File name:

1click.cmd

Full analysis: https://app.any.run/tasks/a18c5d89-9564-4a6d-8cea-bf70102e9fde
Verdict: Malicious activity
Analysis date: April 10, 2025, 13:36:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with very long lines (1298), with CRLF line terminators
MD5:

94C3F6B998627923D7869277E6FFDEE1

SHA1:

7B7F366DFF9655543E146E4950F2AB9B85B77987

SHA256:

ADE548F8424282341FB2E5FAAD4D0CC206898983D3E62107635A653E5BA9727C

SSDEEP:

48:Wigr61lOqoXucXuuAh4qhKgzq1zpHD17Pp5xfmxbZlT/8ZxGg0q4Y:jgr61lOqKumuDvsJJP1MZlAP0LY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6264)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 5508)
      • cscript.exe (PID: 7840)
      • cscript.exe (PID: 7384)
      • cscript.exe (PID: 7388)
      • cscript.exe (PID: 7876)
      • cscript.exe (PID: 4920)
      • cscript.exe (PID: 7888)
      • cscript.exe (PID: 7900)

    • The process creates files with name similar to system file names

      • WerFault.exe (PID: 8060)
      • WerFault.exe (PID: 5556)
      • WerFault.exe (PID: 7260)
      • WerFault.exe (PID: 7424)

    • Accesses computer name via WMI (SCRIPT)

      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6264)
      • cscript.exe (PID: 7388)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 4920)
      • cscript.exe (PID: 7888)
      • cscript.exe (PID: 5508)
      • cscript.exe (PID: 7840)
      • cscript.exe (PID: 7876)
      • cscript.exe (PID: 7384)
      • cscript.exe (PID: 7900)

    • Gets the drive type (SCRIPT)

      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6264)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 5508)
      • cscript.exe (PID: 7388)
      • cscript.exe (PID: 4920)
      • cscript.exe (PID: 7384)
      • cscript.exe (PID: 7840)
      • cscript.exe (PID: 7888)
      • cscript.exe (PID: 7876)
      • cscript.exe (PID: 7900)

    • Gets a collection of all available drive names (SCRIPT)

      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 6264)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 5508)
      • cscript.exe (PID: 7388)
      • cscript.exe (PID: 7384)
      • cscript.exe (PID: 4920)
      • cscript.exe (PID: 7888)
      • cscript.exe (PID: 7876)
      • cscript.exe (PID: 7900)
      • cscript.exe (PID: 7840)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 6264)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 7388)
      • cscript.exe (PID: 5508)
      • cscript.exe (PID: 4920)
      • cscript.exe (PID: 7384)
      • cscript.exe (PID: 7876)
      • cscript.exe (PID: 7840)
      • cscript.exe (PID: 7888)
      • cscript.exe (PID: 7900)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6264)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 7388)
      • cscript.exe (PID: 5508)
      • cscript.exe (PID: 7888)
      • cscript.exe (PID: 4920)
      • cscript.exe (PID: 7876)
      • cscript.exe (PID: 7384)
      • cscript.exe (PID: 7840)
      • cscript.exe (PID: 7900)

    • Executes application which crashes

      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 6264)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 5508)

    • The process executes VB scripts

      • cmd.exe (PID: 7288)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6264)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 5508)

    • Application launched itself

      • cmd.exe (PID: 7288)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7288)

    • Sets XML DOM element text (SCRIPT)

      • cscript.exe (PID: 7840)

