Edit tour
Windows
Analysis Report
ps11.0.0.129pro.exe
Overview
General Information
Detection
Score: | 32 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 40% |
Signatures
Hides threads from debuggers
Query firmware table information (likely to detect VMs)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to evade debugger and weak emulator (self modifying code)
Abnormal high CPU Usage
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Creates a process in suspended mode (likely to inject code)
Drops PE files
Found dropped PE file which has not been started or loaded
PE file contains executable resources (Code or Archives)
PE file contains strange resources
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Office Autorun Keys Modification
Sigma detected: Potential Persistence Via Visual Studio Tools for Office
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Classification
- System is w10x64_ra
- ps11.0.0.129pro.exe (PID: 6804 cmdline:
"C:\Users\ user\Deskt op\ps11.0. 0.129pro.e xe" MD5: FC13BC8B09702EC0CA1A48F7E9157380) - ps11.0.0.129pro.tmp (PID: 6824 cmdline:
"C:\Users\ user\AppDa ta\Local\T emp\is-BR9 JR.tmp\ps1 1.0.0.129p ro.tmp" /S L5="$70296 ,54471570, 58368,C:\U sers\user\ Desktop\ps 11.0.0.129 pro.exe" MD5: 5ED68C2D50F4232A83D39C41722BC908) - _setup64.tmp (PID: 2668 cmdline:
helper 105 0x3EC MD5: E4211D6D009757C078A9FAC7FF4F03D4) - conhost.exe (PID: 1872 cmdline:
C:\Windows \system32\ conhost.ex e 0xffffff ff -ForceV 1 MD5: 0D698AF330FD17BEE3BF90011D49251D) - PlanSwift.exe (PID: 2296 cmdline:
"C:\Progra m Files (x 86)\PlanSw ift11\Plan Swift.exe" /regserve r MD5: B157207600DF34B69CA9AA91F1659383)
- cleanup
⊘No configs have been found
Source | Rule | Description | Author | Strings |
---|---|---|---|---|
JoeSecurity_DelphiSystemParamCount | Detected Delphi use of System.ParamCount() | Joe Security |
Source: | Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): |
Source: | Author: Bhabesh Raj: |
Timestamp | SID | Severity | Classtype | Source IP | Source Port | Destination IP | Destination Port | Protocol |
---|---|---|---|---|---|---|---|---|
2024-10-31T17:13:09.762456+0100 | 2022930 | 1 | A Network Trojan was detected | 52.149.20.212 | 443 | 192.168.2.17 | 49702 | TCP |
2024-10-31T17:13:48.110830+0100 | 2022930 | 1 | A Network Trojan was detected | 52.149.20.212 | 443 | 192.168.2.17 | 49710 | TCP |
Click to jump to signature section
Show All Signature Results
Source: | Static PE information: |
Source: | Window detected: |