Edit tour
Windows
Analysis Report
file.exe
Overview
General Information
| Sample name: | file.exe |
| Analysis ID: | 1504861 |
| MD5: | 9174e680d1b0ea8cdb3ee932ec2dfc6f |
| SHA1: | 49ba7df579d1b30e9c4474ba6733748614ab5c68 |
| SHA256: | 136d5473ded4b9a2bef3ef6160a377c0965b4e7292fb81980219ef8cc7d96cfd |
| Tags: | exe |
| Infos: | |
 | |
Detection
| Score: | 64 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 100% |
Signatures
Multi AV Scanner detection for submitted file
AI detected suspicious sample
Binary is likely a compiled AutoIt script file
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
OS version to string mapping found (often used in BOTs)
PE file contains sections with non-standard names
Potential key logger detected (key state polling based)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Uses insecure TLS / SSL version for HTTPS connection
Classification
- System is w10x64
file.exe (PID: 6500 cmdline: "C:\Users\ user\Deskt op\file.ex e" MD5: 9174E680D1B0EA8CDB3EE932EC2DFC6F) 
msedge.exe (PID: 1352 cmdline: "C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" https:/ /accounts. google.com /ServiceLo gin?servic e=accounts ettings&co ntinue=htt ps://accou nts.google .com/v3/si gnin/chall enge/pwd MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 5616 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --m ojo-platfo rm-channel -handle=21 80 --field -trial-han dle=2056,i ,624716336 7441240488 ,257639870 7470590896 ,262144 /p refetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F) 
firefox.exe (PID: 5608 cmdline: "C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" htt ps://accou nts.google .com/Servi ceLogin?se rvice=acco untsetting s&continue =https://a ccounts.go ogle.com/v 3/signin/c hallenge/p wd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
- firefox.exe (PID: 3228 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" htt ps://accou nts.google .com/Servi ceLogin?se rvice=acco untsetting s&continue =https://a ccounts.go ogle.com/v 3/signin/c hallenge/p wd --attem pting-deel evation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 1816 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" htt ps://accou nts.google .com/Servi ceLogin?se rvice=acco untsetting s&continue =https://a ccounts.go ogle.com/v 3/signin/c hallenge/p wd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 3652 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" -co ntentproc --channel= 2248 -pare ntBuildID 2023092723 2528 -pref sHandle 21 96 -prefMa pHandle 21 88 -prefsL en 25308 - prefMapSiz e 237879 - win32kLock edDown -ap pDir "C:\P rogram Fil es\Mozilla Firefox\b rowser" - {ccf95cfb- f749-4af2- 904e-79948 77402df} 1 816 "\\.\p ipe\gecko- crash-serv er-pipe.18 16" 2408cb 6db10 sock et MD5: C86B1BE9ED6496FE0E0CBE73F81D8045) - firefox.exe (PID: 1984 cmdline:
"C:\Progra m Files\Mo zilla Fire fox\firefo x.exe" -co ntentproc --channel= 4456 -pare ntBuildID 2023092723 2528 -pref sHandle 43 40 -prefMa pHandle 43 36 -prefsL en 26273 - prefMapSiz e 237879 - appDir "C: \Program F iles\Mozil la Firefox \browser" - {2f8d311 1-a88f-4b0 1-91e4-af2 e9be1c464} 1816 "\\. \pipe\geck o-crash-se rver-pipe. 1816" 2409 f819410 rd d MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)
- msedge.exe (PID: 5948 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --flag- switches-b egin --fla g-switches -end --dis able-nacl --do-not-d e-elevate https://ac counts.goo gle.com/Se rviceLogin ?service=a ccountsett ings&conti nue=https: //accounts .google.co m/v3/signi n/challeng e/pwd MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 7188 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=net work.mojom .NetworkSe rvice --la ng=en-GB - -service-s andbox-typ e=none --m ojo-platfo rm-channel -handle=26 88 --field -trial-han dle=2732,i ,205360442 5234520121 ,157015629 9720450245 6,262144 / prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 4676 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=ass et_store.m ojom.Asset StoreServi ce --lang= en-GB --se rvice-sand box-type=a sset_store _service - -mojo-plat form-chann el-handle= 6532 --fie ld-trial-h andle=2732 ,i,2053604 4252345201 21,1570156 2997204502 456,262144 /prefetch :8 MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 8204 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=ent ity_extrac tion_servi ce.mojom.E xtractor - -lang=en-G B --servic e-sandbox- type=entit y_extracti on --onnx- enabled-fo r-ee --moj o-platform -channel-h andle=6736 --field-t rial-handl e=2732,i,2 0536044252 34520121,1 5701562997 204502456, 262144 /pr efetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 8832 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=aud io.mojom.A udioServic e --lang=e n-GB --ser vice-sandb ox-type=au dio --mojo -platform- channel-ha ndle=8500 --field-tr ial-handle =2732,i,20 5360442523 4520121,15 7015629972 04502456,2 62144 /pre fetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 7904 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=vid eo_capture .mojom.Vid eoCaptureS ervice --l ang=en-GB --service- sandbox-ty pe=none -- mojo-platf orm-channe l-handle=8 648 --fiel d-trial-ha ndle=2732, i,20536044 2523452012 1,15701562 9972045024 56,262144 /prefetch: 8 MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 8788 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=pri ce_compari son_servic e.mojom.Da taProcesso r --lang=e n-GB --ser vice-sandb ox-type=en tity_extra ction --mo jo-platfor m-channel- handle=849 6 --field- trial-hand le=2732,i, 2053604425 234520121, 1570156299 7204502456 ,262144 /p refetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F) - msedge.exe (PID: 5796 cmdline:
"C:\Progra m Files (x 86)\Micros oft\Edge\A pplication \msedge.ex e" --type= utility -- utility-su b-type=edg e_search_i ndexer.moj om.SearchI ndexerInte rfaceBroke r --lang=e n-GB --ser vice-sandb ox-type=se arch_index er --messa ge-loop-ty pe-ui --mo jo-platfor m-channel- handle=878 0 --field- trial-hand le=2732,i, 2053604425 234520121, 1570156299 7204502456 ,262144 /p refetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
- cleanup
⊘No configs have been found
⊘No yara matches
⊘No Sigma rule has matched
⊘No Suricata rule has matched
