Edit tour
Windows
Analysis Report
luxor - pharaoh's challenge.exe
Overview
General Information
Detection
Score: | 100 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Uses cmd line tools excessively to alter registry or file data
Modifies Chrome's extension installation force list
Obfuscated command line found
Found potential ransomware demand text
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
PE file contains sections with non-standard names
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
IP address seen in connection with other malware
Enables debug privileges
Sample file is different than original file name gathered from version info
Drops PE files
HTML page is missing a favicon
Uses reg.exe to modify the Windows registry
Uses taskkill to terminate processes
PE / OLE file has an invalid certificate
Found large amount of non-executed APIs
Installs a Chrome extension
Creates a process in suspended mode (likely to inject code)
Classification
- System is w10x64
- luxor - pharaoh's challenge.exe (PID: 7116 cmdline:
C:\Users\u ser\Deskto p\luxor - pharaoh's challenge. exe MD5: A7A5C04005C17D1FA983F835CFFBD183) - luxor - pharaoh's challenge.tmp (PID: 7132 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-1G4 KI.tmp\lux or - phara oh's chall enge.tmp" /SL5="$204 10,857904, 780800,C:\ Users\user \Desktop\l uxor - pha raoh's cha llenge.exe " MD5: A93A63A9E371AF57AE7FF4D3D1A8068C) - luxor - pharaoh's challenge.exe (PID: 6168 cmdline:
"C:\Users\ user\Deskt op\luxor - pharaoh's challenge .exe" /SIL ENT MD5: A7A5C04005C17D1FA983F835CFFBD183) - luxor - pharaoh's challenge.tmp (PID: 1568 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-HVT 6A.tmp\lux or - phara oh's chall enge.tmp" /SL5="$204 14,857904, 780800,C:\ Users\user \Desktop\l uxor - pha raoh's cha llenge.exe " /SILENT MD5: A93A63A9E371AF57AE7FF4D3D1A8068C) - EdgeInstall.exe (PID: 868 cmdline:
"C:\Users\ user\AppDa ta\Local\M icroApp\Ed geInstall. exe" insta ll MD5: BC44C3F3B1E233CCF83E964193F4CC0D) - cmd.exe (PID: 5184 cmdline:
C:\Windows \system32\ cmd.exe" / C ""C:\Use rs\user\Ap pData\Loca l\MicroApp \edge.bat" install MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 5168 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - cmd.exe (PID: 6368 cmdline:
C:\Windows \system32\ cmd.exe" / C ""C:\Use rs\user\Ap pData\Loca l\MicroApp \reg.bat" install MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 6340 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - ChromeInstall.exe (PID: 6328 cmdline:
"C:\Users\ user\AppDa ta\Local\S erviceApp\ ChromeInst all.exe" i nstall MD5: CFBB52F1BD761012D807812DB9566A8B) - cmd.exe (PID: 848 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \ServiceAp p\chrome.b at" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 4812 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - schtasks.exe (PID: 6476 cmdline:
schtasks.e xe /Create /XML "C:\ Users\user \AppData\L ocal\Servi ceApp\reg. xml" /tn C hromeUpdat e MD5: 838D346D1D28F00783B7A6C6BD03A0DA) - cmd.exe (PID: 6472 cmdline:
C:\Windows \system32\ cmd.exe" / C ""C:\Use rs\user\Ap pData\Loca l\ServiceA pp\chrome. bat" insta ll MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 6440 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - schtasks.exe (PID: 6544 cmdline:
schtasks.e xe /Create /XML "C:\ Users\user \AppData\L ocal\Servi ceApp\reg. xml" /tn C hromeUpdat e MD5: 838D346D1D28F00783B7A6C6BD03A0DA) - cmd.exe (PID: 6632 cmdline:
C:\Windows \system32\ cmd.exe" / C ""C:\Use rs\user\Ap pData\Loca l\ServiceA pp\reg.bat " install MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 5096 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - schtasks.exe (PID: 6744 cmdline:
schtasks.e xe /Create /XML "C:\ Users\user \AppData\L ocal\Servi ceApp\reg. xml" /tn C hromeUpdat e MD5: 838D346D1D28F00783B7A6C6BD03A0DA) - chrome.exe (PID: 4648 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --st art-maximi zed --sing le-argumen t https:// getfiles.w iki/welcom e.php MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6500 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1676 --fi eld-trial- handle=179 2,i,107462 4640317420 2797,58806 9723319156 5135,13107 2 --disabl e-features =Optimizat ionGuideMo delDownloa ding,Optim izationHin ts,Optimiz ationTarge tPredictio n /prefetc h:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)
- ChromeInstall.exe (PID: 6420 cmdline:
C:\Users\u ser\AppDat a\Local\Se rviceApp\C hromeInsta ll.exe MD5: CFBB52F1BD761012D807812DB9566A8B) - cmd.exe (PID: 6900 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \ServiceAp p\chrome.b at" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 7252 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - reg.exe (PID: 7292 cmdline:
REG DELETE HKLM\SOFT WARE\Polic ies\Google \Chrome /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 7460 cmdline:
REG DELETE HKLM\SOFT WARE\Googl e\Chrome\E xtensions\ macjkjgiee oakdlmmfef gmldohgddp kj /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 7620 cmdline:
REG DELETE HKLM\SOFT WARE\WOW64 32Node\Goo gle\Chrome \Extension s\macjkjgi eeoakdlmmf efgmldohgd dpkj /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 7916 cmdline:
REG ADD "H KLM\SOFTWA RE\Policie s\Google\C hrome\Exte nsionInsta llAllowlis t" /v "3" /t REG_SZ /d macjkjg ieeoakdlmm fefgmldohg ddpkj /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 8056 cmdline:
REG ADD "H KLM\SOFTWA RE\Google\ Chrome\Ext ensions\ma cjkjgieeoa kdlmmfefgm ldohgddpkj " /v "path " /t REG_S Z /d "C:\U sers\user\ AppData\Lo cal\Servic eApp\apps- helper\app s.crx" /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 7204 cmdline:
REG ADD "H KLM\SOFTWA RE\Google\ Chrome\Ext ensions\ma cjkjgieeoa kdlmmfefgm ldohgddpkj " /v "vers ion" /t RE G_SZ /d 1. 0 /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 6556 cmdline:
REG ADD "H KLM\SOFTWA RE\WOW6432 Node\Polic ies\Google \Chrome\Ex tensionIns tallAllowl ist" /v "3 " /t REG_S Z /d macjk jgieeoakdl mmfefgmldo hgddpkj /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 1340 cmdline:
REG ADD "H KLM\SOFTWA RE\WOW6432 Node\Googl e\Chrome\E xtensions\ macjkjgiee oakdlmmfef gmldohgddp kj" /v "pa th" /t REG _SZ /d "C: \Users\use r\AppData\ Local\Serv iceApp\app s-helper\a pps.crx" / f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 1952 cmdline:
REG ADD "H KLM\SOFTWA RE\WOW6432 Node\Googl e\Chrome\E xtensions\ macjkjgiee oakdlmmfef gmldohgddp kj" /v "ve rsion" /t REG_SZ /d 1.0 /f MD5: E3DACF0B31841FA02064B4457D44B357) - taskkill.exe (PID: 4880 cmdline:
taskkill / F /IM chro me.exe /T MD5: 530C6A6CBA137EAA7021CEF9B234E8D4) - chrome.exe (PID: 7124 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --pr ofile-dire ctory="Def ault" --no -startup-w indow --lo ad-extensi on="C:\Use rs\user\Ap pData\Loca l\ServiceA pp\apps-he lper" --hi de-crash-r estore-bub ble MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 8012 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =2016 --fi eld-trial- handle=182 0,i,648895 5529033307 594,165384 7653363708 0987,13107 2 /prefetc h:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - timeout.exe (PID: 6800 cmdline:
timeout 5 MD5: EB9A65078396FB5D4E3813BB9198CB18) - reg.exe (PID: 6552 cmdline:
REG ADD "H KLM\SOFTWA RE\Policie s\Google\C hrome\Exte nsionInsta llForcelis t" /v "3" /t REG_SZ /d macjkjg ieeoakdlmm fefgmldohg ddpkj /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 5224 cmdline:
REG ADD "H KLM\SOFTWA RE\WOW6432 Node\Polic ies\Google \Chrome\Ex tensionIns tallForcel ist" /v "3 " /t REG_S Z /d macjk jgieeoakdl mmfefgmldo hgddpkj /f MD5: E3DACF0B31841FA02064B4457D44B357) - timeout.exe (PID: 1276 cmdline:
timeout 5 MD5: EB9A65078396FB5D4E3813BB9198CB18) - taskkill.exe (PID: 5044 cmdline:
taskkill / F /IM chro me.exe /T MD5: 530C6A6CBA137EAA7021CEF9B234E8D4) - chrome.exe (PID: 7488 cmdline:
C:\Program Files\Goo gle\Chrome \Applicati on\chrome. exe" --pro file-direc tory="Defa ult MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - chrome.exe (PID: 6904 cmdline:
"C:\Progra m Files\Go ogle\Chrom e\Applicat ion\chrome .exe" --ty pe=utility --utility -sub-type= network.mo jom.Networ kService - -lang=en-U S --servic e-sandbox- type=none --mojo-pla tform-chan nel-handle =1780 --fi eld-trial- handle=180 0,i,127633 6100832153 0227,15262 5314617661 49957,1310 72 /prefet ch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408) - MpCmdRun.exe (PID: 4632 cmdline:
"C:\Progra m Files\Wi ndows Defe nder\mpcmd run.exe" - wdenable MD5: A267555174BFA53844371226F482B86B) - conhost.exe (PID: 7452 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
- ChromeInstall.exe (PID: 1684 cmdline:
C:\Users\u ser\AppDat a\Local\Se rviceApp\C hromeInsta ll.exe MD5: CFBB52F1BD761012D807812DB9566A8B)
- ChromeInstall.exe (PID: 5196 cmdline:
C:\Users\u ser\AppDat a\Local\Se rviceApp\C hromeInsta ll.exe MD5: CFBB52F1BD761012D807812DB9566A8B) - cmd.exe (PID: 6380 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\App Data\Local \ServiceAp p\chrome.b at" " MD5: 4E2ACF4F8A396486AB4268C94A6A245F) - conhost.exe (PID: 6352 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496) - reg.exe (PID: 6472 cmdline:
REG DELETE HKLM\SOFT WARE\Polic ies\Google \Chrome /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 6428 cmdline:
REG DELETE HKLM\SOFT WARE\Googl e\Chrome\E xtensions\ macjkjgiee oakdlmmfef gmldohgddp kj /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 6816 cmdline:
REG DELETE HKLM\SOFT WARE\WOW64 32Node\Goo gle\Chrome \Extension s\macjkjgi eeoakdlmmf efgmldohgd dpkj /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 5448 cmdline:
REG ADD "H KLM\SOFTWA RE\Policie s\Google\C hrome\Exte nsionInsta llAllowlis t" /v "3" /t REG_SZ /d macjkjg ieeoakdlmm fefgmldohg ddpkj /f MD5: E3DACF0B31841FA02064B4457D44B357) - reg.exe (PID: 5500 cmdline:
REG ADD "H KLM\SOFTWA RE\Google\ Chrome\Ext ensions\ma cjkjgieeoa kdlmmfefgm ldohgddpkj " /v "path " /t REG_S Z /d "C:\U sers\user\ AppData\Lo cal\Servic eApp\apps- helper\app s.crx" /f MD5: E3DACF0B31841FA02064B4457D44B357)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |
---|
Source: | ReversingLabs: | |||
Source: | Virustotal: | Perma Link |
Source: | Avira: |
Source: | Avira URL Cloud: | ||
Source: | Avira URL Cloud: |
Source: | Avira: | ||
Source: | Avira: |
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: | ||
Source: | ReversingLabs: |
Source: | HTTP Parser: | ||
Source: | HTTP Parser: |
Source: | Static PE information: |
Source: | File opened: | Jump to behavior |
Source: | Directory created: | Jump to behavior | ||
Source: | Directory created: |
Source: | Static PE information: |
Source: | Code function: |