analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://github.com/massgravel/Microsoft-Activation-Scripts/releases/download/1.4/MAS_1.4_Password_1234.7z

Full analysis: https://app.any.run/tasks/419f8071-969c-4134-afa7-b61251334301
Verdict: Malicious activity
Analysis date: November 08, 2020, 23:17:27
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

897944509CD4DC505345AA056C5DE1B3

SHA1:

3AAE5C3C3C6139B09024B645A6C0077C7A25727F

SHA256:

8477BBF103F66AEF837AC271389A6FE36603390D250D9E8B88751129FE690536

SSDEEP:

3:N8tEd4PKoHXuukGR3RLLLGXUoKkCU9yeEsn:2uuPKzukGv/LGXU169yBsn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 2400)

    • Executes PowerShell scripts

      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 4048)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 1868)

  • SUSPICIOUS

    • Executes scripts

      • cmd.exe (PID: 1768)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 1768)
      • cmd.exe (PID: 4048)
      • cmd.exe (PID: 2700)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 3084)
      • cmd.exe (PID: 1868)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 1768)
      • cscript.exe (PID: 748)
      • cmd.exe (PID: 4048)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 1868)

    • Uses RUNDLL32.EXE to load library

      • cscript.exe (PID: 748)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3540)
      • expand.exe (PID: 2436)
      • expand.exe (PID: 3288)

    • Application launched itself

      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 1768)
      • cmd.exe (PID: 4048)
      • cmd.exe (PID: 2792)
      • cmd.exe (PID: 1868)

    • Creates files in the user directory

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 1796)
      • powershell.exe (PID: 4056)
      • powershell.exe (PID: 2844)
      • powershell.exe (PID: 2820)
      • powershell.exe (PID: 2400)
      • powershell.exe (PID: 2960)
      • powershell.exe (PID: 2232)
      • powershell.exe (PID: 2716)
      • powershell.exe (PID: 3728)

    • Starts CHOICE.EXE (used to create a delay)

      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 2792)

    • Creates files in the Windows directory

      • expand.exe (PID: 2436)
      • powershell.exe (PID: 632)
      • powershell.exe (PID: 1796)
      • powershell.exe (PID: 2400)
      • expand.exe (PID: 3288)
      • powershell.exe (PID: 2960)

    • Removes files from Windows directory

      • expand.exe (PID: 2436)
      • powershell.exe (PID: 632)
      • cmd.exe (PID: 2792)
      • expand.exe (PID: 3288)
      • powershell.exe (PID: 2400)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2328)
      • iexplore.exe (PID: 524)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2328)

    • Changes internet zones settings

      • iexplore.exe (PID: 2328)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2328)

    • Manual execution by user

      • cmd.exe (PID: 1768)
      • cmd.exe (PID: 2792)

    • Creates files in the user directory

      • iexplore.exe (PID: 524)
      • iexplore.exe (PID: 2328)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2328)

    • Application launched itself

      • iexplore.exe (PID: 2328)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
103
Monitored processes
57
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe winrar.exe cmd.exe no specs cmd.exe no specs reg.exe no specs cscript.exe no specs rundll32.exe no specs cmd.exe cmd.exe no specs reg.exe no specs mode.com no specs choice.exe no specs mode.com no specs choice.exe no specs mode.com no specs choice.exe no specs mode.com no specs choice.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs expand.exe powershell.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs mode.com no specs powershell.exe no specs cmd.exe no specs reg.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe cmd.exe no specs reg.exe no specs mode.com no specs choice.exe no specs mode.com no specs choice.exe no specs powershell.exe no specs csc.exe cvtres.exe no specs expand.exe powershell.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs mode.com no specs powershell.exe no specs cmd.exe no specs reg.exe no specs powershell.exe no specs powershell.exe no specs timeout.exe no specs mode.com no specs choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2328"C:\Program Files\Internet Explorer\iexplore.exe" "https://github.com/massgravel/Microsoft-Activation-Scripts/releases/download/1.4/MAS_1.4_Password_1234.7z"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
524"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2328 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
3540"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\MAS_1.4_Password_1234.7z"C:\Program Files\WinRAR\WinRAR.exe
iexplore.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
1768cmd /c ""C:\Users\admin\Desktop\MAS_1.4\All-In-One-Version\MAS_1.4_AIO_CRC32_9A7B5B05.cmd" "C:\Windows\system32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3984C:\Windows\system32\cmd.exe /c verC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3164reg query HKU\S-1-5-19 C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
748cscript //NoLogo "C:\Users\admin\AppData\Local\Temp\admin.vbs" /File:"C:\Users\admin\Desktop\MAS_1.4\All-In-One-Version\MAS_1.4_AIO_CRC32_9A7B5B05.cmd" -elC:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2960rundll32 kernel32,SleepC:\Windows\system32\rundll32.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2112"C:\Windows\System32\cmd.exe" /c ""C:\Users\admin\Desktop\MAS_1.4\All-In-One-Version\MAS_1.4_AIO_CRC32_9A7B5B05.cmd" -el"C:\Windows\System32\cmd.exe
cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225547
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3880C:\Windows\system32\cmd.exe /c verC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
4 410
Read events
3 767
Write events
0
Delete events
0

