We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
14 February 2025, 18:31
Analysis environment:
Windows 10 Pro, build 19045, x64
https://get.activated.win
MD5:
4B01CC7DAC134B0FED2FD49A298DD72D
SHA1:
C350A907D3B85F7AC2A94FAECA014F2FC0E8AEFF
SHA256:
DA21A74A1684EE4CD6067EBBFF51AB8F57B5D73C22A41AFB524FBAEBD867E1CD
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis https://get.activated.win Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
No malicious indicators.
SUSPICIOUS
Gets or sets the security protocol (POWERSHELL)
powershell.exe (PID: 7892)
Uses sleep to delay execution (POWERSHELL)
powershell.exe (PID: 7892)
powershell.exe (PID: 8188)
powershell.exe (PID: 5936)
Gets content of a file (POWERSHELL)
powershell.exe (PID: 7892)
powershell.exe (PID: 8188)
powershell.exe (PID: 5936)
Uses base64 encoding (POWERSHELL)
powershell.exe (PID: 7892)
powershell.exe (PID: 8188)
powershell.exe (PID: 5936)
Creates new GUID (POWERSHELL)
powershell.exe (PID: 7892)
Starts CMD.EXE for commands execution
powershell.exe (PID: 7892)
cmd.exe (PID: 3692)
cmd.exe (PID: 7664)
powershell.exe (PID: 3080)
cmd.exe (PID: 6168)
cmd.exe (PID: 4228)
Executing commands from ".cmd" file
powershell.exe (PID: 7892)
cmd.exe (PID: 7664)
powershell.exe (PID: 3080)
cmd.exe (PID: 6168)
Windows service management via SC.EXE
sc.exe (PID: 7904)
sc.exe (PID: 3152)
Starts SC.EXE for service management
cmd.exe (PID: 7664)
cmd.exe (PID: 6168)
Application launched itself
cmd.exe (PID: 7664)
cmd.exe (PID: 3692)
cmd.exe (PID: 6168)
cmd.exe (PID: 4228)
Using 'findstr.exe' to search for text patterns in files and output
cmd.exe (PID: 7664)
cmd.exe (PID: 6168)
Starts POWERSHELL.EXE for commands execution
cmd.exe (PID: 2356)
cmd.exe (PID: 7664)
cmd.exe (PID: 7104)
cmd.exe (PID: 6168)
Possibly malicious use of IEX has been detected
cmd.exe (PID: 2356)
cmd.exe (PID: 7104)
Probably obfuscated PowerShell command line is found
cmd.exe (PID: 2356)
cmd.exe (PID: 7104)
INFO
Checks supported languages
identity_helper.exe (PID: 7332)
Application launched itself
msedge.exe (PID: 5628)
Reads the computer name
identity_helper.exe (PID: 7332)
Manual execution by a user
powershell.exe (PID: 7892)
Reads Environment values
identity_helper.exe (PID: 7332)
Script raised an exception (POWERSHELL)
powershell.exe (PID: 7892)
Checks current location (POWERSHELL)
powershell.exe (PID: 7892)
Disables trace logs
powershell.exe (PID: 7892)
Creates a byte array (POWERSHELL)
powershell.exe (PID: 7892)
powershell.exe (PID: 8188)
powershell.exe (PID: 5936)
Converts byte array into ASCII string (POWERSHELL)
powershell.exe (PID: 7892)
powershell.exe (PID: 8188)
powershell.exe (PID: 5936)
Checks proxy server information
powershell.exe (PID: 7892)
Gets a random number, or selects objects randomly from a collection (POWERSHELL)
powershell.exe (PID: 7892)
powershell.exe (PID: 8188)
powershell.exe (PID: 5936)
Checks whether the specified file exists (POWERSHELL)
powershell.exe (PID: 7892)
powershell.exe (PID: 8188)
powershell.exe (PID: 5936)
Checks operating system version
cmd.exe (PID: 7664)
cmd.exe (PID: 6168)
Threats
PID
Process
Class
Message
6264
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)
6264
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Network Error Logging (NEL)