Edit tour

Windows Analysis Report
1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe

Overview

General Information

Sample name:	1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe
Analysis ID:	1525934
MD5:	b5a7911c3e2c9b1c2dc810bd3355ea34
SHA1:	a6cb0cb7e7979d99293117f36485ee95207b3d40
SHA256:	8b403bd306d2b5deb77a14627273dd08f2717da9091de9477cf206a42cdbbb6c
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Errors No process behavior to analyse as no analysis process or sample was found Corrupt sample or wrongly selected analyzer. Details: The image file %1 is valid, but is for a machine type other than the current machine.

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected UAC Bypass using CMSTP

Yara signature match

Classification

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x202680:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x20d63e:$s1: CoGetObject 0x20262c:$s2: Elevation:Administrator!new:

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match

File source: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe, type: SAMPLE

System Summary

Malicious sample detected (through community Yara rule)

Source: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe, type: SAMPLE

Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen

Source: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe, type: SAMPLE

Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Source: classification engine

Classification label: mal56.expl.winEXE@0/0@0/0

Source: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe	String found in binary or memory: id-cmc-addExtensions
Source: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe	String found in binary or memory: set-addPolicy
Source: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe	String found in binary or memory: #G $GSeDebugPrivilegentdll.dllNtQuerySystemInformationNtQueryObjectNtQuerySectionkernel32.dllNtWow64QueryInformationProcess64NtWow64ReadVirtualMemory64A:\SystemRoot\??\UnmapViewOfFile [-] Can't kill whitelist process (%s - pid:%i), file: %s[] Killing blocking process (%s - pid:%i), file: %sRstrtmgr.dll [-] Restart manager not loaded! Code %lu.ntdllNtSetInformationProcessNtQueryInformationProcess [-] Unlock file failed: %s. Code %lu. [-] RmStartSession failed. Error = %i. Code %lu. [-] RmRegisterResources failed. Error = %i. Code %lu. [-] RmGetList failed. Error = %i. Code %lu.[] Killing blocking process: %s (%s - pid:%i) [-] Failed to kill process pid:%i. Code %lu.[] Service: %sSYSTEM\CurrentControlSet\Services\Start [-] Failed to disable service: %s! Code %lu.[] Process: %sspoolsv.exesihost.exefontdrvhost.execmd.exedwm.exeLogonUI.exelsass.execsrss.exesmss.exewinlogon.exeservices.execonhost.exeeverything.exe[+] Success run: %s (pid:%i)[+] Failed to run: %s! Code %lu.abcdefghijklmnopqrstuvwxyzLocal_ABCDEF0123456789XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXXWhosYourBunny[] CLONE INFO: I'm a clone![] CLONE INFO: I'm original process!"%1" %Software\Classes\exefile\shell\open\command[+] Auto-elevation success.\AppData\ [-] Auto-elevation failed! Code %lu.[+] Re-launch success. [-] Re-launch failed! Code %lu.[+] Command execution completed.\*[+] OK Copy: %s => %s [-] Failed! Copy: %s =
Source: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe	String found in binary or memory: %s. Code %lu..exe.iniSOFTWARE\Microsoft\Windows\CurrentVersion\RunHKEY_LOCAL_MACHINEHKEY_CURRENT_USER[+] Autorun added success => %s\%s [-] Failed to write autorun value. Code %lu. [-] Failed to create autorun key. Code %lu.ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "%s" & cd /d "%s" & Del /f /q /a .exe .batcmd.exe /d /c "ping 127.2 -n 5 & fsutil file setZeroData offset=0 length=20000000 "%s" & cd /d "%s" & Del /f /q /a .exe .ini .dll .bat .db[] Process (high RAM): %ssqlbackupdatabase[] Added process: %s (%s)[] Added service: %s [-] Failed to get active session Id. Code %lu [-] CreateToolhelp32Snapshot failed. Code %luexplorer.exe [-] Couldn't find explorer [-] Failed to open explorer. Code %lu [-] Failed to duplicate token. Code %ludeque<T> too longFileSectionntuser.dat[] LOCAL: %i dirs processed.[] NETWORK: %i dirs processed. [-] FindFirstFile fails in directory %s. Code %lu.\Everything.exe\Everything2.ini\Everything.ini" -startup [-] Cannot find everything engine: %s!\Program Files\Everything\Program Files (x86)\Everything[] Everything Setup...Everything.exewevtutil.exe cl securitywevtutil.exe cl systemwevtutil.exe cl application!.<file:

Source: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe

Static file information: File size 2522231 > 1048576

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	Path Interception	Path Interception	Direct Volume Access	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe	3%	ReversingLabs

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525934
Start date and time:	2024-10-04 16:42:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe
Detection:	MAL
Classification:	mal56.expl.winEXE@0/0@0/0
Cookbook Comments:	Found application associated with file extension: .exe Unable to launch sample, stop analysis

Errors

No process behavior to analyse as no analysis process or sample was found
Corrupt sample or wrongly selected analyzer. Details: The image file %1 is valid, but is for a machine type other than the current machine.

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
VT rate limit hit for: 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe

File type:	MS-DOS executable
Entropy (8bit):	7.130086658611026
TrID:	Generic Win/DOS Executable (2004/3) 49.94% DOS Executable Generic (2002/1) 49.89% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.17%
File name:	1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe
File size:	2'522'231 bytes
MD5:	b5a7911c3e2c9b1c2dc810bd3355ea34
SHA1:	a6cb0cb7e7979d99293117f36485ee95207b3d40
SHA256:	8b403bd306d2b5deb77a14627273dd08f2717da9091de9477cf206a42cdbbb6c
SHA512:	95d1561fa990c13f45d1690e597a398beef93eba0bd8db67ad44bd434df4bde700c9b35702b21fe4b0e267ee6292f332497af88db628e32bd1cf896ded38b3ba
SSDEEP:	49152:IBwqWcbYJjmq8LVCxIPV+0J0yI71SC8ay5ctPZegDfIsnqZVVtsUsh7vz:IBwqpCCRS71SCI5cfPDAWqHVts
TLSH:	9FC5DF03F7818172E4DB0A7143766B7BA93BB910973085C7A74D99786C326C23A3AFD5
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......Dv...............g.......g......'.........A.....R.......R.......Rp.N...$....g.......g..........}...........Ub.......~.......~y.

File Icon


Icon Hash:	00928e8e8686b000

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Malware Configuration

Yara Signatures

Initial Sample

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Exploits

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Errors

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Statistics

System Behavior

Disassembly

Windows Analysis Report
1728051009eb10e260047d3aa3611519e2e152a4cdb441fe3d74ad605ec9b33cc2a06c688f138.dat-decoded.exe