| File name: | i.ps1 |
| Full analysis: | https://app.any.run/tasks/c01c3f56-9935-4e2e-bf7c-d64b12cedb00 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 15, 2025, 11:58:04 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (6074), with no line terminators |
| MD5: | 70E9F8B79323D52778C951092C1C7E50 |
| SHA1: | 435E74551890B8C70C4B09446EC6CE0A932763F5 |
| SHA256: | 643A7167361F96BD89B939F2DCDC4B696E6A336FE31B420D43D4967C48535C8E |
| SSDEEP: | 96:f749jcwqan6KHZq7xjUYuvT+ylIiRUaf024Ng08HrUqhFNa+85DzDCoo8/MqPN1p:f749jcFa6KHZqtJuvT+mRt058HrNEHz9 |
MALICIOUS
Uses AES cipher (POWERSHELL)
- powershell.exe (PID: 3332)
- powershell.exe (PID: 5428)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 8056)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 3332)
- powershell.exe (PID: 5428)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 8056)
Bypass execution policy to execute commands
- powershell.exe (PID: 3332)
- powershell.exe (PID: 632)
- powershell.exe (PID: 1764)
- powershell.exe (PID: 5392)
- powershell.exe (PID: 6960)
- powershell.exe (PID: 2504)
- powershell.exe (PID: 5116)
- powershell.exe (PID: 6344)
- powershell.exe (PID: 1196)
- powershell.exe (PID: 6228)
- powershell.exe (PID: 5428)
- powershell.exe (PID: 5528)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 7384)
- powershell.exe (PID: 7584)
- powershell.exe (PID: 8056)
- powershell.exe (PID: 5528)
- powershell.exe (PID: 7904)
- powershell.exe (PID: 7048)
- powershell.exe (PID: 6828)
- powershell.exe (PID: 1452)
- powershell.exe (PID: 8104)
- powershell.exe (PID: 7924)
- powershell.exe (PID: 7756)
- powershell.exe (PID: 7712)
- powershell.exe (PID: 7932)
- powershell.exe (PID: 2852)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 3332)
- powershell.exe (PID: 5428)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 8056)
Script downloads file (POWERSHELL)
- powershell.exe (PID: 3332)
Downloads the requested resource (POWERSHELL)
- powershell.exe (PID: 3332)
Changes powershell execution policy (Bypass)
- cmd.exe (PID: 2772)
- cmd.exe (PID: 5776)
- cmd.exe (PID: 208)
- cmd.exe (PID: 4620)
- SearchFilter.exe (PID: 1096)
- cmd.exe (PID: 5020)
- powershell.exe (PID: 5116)
- cmd.exe (PID: 3976)
- cmd.exe (PID: 6676)
- wscript.exe (PID: 5740)
- cmd.exe (PID: 6540)
- wscript.exe (PID: 4268)
- cmd.exe (PID: 7336)
- cmd.exe (PID: 7532)
- wscript.exe (PID: 7988)
- cmd.exe (PID: 872)
- cmd.exe (PID: 7816)
- cmd.exe (PID: 6044)
- cmd.exe (PID: 7756)
- powershell.exe (PID: 7048)
- cmd.exe (PID: 7436)
- cmd.exe (PID: 8040)
- cmd.exe (PID: 4012)
- cmd.exe (PID: 4920)
- cmd.exe (PID: 1132)
Run PowerShell with an invisible window
- powershell.exe (PID: 5392)
- powershell.exe (PID: 5116)
- powershell.exe (PID: 5428)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 8056)
- powershell.exe (PID: 7048)
Uses Task Scheduler to run other applications
- cmd.exe (PID: 472)
- cmd.exe (PID: 2340)
- cmd.exe (PID: 5400)
- cmd.exe (PID: 8084)
- cmd.exe (PID: 7912)
- cmd.exe (PID: 6620)
- cmd.exe (PID: 6392)
- cmd.exe (PID: 7800)
UAC/LUA settings modification
- reg.exe (PID: 4620)
Disables Windows Defender
- reg.exe (PID: 2552)
- reg.exe (PID: 5216)
- reg.exe (PID: 536)
- reg.exe (PID: 5400)
- reg.exe (PID: 6652)
- reg.exe (PID: 6156)
- reg.exe (PID: 6728)
- reg.exe (PID: 6904)