Modification events

No data
Executable files
11
Suspicious files
41
Text files
29
Unknown types
7

Dropped files

PID
Process
Filename
Type
524iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab9BC9.tmp —
MD5:—
SHA256:—
524iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar9BCA.tmp —
MD5:—
SHA256:—
524iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\CH8BIGW1.txt —
MD5:—
SHA256:—
2328iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF38C514969631F4BA.TMP —
MD5:—
SHA256:—
2328iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\MAS_1.4_Password_1234.7z.cprywjb.partial:Zone.Identifier —
MD5:—
SHA256:—
524iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1E698CCB2C296D265AC1A253974E09FD_507D8E76B9B181409C8E098B073B8415binary
MD5:810D1B79F3302071FECD734E7C523698
SHA256:F831DA173595B2A07D2393BD4C8AC6D1E4817B2AA35713D305D5F9D9D1DF7135
524iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_B00CE8D5D4CF0E959CFDB61F636A135Dbinary
MD5:2E4E884756F87FC802ED7CF198630BB1
SHA256:6BB026978E9F36E3FA6204AB45A972F492CFF2C580683D505700E824ADDBD7A3
524iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_B00CE8D5D4CF0E959CFDB61F636A135Dder
MD5:F79DDAD9F93F0C31C98F6B2F566F6082
SHA256:FA4F1D39C4A13D2D68577DF083F540564CAC8DCB022986941D69D8526D628DC8
524iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_EE9DB89C3D6A328B5FEAFF0ED3C77874binary
MD5:0EBA9AA7798CDE9C6B5EB1071080185B
SHA256:F17821F2F2C07F590DC615968C4D805593DCFA719E591FEF228EDE67D514CBCB
524iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5ABder
MD5:737A6A1FEB777F35C52ACA882FEE2E26
SHA256:C45C3C7B15A90A5F67EB79DCC7048B5453027F8421AE10C570AC13D27DDDA1D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
13
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
524
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
2328
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
524
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAGC%2BAmOouYmuRo7J4Qfua8%3D
US
der
1.47 Kb
whitelisted
524
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuqL92L3tjkN67RNFF%2FEdvT6NEzAQUwBKyKHRoRmfpcCV0GgBFWwZ9XEQCEAgt9o7pxpMVvr9yB5s4EP0%3D
US
der
471 b
whitelisted
524
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAVXyAsoJoOhewoRRJMpa3k%3D
US
der
471 b
whitelisted
2328
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
2328
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2328
iexplore.exe
204.79.197.200:443
ieonline.microsoft.com
Microsoft Corporation
US
whitelisted
524
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2328
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2328
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
524
iexplore.exe
52.216.28.204:443
github-production-release-asset-2e65be.s3.amazonaws.com
Amazon.com, Inc.
US
shared
524
iexplore.exe
140.82.121.4:443
github.com
—
US
malicious

DNS requests

Domain
IP
Reputation
github.com
  • 140.82.121.4
shared
ocsp.digicert.com
  • 93.184.220.29
whitelisted
github-production-release-asset-2e65be.s3.amazonaws.com
  • 52.216.28.204
shared
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted

Threats

No threats detected
Process
Message
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/massgravel/Microsoft-Activation-Scripts/releases/download/1.4/MAS_1.4_Password_1234.7z