File name: | 1.ps1 |
Full analysis: | https://app.any.run/tasks/6d4320fd-131f-42b4-ba8d-919b83d4f4cd |
Verdict: | Malicious activity |
Analysis date: | November 29, 2020, 14:55:02 |
OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
Indicators: | |
MIME: | text/plain |
File info: | ASCII text, with no line terminators |
MD5: | E564960BFBA6C645E53D00A3E6DE3D4F |
SHA1: | 93FAC373204259EC87443391A984FDB1F9FB7A6C |
SHA256: | FFB4E23E25FA876504A3F6A0AD0F6760CD6CF460C96907A2DF2EBDBABA275A5D |
SSDEEP: | 3:pLACpwWVMLkXiEbVaZO/I/W1BKiNNfNNNdAJ6k1wiNNn:pLXJMCifO1BN5NNAJHNN |
PID | CMD | Path | Indicators | Parent process |
---|---|---|---|---|
988 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\Desktop\1.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
3840 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\Desktop\1.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) | ||||
2724 | "C:\Windows\system32\cmd.exe" | C:\Windows\system32\cmd.exe | — | explorer.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) | ||||
2180 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" "C:\Users\admin\Desktop\1.ps1" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) |
PID | Process | Filename | Type | |
---|---|---|---|---|
988 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KXOP7IF7M8T51Z4HEYNO.temp | — | |
MD5:— | SHA256:— | |||
3840 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KS1AWKYHU1RZJN8R4HQR.temp | — | |
MD5:— | SHA256:— | |||
2180 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\O1P2MHQ48SW1RDXLAINE.temp | — | |
MD5:— | SHA256:— | |||
988 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:8A05551124C6BDB2904F636A481BD6DC | SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900 | |||
3840 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:8A05551124C6BDB2904F636A481BD6DC | SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900 | |||
2180 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms | binary | |
MD5:8A05551124C6BDB2904F636A481BD6DC | SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900 | |||
988 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF1434e9.TMP | binary | |
MD5:8A05551124C6BDB2904F636A481BD6DC | SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900 | |||
2180 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14d8bb.TMP | binary | |
MD5:8A05551124C6BDB2904F636A481BD6DC | SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900 | |||
3840 | powershell.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF14469c.TMP | binary | |
MD5:8A05551124C6BDB2904F636A481BD6DC | SHA256:17F84075E9B6C27B21B0AB5C00A7D8AA84BBF291764A231BFB72DA223035E900 |