| File name: | reachyb.bat |
| Full analysis: | https://app.any.run/tasks/6d120c22-8ea3-4827-96ef-7bb1bef09827 |
| Verdict: | Malicious activity |
| Analysis date: | June 27, 2022, 12:25:21 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/x-msdos-batch |
| File info: | DOS batch file, ASCII text, with CRLF line terminators |
| MD5: | 878DAC629300319E65DA2D51F01BEC84 |
| SHA1: | 4791E06614C4B716722C2CCBC49F9D90093D85E7 |
| SHA256: | 6EB0C1A39D888E23EFB58E0EAF9AA72C20EE06A5BBA4602E896D74091F8036F6 |
| SSDEEP: | 3:mKDDCMvAW1URoOY2idN+Kf9NoBWW0Rn:hWcVVWidN/96BWWo |
MALICIOUS
Runs app for hidden code execution
- cmd.exe (PID: 2928)
SUSPICIOUS
Checks supported languages
- cmd.exe (PID: 2928)
- cmd.exe (PID: 3820)
- cmd.exe (PID: 3296)
- cmd.exe (PID: 3580)
- cmd.exe (PID: 2232)
- cmd.exe (PID: 2132)
- cmd.exe (PID: 2644)
- cmd.exe (PID: 3796)
- cmd.exe (PID: 1964)
- cmd.exe (PID: 3572)
- cmd.exe (PID: 2172)
- cmd.exe (PID: 3892)
- cmd.exe (PID: 3888)
- cmd.exe (PID: 3836)
- cmd.exe (PID: 2116)
- cmd.exe (PID: 2872)
- cmd.exe (PID: 2616)
- cmd.exe (PID: 1932)
- cmd.exe (PID: 880)
- cmd.exe (PID: 760)
- cmd.exe (PID: 3772)
- cmd.exe (PID: 1236)
- cmd.exe (PID: 3832)
- cmd.exe (PID: 1156)
- cmd.exe (PID: 3048)
- cmd.exe (PID: 3484)
- cmd.exe (PID: 268)
- cmd.exe (PID: 3872)
- cmd.exe (PID: 2312)
- cmd.exe (PID: 2436)
- cmd.exe (PID: 2368)
- cmd.exe (PID: 2840)
- cmd.exe (PID: 3352)
- cmd.exe (PID: 3700)
- cmd.exe (PID: 1224)
- cmd.exe (PID: 2108)
- cmd.exe (PID: 2508)
- cmd.exe (PID: 2900)
- cmd.exe (PID: 2572)
- cmd.exe (PID: 2492)
- cmd.exe (PID: 2940)
- cmd.exe (PID: 3688)
- cmd.exe (PID: 3536)
- cmd.exe (PID: 3860)
- cmd.exe (PID: 3480)
- cmd.exe (PID: 3312)
- cmd.exe (PID: 1584)
- cmd.exe (PID: 2740)
- cmd.exe (PID: 1612)
- cmd.exe (PID: 3680)
- cmd.exe (PID: 3144)
- cmd.exe (PID: 4076)
- cmd.exe (PID: 2624)
- cmd.exe (PID: 3616)
- cmd.exe (PID: 3768)
- cmd.exe (PID: 2920)
- cmd.exe (PID: 2684)
- cmd.exe (PID: 956)
- cmd.exe (PID: 3828)
- cmd.exe (PID: 2480)
- cmd.exe (PID: 3348)
- cmd.exe (PID: 2400)
- cmd.exe (PID: 920)
- cmd.exe (PID: 2184)
- cmd.exe (PID: 764)
- cmd.exe (PID: 3412)
- cmd.exe (PID: 3268)
- cmd.exe (PID: 2188)
- cmd.exe (PID: 3972)
- cmd.exe (PID: 2908)
- cmd.exe (PID: 3204)
- cmd.exe (PID: 2720)
- cmd.exe (PID: 188)
- cmd.exe (PID: 2612)
- cmd.exe (PID: 2836)
- cmd.exe (PID: 4312)
- cmd.exe (PID: 3940)
- cmd.exe (PID: 4504)
- cmd.exe (PID: 5600)
- cmd.exe (PID: 6088)
- cmd.exe (PID: 5832)
- cmd.exe (PID: 4264)
- cmd.exe (PID: 4532)
- cmd.exe (PID: 4908)
- cmd.exe (PID: 5124)
- cmd.exe (PID: 5384)
- cmd.exe (PID: 5940)
- cmd.exe (PID: 4132)
- cmd.exe (PID: 4484)
- cmd.exe (PID: 4768)
