analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RW.ps1

Full analysis: https://app.any.run/tasks/0393f95e-3c77-4bef-938f-cb0d67d9068a
Verdict: Malicious activity
Analysis date: October 20, 2020, 13:44:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines, with CRLF line terminators
MD5:

BD186764E800351F0511163CDED6FE3E

SHA1:

763D800002BA8B6E1FCE6AFB08B8CF54B98EC11E

SHA256:

DED1D6BDEB2BD09C100A1CD7CC264573325C0542B1B82179E530607D4EC653E3

SSDEEP:

12288:cEgtxczJ38aRlFocpp7KGw+ixGaRBralt:4t4uSfbp7KGacazaH

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1832)
      • schtasks.exe (PID: 3848)
      • schtasks.exe (PID: 2436)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 2104)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 2688)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 2484)

    • Creates files in the user directory

      • powershell.exe (PID: 2484)

    • PowerShell script executed

      • powershell.exe (PID: 2484)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe no specs cmd.exe no specs schtasks.exe no specs cmd.exe no specs schtasks.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2484"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\AppData\Local\Temp\RW.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2104"C:\Windows\system32\cmd.exe" /C schtasks /create /xml C:\Windows\SystemApps\Microsoft.Windows.Defender_cw5n1h2txyewy\config.xml /tn "\Microsoft\Windows\Windows Defender\DefenderDefinitionsUpdate" /FC:\Windows\system32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
1832schtasks /create /xml C:\Windows\SystemApps\Microsoft.Windows.Defender_cw5n1h2txyewy\config.xml /tn "\Microsoft\Windows\Windows Defender\DefenderDefinitionsUpdate" /FC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3040"C:\Windows\system32\cmd.exe" /C schtasks /run /tn "\Microsoft\Windows\Windows Defender\DefenderDefinitionsUpdate"C:\Windows\system32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3848schtasks /run /tn "\Microsoft\Windows\Windows Defender\DefenderDefinitionsUpdate"C:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
2688"C:\Windows\system32\cmd.exe" /C schtasks /create /xml C:\Windows\SystemApps\Microsoft.Windows.Defender_cw5n1h2txyewy\config2.xml /tn "\Microsoft\Windows\Windows Defender\ClearOutdatedUpdates" /FC:\Windows\system32\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2436schtasks /create /xml C:\Windows\SystemApps\Microsoft.Windows.Defender_cw5n1h2txyewy\config2.xml /tn "\Microsoft\Windows\Windows Defender\ClearOutdatedUpdates" /FC:\Windows\system32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
279
Read events
220
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2484powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GYAAIA68M2V8JFZS5US5.temp —
MD5:—
SHA256:—
2484powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
2484powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF2d3ee2.TMPbinary
MD5:D6EE8C34E4C28999F00E385C8808E7DE
SHA256:39D598C410E9903C046FC3390F746643C2FDADA6A544E378311F5DC2EA26DFCB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RW.ps1