_6165\ISDbg.exe—powershell.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) Script Debugger
Exit code:
0
Version:
30.0.157
Modules
Images
c:\users\admin\appdata\local\temp\extract12_6165\isdbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6552"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\upl0sl4z.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
6624C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES803F.tmp" "c:\Users\admin\AppData\Local\Temp\CSC6C564F66B79F4FAF8BDE256646D086D.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
7112"C:\Users\admin\AppData\Local\Temp\extracted4_9780\ISDbg.exe" -ExecutionPolicy Bypass C:\Users\admin\AppData\Local\Temp\extracted4_9780\ISDbg.exe—powershell.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) Script Debugger
Exit code:
0
Version:
30.0.157
Modules
Images
c:\users\admin\appdata\local\temp\extracted4_9780\isdbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
6 579
Read events
6 579
Write events
0
Delete events
0

Modification events

No data
Executable files
13
Suspicious files
12
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
236powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_r10mdidd.gsv.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1GG5U0QXD8ESXIUWLOXE.tempbinary
MD5:9F0CC3C548F15ECC4AA03531D4124B91
SHA256:1ACEFB47A7BE05BF1D79EFF77182E365E74ECE9EB0D12C11E485209DF82D6506
236powershell.exeC:\Users\admin\AppData\Local\Temp\upl0sl4z.cmdlinetext
MD5:B9E3504EF8A356DB1B4A126D6D2250AF
SHA256:206C36955F1B3D71C7E8029B1C813873F9A436D8370CF1BAC384E0B514482CE6
236powershell.exeC:\Users\admin\AppData\Local\Temp\upl0sl4z.0.cstext
MD5:61C8EFABA2783745F312409E9781ACE5
SHA256:94AE7A0BB45E6F9DCDFB159C05223E407D76DD71F26E74B6651DA1D0DF71BD39
236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:9F0CC3C548F15ECC4AA03531D4124B91
SHA256:1ACEFB47A7BE05BF1D79EFF77182E365E74ECE9EB0D12C11E485209DF82D6506
236powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_t3s1yuzy.1b3.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
236powershell.exeC:\Users\admin\AppData\Local\Temp\extracted4_9780\ISDbg.exeexecutable
MD5:7AA89907DB887D701309CB9CE0B24114
SHA256:40C88A5620A651B6AF283DFF83C4DA997782784DA7F85B94FC9B6C02A28862E7
6552csc.exeC:\Users\admin\AppData\Local\Temp\upl0sl4z.dllexecutable
MD5:AC7516FB34F6521F512BC812FF863774
SHA256:0F04F74B75F91A15F98F81F3E00D7023DD8476E22AC8D2E37DF723FF98DF7240
6552csc.exeC:\Users\admin\AppData\Local\Temp\upl0sl4z.outtext
MD5:D7D5D6BD33658A4B2EAA02C763DE82D4
SHA256:34E0F33CECA8CE217FB4B6FFE310F8158F09596F0EDA0A70EAD118D701A7D0FE
236powershell.exeC:\Users\admin\AppData\Local\Temp\download1.zipcompressed
MD5:416CEFBAC01DAA47A3133387922C27D7
SHA256:13050FEC2F25EA840ADE2C06CA29514548F3F301029574483962F887F30A0DB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
35
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2220
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2220
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7140
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7140
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6780
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2220
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2220
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.16.204.134:443
—
Akamai International B.V.
DE
unknown
2220
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
236
powershell.exe
104.21.48.1:443
easypath.cyou
CLOUDFLARENET
—
unknown
5064
SearchApp.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
easypath.cyou
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.64.1
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.80.1
  • 104.21.32.1
unknown
ocsp.digicert.com
  • 184.30.131.245
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Untitled.txt