Windows Analysis Report
https://fat-doc.s3.us-east-2.amazonaws.com/Comprovativo_Abril_KDZlyr_26-04-2024_64.zip?=PGNPUKVOPEHCMOLUMNPIBIKXCKFBEBOPMVCSFREHAACJTZHQQDMNCHWFHRMVUUJNQSRQMTOUIHHAGQCFRPLAPBNDXXJPFJOFRPTBGREXQREVKZKSPGDEIIWPFNUPIKPWUBJRXBKAJOLWXREWZSKWGIZHRDXTZPNQBFBZOIVOHCUUZKSOIVSRKQSLE

Overview

General Information

Sample URL:	https://fat-doc.s3.us-east-2.amazonaws.com/Comprovativo_Abril_KDZlyr_26-04-2024_64.zip?=PGNPUKVOPEHCMOLUMNPIBIKXCKFBEBOPMVCSFREHAACJTZHQQDMNCHWFHRMVUUJNQSRQMTOUIHHAGQCFRPLAPBNDXXJPFJOFRPTBGREXQREVKZKS
Analysis ID:	1433174
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected ZipBomb

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Found WSH timer for Javascript or VBS script (likely evasive script)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: fat-doc.s3.us-east-2.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: classification engine

Classification label: mal60.evad.win@18/8@4/138

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\596cd038-db66-4afc-815f-ca69191c7893.tmp

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_Comprovativo_Abril_KDZlyr_26-04-2024_64.zip\Comprovativo_Abril_KDZlyr_26-04-2024_64\Comprovativo_Abril_KDZlyr_26-04-2024_64.vbs"

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://fat-doc.s3.us-east-2.amazonaws.com/Comprovativo_Abril_KDZlyr_26-04-2024_64.zip?=PGNPUKVOPEHCMOLUMNPIBIKXCKFBEBOPMVCSFREHAACJTZHQQDMNCHWFHRMVUUJNQSRQMTOUIHHAGQCFRPLAPBNDXXJPFJOFRPTBGREXQREVKZKSPGDEIIWPFNUPIKPWUBJRXBKAJOLWXREWZSKWGIZHRDXTZPNQBFBZOIVOHCUUZKSOIVSRKQSLE
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1960,i,8941980370019695632,7496778106780440880,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1960,i,8941980370019695632,7496778106780440880,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\Temp\Temp1_Comprovativo_Abril_KDZlyr_26-04-2024_64.zip\Comprovativo_Abril_KDZlyr_26-04-2024_64\Comprovativo_Abril_KDZlyr_26-04-2024_64.vbs"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\Desktop\Comprovativo_Abril_KDZlyr_26-04-2024_64.vbs"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\Desktop\Comprovativo_Abril_KDZlyr_26-04-2024_64.vbs"

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected ZipBomb

Source: Yara match	File source: C:\Users\user\Downloads\596cd038-db66-4afc-815f-ca69191c7893.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\Downloads\596cd038-db66-4afc-815f-ca69191c7893.tmp, type: DROPPED

Found WSH timer for Javascript or VBS script (likely evasive script)

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.5.133.164	s3-r-w.us-east-2.amazonaws.com	United States	16509	AMAZON-02US	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
142.250.190.14	unknown	United States	15169	GOOGLEUS	false
142.250.190.99	unknown	United States	15169	GOOGLEUS	false
142.250.190.67	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.191.100	www.google.com	United States	15169	GOOGLEUS	false
142.251.165.84	unknown	United States	15169	GOOGLEUS	false
142.250.191.110	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16
192.168.2.5
192.168.2.23
192.168.2.15
192.168.2.14

Contacted Domains

Name	IP	Active
www.google.com	142.250.191.100	true
s3-r-w.us-east-2.amazonaws.com	3.5.133.164	true
fat-doc.s3.us-east-2.amazonaws.com	unknown	unknown

