File name:

Nuovo documento 2.vbs

Full analysis: https://app.any.run/tasks/3606bbf1-9f62-42fe-9523-882fb54e395d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 18, 2020, 09:32:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
loader
opendir
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

834F9F8690B3A21D51088A2FD1B04344

SHA1:

762A473B3B05E5B7FE9B2D2D6DCA3B89C70E6517

SHA256:

7867EF48CF88BD6F3EC0F1C811623F90FB272AEF5376BEF616BC1946D3C0DA99

SSDEEP:

49152:pwmMC1UqYRkWPwUzM2rN63RKmhKwlbO9VRZhd4aPxlJlDVMu4JVg/aY/9ItIMQOM:m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • WScript.exe (PID: 2524)
      • rundll32.exe (PID: 3064)
      • mmc.exe (PID: 280)

    • Downloads executable files from the Internet

      • WScript.exe (PID: 2524)

    • Application was injected by another process

      • svchost.exe (PID: 372)
      • svchost.exe (PID: 876)
      • SearchIndexer.exe (PID: 1376)

    • Runs injected code in another process

      • rundll32.exe (PID: 3064)

    • Application was dropped or rewritten from another process

      • TableOfColors.exe (PID: 2544)

    • Changes settings of System certificates

      • svchost.exe (PID: 372)

  • SUSPICIOUS

    • Reads the machine GUID from the registry

      • WScript.exe (PID: 2524)
      • rundll32.exe (PID: 3064)
      • mmc.exe (PID: 280)
      • rundll32.exe (PID: 2672)
      • svchost.exe (PID: 372)
      • DllHost.exe (PID: 2008)

    • Executed as Windows Service

      • rundll32.exe (PID: 3064)
      • lpremove.exe (PID: 1224)
      • vssvc.exe (PID: 2820)

    • Creates files in the program directory

      • SearchIndexer.exe (PID: 1376)

    • Executable content was dropped or overwritten

      • WScript.exe (PID: 2524)

    • Searches for installed software

      • rundll32.exe (PID: 3064)

    • Creates files in the Windows directory

      • rundll32.exe (PID: 3064)
      • svchost.exe (PID: 876)

    • Executed via Task Scheduler

      • TableOfColors.exe (PID: 2544)

    • Executed via COM

      • iexplore.exe (PID: 2188)
      • DllHost.exe (PID: 2008)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 2288)

    • Removes files from Windows directory

      • rundll32.exe (PID: 3064)

    • Adds / modifies Windows certificates

      • svchost.exe (PID: 372)

  • INFO

    • Manual execution by user

      • mmc.exe (PID: 1904)
      • mmc.exe (PID: 280)
      • control.exe (PID: 2288)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 2820)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2188)
      • svchost.exe (PID: 372)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2188)

    • Reads the machine GUID from the registry

      • iexplore.exe (PID: 2188)

    • Changes internet zones settings

      • iexplore.exe (PID: 2188)

    • Reads internet explorer settings

      • IEXPLORE.EXE (PID: 1764)
      • IEXPLORE.EXE (PID: 1052)

    • Creates files in the user directory

      • iexplore.exe (PID: 2188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
16
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inject inject inject wscript.exe rundll32.exe no specs lpremove.exe no specs svchost.exe svchost.exe searchindexer.exe vssvc.exe no specs mmc.exe no specs mmc.exe tableofcolors.exe no specs iexplore.exe iexplore.exe iexplore.exe control.exe no specs rundll32.exe no specs timedate.cpl no specs

Process information

PID
CMD
Path
Indicators
Parent process
280"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\system32\mmc.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mmc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mfc42u.dll
372C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
876C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1052"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:267521 /prefetch:2C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1224C:\Windows\system32\lpremove.exe C:\Windows\system32\lpremove.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
MUI Language pack cleanup
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\lpremove.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1376C:\Windows\system32\SearchIndexer.exe /EmbeddingC:\Windows\System32\SearchIndexer.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Indexer
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchindexer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1764"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:4134182 /prefetch:2C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files (x86)\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1904"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /sC:\Windows\system32\mmc.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Management Console
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\mmc.exe
c:\systemroot\system32\ntdll.dll
2008C:\Windows\system32\DllHost.exe /Processid:{9DF523B0-A6C0-4EA9-B5F1-F4565C3AC8B8}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2188"C:\Program Files\Internet Explorer\iexplore.exe" -EmbeddingC:\Program Files\Internet Explorer\iexplore.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
Total events
7 341
Read events
6 849
Write events
491
Delete events
1

