| File name: | pg.ps1 |
| Full analysis: | https://app.any.run/tasks/ea751c7c-0300-4921-891d-077e5535ca9b |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | May 15, 2025, 12:42:56 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | Non-ISO extended-ASCII text, with LF, NEL line terminators |
| MD5: | E55284D0B3DC01176F3AF139BBC796ED |
| SHA1: | A80F0791FD8B06BABB229A2D440B1C70CEE4557E |
| SHA256: | 8B56AA16BCB0861022CF43F10EEF8303644B1908D0F5AD4B617948369CA3D919 |
| SSDEEP: | 96:KmPEYpJPmvu4Qts98TzVJfcC0uSAA27QUH:K4EOOvu4EsIfcduV/7QUH |
MALICIOUS
Bypass execution policy to execute commands
- powershell.exe (PID: 6516)
- powershell.exe (PID: 4920)
Changes powershell execution policy (Bypass)
- powershell.exe (PID: 6516)
SUSPICIOUS
The process bypasses the loading of PowerShell profile settings
- powershell.exe (PID: 6516)
Checks a user's role membership (POWERSHELL)
- powershell.exe (PID: 6516)
- powershell.exe (PID: 4920)
Removes files via Powershell
- powershell.exe (PID: 1164)
The process executes Powershell scripts
- powershell.exe (PID: 6516)
Starts POWERSHELL.EXE for commands execution
- powershell.exe (PID: 6516)
Application launched itself
- powershell.exe (PID: 6516)
PowerShell delay command usage (probably sleep evasion)
- powershell.exe (PID: 1164)
Detected use of alternative data streams (AltDS)
- powershell.exe (PID: 4920)
The process creates files with name similar to system file names
- powershell.exe (PID: 4920)
Executable content was dropped or overwritten
- powershell.exe (PID: 4920)
- pack.exe (PID: 6080)
Process drops legitimate windows executable
- powershell.exe (PID: 4920)
Starts a Microsoft application from unusual location
- DismHost.exe (PID: 7592)
Connects to unusual port
- powershell.exe (PID: 4920)
Searches for installed software
- TiWorker.exe (PID: 7692)
Uses RUNDLL32.EXE to load library
- cmd.exe (PID: 6392)
Potential Corporate Privacy Violation
- powershell.exe (PID: 4920)
Starts CMD.EXE for commands execution
- pack.exe (PID: 6080)
Executes as Windows Service
- VSSVC.exe (PID: 7764)
INFO
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 1164)
Checks if a key exists in the options dictionary (POWERSHELL)
- powershell.exe (PID: 4920)
The executable file from the user directory is run by the Powershell process
- DismHost.exe (PID: 7592)
- pack.exe (PID: 6080)
The sample compiled with english language support
- powershell.exe (PID: 4920)
Reads the computer name
- DismHost.exe (PID: 7592)
Checks supported languages
- DismHost.exe (PID: 7592)
Reads Environment values
- DismHost.exe (PID: 7592)
Manages system restore points
- SrTasks.exe (PID: 5072)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .669 | | | Composer 669 module (100) |
|---|
Total processes
157
Monitored processes
19
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1164 | "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Start-Sleep -Seconds 3; Remove-Item -Path 'C:\Users\admin\AppData\Local\Temp\wrapper_812050533.ps1' -Force; Remove-Item -Path '' -Force | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4000 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4188 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4920 | "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\wrapper_812050533.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5072 | C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:11 | C:\Windows\System32\SrTasks.exe | — | TiWorker.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Microsoft® Windows System Protection background tasks. Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5964 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | pack.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6032 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6080 | "C:\Users\admin\AppData\Local\Temp\pack.exe" | C:\Users\admin\AppData\Local\Temp\pack.exe | powershell.exe | ||||||||||||
User: admin Integrity Level: HIGH Exit code: 0 Modules
| |||||||||||||||
| 6392 | C:\WINDOWS\system32\cmd.exe /c start rundll32.exe C:\Users\admin\AppData\Local\Temp\jwlbMSrBLX.TTF,GO | C:\Windows\System32\cmd.exe | — | pack.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6516 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\AppData\Local\Temp\pg.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
39 355
Read events
38 264
Write events
593
Delete events
498
Modification events
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRULegacy |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\* |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\crt |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\exe |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\lnk |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\xpi |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (4920) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppBadgeUpdated |
| Operation: | delete key | Name: | (default) |
Value: | |||
Executable files
52
Suspicious files
10
Text files
12
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6516 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\W599NTJGS91VUQJOXBNM.temp | binary | |
MD5:EEEC77826BD5746535894E9871BF3571 | SHA256:E63878A17312C533872276F95D191C31EF433337319EE823B08D9EC616DD0B47 | |||
| 6516 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10c1ea.TMP | binary | |
MD5:D040F64E9E7A2BB91ABCA5613424598E | SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670 | |||
| 6516 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ka1tamsa.n45.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1164 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_olbflhax.rbo.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4920 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LE9K7Y1L608QZH5F093Q.temp | binary | |
MD5:B9F1942C2262FF857B7792C392E4AD41 | SHA256:FD4F39E9D482D73E1C6C7AA93314B86E697C4467E230B4D68C63CCDDA1AE7E4B | |||
| 4920 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10d294.TMP | binary | |
MD5:EEEC77826BD5746535894E9871BF3571 | SHA256:E63878A17312C533872276F95D191C31EF433337319EE823B08D9EC616DD0B47 | |||
| 1164 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4z3trdum.0a1.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4920 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_m0zpxg4a.lqn.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 6516 | powershell.exe | C:\Users\admin\AppData\Local\Temp\wrapper_812050533.ps1 | text | |
MD5:ACD3B0C887BC0DFE2422D42304A7C378 | SHA256:A9C9B8C83E6AF8AF5660BC116429F8C6A68B02E76A8BD0E5A9E6C4FBF4E787E5 | |||
| 6516 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ufukprrp.pzw.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
33
DNS requests
17
Threats
4
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.164:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7928 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
7928 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4920 | powershell.exe | GET | 200 | 150.138.81.219:1005 | http://150.138.81.219:1005/dat/pack.dat | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2316 | RUXIMICS.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.48.23.164:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2104 | svchost.exe | 51.124.78.146:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.31.131:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
4920 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
4920 | powershell.exe | Potential Corporate Privacy Violation | ET INFO PE EXE or DLL Windows file download HTTP |
4920 | powershell.exe | Potentially Bad Traffic | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response |
4920 | powershell.exe | Misc activity | ET INFO Packed Executable Download |