- cmd.exe (PID: 4784)
- cmd.exe (PID: 5120)
- cmd.exe (PID: 5356)
- cmd.exe (PID: 5632)
- cmd.exe (PID: 6108)
- cmd.exe (PID: 4420)
- cmd.exe (PID: 4792)
- cmd.exe (PID: 5088)
- cmd.exe (PID: 5512)
- cmd.exe (PID: 5096)
- cmd.exe (PID: 5452)
- cmd.exe (PID: 5800)
- cmd.exe (PID: 4572)
- cmd.exe (PID: 4884)
- cmd.exe (PID: 5784)
- cmd.exe (PID: 4592)
- cmd.exe (PID: 5112)
- cmd.exe (PID: 5780)
- cmd.exe (PID: 4192)
- cmd.exe (PID: 5352)
- cmd.exe (PID: 4176)
- cmd.exe (PID: 4752)
- cmd.exe (PID: 4544)
- cmd.exe (PID: 6112)
- cmd.exe (PID: 4680)
- cmd.exe (PID: 5684)
- cmd.exe (PID: 5160)
- cmd.exe (PID: 5700)
- cmd.exe (PID: 5148)
- cmd.exe (PID: 5896)
- cmd.exe (PID: 5964)
- cmd.exe (PID: 4824)
- cmd.exe (PID: 5992)
- cmd.exe (PID: 5056)
- cmd.exe (PID: 5000)
- cmd.exe (PID: 4460)
- cmd.exe (PID: 5144)
- cmd.exe (PID: 4952)
- cmd.exe (PID: 3524)
- cmd.exe (PID: 4448)
- cmd.exe (PID: 4256)
- cmd.exe (PID: 5744)
- cmd.exe (PID: 6036)
- cmd.exe (PID: 4732)
- cmd.exe (PID: 5720)
- cmd.exe (PID: 4720)
- cmd.exe (PID: 5812)
- cmd.exe (PID: 5968)
- cmd.exe (PID: 5200)
- cmd.exe (PID: 116)
- cmd.exe (PID: 6576)
- cmd.exe (PID: 6324)
- cmd.exe (PID: 2820)
- cmd.exe (PID: 5936)
- cmd.exe (PID: 7604)
- cmd.exe (PID: 6352)
- cmd.exe (PID: 6168)
- cmd.exe (PID: 7360)
- cmd.exe (PID: 6928)
- cmd.exe (PID: 6644)
- cmd.exe (PID: 7268)
- cmd.exe (PID: 6872)
- cmd.exe (PID: 7100)
- cmd.exe (PID: 7860)
- cmd.exe (PID: 7748)
- cmd.exe (PID: 8132)
- cmd.exe (PID: 6288)
- cmd.exe (PID: 6940)
- cmd.exe (PID: 7244)
- cmd.exe (PID: 7896)
- cmd.exe (PID: 7472)
- cmd.exe (PID: 6552)
- cmd.exe (PID: 7560)
- cmd.exe (PID: 5168)
- cmd.exe (PID: 6884)
- cmd.exe (PID: 7628)
- cmd.exe (PID: 7996)
- cmd.exe (PID: 6384)
- cmd.exe (PID: 6772)
- cmd.exe (PID: 5952)
- cmd.exe (PID: 7328)
- cmd.exe (PID: 6284)
- cmd.exe (PID: 6656)
- cmd.exe (PID: 7184)
- cmd.exe (PID: 7572)
- cmd.exe (PID: 7912)
- cmd.exe (PID: 7052)
- cmd.exe (PID: 7540)
- cmd.exe (PID: 8052)
- cmd.exe (PID: 7556)
- cmd.exe (PID: 5212)
- cmd.exe (PID: 7220)
- cmd.exe (PID: 6592)
- cmd.exe (PID: 7692)
- cmd.exe (PID: 6936)
- cmd.exe (PID: 7588)
- cmd.exe (PID: 6440)
- cmd.exe (PID: 6908)
- cmd.exe (PID: 8168)
- cmd.exe (PID: 8164)
- cmd.exe (PID: 6680)
Application launched itself
- cmd.exe (PID: 2928)
Starts CMD.EXE for commands execution
- cmd.exe (PID: 2928)
INFO
Checks supported languages
- notepad.exe (PID: 3040)
- notepad.exe (PID: 3532)
- notepad.exe (PID: 3744)
- notepad.exe (PID: 848)
- notepad.exe (PID: 4040)
- notepad.exe (PID: 2176)
- notepad.exe (PID: 4008)
- notepad.exe (PID: 3996)
- notepad.exe (PID: 2220)
- notepad.exe (PID: 3316)
- notepad.exe (PID: 328)
- notepad.exe (PID: 1448)
