IOC Report
z1SWIFT_MT103_Payment_552016_cmd.bat

z1SWIFT_MT103_Payment_552016_cmd.bat

Microsoft Cabinet archive data, Windows 2000/XP setup, 4294967295 bytes, 1 file, at 0x75 +A "x.exe", number 1, 35 datablocks, 0 compression

initial sample

C:\Users\Public\Libraries\joedgvvL.cmd

DOS batch file, Unicode text, UTF-8 text, with very long lines (324), with CRLF line terminators

dropped

C:\Users\Public\Libraries\joedgvvL.pif

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\x.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Windows\System32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\z1SWIFT_MT103_Payment_552016_cmd.bat" "

C:\Users\user\AppData\Local\Temp\x.exe

"C:\Users\user\AppData\Local\Temp\x.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\joedgvvL.cmd" "

C:\Windows\SysWOW64\esentutl.exe

C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o

C:\Windows\SysWOW64\esentutl.exe

C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o

C:\Users\Public\alpha.pif

C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "

C:\Users\Public\Libraries\joedgvvL.pif

C:\Users\Public\Libraries\joedgvvL.pif

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

C:\Windows\SysWOW64\cscript.exe

"C:\Windows\SysWOW64\cscript.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Public\Libraries\joedgvvL.pif"

https://himalayastrek.com/stein/233_Lvvgdeojree

50.116.93.185

www.kimosskrupulslacker.cfd/f29s/

https://himalayastrek.com/

unknown