File name:

gaze.exe

Full analysis: https://app.any.run/tasks/420d1961-7f25-473f-a550-3bf28d6a2bb3
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: February 05, 2024, 23:35:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386, for MS Windows
MD5:

47386EE20A6A94830EE4FA38B419A6F7

SHA1:

EE4575CF9818636781677D63236D3DC65652DEAB

SHA256:

736DE79E0A2D08156BAE608B2A3E63336829D59D38D61907642149A566EBD270

SSDEEP:

12288:fSNRvIULdPvv84Sex/nsroQ9QPooisHszx8a/ikU7fwgjMOJgf6aKX3RRGvRT73s:QDvoxPN99AzRKSvXhQioLdGpjyzj+fN/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 2528)
      • net.exe (PID: 3332)
      • net.exe (PID: 3356)
      • net.exe (PID: 1932)
      • net.exe (PID: 1072)
      • net.exe (PID: 3060)
      • net.exe (PID: 3012)
      • net.exe (PID: 3432)
      • net.exe (PID: 3888)
      • net.exe (PID: 2948)
      • net.exe (PID: 3624)
      • net.exe (PID: 1812)
      • net.exe (PID: 3788)
      • net.exe (PID: 4028)
      • net.exe (PID: 2924)
      • net.exe (PID: 3148)
      • net.exe (PID: 2472)
      • net.exe (PID: 1432)
      • net.exe (PID: 3716)
      • net.exe (PID: 2844)
      • net.exe (PID: 2328)
      • net.exe (PID: 1888)
      • net.exe (PID: 2892)
      • net.exe (PID: 2580)
      • net.exe (PID: 2692)
      • net.exe (PID: 1348)
      • net.exe (PID: 1740)
      • net.exe (PID: 2364)
      • gaze.exe (PID: 752)
      • net.exe (PID: 3912)
      • net.exe (PID: 2564)
      • net.exe (PID: 3948)
      • net.exe (PID: 3992)
      • net.exe (PID: 2968)
      • net.exe (PID: 1544)
      • net.exe (PID: 1232)
      • net.exe (PID: 3976)
      • net.exe (PID: 1344)
      • net.exe (PID: 1168)
      • net.exe (PID: 4076)
      • net.exe (PID: 1172)
      • net.exe (PID: 3756)
      • net.exe (PID: 2556)
      • net.exe (PID: 2796)
      • net.exe (PID: 3380)
      • net.exe (PID: 3600)
      • net.exe (PID: 3644)
      • net.exe (PID: 2176)
      • net.exe (PID: 1864)
      • net.exe (PID: 2468)
      • net.exe (PID: 3768)
      • net.exe (PID: 3448)
      • net.exe (PID: 3672)
      • net.exe (PID: 3772)
      • net.exe (PID: 2440)
      • net.exe (PID: 1776)
      • net.exe (PID: 3212)
      • net.exe (PID: 1692)
      • net.exe (PID: 3940)
      • net.exe (PID: 956)
      • net.exe (PID: 2900)
      • net.exe (PID: 2596)
      • net.exe (PID: 3928)
      • net.exe (PID: 3868)
      • net.exe (PID: 2916)
      • net.exe (PID: 3240)
      • net.exe (PID: 748)
      • net.exe (PID: 2060)
      • net.exe (PID: 3504)
      • net.exe (PID: 332)
      • net.exe (PID: 2204)
      • net.exe (PID: 3040)
      • net.exe (PID: 3216)
      • net.exe (PID: 3572)
      • net.exe (PID: 3320)
      • net.exe (PID: 3884)
      • net.exe (PID: 4036)
      • net.exe (PID: 3368)
      • net.exe (PID: 3916)
      • net.exe (PID: 2332)
      • net.exe (PID: 880)
      • net.exe (PID: 1796)
