Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
Detection
Score: | 72 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Drops large PE files
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses a known web browser user agent for HTTP communication
Classification
- System is w10x64
- file.exe (PID: 6964 cmdline:
"C:\Users\ user\Deskt op\file.ex e" MD5: 1FB9195294D3F2C24F8A938C6C8D1628) - file.exe (PID: 2756 cmdline:
"C:\Users\ user\Deskt op\file.ex e" MD5: 1FB9195294D3F2C24F8A938C6C8D1628) - file.exe (PID: 4132 cmdline:
"C:\Users\ user\Deskt op\file.ex e" "C:\Use rs\user\Ap pData\Loca l\Temp\t.p y" MD5: 1FB9195294D3F2C24F8A938C6C8D1628) - file.exe (PID: 6384 cmdline:
"C:\Users\ user\Deskt op\file.ex e" "C:\Use rs\user\Ap pData\Loca l\Temp\t.p y" MD5: 1FB9195294D3F2C24F8A938C6C8D1628) - cmd.exe (PID: 6992 cmdline:
C:\Windows \system32\ cmd.exe /c "powershe ll Add-MpP reference -Exclusion Path 'C:\U sers\user\ AppData' - Force" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2852 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7156 cmdline:
powershell Add-MpPre ference -E xclusionPa th 'C:\Use rs\user\Ap pData' -Fo rce MD5: 04029E121A0CFA5991749937DD22A1D9) - WmiPrvSE.exe (PID: 2688 cmdline:
C:\Windows \system32\ wbem\wmipr vse.exe -s ecured -Em bedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51) - cmd.exe (PID: 5336 cmdline:
C:\Windows \system32\ cmd.exe /c "sc creat e DrvSvc b inPath= "C :\Users\us er\AppData \Local\dri verpatch9t 1ohxw8\di. exe" start = auto" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6100 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 5520 cmdline:
sc create DrvSvc bin Path= "C:\ Users\user \AppData\L ocal\drive rpatch9t1o hxw8\di.ex e" start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - cmd.exe (PID: 2324 cmdline:
C:\Windows \system32\ cmd.exe /c "sc descr iption Drv Svc "Launc hes applic ations ass ociated wi th still i mage acqui sition eve nts."" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2064 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 4780 cmdline:
sc descrip tion DrvSv c "Launche s applicat ions assoc iated with still ima ge acquisi tion event s." MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Integrated Neural Analysis Model: |
Source: | Joe Sandbox ML: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |