Edit tour
Windows
Analysis Report
SecuriteInfo.com.Win32.Malware-gen.10020.18427.exe
Overview
General Information
Detection
Score: | 32 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 0% |
Compliance
Score: | 50 |
Range: | 0 - 100 |
Signatures
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Checks for available system drives (often done to infect USB drives)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to read the clipboard data
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
PE file does not import any functions
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses taskkill to terminate processes
Uses the system / local time for branch decision (may execute only at specific dates)
Classification
- System is w10x64
- SecuriteInfo.com.Win32.Malware-gen.10020.18427.exe (PID: 6592 cmdline:
"C:\Users\ user\Deskt op\Securit eInfo.com. Win32.Malw are-gen.10 020.18427. exe" MD5: 877D291AD79381CB54DE729AC307B613) - taskkill.exe (PID: 5480 cmdline:
"C:\Window s\system32 \taskkill. exe" /F / IM IPCTool s.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD) - conhost.exe (PID: 6092 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - conhost.exe (PID: 7072 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - vcredist_x86_vs2005_en.exe (PID: 4924 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\vcredis t_x86_vs20 05_en.exe MD5: 4F1611F2D0AE799507F60C10FF8654C5) - msiexec.exe (PID: 1744 cmdline:
msiexec /i vcredist. msi MD5: 9D09DC1EDA745A5F87553048E57620CF) - vcredist_x86_vs2013_en.exe (PID: 6952 cmdline:
C:\Users\u ser\AppDat a\Local\Te mp\vcredis t_x86_vs20 13_en.exe MD5: 0FC525B6B7B96A87523DAA7A0013C69D) - vcredist_x86_vs2013_en.exe (PID: 4348 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\vcredi st_x86_vs2 013_en.exe " -burn.un elevated B urnPipe.{A 826652D-AF D8-40B6-84 B0-7105BE4 34658} {ED 4ADFC9-BDF E-4680-B56 2-A7A4CCF9 8333} 6952 MD5: 0FC525B6B7B96A87523DAA7A0013C69D)
- msiexec.exe (PID: 5220 cmdline:
C:\Windows \system32\ msiexec.ex e /V MD5: E5DA170027542E25EDE42FC54C929077) - msiexec.exe (PID: 4564 cmdline:
C:\Windows \syswow64\ MsiExec.ex e -Embeddi ng 8341741 E8479EC6D5 51F124E2FB 1671E MD5: 9D09DC1EDA745A5F87553048E57620CF)
- rundll32.exe (PID: 6716 cmdline:
C:\Windows \System32\ rundll32.e xe C:\Wind ows\System 32\shell32 .dll,SHCre ateLocalSe rverRunDll {9aa46009 -3ce0-458a -a354-7156 10a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)
- SrTasks.exe (PID: 7088 cmdline:
C:\Windows \system32\ srtasks.ex e ExecuteS copeRestor ePoint /Wa itForResto rePoint:1 MD5: 2694D2D28C368B921686FE567BD319EB) - conhost.exe (PID: 7136 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira: |
Source: | ReversingLabs: |
Source: | ReversingLabs: |
Source: | Code function: | 4_2_01006205 | |
Source: | Code function: | 11_2_00A87378 | |
Source: | Code function: | 11_2_00A68101 | |
Source: | Code function: | 11_2_00A68386 | |
Source: | Code function: | 11_2_00A67E2A |
Compliance |
---|
Source: | Static PE information: |
Source: | Window detected: |