File name:

startxback.cmd

Full analysis: https://app.any.run/tasks/95581745-2ca6-4af7-9ba2-40de561514d1
Verdict: Malicious activity
Analysis date: January 01, 2025, 00:41:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text
MD5:

4BD0CA5276016A3CA1ACC6B5872F4259

SHA1:

04B001BA73F4CAD190EF62596B17AC950E796AFE

SHA256:

5E723C959F5A791CF798AA0EFC48CB432B1AFCB0A069D35BDA4E07192E3EF51B

SSDEEP:

48:/mgzquFy07banPRc1H0CHDfsNHmY/nM/VKqPniUskMW7C4OXTzKvuEkuKSyB7Zho:3Fyn5i/rwBnM/VT/iEazz3pZqp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • explorer.exe (PID: 4576)

    • Changes the autorun value in the registry

      • ie4uinit.exe (PID: 396)
      • explorer.exe (PID: 4576)

  • SUSPICIOUS

    • Executes script without checking the security policy

      • powershell.exe (PID: 7140)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6996)
      • runas.exe (PID: 6296)
      • powershell.exe (PID: 7140)

    • Starts another process probably with elevated privileges via RUNAS.EXE

      • runas.exe (PID: 6296)

    • Application launched itself

      • cmd.exe (PID: 6996)
      • ie4uinit.exe (PID: 396)
      • setup.exe (PID: 7116)
      • setup.exe (PID: 4684)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6996)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6996)

    • Manipulates environment variables

      • powershell.exe (PID: 7140)

    • Executing commands from ".cmd" file

      • runas.exe (PID: 6296)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 6996)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 6176)

    • Changes internet zones settings

      • ie4uinit.exe (PID: 396)

    • Uses RUNDLL32.EXE to load library

      • ie4uinit.exe (PID: 6004)

    • Write to the desktop.ini file (may be used to cloak folders)

      • ie4uinit.exe (PID: 396)
      • explorer.exe (PID: 4576)

  • INFO

    • Reads the time zone

      • explorer.exe (PID: 4576)

    • The process uses the downloaded file

      • powershell.exe (PID: 7140)
      • explorer.exe (PID: 4576)

    • Reads Microsoft Office registry keys

      • explorer.exe (PID: 4576)
      • setup.exe (PID: 7116)

    • Reads security settings of Internet Explorer

      • ie4uinit.exe (PID: 6004)
      • explorer.exe (PID: 4576)
      • ie4uinit.exe (PID: 396)

    • Creates files in the program directory

      • ie4uinit.exe (PID: 396)
      • setup.exe (PID: 4684)
      • chrmstp.exe (PID: 6952)

    • Reads the software policy settings

      • explorer.exe (PID: 4576)
      • dllhost.exe (PID: 4856)

    • Local mutex for internet shortcut management

      • ie4uinit.exe (PID: 396)
      • explorer.exe (PID: 4576)

    • Checks supported languages

      • setup.exe (PID: 6188)
      • setup.exe (PID: 4684)
      • setup.exe (PID: 2072)
      • setup.exe (PID: 7116)

    • Reads the computer name

      • setup.exe (PID: 4684)

    • Checks transactions between databases Windows and Oracle

      • explorer.exe (PID: 4576)

    • Checks proxy server information

      • dllhost.exe (PID: 4856)

    • Application launched itself

      • chrmstp.exe (PID: 7024)
      • chrmstp.exe (PID: 6952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
26
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start runas.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs find.exe no specs fltmc.exe no specs powershell.exe no specs cmd.exe no specs taskkill.exe no specs explorer.exe unregmp2.exe no specs ie4uinit.exe ie4uinit.exe no specs rundll32.exe no specs rundll32.exe no specs unregmp2.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs setup.exe no specs User OOBE Create Elevated Object Server

