File name:

SOLICITUD DE COTIZACIÓN - RFQ N.° 3534211..js

Full analysis: https://app.any.run/tasks/9a160700-14c7-4122-9f6a-52108b1b2790
Verdict: Malicious activity
Analysis date: May 10, 2025, 03:16:53
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/javascript
File info: JavaScript source, ASCII text, with very long lines (2044), with no line terminators
MD5:

ACFB0742EB7F143ACA16B4A122E8C90F

SHA1:

4FA7C637E770FC5C790049F5611751985B0A1A23

SHA256:

FE2CBED07EF53768D0A4402669AC4CFA4E4CC7A9705347AAD31201124E864FC6

SSDEEP:

48:pNfWjxgV1S1db4n90gLHQwPksXflpKy4OuYGW2cSS2d:nujxgbS1dhwD3KBQTW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Sends HTTP request (SCRIPT)

      • wscript.exe (PID: 2320)

    • Creates a new folder (SCRIPT)

      • wscript.exe (PID: 2320)

    • Checks whether a specified folder exists (SCRIPT)

      • wscript.exe (PID: 2320)

    • Creates internet connection object (SCRIPT)

      • wscript.exe (PID: 2320)

    • Opens an HTTP connection (SCRIPT)

      • wscript.exe (PID: 2320)

    • Changes powershell execution policy (Bypass)

      • wscript.exe (PID: 2320)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 300)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 2320)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 2320)

    • Executes script without checking the security policy

      • powershell.exe (PID: 300)

    • The process bypasses the loading of PowerShell profile settings

      • wscript.exe (PID: 2320)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 2320)

    • The process executes Powershell scripts

      • wscript.exe (PID: 2320)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2320)

  • INFO

    • Checks proxy server information

      • wscript.exe (PID: 2320)

    • Reads the software policy settings

      • slui.exe (PID: 7352)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 300)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
6
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start wscript.exe powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -ep bypass -file "C:\Temp\HMKUQZZN.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
2320"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\SOLICITUD DE COTIZACIÓN - RFQ N.° 3534211..js"C:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
5056\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
7320C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
7352"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
8088C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
3
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2320wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
300powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:BBEA8F2E662C6C83E30DD01BB1DA7EF7
SHA256:F7847CD3FDF05BF4E117C485D3736C1DD7CFB1CB862CE79726054B3330E088A0
300powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_a0pc5oxl.m5g.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
300powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_znoyyw3j.ugb.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2320wscript.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:7E6B8B6D29EFDC9DDF0633CBAA3C0D56
SHA256:BC040F31441E4504FDB81E1629C815052FB546116E6BB039FB7A6A08C48E5598
2320wscript.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\suspendedpage[1].htmhtml
MD5:A9FBB2B279A334F186C56D0FCF62CD8E
SHA256:405D539EEEFBE3A43F2123546AB79EDCB1DF39FFF831B56F91FF6616B1D4B1CD
2320wscript.exeC:\Temp\HMKUQZZN.ps1html
MD5:A9FBB2B279A334F186C56D0FCF62CD8E
SHA256:405D539EEEFBE3A43F2123546AB79EDCB1DF39FFF831B56F91FF6616B1D4B1CD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.27:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2320
wscript.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7916
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.27:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2320
wscript.exe
192.99.207.151:443
www.arcon.com.pe
OVH SAS
CA
unknown
2320
wscript.exe
23.209.209.135:80
x1.c.lencr.org
PT. Telekomunikasi Selular
ID
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.74.206
whitelisted
crl.microsoft.com
  • 23.216.77.27
  • 23.216.77.28
  • 23.216.77.29
  • 23.216.77.32
  • 23.216.77.31
  • 23.216.77.42
  • 23.216.77.43
  • 23.216.77.21
  • 23.216.77.26
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.arcon.com.pe
  • 192.99.207.151
unknown
x1.c.lencr.org
  • 23.209.209.135
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.5
  • 20.190.160.128
  • 20.190.160.14
  • 20.190.160.64
  • 20.190.160.17
  • 20.190.160.3
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SOLICITUD DE COTIZACIÓN - RFQ N.° 3534211..js