File name: | 7787789878977897978989778.ps1 |
Full analysis: | https://app.any.run/tasks/60e88fc9-a90e-406a-aa0e-93ce54440865 |
Verdict: | Malicious activity |
Analysis date: | January 10, 2025, 21:02:54 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with CRLF line terminators |
MD5: | 81310A11562D06AE4A73CBD8C6FF6180 |
SHA1: | 9152FA4C64A93DFA40F00F971DD4870E5505277C |
SHA256: | 68033EA85E8B64B35B75A31DD09F5D2E8A8BA9825BD0AEB4E50EBBE1930BB171 |
SSDEEP: | 96:LnoEOxYovoycCidxhJJ4AP22cEK/OKtGx:7okPJNP22cpWKtGx |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
5684 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\7787789878977897978989778.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
3688 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
5308 | "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\xgfo2pk3.cmdline" | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Visual C# Command Line Compiler Exit code: 0 Version: 4.8.9037.0 built by: NET481REL1 Modules
| |||||||||||||||
5036 | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES6DF0.tmp" "c:\Users\admin\AppData\Local\Temp\CSC3050894897864795831EAE634A8FE78A.TMP" | C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 14.32.31326.0 Modules
|
PID | Process | Filename | Type | |
---|---|---|---|---|
5684 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\13VB2XTG8M49U7C7VDPV.temp | binary | |
MD5:EF9973D536759DDAD25CFFA306BB2E9F | SHA256:FB1BD772F0FF48313C72D53A0D68CA9D900B2010B1164B53E44C12EFB8795D14 | |||
5684 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tysqlhqr.nbc.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
5684 | powershell.exe | C:\Users\admin\AppData\Local\Temp\xgfo2pk3.cmdline | text | |
MD5:ED562058F7C466513AB59099A618006A | SHA256:236344FB67EC7C2A7EA5316D22264CC1BF98B8D4B5395F7BBC09EFDB14659ED8 | |||
5684 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms | binary | |
MD5:EF9973D536759DDAD25CFFA306BB2E9F | SHA256:FB1BD772F0FF48313C72D53A0D68CA9D900B2010B1164B53E44C12EFB8795D14 | |||
5684 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_oabzkgkq.3q1.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
5308 | csc.exe | C:\Users\admin\AppData\Local\Temp\xgfo2pk3.out | text | |
MD5:CCCC651EE38C7714C2FD4AF9D2022F69 | SHA256:8B86105CF18577ADA940A3957F33DFE0F10BC470ED1B7B808139E5C97993B92D | |||
5308 | csc.exe | C:\Users\admin\AppData\Local\Temp\xgfo2pk3.dll | executable | |
MD5:46C884D7097EDBFB6179687277EA6873 | SHA256:E1F77194F12534D54D58F779E19EF67B0FBE8EFFFBE574A99E72C09811E26E94 | |||
5684 | powershell.exe | C:\Users\admin\AppData\Local\Temp\xgfo2pk3.0.cs | text | |
MD5:A7D9A76211E72735D60D5A4C4CB446FB | SHA256:D5838EFC7DABC739A7D28E3D56BEC835283E0702DDE06399AE1F06404361B630 | |||
5308 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSC3050894897864795831EAE634A8FE78A.TMP | binary | |
MD5:F85D67730FCD770B80E84868D29CB8A0 | SHA256:C863D88855B9FB79E60EEB3CF549AE18F2711DC5D5B80596F22310ED1681C514 | |||
5684 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF13615d.TMP | binary | |
MD5:D040F64E9E7A2BB91ABCA5613424598E | SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.37.237.227:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 2.16.241.19:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
4536 | svchost.exe | GET | 200 | 23.37.237.227:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 2.16.241.19:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4536 | svchost.exe | 23.37.237.227:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.37.237.227:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4536 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4712 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3976 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
Domain | IP | Reputation |
---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |