File name: | 1.ps1 |
Full analysis: | https://app.any.run/tasks/f6f39931-d969-4ad9-aa9d-70897d6616c4 |
Verdict: | Malicious activity |
Analysis date: | September 19, 2019, 01:46:57 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with very long lines, with CRLF line terminators |
MD5: | 8663492E8AAED5F17F77E51AE92F997A |
SHA1: | C525F37D82D539D99967E567649C01A063909E6A |
SHA256: | 6056AA8C477D1BA68635836307537649AF0439ACBE749589A852EC09CD2A26CB |
SSDEEP: | 24576:D9b35P4keTMQ6VRHYwq6xitjMvK0Nv2U8eCte4TxVTMKY7Bu:prVjeGit6/MxTMKGBu |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
3004 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\1.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | explorer.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2824 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | powershell.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2328 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | yjlr.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2396 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | yjlr.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2456 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | yjlr.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2508 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | yjlr.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2584 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | yjlr.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2656 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | yjlr.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2728 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | yjlr.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 | ||||
2804 | "C:\Users\Public\yjlr.exe" | C:\Users\Public\yjlr.exe | — | yjlr.exe |
User: admin Integrity Level: MEDIUM Exit code: 0 |
PID | Process | Filename | Type | |
---|---|---|---|---|
3004 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XRI72YZT25CIMW5HUMSL.temp | — | |
MD5:— | SHA256:— | |||
3004 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:0F2CAD9746414ABA31294C3B560FCFD5 | SHA256:19AD383DED364BB44DED7C7CF00EB6254E5E98D696632944F6BC36724306EE15 | |||
3004 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF169c54.TMP | binary | |
MD5:0F2CAD9746414ABA31294C3B560FCFD5 | SHA256:19AD383DED364BB44DED7C7CF00EB6254E5E98D696632944F6BC36724306EE15 | |||
3004 | powershell.exe | C:\Users\Public\yjlr.exe | executable | |
MD5:5C6611A770CC3395A5D589809DEFD3D6 | SHA256:15F9F4C20204015A10054FA9A98544C5BEED0E75C76EA3D844DCDAEF2738EEA2 |