Windows Analysis Report
PSKILL.EXE

ID:	1559468
Product:	CloudBasic
Start time:	15:22:29
Start date:	20.11.2024
Sample:	PSKILL.EXE
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	ec9bc439b375bd787ab0d6bba1ae76ab
SHA1:	98773b3e894e8c167fb2c7e7da24b21e2e7c4656
SHA256:	8d6306d1d0aaa65f41e2420d23c2035542511d7d3e9d675edf29e13aa14b9e31
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
\Device\ConDrv	ASCII text, with CRLF line terminators	3C224A146EEC9316A04166F37439E1EA	54043C330A1507CB159577002C0C461EADDE30C1	91646E02DD3C29A72229ED5C0A1A420DCB3153219D38FE9DB22D50A1F2CC6BBA

AV Detection

Source: PSKILL.EXE

ReversingLabs: Detection: 24%

Compliance

Source: PSKILL.EXE

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Networking

Source: PSKILL.EXE, ConDrv.0.dr

String found in binary or memory: http://www.sysinternals.com

System Summary

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00401EB0 OpenServiceA,DeleteService,CloseServiceHandle,

0_2_00401EB0

Source: PSKILL.EXE

Static PE information: Resource name: BINRES type: PE32 executable (console) Intel 80386, for MS Windows

Source: PSKILL.EXE, 00000000.00000002.1664181238.000000000040B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepkill.exe vs PSKILL.EXE
Source: PSKILL.EXE	Binary or memory string: OriginalFilenamepkill.exe vs PSKILL.EXE

Source: PSKILL.EXE

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal48.winEXE@2/1@0/0

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00401080 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,AdjustTokenPrivileges,GetLastError,GetLastError,CloseHandle,AdjustTokenPrivileges,CloseHandle,GetLastError,

0_2_00401080

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: CreateServiceA,CloseServiceHandle,

0_2_00401D40

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00401350 FindResourceA,LoadResource,SizeofResource,LockResource,

0_2_00401350

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00401D80 GetTickCount,GetTickCount,CloseServiceHandle,OpenServiceA,GetLastError,StartServiceA,GetLastError,QueryServiceStatus,QueryServiceStatus,GetTickCount,SetLastError,GetLastError,CloseServiceHandle,SetLastError,

0_2_00401D80

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03

Source: PSKILL.EXE

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PSKILL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PSKILL.EXE

ReversingLabs: Detection: 24%

Source: PSKILL.EXE

String found in binary or memory: %s -install to install the service

Source: unknown	Process created: C:\Users\user\Desktop\PSKILL.EXE "C:\Users\user\Desktop\PSKILL.EXE"
Source: C:\Users\user\Desktop\PSKILL.EXE	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\PSKILL.EXE	Section loaded: apphelp.dll			Jump to behavior
Source: C:\Users\user\Desktop\PSKILL.EXE	Section loaded: mpr.dll			Jump to behavior

Data Obfuscation

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00405FB0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00405FB0

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00405AB0 push eax; ret

0_2_00405ADE

Boot Survival

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00401D80 GetTickCount,GetTickCount,CloseServiceHandle,OpenServiceA,GetLastError,StartServiceA,GetLastError,QueryServiceStatus,QueryServiceStatus,GetTickCount,SetLastError,GetLastError,CloseServiceHandle,SetLastError,

0_2_00401D80

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\PSKILL.EXE

API coverage: 7.7 %

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PSKILL.EXE

API call chain: ExitProcess graph end node

Anti Debugging

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00405FB0 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00405FB0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\PSKILL.EXE

Code function: 0_2_00402678 EntryPoint,GetVersion,GetCommandLineA,

0_2_00402678