- notepad.exe (PID: 2500)
- notepad.exe (PID: 1732)
- notepad.exe (PID: 928)
- notepad.exe (PID: 3220)
- notepad.exe (PID: 1036)
- notepad.exe (PID: 3992)
- notepad.exe (PID: 1820)
- notepad.exe (PID: 2712)
- notepad.exe (PID: 2352)
- notepad.exe (PID: 2488)
- notepad.exe (PID: 4032)
- notepad.exe (PID: 2396)
- notepad.exe (PID: 2884)
- notepad.exe (PID: 3392)
- notepad.exe (PID: 1984)
- notepad.exe (PID: 4092)
- notepad.exe (PID: 1768)
- notepad.exe (PID: 2560)
- notepad.exe (PID: 3168)
- notepad.exe (PID: 2760)
- notepad.exe (PID: 3624)
- notepad.exe (PID: 2024)
- notepad.exe (PID: 2032)
- notepad.exe (PID: 3252)
- notepad.exe (PID: 2288)
- notepad.exe (PID: 1132)
- notepad.exe (PID: 1024)
- notepad.exe (PID: 2880)
- notepad.exe (PID: 2800)
- notepad.exe (PID: 2736)
- notepad.exe (PID: 3096)
- notepad.exe (PID: 3856)
- notepad.exe (PID: 3808)
- notepad.exe (PID: 3708)
- notepad.exe (PID: 2672)
- notepad.exe (PID: 2524)
- notepad.exe (PID: 3032)
- notepad.exe (PID: 3592)
- notepad.exe (PID: 400)
- notepad.exe (PID: 616)
- notepad.exe (PID: 3192)
- notepad.exe (PID: 2772)
- notepad.exe (PID: 2460)
- notepad.exe (PID: 892)
- notepad.exe (PID: 3420)
- notepad.exe (PID: 3500)
- notepad.exe (PID: 3012)
- notepad.exe (PID: 2776)
- notepad.exe (PID: 1856)
- notepad.exe (PID: 3240)
- notepad.exe (PID: 1780)
- notepad.exe (PID: 2968)
- notepad.exe (PID: 2392)
- notepad.exe (PID: 2268)
- notepad.exe (PID: 2464)
- notepad.exe (PID: 3676)
- notepad.exe (PID: 2640)
- notepad.exe (PID: 3080)
- notepad.exe (PID: 1792)
- notepad.exe (PID: 3008)
- notepad.exe (PID: 2320)
- notepad.exe (PID: 4740)
- notepad.exe (PID: 5048)
- notepad.exe (PID: 5276)
- notepad.exe (PID: 5972)
- notepad.exe (PID: 5536)
- notepad.exe (PID: 5772)
- notepad.exe (PID: 4136)
- notepad.exe (PID: 2656)
- notepad.exe (PID: 3448)
- notepad.exe (PID: 4228)
- notepad.exe (PID: 4436)
- notepad.exe (PID: 4400)
- notepad.exe (PID: 4684)
- notepad.exe (PID: 4996)
- notepad.exe (PID: 5252)
- notepad.exe (PID: 5548)
- notepad.exe (PID: 5816)
- notepad.exe (PID: 6116)
- notepad.exe (PID: 4368)
- notepad.exe (PID: 4632)
- notepad.exe (PID: 5028)
- notepad.exe (PID: 5620)
- notepad.exe (PID: 5348)
- notepad.exe (PID: 6004)
- notepad.exe (PID: 5732)
- notepad.exe (PID: 6124)
- notepad.exe (PID: 4472)
- notepad.exe (PID: 4808)
- notepad.exe (PID: 5248)
- notepad.exe (PID: 4320)
- notepad.exe (PID: 4664)
- notepad.exe (PID: 2984)
- notepad.exe (PID: 5392)
- notepad.exe (PID: 5672)
- notepad.exe (PID: 6060)
- notepad.exe (PID: 4292)
- notepad.exe (PID: 5460)
- notepad.exe (PID: 4920)
- notepad.exe (PID: 4272)
- notepad.exe (PID: 4816)
- notepad.exe (PID: 5560)