- reg.exe (PID: 8124)
Deletes shadow copies
- powershell.exe (PID: 1196)
- powershell.exe (PID: 1452)
The DLL Hijacking
- taskhostw.exe (PID: 1628)
- Microsoft.exe (PID: 6876)
- Microsoft.exe (PID: 5376)
Actions looks like stealing of personal data
- NVIDIA Control Panel.exe (PID: 6700)
Steals credentials from Web Browsers
- NVIDIA Control Panel.exe (PID: 6700)
Deletes a file (SCRIPT)
- wscript.exe (PID: 5740)
- wscript.exe (PID: 4268)
- wscript.exe (PID: 7988)
Starts CMD.EXE for self-deleting
- powershell.exe (PID: 5428)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 8056)
REMCOS has been detected (SURICATA)
- DWWIN.EXE (PID: 5624)
SUSPICIOUS
Uses sleep to delay execution (POWERSHELL)
- powershell.exe (PID: 3332)
Converts a string into array of characters (POWERSHELL)
- powershell.exe (PID: 3332)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 3332)
Creates new GUID (POWERSHELL)
- powershell.exe (PID: 3332)
Reverses array data (POWERSHELL)
- powershell.exe (PID: 3332)
Executable content was dropped or overwritten
- powershell.exe (PID: 3332)
- 7z.exe (PID: 5576)
- SearchFilter.exe (PID: 1096)
- csc.exe (PID: 2772)
- SearchFilter.exe (PID: 5212)
- 7z.exe (PID: 3676)
- taskhostw.exe (PID: 6272)
- 7z4.exe (PID: 2148)
- csc.exe (PID: 1452)
- NVIDIA Control Panel.exe (PID: 6700)
- 7z.exe (PID: 7796)
Drops 7-zip archiver for unpacking
- powershell.exe (PID: 3332)
- SearchFilter.exe (PID: 1096)
Process drops legitimate windows executable
- 7z.exe (PID: 5576)
- 7z.exe (PID: 3676)
- SearchFilter.exe (PID: 1096)
- 7z4.exe (PID: 2148)
- 7z.exe (PID: 7796)
Writes data into a file (POWERSHELL)
- powershell.exe (PID: 3332)
Starts a new process with hidden mode (POWERSHELL)
- powershell.exe (PID: 3332)
Starts CMD.EXE for commands execution
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 5212)
- taskhostw.exe (PID: 6272)
- NVIDIA Control Panel.exe (PID: 6700)
- powershell.exe (PID: 5428)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 8056)
- Microsoft.exe (PID: 7240)
- Microsoft.exe (PID: 2552)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 2772)
- cmd.exe (PID: 5776)
- cmd.exe (PID: 208)
- cmd.exe (PID: 4620)
- SearchFilter.exe (PID: 1096)
- cmd.exe (PID: 5020)
- powershell.exe (PID: 5116)
- cmd.exe (PID: 3976)
- cmd.exe (PID: 6676)
- wscript.exe (PID: 5740)
- cmd.exe (PID: 6540)
- wscript.exe (PID: 4268)
- cmd.exe (PID: 7336)
- cmd.exe (PID: 7532)
- wscript.exe (PID: 7988)
- cmd.exe (PID: 872)
- cmd.exe (PID: 7816)
- cmd.exe (PID: 7756)
- cmd.exe (PID: 6044)
- cmd.exe (PID: 7436)
- powershell.exe (PID: 7048)
- cmd.exe (PID: 8040)
- cmd.exe (PID: 6592)
- cmd.exe (PID: 4012)
- cmd.exe (PID: 7928)
- cmd.exe (PID: 6828)
- cmd.exe (PID: 4920)
- cmd.exe (PID: 1132)
- cmd.exe (PID: 7936)
Application launched itself
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 5212)
- powershell.exe (PID: 5116)
- taskhostw.exe (PID: 6272)
- NVIDIA Control Panel.exe (PID: 6700)
- Microsoft.exe (PID: 7240)
- powershell.exe (PID: 7048)
- Microsoft.exe (PID: 2552)
Uses WMIC.EXE to obtain a list of video controllers
- cmd.exe (PID: 780)
- cmd.exe (PID: 6592)
Accesses video controller name via WMI (SCRIPT)
- WMIC.exe (PID: 472)
- WMIC.exe (PID: 7556)
Uses WMIC.EXE to obtain local storage devices information
- cmd.exe (PID: 5244)
- cmd.exe (PID: 7336)
