File name:

Geometry dash auto speedhack.bat

Full analysis: https://app.any.run/tasks/fdf3e03b-ba59-4fe2-b5b9-430a18391ab6
Verdict: Malicious activity
Analysis date: August 04, 2018, 12:05:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

4E2A7F369378A76D1DF4D8C448F712AF

SHA1:

1192B4D01254A8704E6D6AE17DC2EC28A7AD5A49

SHA256:

5E2CD213FF47B7657ABD9167C38FFD8B53C13261FE22ADDDEA92B5A2D9E320AD

SSDEEP:

192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • MEMZ.exe (PID: 3464)
      • MEMZ.exe (PID: 3504)
      • MEMZ.exe (PID: 3544)
      • MEMZ.exe (PID: 2320)
      • MEMZ.exe (PID: 1452)
      • MEMZ.exe (PID: 3180)
      • MEMZ.exe (PID: 2704)
      • MEMZ.exe (PID: 1860)
      • MEMZ.exe (PID: 2300)

    • Low-level write access rights to disk partition

      • MEMZ.exe (PID: 2300)

  • SUSPICIOUS

    • Creates files in the user directory

      • cscript.exe (PID: 3660)

    • Executes scripts

      • cmd.exe (PID: 3492)

    • Executable content was dropped or overwritten

      • cscript.exe (PID: 3660)

    • Application launched itself

      • MEMZ.exe (PID: 3504)

    • Low-level read access rights to disk partition

      • MEMZ.exe (PID: 2300)

  • INFO

    • Dropped object may contain URL's

      • cscript.exe (PID: 3660)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
12
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs cscript.exe memz.exe no specs memz.exe no specs memz.exe memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe no specs memz.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1452"C:\Users\admin\AppData\Roaming\MEMZ.exe" /watchdogC:\Users\admin\AppData\Roaming\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\memz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1860"C:\Users\admin\AppData\Roaming\MEMZ.exe" /watchdogC:\Users\admin\AppData\Roaming\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\memz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2300"C:\Users\admin\AppData\Roaming\MEMZ.exe" /mainC:\Users\admin\AppData\Roaming\MEMZ.exe
MEMZ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1073807364
Modules
Images
c:\users\admin\appdata\roaming\memz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2320"C:\Users\admin\AppData\Roaming\MEMZ.exe" /watchdogC:\Users\admin\AppData\Roaming\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\memz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2704"C:\Users\admin\AppData\Roaming\MEMZ.exe" /watchdogC:\Users\admin\AppData\Roaming\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\memz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3180"C:\Users\admin\AppData\Roaming\MEMZ.exe" /watchdogC:\Users\admin\AppData\Roaming\MEMZ.exe—MEMZ.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\memz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3332"C:\Windows\System32\notepad.exe" \note.txtC:\Windows\System32\notepad.exe—MEMZ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
1073807364
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3464"C:\Users\admin\AppData\Roaming\MEMZ.exe" C:\Users\admin\AppData\Roaming\MEMZ.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\roaming\memz.exe
c:\systemroot\system32\ntdll.dll
3492cmd /c ""C:\Users\admin\Desktop\Geometry dash auto speedhack.bat" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3504"C:\Users\admin\AppData\Roaming\MEMZ.exe" C:\Users\admin\AppData\Roaming\MEMZ.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\memz.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
Total events
927
Read events
889
Write events
38
Delete events
0

Modification events

(PID) Process:(3660) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3660) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3660) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E2070800060004000C0005002F00640000000000
(PID) Process:(3492) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3492) cmd.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3504) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3504) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2300) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2300) MEMZ.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
1
Suspicious files
1
Text files
66
Unknown types
0

Dropped files

PID
Process
Filename
Type
3492cmd.exeC:\Users\admin\Desktop\xtext
MD5:—
SHA256:—
3492cmd.exeC:\Users\admin\Desktop\x.jstext
MD5:8EEC8704D2A7BC80B95B7460C06F4854
SHA256:AA01B8864B43E92077A106ED3D4656A511F3BA1910FBA40C78A32EE6A621D596
3660cscript.exeC:\Users\admin\Desktop\z.zipcompressed
MD5:63EE4412B95D7AD64C54B4BA673470A7
SHA256:44C1857B1C4894B3DFBACCBE04905652E634283DCF6B06C25A74B17021E2A268
3660cscript.exeC:\Users\admin\AppData\Roaming\MEMZ.exeexecutable
MD5:19DBEC50735B5F2A72D4199C4E184960
SHA256:A3D5715A81F2FBEB5F76C88C9C21EEEE87142909716472F911FF6950C790C24D
2300MEMZ.exeC:\note.txttext
MD5:AFA6955439B8D516721231029FB9CA1B
SHA256:8E9F20F6864C66576536C0B866C6FFDCF11397DB67FE120E972E244C3C022270
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Geometry dash auto speedhack.bat