analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

beacon.ps1

Full analysis: https://app.any.run/tasks/09d834d3-cf40-4e82-8b0b-3f6d0859747d
Verdict: Malicious activity
Analysis date: November 29, 2020, 15:05:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines
MD5:

ED9D08107E4D236C9DF74D8EA56B19C3

SHA1:

15ADEE8B275A71327364F09CF4210F69FE9FCC37

SHA256:

A444D5B737747C9F5F5CDAEFFE5F2B139D99A742B54F231A72E9BFE8B2705CE8

SSDEEP:

6144:RPfDAJeqCzqdF13o5MpDjUTd/L7rz5BonMr/W+XskRH1mDr:RPfDnqCz4FdXFUxT/V2nw5Xe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • PowerShell script executed

      • powershell.exe (PID: 2580)
    • Creates files in the user directory

      • powershell.exe (PID: 2580)
  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
36
Monitored processes
1
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
2580"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\Desktop\beacon.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
297
Read events
236
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2580powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LUL4GQKBT24NLO97NO31.temp
MD5:
SHA256:
2580powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:A4A2A9FD05FAE4B5A98AF9A593F981AE
SHA256:47ED91B1B78B086262ADF1016099190E42C0B622002E04E72F8CFE50AE18DB4A
2580powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RFfc990.TMPbinary
MD5:A4A2A9FD05FAE4B5A98AF9A593F981AE
SHA256:47ED91B1B78B086262ADF1016099190E42C0B622002E04E72F8CFE50AE18DB4A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2580
powershell.exe
52.14.18.129:14635
2.tcp.ngrok.io
Amazon.com, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
2.tcp.ngrok.io
  • 52.14.18.129
whitelisted

Threats

PID
Process
Class
Message
Potential Corporate Privacy Violation
ET POLICY DNS Query to a *.ngrok domain (ngrok.io)
No debug info