Edit tour

Windows Analysis Report
7zip.exe

Overview

General Information

Sample name:	7zip.exe
Analysis ID:	1579706
MD5:	b47280043c7baa8a5defa1b1f40ceac6
SHA1:	8357dcd88c30fc27c8d495d411f043b4b39ca091
SHA256:	1719052a18c211d86e49577812373375a2e2c21e6d8bfefe008b8451acbec182
Tags:	exeuser-4k95m
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Found pyInstaller with non standard icon

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7zip.exe (PID: 984 cmdline: "C:\Users\user\Desktop\7zip.exe" MD5: B47280043C7BAA8A5DEFA1B1F40CEAC6)

conhost.exe (PID: 5884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

7zip.exe (PID: 5268 cmdline: "C:\Users\user\Desktop\7zip.exe" MD5: B47280043C7BAA8A5DEFA1B1F40CEAC6)

cleanup

Code function: 0_2_00007FF6B7964C40 GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,GetProcAddress,GetLastError,

0_2_00007FF6B7964C40

Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_SHA384.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_ofb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_BLAKE2s.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_ghash_portable.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_ghash_clmul.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_Salsa20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Math\_modexp.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_MD4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_pkcs1_decode.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_chacha20.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_RIPEMD160.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_ARC4.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_MD5.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\PublicKey\_curve448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\libcrypto-3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_SHA224.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_cbc.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\PublicKey\_ed448.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_SHA512.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_aesni.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_aes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_cfb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Protocol\_scrypt.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_ocb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_blowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_SHA256.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_ecb.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_des.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Util\_cpuid_c.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_eksblowfish.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Util\_strxor.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_MD2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\PublicKey\_curve25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_BLAKE2b.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_des3.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_cast.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_keccak.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\PublicKey\_ed25519.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\PublicKey\_ec_ws.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_arc2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_SHA1.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\python312.dll	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Cipher\_raw_ctr.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_wmi.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\7zip.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI9842\Crypto\Hash\_poly1305.pyd	Jump to dropped file