File name:

7787789878977897978989778.ps1

Full analysis: https://app.any.run/tasks/60e88fc9-a90e-406a-aa0e-93ce54440865
Verdict: Malicious activity
Analysis date: January 10, 2025, 21:02:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

81310A11562D06AE4A73CBD8C6FF6180

SHA1:

9152FA4C64A93DFA40F00F971DD4870E5505277C

SHA256:

68033EA85E8B64B35B75A31DD09F5D2E8A8BA9825BD0AEB4E50EBBE1930BB171

SSDEEP:

96:LnoEOxYovoycCidxhJJ4AP22cEK/OKtGx:7okPJNP22cpWKtGx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5684)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 5684)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 5684)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 5684)

  • SUSPICIOUS

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 5308)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 5308)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 5684)

  • INFO

    • Checks supported languages

      • csc.exe (PID: 5308)
      • cvtres.exe (PID: 5036)

    • Create files in a temporary directory

      • csc.exe (PID: 5308)
      • cvtres.exe (PID: 5036)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 5308)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5684)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5684)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs csc.exe cvtres.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5684"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\7787789878977897978989778.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5308"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\xgfo2pk3.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
5036C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES6DF0.tmp" "c:\Users\admin\AppData\Local\Temp\CSC3050894897864795831EAE634A8FE78A.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
Total events
7 020
Read events
7 020
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
5684powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\13VB2XTG8M49U7C7VDPV.tempbinary
MD5:EF9973D536759DDAD25CFFA306BB2E9F
SHA256:FB1BD772F0FF48313C72D53A0D68CA9D900B2010B1164B53E44C12EFB8795D14
5684powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tysqlhqr.nbc.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5684powershell.exeC:\Users\admin\AppData\Local\Temp\xgfo2pk3.cmdlinetext
MD5:ED562058F7C466513AB59099A618006A
SHA256:236344FB67EC7C2A7EA5316D22264CC1BF98B8D4B5395F7BBC09EFDB14659ED8
5684powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:EF9973D536759DDAD25CFFA306BB2E9F
SHA256:FB1BD772F0FF48313C72D53A0D68CA9D900B2010B1164B53E44C12EFB8795D14
5684powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_oabzkgkq.3q1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5308csc.exeC:\Users\admin\AppData\Local\Temp\xgfo2pk3.outtext
MD5:CCCC651EE38C7714C2FD4AF9D2022F69
SHA256:8B86105CF18577ADA940A3957F33DFE0F10BC470ED1B7B808139E5C97993B92D
5308csc.exeC:\Users\admin\AppData\Local\Temp\xgfo2pk3.dllexecutable
MD5:46C884D7097EDBFB6179687277EA6873
SHA256:E1F77194F12534D54D58F779E19EF67B0FBE8EFFFBE574A99E72C09811E26E94
5684powershell.exeC:\Users\admin\AppData\Local\Temp\xgfo2pk3.0.cstext
MD5:A7D9A76211E72735D60D5A4C4CB446FB
SHA256:D5838EFC7DABC739A7D28E3D56BEC835283E0702DDE06399AE1F06404361B630
5308csc.exeC:\Users\admin\AppData\Local\Temp\CSC3050894897864795831EAE634A8FE78A.TMPbinary
MD5:F85D67730FCD770B80E84868D29CB8A0
SHA256:C863D88855B9FB79E60EEB3CF549AE18F2711DC5D5B80596F22310ED1681C514
5684powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF13615d.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
18
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4536
svchost.exe
GET
200
23.37.237.227:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4536
svchost.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.37.237.227:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4536
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3976
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 23.37.237.227
whitelisted
self.events.data.microsoft.com
  • 20.42.65.91
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
7787789878977897978989778.ps1