URL:

x.com

Full analysis: https://app.any.run/tasks/435dd001-d05c-4e63-b97f-9d3fbe221813
Verdict: Malicious activity
Analysis date: February 27, 2024, 14:31:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

9A4323A3426983AB24744F3FDBD15200

SHA1:

71AC3B64AD14777054A74CA197A7C160E61562D1

SHA256:

7F7ED12DFE7AF503DB4F7D8CFA1A264A4F9610FD6677B8AE297EB9DFAFAB279D

SSDEEP:

3:4n:4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • reg.exe (PID: 3148)
      • reg.exe (PID: 568)
      • reg.exe (PID: 1928)
      • reg.exe (PID: 2112)
      • reg.exe (PID: 2308)
      • reg.exe (PID: 2068)
      • reg.exe (PID: 2448)
      • reg.exe (PID: 2316)
      • reg.exe (PID: 1768)
      • reg.exe (PID: 2156)
      • reg.exe (PID: 2576)
      • reg.exe (PID: 3312)
      • reg.exe (PID: 2944)

  • SUSPICIOUS

    • Reads the Internet Settings

      • powershell.exe (PID: 2068)
      • powershell.exe (PID: 2448)
      • powershell.exe (PID: 2820)
      • powershell.exe (PID: 2668)
      • powershell.exe (PID: 3036)
      • powershell.exe (PID: 2852)
      • powershell.exe (PID: 2192)
      • powershell.exe (PID: 3568)
      • powershell.exe (PID: 3148)
      • powershell.exe (PID: 3404)
      • powershell.exe (PID: 848)
      • powershell.exe (PID: 2112)
      • powershell.exe (PID: 2108)
      • powershell.exe (PID: 4092)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 2448)
      • powershell.exe (PID: 2820)
      • powershell.exe (PID: 2668)
      • powershell.exe (PID: 3036)
      • powershell.exe (PID: 2852)
      • powershell.exe (PID: 3568)
      • powershell.exe (PID: 3148)
      • powershell.exe (PID: 3404)
      • powershell.exe (PID: 2192)
      • powershell.exe (PID: 848)
      • powershell.exe (PID: 2112)
      • powershell.exe (PID: 2108)
      • powershell.exe (PID: 4092)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 984)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 984)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 316)
      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 3632)
      • cmd.exe (PID: 2648)
      • cmd.exe (PID: 3140)
      • cmd.exe (PID: 1780)
      • cmd.exe (PID: 1492)
      • cmd.exe (PID: 2964)
      • cmd.exe (PID: 1288)
      • cmd.exe (PID: 1652)

    • Powershell scripting: start process

      • cmd.exe (PID: 984)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 2448)
      • powershell.exe (PID: 2820)
      • powershell.exe (PID: 2668)
      • powershell.exe (PID: 3036)
      • powershell.exe (PID: 2852)
      • powershell.exe (PID: 2192)
      • powershell.exe (PID: 3568)
      • powershell.exe (PID: 3148)
      • powershell.exe (PID: 3404)
      • powershell.exe (PID: 848)
      • powershell.exe (PID: 2112)
      • powershell.exe (PID: 4092)
      • powershell.exe (PID: 2108)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 316)
      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 2648)
      • cmd.exe (PID: 3140)
      • cmd.exe (PID: 3632)
      • cmd.exe (PID: 1492)
      • cmd.exe (PID: 2964)
      • cmd.exe (PID: 1780)
      • cmd.exe (PID: 1288)
      • cmd.exe (PID: 1652)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 1384)

    • Manual execution by a user

      • cmd.exe (PID: 984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
234
Monitored processes
168
Malicious processes
1
Suspicious processes
25

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs timeout.exe no specs net1.exe no specs net.exe no specs powershell.exe no specs cmd.exe net.exe no specs timeout.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net1.exe no specs net.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs reg.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe net.exe no specs timeout.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net1.exe no specs net.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net1.exe no specs net.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net1.exe no specs net.exe no specs powershell.exe no specs cmd.exe net.exe no specs timeout.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe timeout.exe no specs net.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe net1.exe no specs net.exe no specs timeout.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs timeout.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316"C:\Windows\System32\cmd.exe" /C "C:\Users\admin\Desktop\test.bat" C:\Windows\System32\cmd.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
448"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3888 --field-trial-handle=1332,i,11719122761088438670,6008917233430165441,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
480reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
532timeout /t 1 /nobreak C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
568reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
584timeout /t 1 /nobreak C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
664net session C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
668reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
680reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
748reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
31 066
Read events
30 875
Write events
185
Delete events
6

Modification events

(PID) Process:(1384) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1384) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1384) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1384) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1384) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1384) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(1384) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(1384) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
7D990A2CF4702F00
(PID) Process:(1384) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault
Operation:delete valueName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
(PID) Process:(1384) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
Executable files
1
Suspicious files
127
Text files
66
Unknown types
18

Dropped files

PID
Process
Filename
Type
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF17f54d.TMP —
MD5:—
SHA256:—
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF17f57b.TMP —
MD5:—
SHA256:—
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF17f5ca.TMP —
MD5:—
SHA256:—
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:DF0BCCD68449F07F531D76F53C718178
SHA256:12025F4DA9E53A8B91892D4F6E6A9B89513F3488BFE9F1EEEC3C05F7EF96BDD8
3672msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:886E82F2CA62ECCCE64601B30592078A
SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Last Versiontext
MD5:61FE7896F9494DCDF53480A325F4FB85
SHA256:ACFD3CD36E0DFCF1DCB67C7F31F2A5B9BA0815528A0C604D4330DFAA9E683E51
1384msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old~RF17f54d.TMPtext
MD5:A9B940DA81B2E13D048EBB32E79FA414
SHA256:9061129705411EA6CFDD34177BF841CC85EB857BA909D3C4AA69BE8A5C59A8B0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
33
DNS requests
44
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1492
msedge.exe
GET
301
104.244.42.129:80
http://x.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1492
msedge.exe
104.244.42.129:80
x.com
TWITTER
US
unknown
1384
msedge.exe
239.255.255.250:1900
—
—
—
unknown
1492
msedge.exe
13.107.21.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1492
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1492
msedge.exe
104.244.42.65:443
x.com
TWITTER
US
unknown
1492
msedge.exe
104.244.42.194:443
api.twitter.com
TWITTER
US
unknown
1492
msedge.exe
152.199.21.141:443
abs.twimg.com
EDGECAST
US
unknown

DNS requests

Domain
IP
Reputation
x.com
  • 104.244.42.129
  • 104.244.42.193
  • 104.244.42.1
  • 104.244.42.65
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
twitter.com
  • 104.244.42.1
  • 104.244.42.65
  • 104.244.42.129
  • 104.244.42.193
whitelisted
abs.twimg.com
  • 152.199.21.141
whitelisted
api.twitter.com
  • 104.244.42.194
  • 104.244.42.2
  • 104.244.42.66
  • 104.244.42.130
whitelisted
api.x.com
  • 104.244.42.2
  • 104.244.42.66
  • 104.244.42.130
  • 104.244.42.194
unknown
video.twimg.com
  • 68.232.34.217
whitelisted
t.co
  • 104.244.42.5
  • 104.244.42.133
  • 104.244.42.69
  • 104.244.42.197
shared
pbs.twimg.com
  • 199.232.188.159
whitelisted

Threats

No threats detected
No debug info