Edit tour
Windows
Analysis Report
SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe |
| Analysis ID: | 1528935 |
| MD5: | 37d90e55f0e8b192f62a6e7bd600e6a0 |
| SHA1: | 418c84caf00e2da500bf640f73d3d1dfbadc6fe1 |
| SHA256: | 1938fd88f63091a5f14471c06e2ee7bc0887ac58c395e943e9385e81af43991e |
| Tags: | AdwareGenericexe |
| Infos: |  |
 | |
Detection
| Score: | 42 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Connects to many ports of the same IP (likely port scanning)
Creates files in the system32 config directory
Encrypted powershell cmdline option found
Loading BitLocker PowerShell Module
Sigma detected: Dot net compiler compiles file from suspicious location
Uses STUN server to do NAT traversial
Uses cmd line tools excessively to alter registry or file data
Compiles C# or VB.Net code
Connects to several IPs in different countries
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to launch a program with higher privileges
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Classification
- System is w10x64
SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe (PID: 7476 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. PUA.Tool.I nstSrv.3.1 6098.13705 .exe" MD5: 37D90E55F0E8B192F62A6E7BD600E6A0) - SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.tmp (PID: 7492 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-MSS 00.tmp\Sec uriteInfo. com.PUA.To ol.InstSrv .3.16098.1 3705.tmp" /SL5="$802 B0,2335136 6,832512,C :\Users\us er\Desktop \SecuriteI nfo.com.PU A.Tool.Ins tSrv.3.160 98.13705.e xe" MD5: 0FD246583228B14A826C4A9751C8D246) 
cscript.exe (PID: 7932 cmdline: "C:\Window s\system32 \cscript.e xe" "C:\Pr ogram File s\Syncthin g\Syncthin gFirewallR ule.js" /c reate /ele vated /sil ent MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD) 
conhost.exe (PID: 7940 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
startps.exe (PID: 8008 cmdline: "C:\Progra m Files\Sy ncthing\st artps.exe" -Dqnw -W Hidden "C: \Program F iles\Synct hing\Insta ll-Syncthi ngService. ps1" -- -I nstall -Se rviceAccou ntUserName "Syncthin gServiceAc ct" -Servi ceAccountD escription "Syncthin g service account" - ServiceNam e "syncthi ng" -Servi ceDisplayN ame "Synct hing Servi ce" -Servi ceDescript ion "Synct hing secur ely synchr onizes fil es between two or mo re compute rs in real time." -S erviceStar tupType SE RVICE_DELA YED_AUTO_S TART -Serv iceShutdow nTimeout 1 0000 MD5: 45A58147DE34D9D3029B62AC48636F26) 
powershell.exe (PID: 8052 cmdline: "C:\Window s\system32 \WindowsPo werShell\v 1.0\PowerS hell.exe" -NoProfile -NonInter active -En codedComma nd ZgB1AG4 AYwB0AGkAb wBuACAARAB pAHMAYQBiA GwAZQAtAEU AeABlAGMAd QB0AGkAbwB uAFAAbwBsA GkAYwB5AHs AKAAkAGMAP QAkAEUAeAB lAGMAdQB0A GkAbwBuAEM AbwBuAHQAZ QB4AHQALgB HAGUAdABUA HkAcABlACg AKQAuAEcAZ QB0AEYAaQB lAGwAZAAoA CIAXwBjAG8 AbgB0AGUAe AB0ACIALAA iAE4AbwBuA FAAdQBiAGw AaQBjACwAS QBuAHMAdAB hAG4AYwBlA CIAKQAuAEc AZQB0AFYAY QBsAHUAZQA oACQARQB4A GUAYwB1AHQ AaQBvAG4AQ wBvAG4AdAB lAHgAdAApA CkALgBHAGU AdABUAHkAc ABlACgAKQA uAEcAZQB0A EYAaQBlAGw AZAAoACIAX wBhAHUAdAB oAG8AcgBpA HoAYQB0AGk AbwBuAE0AY QBuAGEAZwB lAHIAIgAsA CIATgBvAG4 AUAB1AGIAb ABpAGMALAB JAG4AcwB0A GEAbgBjAGU AIgApAC4AU wBlAHQAVgB hAGwAdQBlA CgAJABjACw AKABOAGUAd wAtAE8AYgB qAGUAYwB0A