File name:

iAnyGo Trial Refresh.bat

Full analysis: https://app.any.run/tasks/f6772c99-1785-4c0f-a69c-a6f0b5c41ef0
Verdict: Malicious activity
Analysis date: August 21, 2024, 00:00:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with CRLF line terminators
MD5:

E44AB83F4F2BEE96F58807A388A1C649

SHA1:

48B2040288107BE75F896BEC2978D1C31745605A

SHA256:

C757F3228C3272BCFD5B8AC18EC64FFE21504ED18C4630F0DE14D4F365801C83

SSDEEP:

12:NgkHK7uHWridxx6H+Edxx6HiAR9idxx11G:NRHyuHW0eH+6eHiAsh1G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6720)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
5 037
Monitored processes
4 905
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
8reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v manypoint /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
8reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v position /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
32reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v position /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
32reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v simplepoint /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
32reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v manypoint /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
32reg delete HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v JoystickMovementTrialTime /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
32reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v manypoint /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
32reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v position /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
232reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v manypoint /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
232reg add HKEY_CURRENT_USER\Software\Siacgltiyg\SiaData\MFTimes /v manypoint /t REG_SZ /d Az+foJSad0P/kFw1nTAWPA== /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
63 237
Read events
60 047
Write events
2 393
Delete events
797

Modification events

(PID) Process:(6800) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:writeName:manypoint
Value:
Az+foJSad0P/kFw1nTAWPA==
(PID) Process:(6824) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:writeName:position
Value:
Az+foJSad0P/kFw1nTAWPA==
(PID) Process:(6844) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:writeName:simplepoint
Value:
Az+foJSad0P/kFw1nTAWPA==
(PID) Process:(6864) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:delete valueName:JoystickMovementTrialTime
Value:
(PID) Process:(6884) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:writeName:manypoint
Value:
Az+foJSad0P/kFw1nTAWPA==
(PID) Process:(6904) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:writeName:position
Value:
Az+foJSad0P/kFw1nTAWPA==
(PID) Process:(6924) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:writeName:simplepoint
Value:
Az+foJSad0P/kFw1nTAWPA==
(PID) Process:(6944) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:delete valueName:JoystickMovementTrialTime
Value:
(PID) Process:(6964) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:writeName:manypoint
Value:
Az+foJSad0P/kFw1nTAWPA==
(PID) Process:(6984) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Siacgltiyg\SiaData\MFTimes
Operation:writeName:position
Value:
Az+foJSad0P/kFw1nTAWPA==
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
26
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3700
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4168
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6784
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3308
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3308
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3700
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3700
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2120
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
6784
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
6784
backgroundTaskHost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.238
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.138
  • 40.126.32.133
  • 20.190.160.22
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.136
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
iAnyGo Trial Refresh.bat