| File name: | winPEAS.bat |
| Full analysis: | https://app.any.run/tasks/40698144-c8ca-4d86-ba3e-a0d9770d4ae1 |
| Verdict: | Malicious activity |
| Analysis date: | December 11, 2023, 11:31:07 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/x-msdos-batch |
| File info: | DOS batch file, ASCII text, with very long lines |
| MD5: | 73A4FFACD4A8DA790068A82EBD21F7F1 |
| SHA1: | 1CA4D0CD69923EA80D826FA28F14540F84A45ED8 |
| SHA256: | 302834B59E8AD760810738FC2188C23C88F8A5E4CD5607636980DB690486267E |
| SSDEEP: | 768:Tn6gSfcYRfl66T+su/TvrqbCYTMBjbSnWMKBue1mlwTNXFeFiF2HpX3JrhF2rpR1:r6gSfcYRfl66CsoTvubCYTMBjbSnWMKn |
MALICIOUS
Actions looks like stealing of personal data
- cmd.exe (PID: 280)
SUSPICIOUS
Starts CMD.EXE for commands execution
- cmd.exe (PID: 280)
- forfiles.exe (PID: 2632)
- forfiles.exe (PID: 2820)
- forfiles.exe (PID: 1152)
- forfiles.exe (PID: 684)
Executing commands from a ".bat" file
- cmd.exe (PID: 280)
Application launched itself
- cmd.exe (PID: 280)
Using 'findstr.exe' to search for text patterns in files and output
- cmd.exe (PID: 280)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 280)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
59
Monitored processes
23
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 280 | C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\winPEAS.bat" " | C:\Windows\System32\cmd.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 684 | FORFILES.EXE /P C:\Users\admin\AppData\Local\Temp\ /M winPEAS.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m Files in registry that may contain credentials" | C:\Windows\System32\forfiles.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ForFiles - Executes a command on selected files Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1152 | FORFILES.EXE /P C:\Users\admin\AppData\Local\Temp\ /M winPEAS.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m AppCmd" | C:\Windows\System32\forfiles.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: ForFiles - Executes a command on selected files Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1360 | reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1608 | reg query HKCU\Software\TightVNC\Server | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1840 | C:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\admin\AppData\Local\Temp\ /M winPEAS.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m AppCmd" | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1844 | C:\Windows\system32\cmd.exe /S /D /c" dir /s/b /A:-D RDCMan.settings == *.rdg == SCClient.exe == *_history == .sudo_as_admin_successful == .profile == *bashrc == httpd.conf == *.plan == .htpasswd == .git-credentials == *.rhosts == hosts.equiv == Dockerfile == docker-compose.yml == appcmd.exe == TypedURLs == TypedURLsTime == History == Bookmarks == Cookies == "Login Data" == places.sqlite == key3.db == key4.db == credentials == credentials.db == access_tokens.db == accessTokens.json == legacy_credentials == azureProfile.json == unattend.txt == access.log == error.log == *.gpg == *.pgp == *config*.php == elasticsearch.y*ml == kibana.y*ml == *.p12 == *.der == *.csr == *.cer == known_hosts == id_rsa == id_dsa == *.ovpn == anaconda-ks.cfg == hostapd.conf == rsyncd.conf == cesi.conf == supervisord.conf == tomcat-users.xml == *.kdbx == KeePass.config == Ntds.dit == SAM == SYSTEM == FreeSSHDservice.ini == sysprep.inf == sysprep.xml == unattend.xml == unattended.xml == *vnc*.ini == *vnc*.c*nf* == *vnc*.txt == *vnc*.xml == groups.xml == services.xml == scheduledtasks.xml == printers.xml == drives.xml == datasources.xml == php.ini == https.conf == https-xampp.conf == httpd.conf == my.ini == my.cnf == access.log == error.log == server.xml == SiteList.xml == ConsoleHost_history.txt == setupinfo == setupinfo.bak 2>nul" | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1936 | reg query HKLM\SYSTEM\CurrentControlSet\Services\SNMP /s | C:\Windows\System32\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 1 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2184 | C:\Windows\system32\cmd.exe /c FORFILES.EXE /P C:\Users\admin\AppData\Local\Temp\ /M winPEAS.bat /C "CMD /C ECHO. 0x1B[33m[+]0x1B[97m Cloud Credentials" | C:\Windows\System32\cmd.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 2292 | /C ECHO. [33m[+][97m AppCmd | C:\Windows\System32\cmd.exe | — | forfiles.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
285
Read events
285
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0
Dropped files
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2588 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
— | — | 192.168.100.255:138 | — | — | — | unknown |