The process executes Powershell scripts
- cmd.exe (PID: 208)
- cmd.exe (PID: 5020)
- powershell.exe (PID: 5116)
- wscript.exe (PID: 5740)
- wscript.exe (PID: 4268)
- wscript.exe (PID: 7988)
- cmd.exe (PID: 872)
- cmd.exe (PID: 7816)
- cmd.exe (PID: 7756)
- powershell.exe (PID: 7048)
CSC.EXE is used to compile C# code
- csc.exe (PID: 2772)
- csc.exe (PID: 1452)
Starts process via Powershell
- powershell.exe (PID: 2504)
- powershell.exe (PID: 5116)
- powershell.exe (PID: 6228)
- powershell.exe (PID: 7048)
Starts NET.EXE to display or manage information about active sessions
- cmd.exe (PID: 6744)
- net.exe (PID: 5116)
- net.exe (PID: 2320)
- cmd.exe (PID: 7616)
- net.exe (PID: 7948)
- cmd.exe (PID: 8168)
- cmd.exe (PID: 7924)
- net.exe (PID: 7984)
- net.exe (PID: 7424)
- cmd.exe (PID: 6156)
- net.exe (PID: 7212)
- cmd.exe (PID: 5188)
Found strings related to reading or modifying Windows Defender settings
- SearchFilter.exe (PID: 5212)
- Microsoft.exe (PID: 7240)
The process bypasses the loading of PowerShell profile settings
- cmd.exe (PID: 5020)
- powershell.exe (PID: 5116)
- cmd.exe (PID: 7756)
- powershell.exe (PID: 7048)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 7000)
- cmd.exe (PID: 4620)
- cmd.exe (PID: 6752)
- cmd.exe (PID: 6388)
- cmd.exe (PID: 5020)
- cmd.exe (PID: 5244)
- cmd.exe (PID: 4068)
- cmd.exe (PID: 472)
- cmd.exe (PID: 5164)
- cmd.exe (PID: 920)
- cmd.exe (PID: 7156)
- cmd.exe (PID: 1228)
- cmd.exe (PID: 4112)
- cmd.exe (PID: 4652)
- cmd.exe (PID: 6388)
- cmd.exe (PID: 2692)
- cmd.exe (PID: 900)
- cmd.exe (PID: 5668)
- cmd.exe (PID: 2552)
- cmd.exe (PID: 6248)
- cmd.exe (PID: 4448)
- cmd.exe (PID: 2288)
- cmd.exe (PID: 4024)
- cmd.exe (PID: 5668)
- cmd.exe (PID: 6820)
- cmd.exe (PID: 4112)
- cmd.exe (PID: 4784)
- cmd.exe (PID: 2192)
- cmd.exe (PID: 6632)
- cmd.exe (PID: 7000)
- cmd.exe (PID: 920)
- cmd.exe (PID: 5400)
- cmd.exe (PID: 536)
- cmd.exe (PID: 7048)
- cmd.exe (PID: 6752)
- cmd.exe (PID: 6900)
- cmd.exe (PID: 7312)
- cmd.exe (PID: 1196)
- cmd.exe (PID: 6852)
- cmd.exe (PID: 7724)
- cmd.exe (PID: 7624)
- cmd.exe (PID: 7616)
- cmd.exe (PID: 6820)
- cmd.exe (PID: 5720)
- cmd.exe (PID: 6852)
- cmd.exe (PID: 4112)
- cmd.exe (PID: 6900)
- cmd.exe (PID: 6620)
- cmd.exe (PID: 540)
- cmd.exe (PID: 736)
- cmd.exe (PID: 7104)
- cmd.exe (PID: 4188)
- cmd.exe (PID: 840)
- cmd.exe (PID: 1748)
- cmd.exe (PID: 8068)
- cmd.exe (PID: 8080)
- cmd.exe (PID: 1276)
- cmd.exe (PID: 1188)
- cmd.exe (PID: 4304)
- cmd.exe (PID: 6032)
- cmd.exe (PID: 6156)
- cmd.exe (PID: 4200)
- cmd.exe (PID: 6900)
- cmd.exe (PID: 2104)
- cmd.exe (PID: 7412)
- cmd.exe (PID: 8164)
- cmd.exe (PID: 7792)
- cmd.exe (PID: 5972)
- cmd.exe (PID: 7324)
- cmd.exe (PID: 6032)
- cmd.exe (PID: 6592)
Modifies existing scheduled task
- schtasks.exe (PID: 7052)
- schtasks.exe (PID: 4024)
- schtasks.exe (PID: 616)
- schtasks.exe (PID: 976)
- schtasks.exe (PID: 668)
- schtasks.exe (PID: 8164)
- schtasks.exe (PID: 7932)
- schtasks.exe (PID: 6040)
- schtasks.exe (PID: 8040)
- schtasks.exe (PID: 7984)
Executes as Windows Service
- VSSVC.exe (PID: 1912)
- VSSVC.exe (PID: 4208)
Get information on the list of running processes
- SearchFilter.exe (PID: 1096)
- cmd.exe (PID: 3976)
- cmd.exe (PID: 7616)
- taskhostw.exe (PID: 6272)
- cmd.exe (PID: 2332)
