Edit tour
Windows
Analysis Report
SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe
Overview
General Information
| Sample name: | SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe |
| Analysis ID: | 1528935 |
| MD5: | 37d90e55f0e8b192f62a6e7bd600e6a0 |
| SHA1: | 418c84caf00e2da500bf640f73d3d1dfbadc6fe1 |
| SHA256: | 1938fd88f63091a5f14471c06e2ee7bc0887ac58c395e943e9385e81af43991e |
| Tags: | AdwareGenericexe |
| Infos: |  |
 | |
Detection
| Score: | 46 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Changes security center settings (notifications, updates, antivirus, firewall)
Connects to many ports of the same IP (likely port scanning)
Creates files in the system32 config directory
Encrypted powershell cmdline option found
Loading BitLocker PowerShell Module
Query firmware table information (likely to detect VMs)
Sigma detected: Dot net compiler compiles file from suspicious location
Uses STUN server to do NAT traversial
Uses cmd line tools excessively to alter registry or file data
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Compiles C# or VB.Net code
Connects to several IPs in different countries
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to delete services
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to launch a program with higher privileges
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain (may stop execution after checking a module file name)
Found large amount of non-executed APIs
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Dynamic .NET Compilation Via Csc.EXE
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Use Short Name Path in Command Line
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Classification
- System is w10x64
SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.exe (PID: 3468 cmdline: "C:\Users\ user\Deskt op\Securit eInfo.com. PUA.Tool.I nstSrv.3.1 6098.13705 .exe" MD5: 37D90E55F0E8B192F62A6E7BD600E6A0) - SecuriteInfo.com.PUA.Tool.InstSrv.3.16098.13705.tmp (PID: 4856 cmdline:
"C:\Users\ user~1\App Data\Local \Temp\is-F M5IR.tmp\S ecuriteInf o.com.PUA. Tool.InstS rv.3.16098 .13705.tmp " /SL5="$2 0434,23351 366,832512 ,C:\Users\ user\Deskt op\Securit eInfo.com. PUA.Tool.I nstSrv.3.1 6098.13705 .exe" MD5: 0FD246583228B14A826C4A9751C8D246) 
cscript.exe (PID: 7652 cmdline: "C:\Window s\system32 \cscript.e xe" "C:\Pr ogram File s\Syncthin g\Syncthin gFirewallR ule.js" /c reate /ele vated /sil ent MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD) 
conhost.exe (PID: 7660 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
startps.exe (PID: 7740 cmdline: "C:\Progra m Files\Sy ncthing\st artps.exe" -Dqnw -W Hidden "C: \Program F iles\Synct hing\Insta ll-Syncthi ngService. ps1" -- -I nstall -Se rviceAccou ntUserName "Syncthin gServiceAc ct" -Servi ceAccountD escription "Syncthin g service account" - ServiceNam e "syncthi ng" -Servi ceDisplayN ame "Synct hing Servi ce" -Servi ceDescript ion "Synct hing secur ely synchr onizes fil es between two or mo re compute rs in real time." -S erviceStar tupType SE RVICE_DELA YED_AUTO_S TART -Serv iceShutdow nTimeout 1 0000 MD5: 45A58147DE34D9D3029B62AC48636F26) 
powershell.exe (PID: 7788 cmdline: "C:\Window s\system32 \WindowsPo werShell\v 1.0\PowerS hell.exe" -NoProfile -NonInter active -En codedComma nd ZgB1AG4 AYwB0AGkAb wBuACAARAB pAHMAYQBiA GwAZQAtAEU AeABlAGMAd QB0AGkAbwB uAFAAbwBsA GkAYwB5AHs AKAAkAGMAP QAkAEUAeAB lAGMAdQB0A GkAbwBuAEM AbwBuAHQAZ QB4AHQALgB HAGUAdABUA HkAcABlACg AKQAuAEcAZ QB0AEYAaQB lAGwAZAAoA CIAXwBjAG8 AbgB0AGUAe AB0ACIALAA iAE4AbwBuA FAAdQBiAGw AaQBjACwAS QBuAHMAdAB hAG4AYwBlA CIAKQAuAEc AZQB0AFYAY QBsAHUAZQA oACQARQB4A GUAYwB1AHQ AaQBvAG4AQ wBvAG4AdAB lAHgAdAApA CkALgBHAGU AdABUAHkAc ABlACgAKQA uAEcAZQB0A EYAaQBlAGw AZAAoACIAX wBhAHUAdAB oAG8AcgBpA HoAYQB0AGk AbwBuAE0AY QBuAGEAZwB lAHIAIgAsA