Edit tour
Windows
Analysis Report
Kiwi_Syslog_Server_9.8.2.Freeware.setup.exe
Overview
General Information
| Sample name: | Kiwi_Syslog_Server_9.8.2.Freeware.setup.exe |
| Analysis ID: | 1365321 |
| MD5: | ddeae6a33dadac7e815f44ffa2e3af72 |
| SHA1: | 35d124119f877ff9d84979f768bc542389f19514 |
| SHA256: | 28b96f7ac372171acbcac4a2cefd1c19d571fb157ab0394b6f33af4f059e5741 |
| Infos: |  |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Disables DEP (Data Execution Prevention) for certain images
Installs new ROOT certificates
Tries to detect sandboxes and other dynamic analysis tools (window names)
Writes a notice file (html or txt) to demand a ransom
Yara detected Generic Downloader
Checks for available system drives (often done to infect USB drives)
Checks for debuggers (devices)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains long sleeps (>= 3 min)
Creates Visual Basic Runtime Dlls
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Enables security privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
HTTP GET or POST without a user agent
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses 32bit PE files
Classification
- System is w10x64_ra
Kiwi_Syslog_Server_9.8.2.Freeware.setup.exe (PID: 2808 cmdline: C:\Users\u ser\Deskto p\Kiwi_Sys log_Server _9.8.2.Fre eware.setu p.exe MD5: DDEAE6A33DADAC7E815F44FFA2E3AF72) 
SolarWinds.Orion.MaintDateCheck.exe (PID: 5144 cmdline: "C:\Users\ user\AppDa ta\Local\T emp\KSS\So larWinds.O rion.Maint DateCheck. exe" /chec k:KiwiSysl og;9 MD5: EBBA335FD28EE47F33CC3D9F219A165F) 
vcredist_x86_2010.exe (PID: 2772 cmdline: C:\Program Files (x8 6)\Syslogd \vcredist_ x86_2010.e xe MD5: A9BDC3AC1FB59528A9907452756BD0DF) 
Setup.exe (PID: 6632 cmdline: c:\9f205d7 d8f8ebe3c2 0c6094cd41 758f8\Setu p.exe MD5: 006F8A615020A4A17F5E63801485DF46) 
vcredist_x86_2013.exe (PID: 2632 cmdline: C:\Program Files (x8 6)\Syslogd \vcredist_ x86_2013.e xe MD5: 0FC525B6B7B96A87523DAA7A0013C69D) - vcredist_x86_2013.exe (PID: 1744 cmdline:
"C:\Progra m Files (x 86)\Syslog d\vcredist _x86_2013. exe" -burn .unelevate d BurnPipe .{B2C923D5 -03AD-40DC -9405-A63C 3C16425A} {6708B3AD- 47E5-4E6F- 9EE8-261E5 C997216} 2 632 MD5: 0FC525B6B7B96A87523DAA7A0013C69D) - RegAsm.exe (PID: 3496 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegA sm.exe "C: \Program F iles (x86) \Syslogd\S olarWinds. Licensing. KiwiSyslog .COMWrappe r.dll" /tl b:SolarWin ds.Licensi ng.KiwiSys log.COMWra pper.tlb / u MD5: 0D5DF43AF2916F47D00C1573797C1A13) 
conhost.exe (PID: 6136 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 3728 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegA sm.exe "C: \Program F iles (x86) \Syslogd\S olarWinds. SyslogServ er.Engine. dll" /tlb: SolarWinds .SyslogSer ver.Engine .tlb /u MD5: 0D5DF43AF2916F47D00C1573797C1A13) - conhost.exe (PID: 3396 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 3448 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegA sm.exe "C: \Program F iles (x86) \Syslogd\S olarWinds. SyslogServ er.SyslogA ction.dll" /tlb:Sola rWinds.Sys logServer. SyslogActi on.tlb /u MD5: 0D5DF43AF2916F47D00C1573797C1A13) - conhost.exe (PID: 6460 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
Syslogd_TaskEngine.exe (PID: 4516 cmdline: "C:\Progra m Files (x 86)\Syslog d\Syslogd_ TaskEngine .exe" /reg server MD5: 60995005FCE2D6C7632D06722BDF1073) - RegAsm.exe (PID: 2396 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegA sm.exe "C: \Program F iles (x86) \Syslogd\S olarWinds. Licensing. KiwiSyslog .COMWrappe r.dll" /tl b /codebas e MD5: 0D5DF43AF2916F47D00C1573797C1A13) - conhost.exe (PID: 3440 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 5680 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegA sm.exe "C: \Program F iles (x86) \Syslogd\S olarWinds. SyslogServ er.Engine. dll" /tlb /codebase MD5: 0D5DF43AF2916F47D00C1573797C1A13) - conhost.exe (PID: 1436 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - RegAsm.exe (PID: 5224 cmdline:
C:\Windows \Microsoft .NET\Frame work\v4.0. 30319\RegA sm.exe "C: \Program F iles (x86) \Syslogd\S olarWinds. SyslogServ er.SyslogA ction.dll" /tlb /cod ebase MD5: 0D5DF43AF2916F47D00C1573797C1A13) - conhost.exe (PID: 5404 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 5708 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\Prog ram Files (x86)\Sysl ogd\DEPInc .bat"" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 6744 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
rundll32.exe (PID: 5800 cmdline: rundll32 s ysdm.cpl, NoExecuteA ddFileOptO utList C:\ Program Fi les (x86)\ Syslogd\Sy slogd.exe MD5: 889B99C52A60DD49227C5E485A016679) 
Syslogd.exe (PID: 4944 cmdline: "C:\Progra m Files (x 86)\Syslog d\Syslogd. exe" MD5: 3503D3AEF9B4A29886D11471AED1B047)
msiexec.exe (PID: 3664 cmdline: C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077)
- SrTasks.exe (PID: 6124 cmdline:
C:\Windows \system32\ srtasks.ex e ExecuteS copeRestor ePoint /Wa itForResto rePoint:1 MD5: 2694D2D28C368B921686FE567BD319EB) - conhost.exe (PID: 3924 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- msiexec.exe (PID: 5324 cmdline:
C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077)
- cleanup
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| JoeSecurity_GenericDownloader_1 | Yara detected Generic Downloader | Joe Security | ||
| Click to see the 1 entries | ||||
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
| Source: | Static PE information: | ||
| Source: | Window detected: | ||