- cmd.exe (PID: 8080)
- NVIDIA Control Panel.exe (PID: 6700)
- Microsoft.exe (PID: 7240)
- cmd.exe (PID: 4920)
- Microsoft.exe (PID: 2552)
- cmd.exe (PID: 1132)
There is functionality for taking screenshot (YARA)
- SearchFilter.exe (PID: 2644)
The process executes via Task Scheduler
- taskhostw.exe (PID: 6272)
- Microsoft.exe (PID: 7240)
- Microsoft.exe (PID: 2552)
Lists all scheduled tasks
- schtasks.exe (PID: 1388)
- schtasks.exe (PID: 904)
- schtasks.exe (PID: 6980)
- schtasks.exe (PID: 7636)
- schtasks.exe (PID: 6344)
- schtasks.exe (PID: 5588)
- schtasks.exe (PID: 348)
- schtasks.exe (PID: 4276)
- schtasks.exe (PID: 5960)
- schtasks.exe (PID: 5212)
- schtasks.exe (PID: 8012)
- schtasks.exe (PID: 1012)
- schtasks.exe (PID: 8140)
- schtasks.exe (PID: 7624)
- schtasks.exe (PID: 7944)
Hides command output
- cmd.exe (PID: 6972)
- cmd.exe (PID: 2092)
- cmd.exe (PID: 4208)
- cmd.exe (PID: 4572)
- cmd.exe (PID: 3124)
- cmd.exe (PID: 8104)
- cmd.exe (PID: 7348)
- cmd.exe (PID: 1388)
- cmd.exe (PID: 4784)
- cmd.exe (PID: 5232)
- cmd.exe (PID: 4572)
- cmd.exe (PID: 896)
Runs shell command (SCRIPT)
- wscript.exe (PID: 5740)
- wscript.exe (PID: 4268)
- wscript.exe (PID: 7988)
Creates FileSystem object to access computer's file system (SCRIPT)
- wscript.exe (PID: 5740)
- wscript.exe (PID: 4268)
- wscript.exe (PID: 7988)
The process executes VB scripts
- cmd.exe (PID: 6724)
- cmd.exe (PID: 5172)
- cmd.exe (PID: 7928)
Gets full path of the running script (SCRIPT)
- wscript.exe (PID: 5740)
- wscript.exe (PID: 4268)
- wscript.exe (PID: 7988)
Checks for external IP
- curl.exe (PID: 6148)
- svchost.exe (PID: 2196)
- Microsoft.exe (PID: 7240)
- SearchFilter.exe (PID: 1096)
- NVIDIA Control Panel.exe (PID: 6700)
- Microsoft.exe (PID: 2552)
Converts a specified value to an integer (POWERSHELL)
- powershell.exe (PID: 5428)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 8056)
Uses TIMEOUT.EXE to delay execution
- cmd.exe (PID: 7104)
- cmd.exe (PID: 7892)
- cmd.exe (PID: 6816)
Connects to unusual port
- DWWIN.EXE (PID: 5624)
Contacting a server suspected of hosting an CnC
- DWWIN.EXE (PID: 5624)
Uses WMIC.EXE to obtain Windows Installer data
- cmd.exe (PID: 8084)
Accesses antivirus product name via WMI (SCRIPT)
- WMIC.exe (PID: 5408)
Query Microsoft Defender preferences
- SearchFilter.exe (PID: 1096)
Uses ATTRIB.EXE to modify file attributes
- cmd.exe (PID: 7436)
Process communicates with Telegram (possibly using it as an attacker's C2 server)
- NVIDIA Control Panel.exe (PID: 6700)
- SearchFilter.exe (PID: 1096)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 7176)
INFO
Disables trace logs
- powershell.exe (PID: 3332)
Checks proxy server information
- powershell.exe (PID: 3332)
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 5212)
- taskhostw.exe (PID: 6272)
- slui.exe (PID: 2420)
- DWWIN.EXE (PID: 5624)
- NVIDIA Control Panel.exe (PID: 6700)
- Microsoft.exe (PID: 2552)
Gets data length (POWERSHELL)
- powershell.exe (PID: 3332)
- powershell.exe (PID: 5428)
- powershell.exe (PID: 7188)
- powershell.exe (PID: 8056)
Checks whether the specified file exists (POWERSHELL)
- powershell.exe (PID: 3332)
Uses string split method (POWERSHELL)
- powershell.exe (PID: 3332)
The sample compiled with english language support
- powershell.exe (PID: 3332)
