Edit tour
Windows
Analysis Report
Project.exe
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Snort IDS alert for network traffic
Drops PE files to the startup folder
Drops PE files with a suspicious file extension
Changes the view of files in windows explorer (hidden files and folders)
Machine Learning detection for sample
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
Disables the Windows registry editor (regedit)
Creates autostart registry keys with suspicious names
Drops executables to the windows directory (C:\Windows) and starts them
Uses schtasks.exe or at.exe to add and modify task schedules
Drops PE files with benign system names
Uses 32bit PE files
Creates files inside the driver directory
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Deletes files inside the Windows folder
Uses code obfuscation techniques (call, push, ret)
Creates files inside the system directory
PE file contains sections with non-standard names
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Stores files to the Windows start menu directory
JA3 SSL client fingerprint seen in connection with other malware
IP address seen in connection with other malware
Entry point lies outside standard sections
Creates a DirectInput object (often for capturing keystrokes)
PE file contains an invalid checksum
PE file contains strange resources
Drops PE files
Tries to load missing DLLs
Drops PE files to the windows directory (C:\Windows)
Creates a start menu entry (Start Menu\Programs\Startup)
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Classification
- System is w10x64
- Project.exe (PID: 4040 cmdline:
"C:\Users\ user\Deskt op\Project .exe" MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9) - explorer.exe (PID: 5944 cmdline:
explorer.e xe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7) - smss.exe (PID: 4592 cmdline:
C:\Users\u ser\AppDat a\Local\sm ss.exe MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9) - winlogon.exe (PID: 2480 cmdline:
C:\Users\u ser\AppDat a\Local\wi nlogon.exe MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9) - at.exe (PID: 6124 cmdline:
at /delete /y MD5: 6E495479C0213E98C8141C75807AADC9) - conhost.exe (PID: 6140 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - at.exe (PID: 3056 cmdline:
at 17:08 / every:M,T, W,Th,F,S,S u "C:\User s\user\App Data\Roami ng\Microso ft\Windows \Templates \WowTumpeh .com" MD5: 6E495479C0213E98C8141C75807AADC9) - conhost.exe (PID: 5328 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - services.exe (PID: 3632 cmdline:
C:\Users\u ser\AppDat a\Local\se rvices.exe MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9) - lsass.exe (PID: 5076 cmdline:
C:\Users\u ser\AppDat a\Local\ls ass.exe MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9) - inetinfo.exe (PID: 1656 cmdline:
C:\Users\u ser\AppDat a\Local\in etinfo.exe MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9)
- smss.exe (PID: 5180 cmdline:
"C:\Users\ user\AppDa ta\Local\s mss.exe" MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9)
- bronstab.exe (PID: 5348 cmdline:
"C:\Window s\ShellNew \bronstab. exe" MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9) - smss.exe (PID: 5296 cmdline:
C:\Users\u ser\AppDat a\Local\sm ss.exe MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9)
- smss.exe (PID: 3896 cmdline:
"C:\Users\ user\AppDa ta\Local\s mss.exe" MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9)
- Empty.pif (PID: 6164 cmdline:
"C:\Users\ user\AppDa ta\Roaming \Microsoft \Windows\S tart Menu\ Programs\S tartup\Emp ty.pif" MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9) - smss.exe (PID: 6272 cmdline:
C:\Users\u ser\AppDat a\Local\sm ss.exe MD5: 7FA0FD0F97237B9F3CAD2578118EA6F9)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
Click to see the 7 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
Click to see the 18 entries |
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
INDICATOR_EXE_Packed_MEW | Detects executables packed with MEW | ditekSHen | ||
Click to see the 41 entries |
⊘No Sigma rule has matched
Timestamp: | 192.168.2.374.6.143.2549773802006999 08/01/22-03:33:36.434328 |
SID: | 2006999 |
Source Port: | 49773 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 192.168.2.3212.82.100.15049753802006999 08/01/22-03:33:36.273001 |
SID: | 2006999 |
Source Port: | 49753 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Timestamp: | 192.168.2.374.6.143.2549754802006999 08/01/22-03:33:14.494080 |
SID: | 2006999 |
Source Port: | 49754 |
Destination Port: | 80 |
Protocol: | TCP |
Classtype: | A Network Trojan was detected |
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | Virustotal: | Perma Link | ||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Avira: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: | |||
Source: | Metadefender: | Perma Link | ||
Source: | ReversingLabs: |
Source: | Joe Sandbox ML: |
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: | ||
Source: | Joe Sandbox ML: |
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: | ||
Source: | Avira: |
Source: | Static PE information: |
Source: | HTTPS traffic detected: | ||
Source: | HTTPS traffic detected: |
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior | ||
Source: | File opened: | Jump to behavior |
Networking |
---|
Source: | Snort IDS: | ||
Source: | Snort IDS: | ||
Source: | Snort IDS: |
Source: | JA3 fingerprint: |
Source: | IP Address: | ||
Source: | IP Address: |
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: | ||
Source: | Network traffic detected: |
Source: | String found in binary or memory: | ||
Source: | String found in binary or memory: |