Analysis Report OPDATERINGSDISKETTES.exe

ID:	357952
Product:	CloudBasic
Start time:	01:14:59
Start date:	25.02.2021
Sample:	OPDATERINGSDISKETTES.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	446701e67dd00e1d2c45b23263533dea
SHA1:	1acbd6fae421f3cc96e757138c9af9e4fc5b5d3a
SHA256:	2414764b6c9385725e8ad59646c7af513fe3cd1bdd0de671dea8dc04ba4c6fe3
Filetype:	Win32 Executable (generic) a (10002005/4) 99.15%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Multi AV Scanner detection for submitted file

Source: OPDATERINGSDISKETTES.exe	Virustotal: Detection: 21%			Perma Link
Source: OPDATERINGSDISKETTES.exe	ReversingLabs: Detection: 10%

Compliance:

Uses 32bit PE files

Source: OPDATERINGSDISKETTES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Abnormal high CPU Usage

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Process Stats: CPU usage > 98%

Detected potential crypto function

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00402029		0_2_00402029
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00401A29		0_2_00401A29
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_004019DC		0_2_004019DC
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_004017E9		0_2_004017E9

Tries to load missing DLLs

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Uses 32bit PE files

Source: OPDATERINGSDISKETTES.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal84.troj.evad.winEXE@4/0@0/0

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5788:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

File created: C:\Users\user\AppData\Local\Temp\~DFA3B2BCDEB5667DD5.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: OPDATERINGSDISKETTES.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: OPDATERINGSDISKETTES.exe	Virustotal: Detection: 21%
Source: OPDATERINGSDISKETTES.exe	ReversingLabs: Detection: 10%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'			Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Data Obfuscation:

Yara detected GuLoader

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 1948, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00405D44 push ebx; iretd		0_2_00405D4B
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_0040BF54 push edi; retn 0004h		0_2_0040C441
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00403D0E push ds; retf		0_2_00403D28
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_00406BF3 push ebx; retf		0_2_00406BF4
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Code function: 0_2_0040B1BD push edi; retn 0004h		0_2_0040C441
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B009AD push ss; retf		14_2_00B009B5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B02907 pushfd ; iretd		14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B00B83 push ss; retf		14_2_00B00B8B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B005B3 pushfd ; iretd		14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B0050D pushfd ; iretd		14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B0068F pushfd ; iretd		14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B03ECD pushfd ; iretd		14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B0060F pushfd ; iretd		14_2_00B03541
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B00707 pushfd ; iretd		14_2_00B03541

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00B013F1

14_2_00B013F1

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

RDTSC instruction interceptor: First address: 0000000000622878 second address: 0000000000622878 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FA66039AC58h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e add edi, edx 0x00000020 dec ecx 0x00000021 test esi, 5AFA4577h 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007FA66039AC3Ah 0x0000002c push ecx 0x0000002d test ch, 00000041h 0x00000030 call 00007FA66039AC6Dh 0x00000035 call 00007FA66039AC68h 0x0000003a lfence 0x0000003d mov edx, dword ptr [7FFE0014h] 0x00000043 lfence 0x00000046 ret 0x00000047 mov esi, edx 0x00000049 pushad 0x0000004a rdtsc

Tries to detect Any.run

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: RegAsm.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

RDTSC instruction interceptor: First address: 0000000000622878 second address: 0000000000622878 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007FA66039AC58h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d pop ecx 0x0000001e add edi, edx 0x00000020 dec ecx 0x00000021 test esi, 5AFA4577h 0x00000027 cmp ecx, 00000000h 0x0000002a jne 00007FA66039AC3Ah 0x0000002c push ecx 0x0000002d test ch, 00000041h 0x00000030 call 00007FA66039AC6Dh 0x00000035 call 00007FA66039AC68h 0x0000003a lfence 0x0000003d mov edx, dword ptr [7FFE0014h] 0x00000043 lfence 0x00000046 ret 0x00000047 mov esi, edx 0x00000049 pushad 0x0000004a rdtsc

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

RDTSC instruction interceptor: First address: 0000000000622A2D second address: 0000000000622A2D instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007FA660B0C492h 0x0000001d popad 0x0000001e call 00007FA660B0A08Dh 0x00000023 lfence 0x00000026 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00B018B7 rdtsc

14_2_00B018B7

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: RegAsm.exe

Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Process Stats: CPU usage > 90% for more than 60s

Hides threads from debuggers

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Process queried: DebugPort

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 14_2_00B018B7 rdtsc

14_2_00B018B7

Contains functionality to read the PEB

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B051AB mov eax, dword ptr fs:[00000030h]		14_2_00B051AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B051DF mov eax, dword ptr fs:[00000030h]		14_2_00B051DF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B01AF3 mov eax, dword ptr fs:[00000030h]		14_2_00B01AF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B04ACA mov eax, dword ptr fs:[00000030h]		14_2_00B04ACA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B013F1 mov eax, dword ptr fs:[00000030h]		14_2_00B013F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B044BF mov eax, dword ptr fs:[00000030h]		14_2_00B044BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B04498 mov eax, dword ptr fs:[00000030h]		14_2_00B04498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 14_2_00B0272D mov eax, dword ptr fs:[00000030h]		14_2_00B0272D

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 'C:\Users\user\Desktop\OPDATERINGSDISKETTES.exe'

Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: OPDATERINGSDISKETTES.exe, 00000000.00000002.471694785.0000000000CC0000.00000002.00000001.sdmp, RegAsm.exe, 0000000E.00000002.470676447.0000000001360000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: OPDATERINGSDISKETTES.exe, 00000000.00000002.471694785.0000000000CC0000.00000002.00000001.sdmp, RegAsm.exe, 0000000E.00000002.470676447.0000000001360000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: OPDATERINGSDISKETTES.exe, 00000000.00000002.471694785.0000000000CC0000.00000002.00000001.sdmp, RegAsm.exe, 0000000E.00000002.470676447.0000000001360000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: OPDATERINGSDISKETTES.exe, 00000000.00000002.471694785.0000000000CC0000.00000002.00000001.sdmp, RegAsm.exe, 0000000E.00000002.470676447.0000000001360000.00000002.00000001.sdmp	Binary or memory string: Progmanlock