File name: | virus.bat |
Full analysis: | https://app.any.run/tasks/e55a229d-ca31-4cf9-8def-d4aabea24e0f |
Verdict: | Malicious activity |
Analysis date: | May 20, 2022, 16:53:00 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/x-msdos-batch |
File info: | DOS batch file, ASCII text, with CRLF line terminators |
MD5: | 2F5805AAAB5CFB4D835C3584E36E2FEA |
SHA1: | A2CA325F4E73FBBFED8B141D646794F271B45FBF |
SHA256: | DD9F5682B8458FC29C02ED453DD83E8D6C79BE99C91CED7BA1F5FDC8D9326FE4 |
SSDEEP: | 6:hHQELSGAGNKxbtUx9ouYAYyaqw5zHyjWwFjrfOvqTRFshkNT3vMxXqTRFlOdLqVn:xdSXGNktbjdxSjxFjrGvoFSCzvM9oFiu |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
116 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\virus.bat" " | C:\Windows\system32\cmd.exe | — | Explorer.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3176 | C:\Windows\system32\cmd.exe /S /D /c" echo Y" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3252 | C:\Windows\system32\cmd.exe /S /D /c" del D:\" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3292 | C:\Windows\system32\cmd.exe /S /D /c" echo Y" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2816 | C:\Windows\system32\cmd.exe /S /D /c" del C:\documents and settings" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3136 | C:\Windows\system32\cmd.exe /S /D /c" echo Y" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
2272 | C:\Windows\system32\cmd.exe /S /D /c" del C:\users" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3564 | C:\Windows\system32\cmd.exe /S /D /c" echo Y" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3632 | C:\Windows\system32\cmd.exe /S /D /c" del C:\windows\system32\hal.dll" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
3208 | C:\Windows\system32\cmd.exe /S /D /c" echo Y" | C:\Windows\system32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
|