- 7z.exe (PID: 5576)
- SearchFilter.exe (PID: 1096)
- 7z.exe (PID: 3676)
- 7z4.exe (PID: 2148)
- 7z.exe (PID: 7796)
Found Base64 encoded text manipulation via PowerShell (YARA)
- powershell.exe (PID: 3332)
Checks supported languages
- 7z.exe (PID: 5576)
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 2644)
- SearchFilter.exe (PID: 4152)
- csc.exe (PID: 2772)
- cvtres.exe (PID: 7156)
- SearchFilter.exe (PID: 4436)
- SearchFilter.exe (PID: 4464)
- SearchFilter.exe (PID: 5212)
- 7z.exe (PID: 3676)
- 7z.exe (PID: 780)
- taskhostw.exe (PID: 6272)
- taskhostw.exe (PID: 1628)
- cvtres.exe (PID: 6228)
- 7z4.exe (PID: 2148)
- NVIDIA Control Panel.exe (PID: 6700)
- curl.exe (PID: 6148)
- NVIDIA Control Panel.exe (PID: 5188)
- Microsoft.exe (PID: 1328)
- Microsoft.exe (PID: 6876)
- Microsoft.exe (PID: 7240)
- NVIDIA Control Panel.exe (PID: 5968)
- SearchFilter.exe (PID: 5720)
- 7z.exe (PID: 6272)
- Microsoft.exe (PID: 5376)
- Microsoft.exe (PID: 6228)
- 7z.exe (PID: 5756)
- Microsoft.exe (PID: 2552)
Create files in a temporary directory
- 7z.exe (PID: 5576)
- SearchFilter.exe (PID: 1096)
- cvtres.exe (PID: 7156)
- csc.exe (PID: 2772)
- SearchFilter.exe (PID: 5212)
- taskhostw.exe (PID: 6272)
- powershell.exe (PID: 1388)
- csc.exe (PID: 1452)
- cvtres.exe (PID: 6228)
- NVIDIA Control Panel.exe (PID: 6700)
- 7z.exe (PID: 7544)
- 7z.exe (PID: 5756)
Reads Environment values
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 5212)
Found Base64 encoded file access via PowerShell (YARA)
- powershell.exe (PID: 3332)
The executable file from the user directory is run by the Powershell process
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 5212)
- NVIDIA Control Panel.exe (PID: 6700)
Reads the computer name
- 7z.exe (PID: 5576)
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 4152)
- SearchFilter.exe (PID: 5212)
- SearchFilter.exe (PID: 2644)
- SearchFilter.exe (PID: 4436)
- SearchFilter.exe (PID: 4464)
- 7z.exe (PID: 780)
- 7z.exe (PID: 3676)
- taskhostw.exe (PID: 6272)
- 7z4.exe (PID: 2148)
- taskhostw.exe (PID: 1628)
- NVIDIA Control Panel.exe (PID: 6700)
- curl.exe (PID: 6148)
- 7z.exe (PID: 7796)
- Microsoft.exe (PID: 7240)
- Microsoft.exe (PID: 1328)
- SearchFilter.exe (PID: 5720)
- 7z.exe (PID: 6272)
- 7z.exe (PID: 5756)
- Microsoft.exe (PID: 5376)
Reads product name
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 5212)
Process checks computer location settings
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 5212)
- NVIDIA Control Panel.exe (PID: 6700)
Creates files in the program directory
- powershell.exe (PID: 3332)
- SearchFilter.exe (PID: 1096)
- 7z.exe (PID: 7796)
- Microsoft.exe (PID: 7240)
Reads the machine GUID from the registry
- SearchFilter.exe (PID: 1096)
- csc.exe (PID: 2772)
- SearchFilter.exe (PID: 5212)
- csc.exe (PID: 1452)
- NVIDIA Control Panel.exe (PID: 6700)
- SearchFilter.exe (PID: 5720)
Creates files or folders in the user directory
- SearchFilter.exe (PID: 1096)
- 7z.exe (PID: 3676)
- taskhostw.exe (PID: 6272)
- 7z4.exe (PID: 2148)
- NVIDIA Control Panel.exe (PID: 6700)
- DWWIN.EXE (PID: 5624)
- Microsoft.exe (PID: 7240)
- SearchFilter.exe (PID: 5720)
- 7z.exe (PID: 6272)
Reads security settings of Internet Explorer
- WMIC.exe (PID: 472)
- WMIC.exe (PID: 1912)
- powershell.exe (PID: 1388)