      • net.exe (PID: 2876)
      • net.exe (PID: 896)
      • net.exe (PID: 908)
      • net.exe (PID: 2184)
      • net.exe (PID: 3308)
      • net.exe (PID: 1288)
      • net.exe (PID: 1380)
      • net.exe (PID: 1540)
      • net.exe (PID: 1404)
      • net.exe (PID: 3604)
      • net.exe (PID: 1696)
      • net.exe (PID: 2232)
      • net.exe (PID: 2064)
      • net.exe (PID: 3980)
      • net.exe (PID: 2384)
      • net.exe (PID: 2544)
      • net.exe (PID: 4020)
      • net.exe (PID: 3664)
      • net.exe (PID: 2228)
      • net.exe (PID: 3268)
      • net.exe (PID: 1836)
      • net.exe (PID: 3736)
      • net.exe (PID: 2292)
      • net.exe (PID: 796)
      • net.exe (PID: 2388)
      • net.exe (PID: 2560)
      • net.exe (PID: 2308)
      • net.exe (PID: 2336)
      • net.exe (PID: 1816)
      • net.exe (PID: 668)
      • net.exe (PID: 3748)
      • net.exe (PID: 3284)
      • net.exe (PID: 3956)
      • net.exe (PID: 3376)
      • net.exe (PID: 3264)
      • net.exe (PID: 3612)
      • net.exe (PID: 292)
      • net.exe (PID: 3080)
      • net.exe (PID: 2636)
      • net.exe (PID: 2896)
      • net.exe (PID: 2072)
      • net.exe (PID: 980)
      • net.exe (PID: 548)
      • net.exe (PID: 3276)
      • net.exe (PID: 2856)
      • net.exe (PID: 784)
      • net.exe (PID: 2740)
      • net.exe (PID: 3660)
      • net.exe (PID: 696)
      • net.exe (PID: 3000)
      • net.exe (PID: 3596)
      • net.exe (PID: 664)
      • net.exe (PID: 3968)
      • net.exe (PID: 2572)
      • net.exe (PID: 3840)
      • net.exe (PID: 4108)
      • net.exe (PID: 2904)
      • net.exe (PID: 3164)
      • net.exe (PID: 1560)
      • net.exe (PID: 2080)
      • net.exe (PID: 3988)
      • net.exe (PID: 1196)
      • net.exe (PID: 3104)
      • net.exe (PID: 4308)
      • net.exe (PID: 4272)
      • net.exe (PID: 4232)
      • net.exe (PID: 4472)
      • net.exe (PID: 4680)
      • net.exe (PID: 4348)
      • net.exe (PID: 4388)
      • net.exe (PID: 4428)
      • net.exe (PID: 4512)
      • net.exe (PID: 4556)
      • net.exe (PID: 4600)
      • net.exe (PID: 4640)
      • net.exe (PID: 4836)
      • net.exe (PID: 4720)
      • net.exe (PID: 4760)
      • net.exe (PID: 4800)
      • net.exe (PID: 4880)
      • net.exe (PID: 4916)
      • net.exe (PID: 4152)
      • net.exe (PID: 4192)
      • net.exe (PID: 5120)
      • net.exe (PID: 5076)
      • net.exe (PID: 5040)
      • net.exe (PID: 5156)
      • net.exe (PID: 5196)
      • net.exe (PID: 5236)
      • net.exe (PID: 5276)
      • net.exe (PID: 5320)
      • net.exe (PID: 5360)
      • net.exe (PID: 5396)
      • net.exe (PID: 5440)
      • net.exe (PID: 5600)
      • net.exe (PID: 5480)
      • net.exe (PID: 5516)
      • net.exe (PID: 5560)
      • net.exe (PID: 5636)
      • net.exe (PID: 5720)
      • net.exe (PID: 5680)
      • net.exe (PID: 4956)
      • net.exe (PID: 5000)

