Edit tour
Windows
Analysis Report
Overview
General Information
| Analysis ID: | 803134 |
| Infos: | |
 | |
Detection
| Score: | 1 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Sample execution stops while process was sleeping (likely an evasion)
Program does not show much activity (idle)
Queries the volume information (name, serial number etc) of a device
Classification
- System is w10x64native
cmd.exe (PID: 8124 cmdline: cmd /C "C: \WINDOWS\s ystem32\co nhost.exe 0xffffffff -ForceV1" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B) - conhost.exe (PID: 2752 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Mutant created: | ||
| Source: | Mutant created: | ||
| Source: | Classification label: | ||
| Source: | Process created: | ||
| Source: | Process created: | ||
| Source: | Last function: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Thread injection, dropped files, key value created, disk infection and DNS query: | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Windows Management Instrumentation | Path Interception | 1 Process Injection | 1 Process Injection | OS Credential Dumping | 1 System Information Discovery | Remote Services | Data from Local System | Exfiltration Over Other Network Medium | Data Obfuscation | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No contacted domains info
⊘No contacted IP infos
| Joe Sandbox Version: | 36.0.0 Rainbow Opal |
| Analysis ID: | 803134 |
| Start date and time: | 2023-02-09 19:14:30 +01:00 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 3m 57s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultwindowscmdlinecookbook.jbs |
| Analysis system description: | Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301 |
| Run name: | Potential for more IOCs and behavior |
| Number of analysed new started processes analysed: | 6 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | CLEAN |
| Classification: | clean1.win@2/0@0/0 |
| Cookbook Comments: |
|
- Exclude process from analysis
(whitelisted): dllhost.exe, ba ckgroundTaskHost.exe - Excluded IPs from analysis (wh
itelisted): 20.190.160.17, 40. 126.32.74, 20.190.160.22, 40.1 26.32.72, 40.126.32.68, 20.190 .160.20, 40.126.32.140, 40.126 .32.134 - Excluded domains from analysis
(whitelisted): wdcpalt.micros oft.com, client.wns.windows.co m, prda.aadg.msidentity.com, l ogin.live.com, www.tm.a.prd.aa dg.akadns.net, wdcp.microsoft. com, login.msa.msidentity.com, www.tm.lg.prod.aadmsa.traffic manager.net - Not all processes where analyz
ed, report is missing behavior information
⊘No simulations
⊘No context
⊘No context
⊘No context
⊘No context
⊘No context
⊘No created / dropped files found
⊘No static file info
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node
Report size exceeds maximum size, please checkout the PCAP download to see all network behavior
Click to jump to process
Click to jump to process
Click to jump to process
| Target ID: | 0 |
| Start time: | 19:16:23 |
| Start date: | 09/02/2023 |
| Path: | C:\Windows\SysWOW64\cmd.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x170000 |
| File size: | 236544 bytes |
| MD5 hash: | D0FCE3AFA6AA1D58CE9FA336CC2B675B |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
| Target ID: | 1 |
| Start time: | 19:16:23 |
| Start date: | 09/02/2023 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7381c0000 |
| File size: | 875008 bytes |
| MD5 hash: | 81CA40085FC75BABD2C91D18AA9FFA68 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
⊘No disassembly
