File name:

SharkHack.exe

Full analysis: https://app.any.run/tasks/4124e25b-080f-49dd-80b1-b06549fd5865
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 21, 2025, 19:02:35
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
umbralstealer
stealer
discord
exfiltration
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

031A4AD4EE7B4B79C16B1D17B8C6CDF2

SHA1:

BF2D9B5C88D8BA3E00EC4461D49AB6ACA6DADD1B

SHA256:

8D7CDADC3FB3E90255E9DD09C29E533C46C559F38E8F6473B1646D2832771B87

SSDEEP:

98304:tpfwJ0Wa0jZAJ7O2YEHY+WAFJDT2f9kxo52m1Nw2wcDsWaeULnzDtHi7IyjIablK:tp+Kq6pe56

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Winlogon.exe (PID: 6644)

    • Create files in the Startup directory

      • Winlogon.exe (PID: 6644)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 6784)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 6784)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 6784)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 6784)

    • Adds path to the Windows Defender exclusion list

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 6784)

    • Changes settings for real-time protection

      • powershell.exe (PID: 6784)

    • XWORM has been detected (YARA)

      • Winlogon.exe (PID: 6644)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 6784)

    • UMBRALSTEALER has been detected (SURICATA)

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Steals credentials from Web Browsers

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Actions looks like stealing of personal data

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Starts CMD.EXE for self-deleting

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • SharkHack.exe (PID: 6496)
      • SharkHack.exe (PID: 6608)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)

    • Executable content was dropped or overwritten

      • SharkHack.exe (PID: 6496)
      • Winlogon.exe (PID: 6644)
      • SharkHack.exe (PID: 6608)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • The process creates files with name similar to system file names

      • SharkHack.exe (PID: 6496)

    • Uses WMIC.EXE to obtain Windows Installer data

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 6976)
      • WMIC.exe (PID: 6588)
      • WMIC.exe (PID: 5968)

    • Checks Windows Trust Settings

      • SharkHack.exe (PID: 6608)

    • Reads the date of Windows installation

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)

    • Application launched itself

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)

    • Connects to unusual port

      • Winlogon.exe (PID: 6644)

    • Uses ATTRIB.EXE to modify file attributes

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Script adds exclusion path to Windows Defender

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Starts POWERSHELL.EXE for commands execution

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Checks for external IP

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)
      • svchost.exe (PID: 2192)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Script disables Windows Defender's IPS

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Script disables Windows Defender's real-time protection

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Accesses operating system name via WMI (SCRIPT)

      • WMIC.exe (PID: 3576)

    • Uses WMIC.EXE to obtain computer system information

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Uses WMIC.EXE to obtain operating system information

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Accesses video controller name via WMI (SCRIPT)

      • WMIC.exe (PID: 6788)

    • The process connected to a server suspected of theft

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Starts CMD.EXE for commands execution

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Uses WMIC.EXE to obtain a list of video controllers

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

  • INFO

    • Checks supported languages

      • SharkHack.exe (PID: 6496)
      • WindowsPowerShell.exe (PID: 6628)
      • Winlogon.exe (PID: 6644)
      • SharkHack.exe (PID: 6608)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)

    • Reads the computer name

      • SharkHack.exe (PID: 6496)
      • SharkHack.exe (PID: 6608)
      • Winlogon.exe (PID: 6644)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)
      • WindowsPowerShell.exe (PID: 6628)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)

    • Reads the machine GUID from the registry

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)
      • SharkHack.exe (PID: 6608)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)
      • Winlogon.exe (PID: 6644)

    • Checks proxy server information

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)
      • SharkHack.exe (PID: 6608)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Process checks computer location settings

      • SharkHack.exe (PID: 6496)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)

    • Create files in a temporary directory

      • SharkHack.exe (PID: 6496)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6976)
      • WMIC.exe (PID: 6588)
      • WMIC.exe (PID: 3576)
      • WMIC.exe (PID: 4444)
      • WMIC.exe (PID: 5968)
      • WMIC.exe (PID: 6788)

    • Reads the software policy settings

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)
      • SharkHack.exe (PID: 6608)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Creates files or folders in the user directory

      • SharkHack.exe (PID: 6608)
      • Winlogon.exe (PID: 6644)

    • Creates files in the program directory

      • Winlogon.exe (PID: 6644)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)

    • Disables trace logs

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)

    • Reads Environment values

      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6472)
      • Õîñò ïðèëîæåíèé .NET Framework.exe (PID: 6676)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5592)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5592)
      • powershell.exe (PID: 6784)
      • powershell.exe (PID: 5836)
      • powershell.exe (PID: 6484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6644) Winlogon.exe
C2guest-lanka.gl.at.ply.gg:14484
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
Mutexn2zO2LoYIcbD5AhS
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (9.1)
.scr | Windows screen saver (8.4)
.exe | Win32 Executable (generic) (2.9)
.exe | Win16/32 Executable Delphi generic (1.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 5120
InitializedDataSize: 5126144
UninitializedDataSize: -
EntryPoint: 0x20cc
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
34
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start sharkhack.exe sharkhack.exe windowspowershell.exe no specs #XWORM winlogon.exe õîñò ïðèëîæåíèé .net framework.exe wmic.exe no specs conhost.exe no specs svchost.exe #UMBRALSTEALER õîñò ïðèëîæåíèé .net framework.exe wmic.exe no specs conhost.exe no specs attrib.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2168ping localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3576"wmic.exe" os get CaptionC:\Windows\System32\wbem\WMIC.exe—Õîñò ïðèëîæåíèé .NET Framework.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
3820\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3876\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4444"wmic.exe" computersystem get totalphysicalmemoryC:\Windows\System32\wbem\WMIC.exe—Õîñò ïðèëîæåíèé .NET Framework.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
5592"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\admin\AppData\Local\Temp\Õîñò ïðèëîæåíèé .NET Framework.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Õîñò ïðèëîæåíèé .NET Framework.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—attrib.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5836"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITYC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Õîñò ïðèëîæåíèé .NET Framework.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5968"wmic.exe" csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—Õîñò ïðèëîæåíèé .NET Framework.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
Total events
27 823
Read events
27 801
Write events
22
Delete events
0