- notepad.exe (PID: 5856)
- notepad.exe (PID: 5948)
- notepad.exe (PID: 4216)
- notepad.exe (PID: 4872)
- notepad.exe (PID: 5416)
- notepad.exe (PID: 5420)
- notepad.exe (PID: 4848)
- notepad.exe (PID: 5396)
- notepad.exe (PID: 4904)
- notepad.exe (PID: 5204)
- notepad.exe (PID: 5840)
- notepad.exe (PID: 5576)
- notepad.exe (PID: 4104)
- notepad.exe (PID: 4540)
- notepad.exe (PID: 5868)
- notepad.exe (PID: 5660)
- notepad.exe (PID: 5164)
- notepad.exe (PID: 4516)
- notepad.exe (PID: 5568)
- notepad.exe (PID: 5292)
- notepad.exe (PID: 5232)
- notepad.exe (PID: 4956)
- notepad.exe (PID: 6764)
- notepad.exe (PID: 4864)
- notepad.exe (PID: 4364)
- notepad.exe (PID: 4776)
- notepad.exe (PID: 4596)
- notepad.exe (PID: 5188)
- notepad.exe (PID: 6252)
- notepad.exe (PID: 6512)
- notepad.exe (PID: 7012)
- notepad.exe (PID: 6500)
- notepad.exe (PID: 8072)
- notepad.exe (PID: 6248)
- notepad.exe (PID: 7084)
- notepad.exe (PID: 7280)
- notepad.exe (PID: 7544)
- notepad.exe (PID: 7780)
- notepad.exe (PID: 6832)
- notepad.exe (PID: 7428)
- notepad.exe (PID: 7644)
- notepad.exe (PID: 7956)
- notepad.exe (PID: 6480)
- notepad.exe (PID: 7464)
- notepad.exe (PID: 4916)
- notepad.exe (PID: 6136)
- notepad.exe (PID: 7132)
- notepad.exe (PID: 7804)
- notepad.exe (PID: 8068)
- notepad.exe (PID: 6412)
- notepad.exe (PID: 7484)
- notepad.exe (PID: 6152)
- notepad.exe (PID: 6572)
- notepad.exe (PID: 6972)
- notepad.exe (PID: 4380)
- notepad.exe (PID: 6744)
- notepad.exe (PID: 7124)
- notepad.exe (PID: 7872)
- notepad.exe (PID: 7172)
- notepad.exe (PID: 6596)
- notepad.exe (PID: 8184)
- notepad.exe (PID: 7936)
- notepad.exe (PID: 6904)
- notepad.exe (PID: 7764)
- notepad.exe (PID: 6192)
- notepad.exe (PID: 7792)
- notepad.exe (PID: 6200)
- notepad.exe (PID: 8180)
- notepad.exe (PID: 7532)
- notepad.exe (PID: 8116)
- notepad.exe (PID: 6732)
- notepad.exe (PID: 7352)
- notepad.exe (PID: 7320)
- notepad.exe (PID: 7848)
- notepad.exe (PID: 8020)
- notepad.exe (PID: 8148)
- notepad.exe (PID: 7296)
- notepad.exe (PID: 7580)
- notepad.exe (PID: 6376)
- notepad.exe (PID: 6228)
- notepad.exe (PID: 6164)
- notepad.exe (PID: 7324)
- notepad.exe (PID: 7508)
- notepad.exe (PID: 6304)
- notepad.exe (PID: 7880)
- notepad.exe (PID: 6692)
- notepad.exe (PID: 6708)
- notepad.exe (PID: 7876)
- notepad.exe (PID: 6232)
- notepad.exe (PID: 7080)
- notepad.exe (PID: 6320)
- notepad.exe (PID: 7564)
- notepad.exe (PID: 7832)
- notepad.exe (PID: 7396)
- notepad.exe (PID: 6620)
- notepad.exe (PID: 6556)
- notepad.exe (PID: 6408)
- notepad.exe (PID: 6640)
- notepad.exe (PID: 7248)
- notepad.exe (PID: 7488)
- notepad.exe (PID: 6560)
- notepad.exe (PID: 8648)