ID:	1433174
Product:	CloudBasic
Start time:	10:38:50
Start date:	29.04.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Apr 29 07:39:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	7200F8F24B1071070C0EFFE91F9F29A7	8269D6A28F9ECC415DDEA9B642CB00064E0C0516	973DC6C0B3D56BCA8CA577FF30C30B8E29BC05828435A9E13F7373FEC70ED658
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Apr 29 07:39:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	43E950AA6217B2E4170F389A9F43D59D	7DE8B2488E3EEA92B0FF05F0865143C64557003C	C45283C2B3F13FAFDEEFF4A8527A2B689DE7596A95B97C9000D153DE3F8C6823
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	A800B34F827A653CD65750E5A29B4BE5	0C13A4DC62F3B0FA7C66033668763993B52A9530	8E26DEFA435D275929990823BEC9F221249252B71CD7825FDADB1D770A5F861B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Apr 29 07:39:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9BCE03D068D51C6D343512CBF8057335	B699CBEA43D8F6388A12CD8FAEB7FA6B3D675835	A55560DF0E40C0A4546B3FA7F61B35816A5DA199F4B8B9E3007EA148BD25B880
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Apr 29 07:39:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	9C00A0F46CF64E7375D01E8ECB56BC73	E48CD72635B6B354E900EA1C54246DA028C64C96	2B5044BE8848CA531179FA6FF7375EB46EC2C479672931546DD67F6AD0D1FB44
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Apr 29 07:39:16 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	53EB8D5DAB562DADC02B255CD2EE190E	8F711A6D8D368E146C7107C9F8F27D2841B00D4B	0A80CFA0FA5286D519CCEA162294046BF991A2606D4BE32606ED6D6D0BE746D0
C:\Users\user\Downloads\596cd038-db66-4afc-815f-ca69191c7893.tmp	Zip archive data, at least v2.0 to extract, compression method=deflate	ED03C15CD57FAF4BF9094CE55D13E99A	0F9CFC2D78B0EA915353D1C0D7B42B1C128F2417	CB381972FB40C3D96856DDDEB244A480A279573FAEDA18C68843BCFDCCDFCCF6
C:\Users\user\Downloads\Comprovativo_Abril_KDZlyr_26-04-2024_64.zip (copy)	Zip archive data, at least v2.0 to extract, compression method=deflate	21C6DB1C126E90A2293E70F11718D64B	DFCE67C04701B02A412CCD624407D3A791ED841B	7DE30905736469D383302807E6DC60C97FD0C23C4AF12049A1851EA5752EC591
C:\Users\user\Downloads\Comprovativo_Abril_KDZlyr_26-04-2024_64.zip.crdownload	Zip archive data, at least v2.0 to extract, compression method=deflate	21C6DB1C126E90A2293E70F11718D64B	DFCE67C04701B02A412CCD624407D3A791ED841B	7DE30905736469D383302807E6DC60C97FD0C23C4AF12049A1851EA5752EC591

Windows Analysis Report
https://fat-doc.s3.us-east-2.amazonaws.com/Comprovativo_Abril_KDZlyr_26-04-2024_64.zip?=PGNPUKVOPEHCMOLUMNPIBIKXCKFBEBOPMVCSFREHAACJTZHQQDMNCHWFHRMVUUJNQSRQMTOUIHHAGQCFRPLAPBNDXXJPFJOFRPTBGREXQREVKZKSPGDEIIWPFNUPIKPWUBJRXBKAJOLWXREWZSKWGIZHRDXTZPNQBFBZOIVOHCUUZKSOIVSRKQSLE

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report https://fat-doc.s3.us-east-2.amazonaws.com/Comprovativo_Abril_KDZlyr_26-04-2024_64.zip?=PGNPUKVOPEHCMOLUMNPIBIKXCKFBEBOPMVCSFREHAACJTZHQQDMNCHWFHRMVUUJNQSRQMTOUIHHAGQCFRPLAPBNDXXJPFJOFRPTBGREXQREVKZKSPGDEIIWPFNUPIKPWUBJRXBKAJOLWXREWZSKWGIZHRDXTZPNQBFBZOIVOHCUUZKSOIVSRKQSLE

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Screenshots

Network Map

Contacted Public IPs

Private

Contacted Domains

Windows Analysis Report
https://fat-doc.s3.us-east-2.amazonaws.com/Comprovativo_Abril_KDZlyr_26-04-2024_64.zip?=PGNPUKVOPEHCMOLUMNPIBIKXCKFBEBOPMVCSFREHAACJTZHQQDMNCHWFHRMVUUJNQSRQMTOUIHHAGQCFRPLAPBNDXXJPFJOFRPTBGREXQREVKZKSPGDEIIWPFNUPIKPWUBJRXBKAJOLWXREWZSKWGIZHRDXTZPNQBFBZOIVOHCUUZKSOIVSRKQSLE