We are hiring! Windows Kernel Developer (Remote), apply here!
flash

file.exe

Status: finished
Submission Time: 2022-11-24 19:03:07 +01:00
Malicious
Evader
Trojan

Comments

Tags

  • exe

Details

  • Analysis ID:
    753408
  • API (Web) ID:
    1120691
  • Analysis Started:
    2022-11-24 19:03:09 +01:00
  • Analysis Finished:
    2022-11-24 19:25:26 +01:00
  • MD5:
    e99e15a440798e20c682eb859b3f7885
  • SHA1:
    b6f3b87894f51669dede0afe6cb4b504fe0ae614
  • SHA256:
    c3dd8a06d395f4772011ed42c0980a54b06915782a06873150462994ed92a712
  • Technologies:
Full Report Management Report IOC Report Engine Info Verdict Score Reports

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211

malicious
88/100

System: Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run Condition: Run with higher sleep bypass

malicious
100/100

malicious
10/90

malicious
21/41

malicious

Domains

Name IP Detection
service-domain.xyz
3.80.150.121
clients.l.google.com
142.250.203.110
clients2.google.com
0.0.0.0

URLs

Name Detection
http://nuget.org/NuGet.exe
http://www.apache.org/licenses/LICENSE-2.0
http://pesterbdd.com/images/Pester.png
Click to see the 12 hidden entries
https://go.microsoft.co
http://www.apache.org/licenses/LICENSE-2.0.html
https://contoso.com/
https://nuget.org/nuget.exe
https://contoso.com/License
https://contoso.com/Icon
https://oneget.orgX
https://oneget.orgformat.ps1xmlagement.dll2040.missionsand
http://crl.micr
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
https://github.com/Pester/Pester
https://oneget.org

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\7zS2607.tmp\Install.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\7zS2D0C.tmp\Install.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\VXAfcxyYiTQKMOERw\efplSHrLkKviaSK\pdyDoIJ.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
Click to see the 12 hidden entries
C:\Windows\System32\GroupPolicy\gpt.ini
ASCII text
#
C:\Windows\Temp\aoRCsjFoxFbwPJxK\MeXzroudxpEgwUW\RFYnzaH.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\7zS2607.tmp\__data__\config.txt
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ambua3bc.cdi.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ctvry2t3.t3r.psm1
very short file (no magic)
#
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Windows\System32\GroupPolicy\Machine\Registry.pol
RAGE Package Format (RPF),
#
C:\Windows\Tasks\bbsSMGQQDZvgelOgpL.job
data
#
C:\Windows\Temp\__PSScriptPolicyTest_22rgx3dy.2p3.psm1
very short file (no magic)
#
C:\Windows\Temp\__PSScriptPolicyTest_umumzqbx.1yl.ps1
very short file (no magic)
#
\Device\ConDrv
ASCII text, with CRLF, CR line terminators
#