- WMIC.exe (PID: 7556)
- powershell.exe (PID: 7712)
Potential access to remote process (Base64 Encoded 'OpenProcess')
- SearchFilter.exe (PID: 1096)
Found Base64 encoded reflection usage via PowerShell (YARA)
- SearchFilter.exe (PID: 1096)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 1196)
- powershell.exe (PID: 1452)
- powershell.exe (PID: 7712)
Reads the software policy settings
- slui.exe (PID: 5024)
- powershell.exe (PID: 1388)
- slui.exe (PID: 2420)
- powershell.exe (PID: 7712)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 1196)
- powershell.exe (PID: 1452)
Node.js compiler has been detected
- SearchFilter.exe (PID: 1096)
- SearchFilter.exe (PID: 2644)
Found Base64 encoded access to processes via PowerShell (YARA)
- SearchFilter.exe (PID: 1096)
Reads CPU info
- SearchFilter.exe (PID: 1096)
- NVIDIA Control Panel.exe (PID: 6700)
- Microsoft.exe (PID: 7240)
- Microsoft.exe (PID: 2552)
Execution of CURL command
- cmd.exe (PID: 4448)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 7904)
Gets or sets the time when the file was last written to (POWERSHELL)
- powershell.exe (PID: 7904)
Creates a new folder
- cmd.exe (PID: 8164)
Attempting to use instant messaging service
- NVIDIA Control Panel.exe (PID: 6700)
- svchost.exe (PID: 2196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
688
Monitored processes
556
Malicious processes
40
Suspicious processes
19
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\WINDOWS\system32\cmd.exe /d /s /c "powershell -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\admin\.vs-script\antiDebug.ps1"" | C:\Windows\System32\cmd.exe | — | SearchFilter.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 208 | C:\WINDOWS\system32\cmd.exe /d /s /c "schtasks /query /TN "\Microsoft\Windows\Device Guide\RegisterDeviceNetworkChange"" | C:\Windows\System32\cmd.exe | — | SearchFilter.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 300 | #system32 | C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft .NET Assembly Registration Utility Version: 4.8.9037.0 built by: NET481REL1 | |||||||||||||||
| 332 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 348 | schtasks /query /TN "nul" | C:\Windows\System32\schtasks.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Task Scheduler Configuration Tool Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 472 | wmic path win32_videocontroller get name | C:\Windows\System32\wbem\WMIC.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 472 | C:\WINDOWS\system32\cmd.exe /d /s /c "schtasks /create /tn "\Microsoft\Windows\Device Guide\RegisterDeviceSecurityAlert" /tr "powershell -ExecutionPolicy Bypass -File \"C:\Users\admin\AppData\Local\Programs\Common\OneDriveCloud\mbam.ps1\"" /sc once /st 00:00 /du 9999:59 /ri 58 /ru "SYSTEM" /RL HIGHEST /F" | C:\Windows\System32\cmd.exe | — | SearchFilter.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 472 | C:\WINDOWS\system32\cmd.exe /d /s /c "reg.exe ADD "HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile" /v DisableNotifications /t REG_DWORD /d 1 /f" | C:\Windows\System32\cmd.exe | — | SearchFilter.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 536 | reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 536 | C:\WINDOWS\system32\cmd.exe /d /s /c "reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f" | C:\Windows\System32\cmd.exe | — | SearchFilter.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
