File name:

Untitled.txt

Full analysis: https://app.any.run/tasks/02c31bb3-7e60-41c0-8e0d-709e1e01e483
Verdict: Malicious activity
Analysis date: January 24, 2025, 06:45:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: text/plain
File info: ASCII text
MD5:

124EBA15058065C5A118E981057AA83D

SHA1:

6077A09D2C3744CED2C451B97EC2867F447CB846

SHA256:

5BD520FD43EC8E2C3BBA6CAAB359A3D6C7BAA5D24F60402727C6A1638A734A90

SSDEEP:

96:DEj4LW/kQfbcM6ZTKeCDuOo2E3NB6seju:1LWcQfoBTKpztEd7ey

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 236)

  • SUSPICIOUS

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 6552)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 236)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 236)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 236)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 236)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 6552)
      • powershell.exe (PID: 236)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 236)

  • INFO

    • Checks supported languages

      • csc.exe (PID: 6552)
      • cvtres.exe (PID: 6624)
      • ISDbg.exe (PID: 7112)
      • ISDbg.exe (PID: 736)

    • Create files in a temporary directory

      • csc.exe (PID: 6552)
      • cvtres.exe (PID: 6624)

    • The sample compiled with english language support

      • powershell.exe (PID: 236)

    • Reads the computer name

      • ISDbg.exe (PID: 7112)
      • ISDbg.exe (PID: 736)

    • The executable file from the user directory is run by the Powershell process

      • ISDbg.exe (PID: 736)
      • ISDbg.exe (PID: 7112)

    • Checks proxy server information

      • powershell.exe (PID: 236)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 6552)

    • Disables trace logs

      • powershell.exe (PID: 236)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 236)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
132
Monitored processes
6
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs isdbg.exe no specs isdbg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\Untitled.txt.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\Users\admin\AppData\Local\Temp\extract12_6165\ISDbg.exe" -ExecutionPolicy Bypass C:\Users\admin\AppData\Local\Temp\extract12_6165\ISDbg.exe—powershell.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) Script Debugger
Exit code:
0
Version:
30.0.157
Modules
Images
c:\users\admin\appdata\local\temp\extract12_6165\isdbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6552"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\upl0sl4z.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
6624C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES803F.tmp" "c:\Users\admin\AppData\Local\Temp\CSC6C564F66B79F4FAF8BDE256646D086D.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
7112"C:\Users\admin\AppData\Local\Temp\extracted4_9780\ISDbg.exe" -ExecutionPolicy Bypass C:\Users\admin\AppData\Local\Temp\extracted4_9780\ISDbg.exe—powershell.exe
User:
admin
Company:
Flexera
Integrity Level:
MEDIUM
Description:
InstallShield (R) Script Debugger
Exit code:
0
Version:
30.0.157
Modules
Images
c:\users\admin\appdata\local\temp\extracted4_9780\isdbg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
6 579
Read events
6 579
Write events
0
Delete events
0

Modification events

No data
Executable files
13
Suspicious files
12
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
236powershell.exeC:\Users\admin\AppData\Local\Temp\upl0sl4z.cmdlinetext
MD5:B9E3504EF8A356DB1B4A126D6D2250AF
SHA256:206C36955F1B3D71C7E8029B1C813873F9A436D8370CF1BAC384E0B514482CE6
236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:9F0CC3C548F15ECC4AA03531D4124B91
SHA256:1ACEFB47A7BE05BF1D79EFF77182E365E74ECE9EB0D12C11E485209DF82D6506
236powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1GG5U0QXD8ESXIUWLOXE.tempbinary
MD5:9F0CC3C548F15ECC4AA03531D4124B91
SHA256:1ACEFB47A7BE05BF1D79EFF77182E365E74ECE9EB0D12C11E485209DF82D6506
236powershell.exeC:\Users\admin\AppData\Local\Temp\upl0sl4z.0.cstext
MD5:61C8EFABA2783745F312409E9781ACE5
SHA256:94AE7A0BB45E6F9DCDFB159C05223E407D76DD71F26E74B6651DA1D0DF71BD39
6624cvtres.exeC:\Users\admin\AppData\Local\Temp\RES803F.tmpbinary
MD5:0B3B89EE31BACA8898DCE27B462A61E5
SHA256:D2AA246AFD12EA135F8FB1570A308B16C1595E38BEB62BC9CDECAA51D77C6102
6552csc.exeC:\Users\admin\AppData\Local\Temp\upl0sl4z.outtext
MD5:D7D5D6BD33658A4B2EAA02C763DE82D4
SHA256:34E0F33CECA8CE217FB4B6FFE310F8158F09596F0EDA0A70EAD118D701A7D0FE
236powershell.exeC:\Users\admin\AppData\Local\Temp\extracted4_9780\ISDbg.exeexecutable
MD5:7AA89907DB887D701309CB9CE0B24114
SHA256:40C88A5620A651B6AF283DFF83C4DA997782784DA7F85B94FC9B6C02A28862E7
236powershell.exeC:\Users\admin\AppData\Local\Temp\extracted4_9780\FNP_Act_Installer.dllexecutable
MD5:BD1341856F0F5F8DB5D54401C0D3261C
SHA256:4C08963572D2E9D80782221C2A0D7633C72E6EB3ED8D364B8A512441EC5D774F
236powershell.exeC:\Users\admin\AppData\Local\Temp\extracted4_9780\MSIMG32.dllexecutable
MD5:AE2FB3295FD4BEE1E651B7B6639D7BFE
SHA256:C1F88D099AF72CAE6F6BAAF7473DA78279DC50B112F7FB68F93B5C3F29051C45
236powershell.exeC:\Users\admin\AppData\Local\Temp\extracted4_9780\ISUIServices.dllexecutable
MD5:F121F1FE4965DB576E6B306FE09DA29F
SHA256:C7A86F68F55445B9CB00CEA1C0FFCBCE0CF9B1BDE2F9AD617CE022FB1E34C339
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
35
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2220
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7140
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6780
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7140
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2220
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2220
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2220
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.16.204.134:443
—
Akamai International B.V.
DE
unknown
2220
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
236
powershell.exe
104.21.48.1:443
easypath.cyou
CLOUDFLARENET
—
unknown
5064
SearchApp.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
easypath.cyou
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.64.1
  • 104.21.16.1
  • 104.21.96.1
  • 104.21.80.1
  • 104.21.32.1
unknown
ocsp.digicert.com
  • 184.30.131.245
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.22
whitelisted
go.microsoft.com
  • 2.23.242.9
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Untitled.txt