CAATQBhAG4 AYQBnAGUAb QBlAG4AdAA uAEEAdQB0A G8AbQBhAHQ AaQBvAG4AL gBBAHUAdAB oAG8AcgBpA HoAYQB0AGk AbwBuAE0AY QBuAGEAZwB lAHIAIAAiA E0AaQBjAHI AbwBzAG8AZ gB0AC4AUAB vAHcAZQByA FMAaABlAGw AbAAiACkAK QB9ADsARAB pAHMAYQBiA GwAZQAtAEU AeABlAGMAd QB0AGkAbwB uAFAAbwBsA GkAYwB5ADs AJgAgACcAQ wA6AFwAUAB yAG8AZwByA GEAbQAgAEY AaQBsAGUAc wBcAFMAeQB uAGMAdABoA GkAbgBnAFw ASQBuAHMAd ABhAGwAbAA tAFMAeQBuA GMAdABoAGk AbgBnAFMAZ QByAHYAaQB jAGUALgBwA HMAMQAnACA ALQBJAG4Ac wB0AGEAbAB sACAALQBTA GUAcgB2AGk AYwBlAEEAY wBjAG8AdQB uAHQAVQBzA GUAcgBOAGE AbQBlACAAI gBTAHkAbgB jAHQAaABpA G4AZwBTAGU AcgB2AGkAY wBlAEEAYwB jAHQAIgAgA C0AUwBlAHI AdgBpAGMAZ QBBAGMAYwB vAHUAbgB0A EQAZQBzAGM AcgBpAHAAd ABpAG8AbgA gACIAUwB5A G4AYwB0AGg AaQBuAGcAI ABzAGUAcgB 2AGkAYwBlA CAAYQBjAGM AbwB1AG4Ad AAiACAALQB TAGUAcgB2A GkAYwBlAE4 AYQBtAGUAI AAiAHMAeQB uAGMAdABoA GkAbgBnACI AIAAtAFMAZ QByAHYAaQB jAGUARABpA HMAcABsAGE AeQBOAGEAb QBlACAAIgB TAHkAbgBjA HQAaABpAG4 AZwAgAFMAZ QByAHYAaQB jAGUAIgAgA C0AUwBlAHI AdgBpAGMAZ QBEAGUAcwB jAHIAaQBwA HQAaQBvAG4 AIAAiAFMAe QBuAGMAdAB oAGkAbgBnA CAAcwBlAGM AdQByAGUAb AB5ACAAcwB 5AG4AYwBoA HIAbwBuAGk AegBlAHMAI ABmAGkAbAB lAHMAIABiA GUAdAB3AGU AZQBuACAAd AB3AG8AIAB vAHIAIABtA G8AcgBlACA AYwBvAG0Ac AB1AHQAZQB yAHMAIABpA G4AIAByAGU AYQBsACAAd ABpAG0AZQA uACIAIAAtA FMAZQByAHY AaQBjAGUAU wB0AGEAcgB 0AHUAcABUA HkAcABlACA AUwBFAFIAV gBJAEMARQB fAEQARQBMA EEAWQBFAEQ AXwBBAFUAV ABPAF8AUwB UAEEAUgBUA CAALQBTAGU AcgB2AGkAY wBlAFMAaAB 1AHQAZABvA HcAbgBUAGk AbQBlAG8Ad QB0ACAAMQA wADAAMAAwA DsAZQB4AGk AdAAgACQAT ABBAFMAVAB FAFgASQBUA EMATwBEAEU A MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 8060 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
csc.exe (PID: 7176 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\uns403 yn\uns403y n.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66) - cvtres.exe (PID: 7228 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user \AppData\L ocal\Temp\ RESAD18.tm p" "c:\Use rs\user\Ap pData\Loca l\Temp\uns 403yn\CSC6 91BDFF1599 64D64AE78B 0A96253D8A .TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) 
nssm.exe (PID: 7260 cmdline: "C:\Progra m Files\Sy ncthing\ns sm.exe" in stall sync thing "C:\ Program Fi les\Syncth ing\syncth ing.exe" MD5: 8F3125D49DD0E38E2FD7A1351281005E) - icacls.exe (PID: 2520 cmdline:
"C:\Window s\system32 \icacls.ex e" C:\Prog ramData\Sy ncthing /r eset /t MD5: 48C87E3B3003A2413D6399EA77707F5D) - icacls.exe (PID: 5104 cmdline:
"C:\Window s\system32 \icacls.ex e" C:\Prog ramData\Sy ncthing /i nheritance :r /grant *S-1-5-18: (OI)(CI)F /grant *S- 1-5-32-544 :(OI)(CI)F /grant Sy ncthingSer viceAcct:( OI)(CI)M MD5: 48C87E3B3003A2413D6399EA77707F5D) - attrib.exe (PID: 3900 cmdline:
"C:\Window s\system32 \attrib.ex e" +i C:\P rogramData \Syncthing MD5: 5037D8E6670EF1D89FB6AD435F12A9FD) - attrib.exe (PID: 3272 cmdline:
"C:\Window s\system32 \attrib.ex e" +i C:\P rogramData \Syncthing \* /s /d MD5: 5037D8E6670EF1D89FB6AD435F12A9FD) - nssm.exe (PID: 1740 cmdline:
"C:\Progra m Files\Sy ncthing\ns sm.exe" se t syncthin g ObjectNa me .\Synct hingServic eAcct 3WSC 9CSeGtQrus gAoMvYsQCu 93yz9M3TPh SyQ9ICIb+8 jB7I/sk1yM okJv02BsjR ee7C7qDGAO tJAqnNpsTC fzZd5tGgwT sIwIdJ/OJ+ 0bupzkwsx1 sgPMNgYmve EKf MD5: 8F3125D49DD0E38E2FD7A1351281005E) - icacls.exe (PID: 4460 cmdline:
"C:\Window s\system32 \icacls.ex e" "C:\Pro gram Files \Syncthing " /reset / t MD5: 48C87E3B3003A2413D6399EA77707F5D) - conhost.exe (PID: 6636 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - icacls.exe (PID: 7396 cmdline:
"C:\Window s\system32 \icacls.ex e" "C:\Pro gram Files \Syncthing " /grant " SyncthingS erviceAcct :(OI)(CI)M " MD5: 48C87E3B3003A2413D6399EA77707F5D) - conhost.exe (PID: 7424 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cscript.exe (PID: 7568 cmdline:
"C:\Window s\system32 \cscript.e xe" "C:\Pr ogram File s\Syncthin g\SetSynct hingConfig .js" /serv ice /autou pgradeinte rval:12 /g uiaddress: "127.0.0.1 :8384" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD) - conhost.exe (PID: 7212 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
syncthing.exe (PID: 4296 cmdline: "C:\Progra m Files\Sy ncthing\sy ncthing.ex e" generat e --skip-p ort-probin g --home=" C:\Program Data\Synct hing" --no -default-f older MD5: EF3D18900944F5CCB93E62C51385D056) - conhost.exe (PID: 5432 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - nssm.exe (PID: 3452 cmdline:
"C:\Progra m Files\Sy ncthing\ns sm.exe" st art "synct hing" MD5: 8F3125D49DD0E38E2FD7A1351281005E) - conhost.exe (PID: 5236 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- nssm.exe (PID: 7772 cmdline:
"C:\Progra m Files\Sy ncthing\ns sm.exe" MD5: 8F3125D49DD0E38E2FD7A1351281005E) - conhost.exe (PID: 7788 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 3412 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: EF3D18900944F5CCB93E62C51385D056) - conhost.exe (PID: 7808 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 7880 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: EF3D18900944F5CCB93E62C51385D056) - syncthing.exe (PID: 1068 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 1908 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - ROUTE.EXE (PID: 6696 cmdline:
route prin t 0.0.0.0 MD5: 3C97E63423E527BA8381E81CBA00B8CD) - conhost.exe (PID: 7040 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 6904 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - conhost.exe (PID: 7124 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 7672 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 1208 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 8000 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 7956 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - conhost.exe (PID: 7716 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 6928 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - conhost.exe (PID: 7140 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 5080 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 5224 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 8116 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 3912 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - conhost.exe (PID: 2668 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 2024 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - conhost.exe (PID: 2112 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 8112 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 8180 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 3752 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): | ||