Edit tour
Windows
Analysis Report
ITC590-Script 2 V1-2024.exe
Overview
General Information
| Sample name: | ITC590-Script 2 V1-2024.exe |
| Analysis ID: | 1522421 |
| MD5: | 4ac074744836b3742200b03807655bd9 |
| SHA1: | cec4e3902cab847249ca4e63750f8bbfdb503165 |
| SHA256: | 918bf06d20f2240938fc8a940a4b019cc573cee762ee169ce3e2fba155d5796b |
| Tags: | exeuser-Dyrockful |
| Infos: | |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Found pyInstaller with non standard icon
Uses cmd line tools excessively to alter registry or file data
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Extensive use of GetProcAddress (often used to hide API calls)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses reg.exe to modify the Windows registry
Classification
- System is w10x64
ITC590-Script 2 V1-2024.exe (PID: 6280 cmdline: "C:\Users\ user\Deskt op\ITC590- Script 2 V 1-2024.exe " MD5: 4AC074744836B3742200B03807655BD9) - ITC590-Script 2 V1-2024.exe (PID: 6536 cmdline:
"C:\Users\ user\Deskt op\ITC590- Script 2 V 1-2024.exe " MD5: 4AC074744836B3742200B03807655BD9) 
cmd.exe (PID: 6464 cmdline: C:\Windows \system32\ cmd.exe /c reg add " HKCU\Softw are\TestSo ftware" /v TestValue /d "Test Data" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 6588 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) 
reg.exe (PID: 480 cmdline: reg add "H KCU\Softwa re\TestSof tware" /v TestValue /d "Test D ata" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4) - cmd.exe (PID: 4108 cmdline:
C:\Windows \system32\ cmd.exe /c reg add " HKCU\Softw are\TestSo ftware" /v TestValue /d "Modif ied Data-I TC590 2024 " /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 3752 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - reg.exe (PID: 6128 cmdline:
reg add "H KCU\Softwa re\TestSof tware" /v TestValue /d "Modifi ed Data-IT C590 2024" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | ReversingLabs: | ||
| Source: | Integrated Neural Analysis Model: | ||
| Source: | Static PE information: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||