Process information

PID
CMD
Path
Indicators
Parent process
396"C:\Windows\System32\ie4uinit.exe" -UserConfigC:\Windows\System32\ie4uinit.exe
explorer.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IE Per-User Initialization Utility
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ie4uinit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2072"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\WINDOWS\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x230,0x260,0x264,0x234,0x268,0x7ff61c6169a8,0x7ff61c6169b4,0x7ff61c6169c0C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\Installer\setup.exe—setup.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Installer
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\installer\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4576"C:\WINDOWS\explorer.exe" C:\Windows\explorer.exe
powershell.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
4684"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\Installer\setup.exe" --msedge --channel=stable --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\Installer\setup.exe—setup.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Installer
Exit code:
99
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\installer\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4856C:\WINDOWS\system32\DllHost.exe /Processid:{CA8C87C1-929D-45BA-94DB-EF8E6CB346AD}C:\Windows\System32\dllhost.exe
svchost.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
5712taskkill /f /im explorer.exeC:\Windows\System32\taskkill.exe—cmd.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5748"C:\Windows\System32\unregmp2.exe" /FirstLogonC:\Windows\System32\unregmp2.exe—explorer.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6004C:\Windows\System32\ie4uinit.exe -ClearIconCacheC:\Windows\System32\ie4uinit.exe—ie4uinit.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IE Per-User Initialization Utility
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ie4uinit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6072"C:\Windows\System32\unregmp2.exe" /FirstLogonC:\Windows\System32\unregmp2.exe—explorer.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6176"C:\WINDOWS\system32\cmd.exe" /c taskkill /f /im explorer.exeC:\Windows\System32\cmd.exe—powershell.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
47 866
Read events
47 224
Write events
614
Delete events
28

Modification events

(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:ExplorerStartupTraceRecorded
Value:
1
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\Control Panel\Appearance
Operation:writeName:SchemeLangID
Value:
0904
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics
Operation:writeName:AppliedDPI
Value:
96
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics
Operation:writeName:Shell Icon Size
Value:
32
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bat\OpenWithProgids
Operation:writeName:batfile
Value:
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.bmp\OpenWithProgids
Operation:writeName:Paint.Picture
Value:
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.db\OpenWithProgids
Operation:writeName:dbfile
Value:
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib\OpenWithProgids
Operation:writeName:Paint.Picture
Value:
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dll\OpenWithProgids
Operation:writeName:dllfile
Value:
(PID) Process:(4576) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc\OpenWithProgids
Operation:writeName:Word.Document.8
Value:
Executable files
7
Suspicious files
29
Text files
57
Unknown types
0

Dropped files

PID
Process
Filename
Type
7140powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_ra52eyvh.clq.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7140powershell.exeC:\Users\Administrator\AppData\Local\Temp\__PSScriptPolicyTest_msbvytr3.kip.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
396ie4uinit.exeC:\Users\Administrator\AppData\Local\Temp\RGI82A6.tmptext
MD5:87BA1D52A05A8D4343356EB0C6279DE2
SHA256:564A351DB0AB9249751ECF3F5D03049A43BEB0F8F3B95A5B8AAE9A9F7D0C17FB
396ie4uinit.exeC:\Users\Administrator\AppData\Local\Temp\RGI8228.tmptext
MD5:0D6E3B5966C8910612CBB86683829EFD
SHA256:6B5C97558FDF8CC87169CAD942F04A633BF2B9931D50BF22D91E632C0EA596AF
5748unregmp2.exeC:\Users\Administrator\AppData\Local\Temp\wmsetup.logtext
MD5:9239E2F1A5D8AE40A2372B52EE7BB834
SHA256:04CFBE94284F9118B83F67937A0347A01EAC34C1C0B26BB9A9FEEF143CC15FE7
396ie4uinit.exeC:\Users\Administrator\AppData\Local\Temp\RGI8216.tmptext
MD5:0D6E3B5966C8910612CBB86683829EFD
SHA256:6B5C97558FDF8CC87169CAD942F04A633BF2B9931D50BF22D91E632C0EA596AF
396ie4uinit.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.initext
MD5:2050878EFC2315CC685312928C0D0FA2
SHA256:8875411F92CBD74D8D47AD0014B788379615D9A39BDE3122FD73E25D336CD257
396ie4uinit.exeC:\Users\Administrator\AppData\Local\Temp\RGI8205.tmpini
MD5:0D6E3B5966C8910612CBB86683829EFD
SHA256:6B5C97558FDF8CC87169CAD942F04A633BF2B9931D50BF22D91E632C0EA596AF
396ie4uinit.exeC:\Users\Administrator\AppData\Local\Temp\RGI81F5.tmptext
MD5:0D6E3B5966C8910612CBB86683829EFD
SHA256:6B5C97558FDF8CC87169CAD942F04A633BF2B9931D50BF22D91E632C0EA596AF
396ie4uinit.exeC:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnkbinary
MD5:6F1306D13B5965D65C19A1922E61F745
SHA256:F67CB5B83C458CAE8D9CD160705789F75D653D39E460DCED62C53EF8E2B38F79
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
10
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4856
dllhost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4856
dllhost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2380
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
92.123.104.32:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
www.bing.com
  • 92.123.104.32
  • 92.123.104.34
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.71
  • 40.126.31.71
  • 20.190.159.68
  • 20.190.159.4
  • 20.190.159.2
whitelisted
go.microsoft.com
  • 23.35.238.131
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
startxback.cmd