analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

in3.ps1

Full analysis: https://app.any.run/tasks/0a0bc1e9-b241-4c0d-8e8f-72ddadb0a1bb
Verdict: Malicious activity
Analysis date: September 11, 2019, 02:10:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with no line terminators
MD5:

1AAFB3096F879F7463A5A3F97D3C38A6

SHA1:

9B9B9CA10266C92F67C04C04B2F61E29F0AC9559

SHA256:

64BE37C0094032D1DD6367042E2ADE7094AAC954692CCE8380CFE97D4223AE20

SSDEEP:

49152:enxlB4rYCK+0KbtI4mjkSNn4CY4Yqj1LjmmxDWau:d

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 4012)
      • schtasks.exe (PID: 2248)
      • schtasks.exe (PID: 2376)

    • Uses Task Scheduler to run other applications

      • powershell.exe (PID: 2924)

  • SUSPICIOUS

    • Connects to unusual port

      • powershell.exe (PID: 2924)

    • Uses NETSTAT.EXE to discover network connections

      • powershell.exe (PID: 2924)

    • PowerShell script executed

      • powershell.exe (PID: 2924)

    • Creates files in the user directory

      • powershell.exe (PID: 2924)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
16
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe schtasks.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs netstat.exe no specs schtasks.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs netstat.exe no specs schtasks.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs netstat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2924"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\in3.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4012"C:\Windows\system32\schtasks.exe" /delete /tn sysupdater0 /fC:\Windows\system32\schtasks.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2660"C:\Windows\system32\powercfg.exe" /CHANGE -standby-timeout-ac 0C:\Windows\system32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3244"C:\Windows\system32\powercfg.exe" /CHANGE -hibernate-timeout-ac 0C:\Windows\system32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3740"C:\Windows\system32\powercfg.exe" -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000C:\Windows\system32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2296"C:\Windows\system32\NETSTAT.EXE" -anop tcpC:\Windows\system32\NETSTAT.EXE—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2376"C:\Windows\system32\schtasks.exe" /delete /tn sysupdater0 /fC:\Windows\system32\schtasks.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3008"C:\Windows\system32\powercfg.exe" /CHANGE -standby-timeout-ac 0C:\Windows\system32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3496"C:\Windows\system32\powercfg.exe" /CHANGE -hibernate-timeout-ac 0C:\Windows\system32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
4008"C:\Windows\system32\powercfg.exe" -SetAcValueIndex 381b4222-f694-41f0-9685-ff5bb260df2e 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 000C:\Windows\system32\powercfg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
270
Read events
199
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2924powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5KGWD8BVVRAMH9NDJ8MX.temp —
MD5:—
SHA256:—
2924powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF168f25.TMPbinary
MD5:0F2CAD9746414ABA31294C3B560FCFD5
SHA256:19AD383DED364BB44DED7C7CF00EB6254E5E98D696632944F6BC36724306EE15
2924powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:0F2CAD9746414ABA31294C3B560FCFD5
SHA256:19AD383DED364BB44DED7C7CF00EB6254E5E98D696632944F6BC36724306EE15
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/banner
US
text
14 b
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/in3.ps1
US
text
3.31 Mb
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/in3.ps1
US
text
3.31 Mb
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/banner
US
text
14 b
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/banner
US
text
14 b
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/banner
US
text
14 b
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/in3.ps1
US
text
3.31 Mb
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/banner
US
text
14 b
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/banner
US
text
14 b
malicious
2924
powershell.exe
GET
200
128.14.23.149:8000
http://profetestruec.net:8000/banner
US
text
14 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2924
powershell.exe
128.14.23.149:8000
profetestruec.net
Zenlayer Inc
US
malicious

DNS requests

Domain
IP
Reputation
profetestruec.net
  • 128.14.23.149
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
in3.ps1