Windows Analysis Report
FYBRUTggrf.exe

Overview

General Information

Sample name: FYBRUTggrf.exe
(renamed file extension from txt to exe, renamed because original name is a hash value)
Original sample name: 4E928F2C40DC96A6A84C207B4B1145997CDC3387B706F0C254A4CC72797C4AB0.txt
Analysis ID: 1546618
MD5: 9bd767f6b9bb867fe32a6cae6b3dd659
SHA1: 53e2092bb89df2e77178c9abfd79ce8b194bf18f
SHA256: 4e928f2c40dc96a6a84c207b4b1145997cdc3387b706f0c254a4cc72797c4ab0
Infos:

Detection

Score: 21
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Signatures

AI detected suspicious sample
Drops PE files
Found dropped PE file which has not been started or loaded
Uses 32bit PE files

Classification

AV Detection
barindex
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 97.2% probability
Uses 32bit PE files
Source: FYBRUTggrf.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: Binary string: D:\users\jyhshyuan_su\Desktop\RunAsAdmin\Release\RunAsAdmin.pdb source: RunAsAdmin.exe.0.dr
Source: FYBRUTggrf.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: FYBRUTggrf.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Uses 32bit PE files
Source: FYBRUTggrf.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: classification engine Classification label: sus21.winEXE@1/2@0/0
Source: C:\Users\user\Desktop\FYBRUTggrf.exe File created: C:\Users\user\AppData\Local\Temp\nsj3117.tmp Jump to behavior
Source: FYBRUTggrf.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\FYBRUTggrf.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe File read: C:\Users\user\Desktop\FYBRUTggrf.exe Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Binary string: D:\users\jyhshyuan_su\Desktop\RunAsAdmin\Release\RunAsAdmin.pdb source: RunAsAdmin.exe.0.dr
Drops PE files
Source: C:\Users\user\Desktop\FYBRUTggrf.exe File created: C:\Users\user\AppData\Local\Temp\RunAsAdmin.exe Jump to dropped file
Source: C:\Users\user\Desktop\FYBRUTggrf.exe File created: C:\Users\user\AppData\Local\Temp\nsz3186.tmp\UserInfo.dll Jump to dropped file
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\RunAsAdmin.exe Jump to dropped file
Source: C:\Users\user\Desktop\FYBRUTggrf.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsz3186.tmp\UserInfo.dll Jump to dropped file
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1546618 Sample: FYBRUTggrf.txt Startdate: 01/11/2024 Architecture: WINDOWS Score: 21 12 AI detected suspicious sample 2->12 5 FYBRUTggrf.exe 12 2->5         started        process3 file4 8 C:\Users\user\AppData\Local\...\UserInfo.dll, PE32 5->8 dropped 10 C:\Users\user\AppData\...\RunAsAdmin.exe, PE32 5->10 dropped
⊘No contacted IP infos