- notepad.exe (PID: 9152)
- notepad.exe (PID: 9444)
- notepad.exe (PID: 9708)
- notepad.exe (PID: 9972)
- notepad.exe (PID: 10236)
- notepad.exe (PID: 8404)
- notepad.exe (PID: 8920)
- notepad.exe (PID: 8720)
- notepad.exe (PID: 9420)
- notepad.exe (PID: 9704)
- notepad.exe (PID: 8208)
- notepad.exe (PID: 8588)
- notepad.exe (PID: 8468)
- notepad.exe (PID: 9068)
- notepad.exe (PID: 9968)
- notepad.exe (PID: 8452)
- notepad.exe (PID: 9848)
- notepad.exe (PID: 8836)
- notepad.exe (PID: 9248)
- notepad.exe (PID: 9640)
- notepad.exe (PID: 10052)
- notepad.exe (PID: 8880)
- notepad.exe (PID: 9200)
- notepad.exe (PID: 9560)
- notepad.exe (PID: 10156)
- notepad.exe (PID: 8724)
- notepad.exe (PID: 8316)
- notepad.exe (PID: 9584)
- notepad.exe (PID: 8232)
- notepad.exe (PID: 10016)
- notepad.exe (PID: 8780)
- notepad.exe (PID: 9336)
- notepad.exe (PID: 9240)
- notepad.exe (PID: 9816)
- notepad.exe (PID: 9144)
- notepad.exe (PID: 8088)
- notepad.exe (PID: 10188)
- notepad.exe (PID: 6224)
- notepad.exe (PID: 9416)
- notepad.exe (PID: 10144)
- notepad.exe (PID: 8644)
- notepad.exe (PID: 8628)
- notepad.exe (PID: 9736)
- notepad.exe (PID: 9048)
- notepad.exe (PID: 9780)
- notepad.exe (PID: 10208)
- notepad.exe (PID: 9360)
- notepad.exe (PID: 9232)
- notepad.exe (PID: 9900)
- notepad.exe (PID: 8972)
- notepad.exe (PID: 8280)
- notepad.exe (PID: 9004)
- notepad.exe (PID: 9044)
- notepad.exe (PID: 8432)
- notepad.exe (PID: 9808)
- notepad.exe (PID: 9468)
- notepad.exe (PID: 8472)
- notepad.exe (PID: 8616)
- notepad.exe (PID: 10172)
- notepad.exe (PID: 3648)
- notepad.exe (PID: 7008)
- notepad.exe (PID: 1372)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
868
Monitored processes
557
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 116 | cmd.exe | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 188 | cmd.exe | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 268 | cmd.exe | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 328 | notepad.exe | C:\Windows\system32\notepad.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 400 | notepad.exe | C:\Windows\system32\notepad.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 616 | notepad.exe | C:\Windows\system32\notepad.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 736 | cmd.exe | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 760 | cmd.exe | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 764 | cmd.exe | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 848 | notepad.exe | C:\Windows\system32\notepad.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
6 864
Read events
6 864
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report