  • INFO

    • Reads the software policy settings

      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 5508)
      • cscript.exe (PID: 7388)
      • cscript.exe (PID: 7900)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 7952)
      • cscript.exe (PID: 8152)
      • cscript.exe (PID: 4300)
      • cscript.exe (PID: 6036)
      • cscript.exe (PID: 7900)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 8060)
      • WerFault.exe (PID: 5556)
      • WerFault.exe (PID: 7424)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
27
Malicious processes
14
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs cscript.exe no specs sppextcomobj.exe no specs slui.exe no specs cscript.exe werfault.exe no specs cscript.exe werfault.exe no specs cmd.exe no specs cscript.exe werfault.exe no specs cscript.exe werfault.exe no specs cscript.exe werfault.exe no specs cscript.exe werfault.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs find.exe no specs choice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3768find /i "successful" C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
4008C:\WINDOWS\system32\cmd.exe /c dir /b ..\root\Licenses16\proplusvl_mak*.xrm-msC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
4300cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlusVL_MAK-pl.xrm-ms" C:\Windows\System32\cscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
3221225477
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4920cscript //nologo ospp.vbs /unpkey:DRTFM C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5508cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms" C:\Windows\System32\cscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
3221225477
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5556C:\WINDOWS\system32\WerFault.exe -u -p 8152 -s 1540C:\Windows\System32\WerFault.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
6036cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlusVL_MAK-ul-oob.xrm-ms" C:\Windows\System32\cscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
3221225477
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6264cscript ospp.vbs /inslic:"..\root\Licenses16\ProPlusVL_MAK-ppd.xrm-ms" C:\Windows\System32\cscript.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
3221225477
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6324C:\WINDOWS\system32\WerFault.exe -u -p 6036 -s 1488C:\Windows\System32\WerFault.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
6392C:\WINDOWS\system32\WerFault.exe -u -p 6264 -s 1328C:\Windows\System32\WerFault.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
Total events
51 997
Read events
51 997
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
12
Unknown types
14

Dropped files

PID
Process
Filename
Type
8060WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cscript.exe_62b6f5ddb4f9b32f9faaaa562a56d6d8f11b6a_d25c8a3a_01b59542-3f86-4f0a-bb98-d354a25d3cd6\Report.wer —
MD5:—
SHA256:—
5556WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cscript.exe_62b6f5ddb4f9b32f9faaaa562a56d6d8f11b6a_d25c8a3a_d533fa49-eeb2-437c-85ea-b088ed80e8de\Report.wer —
MD5:—
SHA256:—
7260WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cscript.exe_62b6f5ddb4f9b32f9faaaa562a56d6d8f11b6a_d25c8a3a_3fff7c1c-0516-4b9d-8bd2-c2d1ee23149d\Report.wer —
MD5:—
SHA256:—
6392WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cscript.exe_62b6f5ddb4f9b32f9faaaa562a56d6d8f11b6a_d25c8a3a_9766ac0f-c3a8-4d6a-877b-b8674ddebe4b\Report.wer —
MD5:—
SHA256:—
7260WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD823.tmp.WERInternalMetadata.xmlxml
MD5:D97D90DE86C8AFB70FF18964785FD2BC
SHA256:C93563AC7C52F2515658B870968466CF005E82535D5F3BEEEEDD9D16F11400BE
7372cscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:33F1B29F7D894A40FD67288154001FD5
SHA256:4C1E62054B332B4431CDE5E5957DD23DE361847496046B6E5B00C85631550882
8060WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\cscript.exe.7952.dmpdmp
MD5:9A3E5B226A561EB9AD8912D37F23D2AF
SHA256:61BE114F6519837DF12E0AFE8B5AB16DA5F29E71614238E3445CF04CB1100A52
5556WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD312.tmp.WERInternalMetadata.xmlxml
MD5:B449C25387400454C91BF0D859962283
SHA256:A374B1D017BD4ED94886669AB980550B85D16FBD3FFFAF081FA6424233C51201
6324WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_cscript.exe_62b6f5ddb4f9b32f9faaaa562a56d6d8f11b6a_d25c8a3a_8544eb85-bb52-460c-bda9-6db4c97457e9\Report.wer —
MD5:—
SHA256:—
7372cscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\36AC0BE60E1243344AE145F746D881FEder
MD5:411D4C6D9068F0593E05D0F67B46BF77
SHA256:743747DD59C21B0ECD5328A93F31A5D89A9765AFC6740C4963EBA797AA383043
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
17
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7196
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7196
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.20:80
—
Akamai International B.V.
DE
unknown
—
—
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7464
WmiPrvSE.exe
40.91.76.224:443
activation.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.0
  • 40.126.31.128
  • 40.126.31.71
  • 20.190.159.128
  • 40.126.31.129
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
activation.sls.microsoft.com
  • 40.91.76.224
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1click.cmd