top title background image
flash

SecuriteInfo.com.Trojan.MulDrop11.26182.3488.exe

Status: finished
Submission Time: 2020-08-01 21:30:24 +02:00
Malicious
Evader

Comments

Tags

Details

  • Analysis ID:
    255563
  • API (Web) ID:
    406665
  • Analysis Started:
    2020-08-01 21:57:32 +02:00
  • Analysis Finished:
    2020-08-01 22:11:00 +02:00
  • MD5:
    4b031cf99a7e85caf64b182ac5e6fb11
  • SHA1:
    aadb62600e6f8d8f41e5252d572ea8743b0405d1
  • SHA256:
    fbebdf40d44f38814dbfa6e613817a2fe244fac4fc35674a69e4a6385508f18e
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 51
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

URLs

Name Detection
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.MulDrop11.26182.3488.exe.log
ASCII text, with CRLF line terminators
#
C:\Windows\Temp\1mq51nf5.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_po5xrab1.s0g.ps1
very short file (no magic)
#
Click to see the 39 hidden entries
C:\Windows\Temp\olowcgyl.inf
Windows setup INFormation, ASCII text
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzab0npn.vlx.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_smurxq1q.dv5.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_woesb0de.l0k.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xfthmoly.53i.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xnhagmpd.1my.psm1
very short file (no magic)
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.+8U6RoW5.20200801215850.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.F_m0YVPE.20200801215854.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.H0i5Gt2d.20200801215836.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.QjApjzkt.20200801215844.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.SLIbqorK.20200801215853.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.V9ieR6jq.20200801215851.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552._TWp8wlo.20200801215845.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.c25jVdUV.20200801215848.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.c_p5BD01.20200801215847.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.ov7fAz6Q.20200801215853.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.tXtD6_eZ.20200801215843.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\Documents\20200801\PowerShell_transcript.899552.zH4fXbJ5.20200801215846.txt
UTF-8 Unicode (with BOM) text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1mq51nf5.exe.log
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_drmtpp1q.rzu.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
data
#
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2kqzuilq.4l1.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3l0qrhld.x5k.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5n2c3bhw.yx5.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a5lq3hyf.pcg.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b0djtxpe.xs0.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bat5zv4f.efk.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bo5yyz0v.bbe.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lmccvv3i.yqt.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dtaxe2we.mgv.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dvhsyqds.m4g.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dwgvhrgm.yyb.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e02wqxvp.p3e.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fuh4hmor.e0f.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jj20vphs.xpj.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k3rn4bba.ome.psm1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kc0tfmnd.aiw.ps1
very short file (no magic)
#
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kdornnxf.tas.ps1
very short file (no magic)
#