Modification events

(PID) Process:(6496) SharkHack.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6608) SharkHack.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6608) SharkHack.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6608) SharkHack.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6644) Winlogon.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Winlogon
Value:
C:\ProgramData\Winlogon.exe
(PID) Process:(6676) Õîñò ïðèëîæåíèé .NET Framework.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Õîñò ïðèëîæåíèé _RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6676) Õîñò ïðèëîæåíèé .NET Framework.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Õîñò ïðèëîæåíèé _RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6676) Õîñò ïðèëîæåíèé .NET Framework.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Õîñò ïðèëîæåíèé _RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6676) Õîñò ïðèëîæåíèé .NET Framework.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Õîñò ïðèëîæåíèé _RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6676) Õîñò ïðèëîæåíèé .NET Framework.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Õîñò ïðèëîæåíèé _RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
Executable files
8
Suspicious files
9
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
6644Winlogon.exeC:\ProgramData\Winlogon.exeexecutable
MD5:12FC976616E4E5B81CD8EC5C966C6B4A
SHA256:BF8169826729CBACDD1FD89103B7F2EF255DC21A6C1EAE59028E47272DB9DD4A
6608SharkHack.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0Bbinary
MD5:C8DB4CB346CD6A126AAE650044050DED
SHA256:E757CFDB30CB0FEC35D88122185B877CA0417D232CCD45DBC65940B342782678
6496SharkHack.exeC:\Users\admin\AppData\Local\Temp\Winlogon.exeexecutable
MD5:12FC976616E4E5B81CD8EC5C966C6B4A
SHA256:BF8169826729CBACDD1FD89103B7F2EF255DC21A6C1EAE59028E47272DB9DD4A
6496SharkHack.exeC:\Users\admin\AppData\Local\Temp\SharkHack.exeexecutable
MD5:DE1829AF1A22BBF3E19E47A95429801F
SHA256:24DE9F578A10C496DBED85D9E01A1BAE955F317E93717988E39E9049CE4896C2
5592powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hgwfyulu.ygc.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6608SharkHack.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0Bbinary
MD5:A2875A98138F8BE82B48668CAA412F83
SHA256:E073C7BE1EB054388D0F9222DE3516EA3ED870AA5712696C15B3A10B32D3833D
5592powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_gfdwiqzr.hsd.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6496SharkHack.exeC:\Users\admin\AppData\Local\Temp\Õîñò ïðèëîæåíèé .NET Framework.exeexecutable
MD5:9EA8EBBF96404E04CFA46464484A50D2
SHA256:5EEB5D7CC0180AA783FDE468F5B821CE5378D48B71504BB926C82F09DE569DE9
6608SharkHack.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\OperaSetup[1].exeexecutable
MD5:9636CC3E8AA52DD26887CE77496C32E2
SHA256:B3F69F13FA66DA62BC2DC68FECFD4D6EB7A19365C9EE8AD08592D098D068824D
6644Winlogon.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Winlogon.lnkbinary
MD5:5BBF29D6591839720F208E6B8A09D2D5
SHA256:F90756938F485056B0512A3B5CF83CA91A6241BE65433361E33A208DD21BCF56
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
57
DNS requests
25
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1536
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.217.18.99:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
760
lsass.exe
GET
200
172.217.18.99:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6676
Õîñò ïðèëîæåíèé .NET Framework.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6608
SharkHack.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6472
Õîñò ïðèëîæåíèé .NET Framework.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.110.177:443
—
Akamai International B.V.
DE
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1536
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3032
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6608
SharkHack.exe
188.114.96.3:443
shark-software.ru
CLOUDFLARENET
NL
unknown
5064
SearchApp.exe
2.16.110.121:443
—
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 184.24.77.37
  • 184.24.77.35
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
google.com
  • 142.250.186.110
whitelisted
shark-software.ru
  • 188.114.96.3
  • 188.114.97.3
unknown
c.pki.goog
  • 172.217.18.99
whitelisted
gstatic.com
  • 142.250.186.99
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
net.geo.opera.com
  • 185.26.182.112
  • 185.26.182.111
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6676
Õîñò ïðèëîæåíèé .NET Framework.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6676
Õîñò ïðèëîæåíèé .NET Framework.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6472
Õîñò ïðèëîæåíèé .NET Framework.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6472
Õîñò ïðèëîæåíèé .NET Framework.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2192
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
2192
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
2192
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
6472
Õîñò ïðèëîæåíèé .NET Framework.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SharkHack.exe