Edit tour
Windows
Analysis Report
Adobe_Photoshop_2024 (1).zip
Overview
General Information
| Sample name: | Adobe_Photoshop_2024 (1).zip |
| Analysis ID: | 1509259 |
| MD5: | 37c3d10abf89febf3f2ad91f16c39f51 |
| SHA1: | 4325fabfa5e1d2b58926274354b3466aef8bd3b3 |
| SHA256: | 802f0d869b63e4302dfeff1905708232402373d308cc112130593ed428b6a667 |
| Infos: |  |
 | |
Detection
| Score: | 52 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Bypasses PowerShell execution policy
Loading BitLocker PowerShell Module
Suspicious powershell command line found
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to detect virtual machines (SGDT)
Contains functionality to detect virtual machines (SLDT)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Uses code obfuscation techniques (call, push, ret)
Classification
- System is w10x64
unarchiver.exe (PID: 4208 cmdline: "C:\Window s\SysWOW64 \unarchive r.exe" "C: \Users\use r\Desktop\ Adobe_Phot oshop_2024 (1).zip" MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2) - 7za.exe (PID: 2460 cmdline:
"C:\Window s\System32 \7za.exe" x -pinfect ed -y -o"C :\Users\us er\AppData \Local\Tem p\o5y53bbg .hyg" "C:\ Users\user \Desktop\A dobe_Photo shop_2024 (1).zip" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C) 
conhost.exe (PID: 3712 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cmd.exe (PID: 1472 cmdline:
"cmd.exe" /C "C:\Use rs\user\Ap pData\Loca l\Temp\o5y 53bbg.hyg\ Adobe_Phot oshop_2024 .exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7088 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
Adobe_Photoshop_2024.exe (PID: 4268 cmdline: C:\Users\u ser\AppDat a\Local\Te mp\o5y53bb g.hyg\Adob e_Photosho p_2024.exe MD5: D71C5F6E1CBCC6AB812D3433FFF7BE31) 
powershell.exe (PID: 2364 cmdline: "powershel l.exe" -Wi ndowStyle Hidden -Ex ecutionPol icy Bypass -Command "(Get-CimI nstance -C lassName W in32_Video Controller ).Caption; " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC) - conhost.exe (PID: 6352 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: frack113: | ||
| Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): | ||
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | String found in binary or memory: | ||