Edit tour
Windows
Analysis Report
https://downloads.jam-software.de/ultrasearch/UltraSearch-Setup.exe
Overview
General Information
Detection
Score: | 56 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Found direct / indirect Syscall (likely to bypass EDR)
Installs new ROOT certificates
Reads the Security eventlog
Reads the System eventlog
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Contains long sleeps (>= 3 min)
Creates or modifies windows services
Detected non-DNS traffic on DNS port
Detected potential crypto function
Drops PE files
Enables debug privileges
Found dropped PE file which has not been started or loaded
Installs a raw input device (often for capturing keystrokes)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Usage Of Web Request Commands And Cmdlets
Sigma detected: Use Short Name Path in Command Line
Stores files to the Windows start menu directory
Stores large binary data to the registry
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Keylogger Generic
Classification
- System is w10x64
- cmd.exe (PID: 7236 cmdline:
C:\Windows \system32\ cmd.exe /c wget -t 2 -v -T 60 -P "C:\Use rs\user\De sktop\down load" --no -check-cer tificate - -content-d isposition --user-ag ent="Mozil la/5.0 (Wi ndows NT 6 .1; WOW64; Trident/7 .0; AS; rv :11.0) lik e Gecko" " https://do wnloads.ja m-software .de/ultras earch/Ultr aSearch-Se tup.exe" > cmdline.o ut 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 7244 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - wget.exe (PID: 7288 cmdline:
wget -t 2 -v -T 60 - P "C:\User s\user\Des ktop\downl oad" --no- check-cert ificate -- content-di sposition --user-age nt="Mozill a/5.0 (Win dows NT 6. 1; WOW64; Trident/7. 0; AS; rv: 11.0) like Gecko" "h ttps://dow nloads.jam -software. de/ultrase arch/Ultra Search-Set up.exe" MD5: 3DADB6E2ECE9C4B3E1E322E617658B60)
- UltraSearch-Setup.exe (PID: 7684 cmdline:
"C:\Users\ user\Deskt op\downloa d\UltraSea rch-Setup. exe" MD5: FCEFF2B1037BD03E9E3966F1960E6028) - UltraSearch-Setup.tmp (PID: 7696 cmdline:
"C:\Users\ user~1\App Data\Local \Temp\is-8 V5O3.tmp\U ltraSearch -Setup.tmp " /SL5="$2 0444,19444 892,801792 ,C:\Users\ user\Deskt op\downloa d\UltraSea rch-Setup. exe" MD5: D9E522D4DDCF4C675F4522E011FDFEEA) - LicenseManager.exe (PID: 7872 cmdline:
"C:\Users\ user~1\App Data\Local \Temp\is-4 33GV.tmp\L icenseMana ger.exe" l icense ins tall --lan guage en - -useInnoSe tupStyleDi alog --dia logTitle " Setup - U ltraSearch V4.6" --p arentWindo wIdentifie r 197732 - -suppressD ialogs MD5: 97EBF8A47AA5F9E08BCF8E68EA482F76) - LicenseManager.exe (PID: 8068 cmdline:
"C:\Users\ user~1\App Data\Local \Temp\is-4 33GV.tmp\L icenseMana ger.exe" l icense get Type MD5: 97EBF8A47AA5F9E08BCF8E68EA482F76) - UltraSearch.exe (PID: 8180 cmdline:
"C:\Progra m Files\JA M Software \UltraSear ch\UltraSe arch.exe" /nogui /in stallcerti ficate MD5: DB7DCF7351CAACF862F66D1E62D0B2EF) - UltraSearch.exe (PID: 1464 cmdline:
"C:\Progra m Files\JA M Software \UltraSear ch\UltraSe arch.exe" /NOGUI /NO TRAY /INST ALL /SL5=" $20444,194 44892,8017 92,C:\User s\user\Des ktop\downl oad\UltraS earch-Setu p.exe" MD5: DB7DCF7351CAACF862F66D1E62D0B2EF) - UltraSearch.exe (PID: 4872 cmdline:
"C:\Progra m Files\JA M Software \UltraSear ch\UltraSe arch.exe" /NOGUI /NO TRAY /INST ALL /INSTA LL_AUTOSTA RT /INSTAL L_CONTEXTM ENU MD5: DB7DCF7351CAACF862F66D1E62D0B2EF) - UltraSearch.exe (PID: 7432 cmdline:
"C:\Progra m Files\JA M Software \UltraSear ch\UltraSe arch.exe" /NOGUI /NO TRAY /INST ALL /REGIS TERPACKAGE /SAVESETT INGS /Lang uage "en" MD5: DB7DCF7351CAACF862F66D1E62D0B2EF)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_Keylogger_Generic | Yara detected Keylogger Generic | Joe Security |
Source: | Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: |
Source: | Author: frack113, Nasreddine Bencherchali: |
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
Source: | Window detected: |