    • Drops the executable file immediately after the start

      • gaze.exe (PID: 752)

    • Deletes shadow copies

      • gaze.exe (PID: 752)

    • Uses TASKKILL.EXE to kill antiviruses

      • gaze.exe (PID: 752)

    • Antivirus name has been found in the command line (generic signature)

      • taskkill.exe (PID: 4376)

    • Steals credentials

      • gaze.exe (PID: 752)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • gaze.exe (PID: 752)

    • Uses TASKKILL.EXE to kill Office Apps

      • gaze.exe (PID: 752)

    • Uses TASKKILL.EXE to kill Browsers

      • gaze.exe (PID: 752)

    • Uses TASKKILL.EXE to kill process

      • gaze.exe (PID: 752)

  • INFO

    • Checks supported languages

      • gaze.exe (PID: 752)

    • The dropped object may contain a URL to Tor Browser

      • gaze.exe (PID: 752)

    • Dropped object may contain TOR URL's

      • gaze.exe (PID: 752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:10 21:16:52+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.27
CodeSize: 492032
InitializedDataSize: 191488
UninitializedDataSize: -
EntryPoint: 0x38851
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
689
Monitored processes
418
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gaze.exe powershell.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124C:\Windows\system32\net1 stop "MSSQL$SHAREPOINT" /yC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
292net stop "sophossps" /yC:\Windows\System32\net.exe—gaze.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
316C:\Windows\system32\net1 stop "MBAMService" /yC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
324C:\Windows\system32\net1 stop "McAfeeFramework" /yC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
332net stop "MSSQL$SQL_2008" /yC:\Windows\System32\net.exe—gaze.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
376C:\Windows\system32\net1 stop "TrueKey" /yC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
452C:\Windows\system32\net1 stop "SQLAgent$VEEAMSQL2012" /yC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
492C:\Windows\system32\net1 stop "EsgShKernel" /yC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
548net stop "SQLAgent$SHAREPOINT" /yC:\Windows\System32\net.exe—gaze.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
560C:\Windows\system32\net1 stop "Sophos MCS Agent" /yC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
Total events
5 180
Read events
5 180
Write events
0
Delete events
0

Modification events

No data
Executable files
10
Suspicious files
3 326
Text files
517
Unknown types
1

Dropped files

PID
Process
Filename
Type
1316powershell.exeC:\Users\admin\AppData\Local\Temp\z4vuwigb.wi4.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
752gaze.exeC:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\!!!READ_ME_MEDUSA!!!.txttext
MD5:9C5862568F86F3F55E2FFDE3569F8653
SHA256:80A8D10E9EB007F51C572AC7FFEEFBBDA7FF0E37ECDF1EF35B4F93103B2ED8CB
1316powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
1316powershell.exeC:\Users\admin\AppData\Local\Temp\zmcck325.2yl.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
752gaze.exeC:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\!!!READ_ME_MEDUSA!!!.txttext
MD5:9C5862568F86F3F55E2FFDE3569F8653
SHA256:80A8D10E9EB007F51C572AC7FFEEFBBDA7FF0E37ECDF1EF35B4F93103B2ED8CB
752gaze.exeC:\ProgramData\Microsoft\DeviceSync\!!!READ_ME_MEDUSA!!!.txttext
MD5:9C5862568F86F3F55E2FFDE3569F8653
SHA256:80A8D10E9EB007F51C572AC7FFEEFBBDA7FF0E37ECDF1EF35B4F93103B2ED8CB
752gaze.exeC:\ProgramData\Microsoft\eHome\!!!READ_ME_MEDUSA!!!.txttext
MD5:9C5862568F86F3F55E2FFDE3569F8653
SHA256:80A8D10E9EB007F51C572AC7FFEEFBBDA7FF0E37ECDF1EF35B4F93103B2ED8CB
752gaze.exeC:\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdfbinary
MD5:330D542C9076CAC7A621285515D0DC10
SHA256:8657F3AB855044F43DC78F0EA397B675649C3089C67B82D14142512B2556DA88
752gaze.exeC:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\!!!READ_ME_MEDUSA!!!.txttext
MD5:9C5862568F86F3F55E2FFDE3569F8653
SHA256:80A8D10E9EB007F51C572AC7FFEEFBBDA7FF0E37ECDF1EF35B4F93103B2ED8CB
752gaze.exeC:\ProgramData\Microsoft\MF\Pending.GRLbinary
MD5:C4C7403F72B8AE68900E9DBE838F0026
SHA256:D478628B9187B7640120A7ED81FA810430F6F69A5865D832F2058FEB8A4DF031
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
gaze.exe