File name: | String-Buddy.ps1 |
Full analysis: | https://app.any.run/tasks/c7ea8c63-0679-433e-a0c7-6f854b292989 |
Verdict: | Malicious activity |
Analysis date: | December 18, 2018, 11:11:56 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | UTF-8 Unicode (with BOM) text, with CRLF line terminators |
MD5: | 9ED25030F5B673BD9F2380647BE0EA92 |
SHA1: | 3E071033F58693E8741A9051F5BBDE3EE4EB2CC5 |
SHA256: | B50D6465B90EAD5365C6FD13B4B28046830B33CCE6D1F35FD7B31014EEFBA920 |
SSDEEP: | 96:ik8OHOl09jWVvW2bseJW2buK35bK3kw/+Xvwuk:s6EW2bdW2bF2/+Xvwuk |
.txt | | | Text - UTF-8 encoded (100) |
---|
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
2988 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\String-Buddy.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3624 | "C:\Program Files\Opera\opera.exe" | C:\Program Files\Opera\opera.exe | explorer.exe | |
User: admin Company: Opera Software Integrity Level: MEDIUM Description: Opera Internet Browser Exit code: 0 Version: 1748 |
PID | Process | Filename | Type | |
---|---|---|---|---|
2988 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NSJTZYTCTPOCNIT492GO.temp | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\oprCB07.tmp | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\oprCB56.tmp | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\cache\sesn\opr0000V.tmp | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V20OK83HL2YEWIQ3OAPF.temp | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\oprE799.tmp | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\icons\https%3A%2F%2Fwww.nu.nl%2Fstatic%2Fimg%2Fatoms%2Fimages%2Ffavicon%2Ffavicon-32x32.png | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\icons\https%3A%2F%2Fwww.nu.nl%2Fstatic%2Fimg%2Fatoms%2Fimages%2Ffavicon%2Ffavicon.png | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Local\Opera\Opera\icons\https%3A%2F%2Fwww.nu.nl%2Fstatic%2Fimg%2Fatoms%2Fimages%2Ffavicon%2Ffavicon-96x96.png | — | |
MD5:— | SHA256:— | |||
3624 | opera.exe | C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat | binary | |
MD5:82BE85AEAE7A961E19067DF19AF2231B | SHA256:31B27D20E34FA3FEA68EFD6F775FE0886BED27EBAEFB40BEAA092050211FD117 |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
3624 | opera.exe | GET | 301 | 54.230.202.202:80 | http://www.nu.nl/ | US | — | — | whitelisted |
3624 | opera.exe | GET | 200 | 52.85.182.139:80 | http://s.ss2.us/r.crl | US | der | 434 b | whitelisted |
3624 | opera.exe | GET | 200 | 52.85.182.136:80 | http://crl.rootca1.amazontrust.com/rootca1.crl | US | der | 439 b | whitelisted |
3624 | opera.exe | GET | 200 | 93.184.220.29:80 | http://crl3.digicert.com/DigiCertGlobalRootCA.crl | US | der | 581 b | whitelisted |
3624 | opera.exe | GET | 200 | 66.225.197.197:80 | http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl | US | der | 543 b | whitelisted |
3624 | opera.exe | GET | 200 | 104.16.89.188:80 | http://crl.comodoca.com/COMODORSACertificationAuthority.crl | US | der | 820 b | whitelisted |
3624 | opera.exe | GET | 200 | 93.184.220.29:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPJvUY%2Bsl%2Bj4yzQuAcL2oQno5fCgQUUWj%2FkK8CB3U8zNllZGKiErhZcjsCEAOXQPQlVpLtFek%2BmcpabOk%3D | US | der | 471 b | whitelisted |
3624 | opera.exe | GET | 200 | 216.58.215.238:80 | http://ocsp.pki.goog/GTSGIAG3/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBT27bBjYjKBmjX2jXWgnQJKEapsrQQUd8K4UJpndnaxLcKG0IOgfqZ%2BuksCCDPOcdsMs39T | US | der | 463 b | whitelisted |
3624 | opera.exe | GET | 200 | 52.85.182.96:80 | http://crl.rootg2.amazontrust.com/rootg2.crl | US | der | 608 b | whitelisted |
3624 | opera.exe | GET | 400 | 185.26.182.94:80 | http://sitecheck2.opera.com/?host=www.nu.nl&hdn=TTigR/gP5B8tS0EYBIoUng== | unknown | html | 166 b | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
3624 | opera.exe | 66.225.197.197:80 | crl4.digicert.com | CacheNetworks, Inc. | US | whitelisted |
3624 | opera.exe | 82.145.215.40:443 | certs.opera.com | Opera Software AS | — | whitelisted |
3624 | opera.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3624 | opera.exe | 54.230.202.202:80 | www.nu.nl | Amazon.com, Inc. | US | unknown |
3624 | opera.exe | 185.26.182.94:80 | sitecheck2.opera.com | Opera Software AS | — | whitelisted |
3624 | opera.exe | 54.230.202.202:443 | www.nu.nl | Amazon.com, Inc. | US | unknown |
3624 | opera.exe | 52.85.182.136:80 | crl.rootg2.amazontrust.com | Amazon.com, Inc. | US | whitelisted |
3624 | opera.exe | 68.232.35.180:443 | tags.tiqcdn.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
3624 | opera.exe | 52.85.182.139:80 | s.ss2.us | Amazon.com, Inc. | US | whitelisted |
3624 | opera.exe | 216.58.215.234:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
Domain | IP | Reputation |
---|---|---|
certs.opera.com |
| whitelisted |
crl4.digicert.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.nu.nl |
| whitelisted |
sitecheck2.opera.com |
| whitelisted |
crl.rootg2.amazontrust.com |
| whitelisted |
s.ss2.us |
| whitelisted |
crl.rootca1.amazontrust.com |
| whitelisted |
consent.snmmd.nl |
| whitelisted |
fonts.googleapis.com |
| whitelisted |