CIATgBvAG4 AUAB1AGIAb ABpAGMALAB JAG4AcwB0A GEAbgBjAGU AIgApAC4AU wBlAHQAVgB hAGwAdQBlA CgAJABjACw AKABOAGUAd wAtAE8AYgB qAGUAYwB0A CAATQBhAG4 AYQBnAGUAb QBlAG4AdAA uAEEAdQB0A G8AbQBhAHQ AaQBvAG4AL gBBAHUAdAB oAG8AcgBpA HoAYQB0AGk AbwBuAE0AY QBuAGEAZwB lAHIAIAAiA E0AaQBjAHI AbwBzAG8AZ gB0AC4AUAB vAHcAZQByA FMAaABlAGw AbAAiACkAK QB9ADsARAB pAHMAYQBiA GwAZQAtAEU AeABlAGMAd QB0AGkAbwB uAFAAbwBsA GkAYwB5ADs AJgAgACcAQ wA6AFwAUAB yAG8AZwByA GEAbQAgAEY AaQBsAGUAc wBcAFMAeQB uAGMAdABoA GkAbgBnAFw ASQBuAHMAd ABhAGwAbAA tAFMAeQBuA GMAdABoAGk AbgBnAFMAZ QByAHYAaQB jAGUALgBwA HMAMQAnACA ALQBJAG4Ac wB0AGEAbAB sACAALQBTA GUAcgB2AGk AYwBlAEEAY wBjAG8AdQB uAHQAVQBzA GUAcgBOAGE AbQBlACAAI gBTAHkAbgB jAHQAaABpA G4AZwBTAGU AcgB2AGkAY wBlAEEAYwB jAHQAIgAgA C0AUwBlAHI AdgBpAGMAZ QBBAGMAYwB vAHUAbgB0A EQAZQBzAGM AcgBpAHAAd ABpAG8AbgA gACIAUwB5A G4AYwB0AGg AaQBuAGcAI ABzAGUAcgB 2AGkAYwBlA CAAYQBjAGM AbwB1AG4Ad AAiACAALQB TAGUAcgB2A GkAYwBlAE4 AYQBtAGUAI AAiAHMAeQB uAGMAdABoA GkAbgBnACI AIAAtAFMAZ QByAHYAaQB jAGUARABpA HMAcABsAGE AeQBOAGEAb QBlACAAIgB TAHkAbgBjA HQAaABpAG4 AZwAgAFMAZ QByAHYAaQB jAGUAIgAgA C0AUwBlAHI AdgBpAGMAZ QBEAGUAcwB jAHIAaQBwA HQAaQBvAG4 AIAAiAFMAe QBuAGMAdAB oAGkAbgBnA CAAcwBlAGM AdQByAGUAb AB5ACAAcwB 5AG4AYwBoA HIAbwBuAGk AegBlAHMAI ABmAGkAbAB lAHMAIABiA GUAdAB3AGU AZQBuACAAd AB3AG8AIAB vAHIAIABtA G8AcgBlACA AYwBvAG0Ac AB1AHQAZQB yAHMAIABpA G4AIAByAGU AYQBsACAAd ABpAG0AZQA uACIAIAAtA FMAZQByAHY AaQBjAGUAU wB0AGEAcgB 0AHUAcABUA HkAcABlACA AUwBFAFIAV gBJAEMARQB fAEQARQBMA EEAWQBFAEQ AXwBBAFUAV ABPAF8AUwB UAEEAUgBUA CAALQBTAGU AcgB2AGkAY wBlAFMAaAB 1AHQAZABvA HcAbgBUAGk AbQBlAG8Ad QB0ACAAMQA wADAAMAAwA DsAZQB4AGk AdAAgACQAT ABBAFMAVAB FAFgASQBUA EMATwBEAEU A MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7796 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
csc.exe (PID: 7940 cmdline: "C:\Window s\Microsof t.NET\Fram ework64\v4 .0.30319\c sc.exe" /n oconfig /f ullpaths @ "C:\Users\ user\AppDa ta\Local\T emp\osrmxu 4t\osrmxu4 t.cmdline" MD5: F65B029562077B648A6A5F6A1AA76A66) - cvtres.exe (PID: 7956 cmdline:
C:\Windows \Microsoft .NET\Frame work64\v4. 0.30319\cv tres.exe / NOLOGO /RE ADONLY /MA CHINE:IX86 "/OUT:C:\ Users\user ~1\AppData \Local\Tem p\RESC856. tmp" "c:\U sers\user\ AppData\Lo cal\Temp\o srmxu4t\CS CBC202AC77 DBF49D3B95 CED35FD5BD 811.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950) 
nssm.exe (PID: 7992 cmdline: "C:\Progra m Files\Sy ncthing\ns sm.exe" in stall sync thing "C:\ Program Fi les\Syncth ing\syncth ing.exe" MD5: 8F3125D49DD0E38E2FD7A1351281005E) - icacls.exe (PID: 8012 cmdline:
"C:\Window s\system32 \icacls.ex e" C:\Prog ramData\Sy ncthing /r eset /t MD5: 48C87E3B3003A2413D6399EA77707F5D) - icacls.exe (PID: 8032 cmdline:
"C:\Window s\system32 \icacls.ex e" C:\Prog ramData\Sy ncthing /i nheritance :r /grant *S-1-5-18: (OI)(CI)F /grant *S- 1-5-32-544 :(OI)(CI)F /grant Sy ncthingSer viceAcct:( OI)(CI)M MD5: 48C87E3B3003A2413D6399EA77707F5D) - attrib.exe (PID: 8052 cmdline:
"C:\Window s\system32 \attrib.ex e" +i C:\P rogramData \Syncthing MD5: 5037D8E6670EF1D89FB6AD435F12A9FD) - attrib.exe (PID: 8084 cmdline:
"C:\Window s\system32 \attrib.ex e" +i C:\P rogramData \Syncthing \* /s /d MD5: 5037D8E6670EF1D89FB6AD435F12A9FD) - nssm.exe (PID: 8120 cmdline:
"C:\Progra m Files\Sy ncthing\ns sm.exe" se t syncthin g ObjectNa me .\Synct hingServic eAcct eLXY qAsefewf61 oUDKtR3UCB d5SuKIgVFW q1EpUcJQYH HzoeRojjKs P40YWiuYrA chxH8Ky+ER zl1tD+yHxl PFn7cldw+X 4Hv9uxzftM 2ig/WIrwAI AOynixJPLk oYS MD5: 8F3125D49DD0E38E2FD7A1351281005E) - icacls.exe (PID: 6384 cmdline:
"C:\Window s\system32 \icacls.ex e" "C:\Pro gram Files \Syncthing " /reset / t MD5: 48C87E3B3003A2413D6399EA77707F5D) - conhost.exe (PID: 6952 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - icacls.exe (PID: 2936 cmdline:
"C:\Window s\system32 \icacls.ex e" "C:\Pro gram Files \Syncthing " /grant " SyncthingS erviceAcct :(OI)(CI)M " MD5: 48C87E3B3003A2413D6399EA77707F5D) - conhost.exe (PID: 6408 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - cscript.exe (PID: 4016 cmdline:
"C:\Window s\system32 \cscript.e xe" "C:\Pr ogram File s\Syncthin g\SetSynct hingConfig .js" /serv ice /autou pgradeinte rval:12 /g uiaddress: "127.0.0.1 :8384" MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD) - conhost.exe (PID: 3088 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
syncthing.exe (PID: 3020 cmdline: "C:\Progra m Files\Sy ncthing\sy ncthing.ex e" generat e --skip-p ort-probin g --home=" C:\Program Data\Synct hing" --no -default-f older MD5: EF3D18900944F5CCB93E62C51385D056) - conhost.exe (PID: 1568 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - nssm.exe (PID: 1532 cmdline:
"C:\Progra m Files\Sy ncthing\ns sm.exe" st art "synct hing" MD5: 8F3125D49DD0E38E2FD7A1351281005E) - conhost.exe (PID: 2332 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- svchost.exe (PID: 4236 cmdline:
C:\Windows \System32\ svchost.ex e -k Netwo rkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- SgrmBroker.exe (PID: 2520 cmdline:
C:\Windows \system32\ SgrmBroker .exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
- svchost.exe (PID: 3172 cmdline:
C:\Windows \system32\ svchost.ex e -k Unist ackSvcGrou p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svchost.exe (PID: 4480 cmdline:
C:\Windows \System32\ svchost.ex e -k Local SystemNetw orkRestric ted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svchost.exe (PID: 4892 cmdline:
C:\Windows \System32\ svchost.ex e -k Local ServiceNet workRestri cted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) 
MpCmdRun.exe (PID: 7240 cmdline: "C:\Progra m Files\Wi ndows Defe nder\mpcmd run.exe" - wdenable MD5: B3676839B2EE96983F9ED735CD044159) - conhost.exe (PID: 7504 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- svchost.exe (PID: 4340 cmdline:
C:\Windows \System32\ svchost.ex e -k wsapp x -p -s Cl ipSVC MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svchost.exe (PID: 7304 cmdline:
C:\Windows \system32\ svchost.ex e -k Local Service -s W32Time MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svchost.exe (PID: 8160 cmdline:
C:\Windows \System32\ svchost.ex e -k Local Service -p -s Licens eManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- nssm.exe (PID: 4240 cmdline:
"C:\Progra m Files\Sy ncthing\ns sm.exe" MD5: 8F3125D49DD0E38E2FD7A1351281005E) - conhost.exe (PID: 2500 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 2860 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: EF3D18900944F5CCB93E62C51385D056) - conhost.exe (PID: 3084 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 4452 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: EF3D18900944F5CCB93E62C51385D056) - syncthing.exe (PID: 3916 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 5204 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - ROUTE.EXE (PID: 4220 cmdline:
route prin t 0.0.0.0 MD5: 3C97E63423E527BA8381E81CBA00B8CD) - conhost.exe (PID: 5100 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 792 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - conhost.exe (PID: 7000 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - syncthing.exe (PID: 5648 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 5700 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 4196 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - syncthing.exe (PID: 5880 cmdline:
"C:\Progra m Files\Sy ncthing\sy ncthing.ex e" MD5: 26F6E036AD270D4AFC3B24520CD72166) - conhost.exe (PID: 7720 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- cleanup
⊘No configs have been found
⊘No yara matches
| Source: | Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): | ||