File name:

Email-Worm.VBS.LoveLetter.vbs

Full analysis: https://app.any.run/tasks/59c0b699-a9f4-406b-8353-e143ce18c9a7
Verdict: Malicious activity
Analysis date: March 04, 2025, 05:38:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
eicar-test
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

23CD4244FD4EB14CA42F4AF89F576DAC

SHA1:

DF38F78F1C73B0996BA04DBCA849057BDA60FC1F

SHA256:

B283ED862DE0CEA47EAF84AA3F6B37000AE512FFC87A7A7799850EBA6CE130D4

SSDEEP:

12:05rIqXECnqA7DhccwLZdZBhfAy8wzyMakGLGy1:05UIE8FEZdZBhj8wzQkx4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • The EICAR Standard Anti-Virus Test File is detected

      • WinRAR.exe (PID: 3076)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • notepad++.exe (PID: 3352)
      • notepad++.exe (PID: 944)
      • ntvdm.exe (PID: 960)

  • INFO

    • Manual execution by a user

      • notepad++.exe (PID: 1880)
      • cmd.exe (PID: 1276)
      • WinRAR.exe (PID: 3076)
      • cmd.exe (PID: 268)
      • explorer.exe (PID: 3640)
      • notepad++.exe (PID: 3352)
      • notepad++.exe (PID: 944)
      • rundll32.exe (PID: 1772)
      • ntvdm.exe (PID: 960)
      • WinRAR.exe (PID: 3580)
      • ntvdm.exe (PID: 1332)
      • WinRAR.exe (PID: 2308)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
70
Monitored processes
17
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs notepad++.exe cmd.exe no specs winrar.exe cmd.exe no specs find.exe no specs find.exe no specs find.exe no specs find.exe no specs explorer.exe no specs notepad++.exe winrar.exe no specs notepad++.exe ntvdm.exe no specs ntvdm.exe no specs rundll32.exe no specs winrar.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Trojan.BAT.Crapbat.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
944"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Trojan.BAT.FormatCQ.bat"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
960"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\System32\ntvdm.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1276C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Virus.BAT.Ctty.bat" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1332"C:\Windows\system32\ntvdm.exe" -i2 C:\Windows\System32\ntvdm.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1772"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\Dutch_Tiny.163.bC:\Windows\System32\rundll32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1880"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\Trojan.BAT.Crapbat"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2308"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\Email-Worm.Win32.Alcaul.ak.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2448"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\Email-Worm.VBS.LoveLetter.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
1
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2760find /c "!" Virus.BAT.Ctty.batC:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (grep) Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 970
Read events
2 889
Write events
81
Delete events
0

Modification events

(PID) Process:(1880) notepad++.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3076) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3352) notepad++.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(3580) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Trojan.BAT.FormatCQ.zip
Executable files
53
Suspicious files
3 392
Text files
176
Unknown types
0

Dropped files

PID
Process
Filename
Type
3076WinRAR.exeC:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\09logtext
MD5:100428FCA645F08F792E45B0B3BF24A7
SHA256:84C35115E8046B0FA36FF98C65A0B505C8AE114606EE0A4259F14310D3EBB1DA
3076WinRAR.exeC:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\7son.284.abinary
MD5:6BACB88A242312208BF35F821F2F9A4A
SHA256:C62B56F3E39EE54320B054607659244807B2830F5CEF0D40EB30DA5666AA86D6
3076WinRAR.exeC:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\10past3.bbinary
MD5:11C8B7CB1CAC301AC807AD7B6C1C1C3F
SHA256:17F8C4BAD3AF16C5FDA1697ED958559A30CA778608E0E298FADA02F11ABF8B32
3076WinRAR.exeC:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\1_COMbinary
MD5:19E14970DF9FEB1CFE3AA285171AB192
SHA256:0C6E5AEF79152438869D451773C47D5E0BE0036E5A5C669919ADDBE87D658955
3076WinRAR.exeC:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\10past3.aexecutable
MD5:5A40985ED7DC4EAE11CB2A198DF7FD1A
SHA256:EF0DE637138E5FFC35387AD156AE93BA7A8D74E5AE07BF24A49A4F60A9ADC8BF
1880notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\session.xmltext
MD5:1386E8E0D3523EE1BEDF4F985E60552F
SHA256:F5F1648BC6B19FDD464B102F5F54E4B265C16102B3EDCB342B61A25E1F26129C
1880notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\config.xmlxml
MD5:75DAF0C838CA0F9DAA89D4074A504E1B
SHA256:97901B6DEF410AA997B0E91A0FD0947EB3A26B7D5C83FD7228FDE04F981AC53C
3076WinRAR.exeC:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\Ac-330.combinary
MD5:BB2AB0F79D2D4122622CA6E232FFB4BF
SHA256:63BB1F14688E86CF05AB2F77F4D9AD356613E0671CF429E3E5ECC6422F0EBCEC
3076WinRAR.exeC:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\8ball.bbinary
MD5:38EC5DDBE7EE27A0616924327DD595B2
SHA256:4B9165DCC6F208E0B422072B928B28B6584B5133F4BB852490A1BB5CBA1DC8F8
3076WinRAR.exeC:\Users\admin\Desktop\5251_Viruses_for_Anti-Virus_Testing\5251 Viruses for Anti-Virus Testing\ACDC.499binary
MD5:8561E3AAA203B91B39A8927AF2E5B068
SHA256:378B7B0BA4B7C716EDFED02DD6F272BA145270C7889B1A7C2592349EEC7FA3DE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Email-Worm.VBS.LoveLetter.vbs