164 247
Read events
164 160
Write events
71
Delete events
16
Modification events
| (PID) Process: | (3332) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer |
| Operation: | write | Name: | SlowContextMenuEntries |
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000 | |||
| (PID) Process: | (6644) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.WindowsDefender.SecurityCenter.Notifications |
| Operation: | write | Name: | Enabled |
Value: 0 | |||
| (PID) Process: | (6652) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance |
| Operation: | write | Name: | Enabled |
Value: 0 | |||
| (PID) Process: | (5968) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications |
| Operation: | write | Name: | ToastEnabled |
Value: 0 | |||
| (PID) Process: | (4652) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile |
| Operation: | write | Name: | DisableNotifications |
Value: 1 | |||
| (PID) Process: | (3024) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile |
| Operation: | write | Name: | DisableNotifications |
Value: 1 | |||
| (PID) Process: | (5352) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Notifications |
| Operation: | write | Name: | SCNotifyEnabled |
Value: 0 | |||
| (PID) Process: | (4620) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System |
| Operation: | write | Name: | EnableLUA |
Value: 0 | |||
| (PID) Process: | (6248) reg.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications |
| Operation: | write | Name: | DisableNotifications |
Value: 1 | |||
| (PID) Process: | (6820) reg.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance |
| Operation: | write | Name: | Enabled |
Value: 0 | |||
Executable files
63
Suspicious files
389
Text files
107
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3332 | powershell.exe | C:\Users\admin\AppData\Local\Temp\855fd459-aa52-4226-89da-1fffff4443ed.7z | — | |
MD5:— | SHA256:— | |||
| 5576 | 7z.exe | C:\Users\admin\AppData\Local\Temp\756cfcc5-21a2-4070-913a-e78ec5ade42e\icudtl.dat | — | |
MD5:— | SHA256:— | |||
| 3332 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q6A3LIA15S9LG1ZEF3N2.temp | binary | |
MD5:36CE6307ECA34AF3AC5F71EA95514BA7 | SHA256:1BC28EFB2F82C78617F4FD284AB04FF92375C02B55870C3DF0B3E3CC3841A102 | |||
| 3332 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_d540hq5p.aea.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 3332 | powershell.exe | C:\ProgramData\sevenZip\7z.exe | executable | |
MD5:9F018E5FEB96AAE0E893A739C83A8B1F | SHA256:D2C0045523CF053A6B43F9315E9672FC2535F06AEADD4FFA53C729CD8B2B6DFE | |||
| 5576 | 7z.exe | C:\Users\admin\AppData\Local\Temp\756cfcc5-21a2-4070-913a-e78ec5ade42e\chrome_200_percent.pak | binary | |
MD5:4610337E3332B7E65B73A6EA738B47DF | SHA256:C91ABF556E55C29D1EA9F560BB17CC3489CB67A5D0C7A22B58485F5F2FBCF25C | |||
| 5576 | 7z.exe | C:\Users\admin\AppData\Local\Temp\756cfcc5-21a2-4070-913a-e78ec5ade42e\locales\ca.pak | binary | |
MD5:D259469E94F2ADF54380195555154518 | SHA256:F98B7442BEFC285398A5DD6A96740CBA31D2F5AADADD4D5551A05712D693029B | |||
| 5576 | 7z.exe | C:\Users\admin\AppData\Local\Temp\756cfcc5-21a2-4070-913a-e78ec5ade42e\locales\cs.pak | binary | |