Modification events

(PID) Process:(876) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0C8E4BF2-7AA8-4798-9BBB-3767F5B9E79A}
Operation:writeName:Path
Value:
\JqTsJFBtfxXlXEgXYaZlJqM
(PID) Process:(876) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0C8E4BF2-7AA8-4798-9BBB-3767F5B9E79A}
Operation:writeName:Hash
Value:
CEE3F101B0006DBD26A3BC54FAC7718709E55D54ACCC846D5E188852E087E748
(PID) Process:(876) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\JqTsJFBtfxXlXEgXYaZlJqM
Operation:writeName:Id
Value:
{0C8E4BF2-7AA8-4798-9BBB-3767F5B9E79A}
(PID) Process:(876) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\JqTsJFBtfxXlXEgXYaZlJqM
Operation:writeName:Index
Value:
3
(PID) Process:(876) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0C8E4BF2-7AA8-4798-9BBB-3767F5B9E79A}
Operation:writeName:Triggers
Value:
15000000000000000141A00100000000002D39C647E6D5010141A001000000000045465548E6D50178214100484848484659AF35484848480048484848484848004848484848484801000000484848481C00000048484848010500000000000515000000881744E889129CFD800D6733E8030000484848481C0000004848484855005300450052002D00500043005C00610064006D0069006E00000048484848380000004848484858020000100E000080F40300FFFFFFFF07000000000000000000000000000000000000000000000000000000000000000000000000000000DDDD0000000000000141A00100000000002D39C647E6D5010141A001000000000045465548E6D5010000000000000000000000000000000000000000000000002C01000000000000000000000000000000010000010000000000000000000000
(PID) Process:(876) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0C8E4BF2-7AA8-4798-9BBB-3767F5B9E79A}
Operation:writeName:DynamicInfo
Value:
03000000481F646A3EE6D50100000000000000000000000000000000
(PID) Process:(3064) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000009822726D3EE6D501F80B00003C070000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1224) lpremove.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MUI\Settings
Operation:writeName:NextSQMCollection
Value:
00946DB8FF2CD601
(PID) Process:(3064) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
4800000000000000E01CEE6D3EE6D501F80B00003C070000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3064) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000048A6F76D3EE6D501F80B00003C070000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
1
Suspicious files
35
Text files
15
Unknown types
6

Dropped files

PID
Process
Filename
Type
3064rundll32.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
372svchost.exeC:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb —
MD5:—
SHA256:—
372svchost.exeC:\Windows\system32\CatRoot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb —
MD5:—
SHA256:—
372svchost.exeC:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb —
MD5:—
SHA256:—
372svchost.exeC:\Windows\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb —
MD5:—
SHA256:—
372svchost.exeC:\Windows\System32\catroot2\edb.log —
MD5:—
SHA256:—
372svchost.exeC:\Windows\system32\CatRoot2\edb.log —
MD5:—
SHA256:—
3064rundll32.exeC:\System Volume Information\SPP\SppGroupCache\Temp_{17240B5A-7E57-4A52-A04C-7BE097032B15}_DriverPackageInfo —
MD5:—
SHA256:—
3064rundll32.exeVolume{4b10993c-02aa-11e8-b4df-806e6f6e6963}\System Volume Information\SPP\SppGroupCache\{17240B5A-7E57-4A52-A04C-7BE097032B15}_DriverPackageInfo —
MD5:—
SHA256:—
3064rundll32.exeC:\System Volume Information\SPP\SppCbsHiveStore\{cd42efe1-f6f1-427c-b004-033192c625a4}{C95922F0-6297-4045-B573-221ED1AC5D3D} —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
25
DNS requests
47
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2524
WScript.exe
GET
200
193.233.78.26:80
http://tohomeroom.com/pagkit56.php
RU
executable
169 Kb
suspicious
1052
IEXPLORE.EXE
GET
200
205.185.216.10:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?f5b9b13270df8749
US
compressed
55.4 Kb
whitelisted
1052
IEXPLORE.EXE
GET
200
205.185.216.10:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0690a4f73acfba96
US
compressed
55.4 Kb
whitelisted
1052
IEXPLORE.EXE
GET
200
192.35.177.64:80
http://apps.identrust.com/roots/dstrootcax3.p7c
US
cat
893 b
shared
1052
IEXPLORE.EXE
GET
200
192.35.177.64:80
http://apps.identrust.com/roots/dstrootcax3.p7c
US
cat
893 b
shared
1052
IEXPLORE.EXE
GET
200
205.185.216.10:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?2f5779c724ab95de
US
compressed
55.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2524
WScript.exe
193.233.78.26:80
tohomeroom.com
OOO FREEnet Group
RU
suspicious
1052
IEXPLORE.EXE
192.35.177.64:80
apps.identrust.com
IdenTrust
US
malicious
1052
IEXPLORE.EXE
45.140.169.211:443
dungdoptiop.xyz
—
—
unknown
1764
IEXPLORE.EXE
45.140.169.211:443
dungdoptiop.xyz
—
—
unknown
2188
iexplore.exe
45.140.169.211:443
dungdoptiop.xyz
—
—
unknown
2188
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2188
iexplore.exe
204.79.197.203:443
www.msn.com
Microsoft Corporation
US
malicious
2188
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
1052
IEXPLORE.EXE
205.185.216.10:80
ctldl.windowsupdate.com
Highwinds Network Group, Inc.
US
whitelisted
2188
iexplore.exe
2.22.134.59:443
go.microsoft.com
Akamai Technologies, Inc.
GB
unknown

DNS requests

Domain
IP
Reputation
teredo.ipv6.microsoft.com
  • —
whitelisted
tohomeroom.com
  • 193.233.78.26
suspicious
dns.msftncsi.com
  • 131.107.255.255
shared
dungdoptiop.xyz
  • 45.140.169.211
unknown
apps.identrust.com
  • 192.35.177.64
shared
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
whitelisted
ctldl.windowsupdate.com
  • 205.185.216.10
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Nuovo documento 2.vbs