MD5:04A680847C4A66AD9F0A88FB9FB1FC7B | SHA256:1CC44C5FBE1C0525DF37C5B6267A677F79C9671F86EDA75B6FC13ABF5D5356EB | |||
| 5576 | 7z.exe | C:\Users\admin\AppData\Local\Temp\756cfcc5-21a2-4070-913a-e78ec5ade42e\locales\de.pak | binary | |
MD5:8E6654B89ED4C1DC02E1E2D06764805A | SHA256:61CBCE9A31858DDF70CC9B0C05FB09CE7032BFB8368A77533521722465C57475 | |||
| 5576 | 7z.exe | C:\Users\admin\AppData\Local\Temp\756cfcc5-21a2-4070-913a-e78ec5ade42e\locales\ar.pak | binary | |
MD5:47A6D10B4112509852D4794229C0A03B | SHA256:857FE3AB766B60A8D82B7B6043137E3A7D9F5CFB8DDD942316452838C67D0495 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
61
DNS requests
29
Threats
29
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | DE | binary | 471 b | whitelisted |
6148 | curl.exe | GET | 200 | 172.67.74.152:80 | http://api.ipify.org/ | US | text | 13 b | malicious |
4944 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | DE | binary | 407 b | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 825 b | whitelisted |
1096 | SearchFilter.exe | GET | 200 | 172.67.74.152:80 | http://api.ipify.org/ | US | text | 13 b | malicious |
5624 | DWWIN.EXE | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | NL | binary | 958 b | whitelisted |
7240 | Microsoft.exe | GET | 200 | 172.67.74.152:80 | http://api.ipify.org/ | US | text | 13 b | malicious |
2552 | Microsoft.exe | GET | 200 | 172.67.74.152:80 | http://api.ipify.org/ | US | text | 13 b | malicious |
4944 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | DE | binary | 419 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
3332 | powershell.exe | 49.12.202.237:443 | www.7-zip.org | Hetzner Online GmbH | DE | whitelisted |
3332 | powershell.exe | 188.114.97.3:443 | rlim.com | CLOUDFLARENET | NL | unknown |
6544 | svchost.exe | 40.126.31.2:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
3332 | powershell.exe | 140.82.121.3:443 | github.com | GITHUB | US | whitelisted |
3332 | powershell.exe | 185.199.109.133:443 | objects.githubusercontent.com | FASTLY | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
www.7-zip.org |
| whitelisted |
rlim.com |
| unknown |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
github.com |
| whitelisted |
objects.githubusercontent.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2196 | svchost.exe | Misc activity | ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup |
6148 | curl.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup api.ipify.org |
6148 | curl.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org) |
6148 | curl.exe | Device Retrieving External IP Address Detected | SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request |
5624 | DWWIN.EXE | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
5624 | DWWIN.EXE | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
7240 | Microsoft.exe | Device Retrieving External IP Address Detected | SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request |
7240 | Microsoft.exe | Device Retrieving External IP Address Detected | POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org) |
7240 | Microsoft.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup api.ipify.org |
1096 | SearchFilter.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup api.ipify.org |