Windows Analysis Report June-July_Commission_List_Summary-2021.exe

ID:	457757
Product:	CloudBasic
Start time:	09:23:32
Start date:	02.08.2021
Sample:	June-July_Commission_List_Summary-2021.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	bc6d6f6c55211e9ffc8972f330135da7
SHA1:	07b6f45608594b9ee812a9a95f80e51d644424c9
SHA256:	4326190ec077d66ad458337eed8a4f517cfd354247e921c4d01d9f50d9346e32
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256

AV Detection:

Multi AV Scanner detection for submitted file

Source: June-July_Commission_List_Summary-2021.exe	Virustotal: Detection: 29%			Perma Link
Source: June-July_Commission_List_Summary-2021.exe	ReversingLabs: Detection: 17%

Machine Learning detection for sample

Source: June-July_Commission_List_Summary-2021.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: June-July_Commission_List_Summary-2021.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe

Process Stats: CPU usage > 98%

Detected potential crypto function

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F7A3A		0_2_021F7A3A
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F7A68		0_2_021F7A68
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F4F09		0_2_021F4F09
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F78FC		0_2_021F78FC
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F70E7		0_2_021F70E7
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F5521		0_2_021F5521
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F5574		0_2_021F5574
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F4DBE		0_2_021F4DBE
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F59CC		0_2_021F59CC

Sample file is different than original file name gathered from version info

Source: June-July_Commission_List_Summary-2021.exe, 00000000.00000002.755289932.0000000000473000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameWivrejaygeesca9.exe vs June-July_Commission_List_Summary-2021.exe
Source: June-July_Commission_List_Summary-2021.exe	Binary or memory string: OriginalFilenameWivrejaygeesca9.exe vs June-July_Commission_List_Summary-2021.exe

Uses 32bit PE files

Source: June-July_Commission_List_Summary-2021.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Classification label

Source: classification engine

Classification label: mal68.evad.winEXE@1/0@0/0

Creates temporary files

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF152992B35EEE298A.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: June-July_Commission_List_Summary-2021.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Sample is known by Antivirus

Source: June-July_Commission_List_Summary-2021.exe	Virustotal: Detection: 29%
Source: June-July_Commission_List_Summary-2021.exe	ReversingLabs: Detection: 17%

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_00404923 push ds; ret		0_2_00404930
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_0040659A push esp; retf		0_2_0040659B
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_0040569B push ebp; retf		0_2_0040569E
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_00408B7B push ebx; iretd		0_2_00408B82
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_00406F8F push ebp; retf		0_2_00406F93
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F24F8 push es; iretd		0_2_021F24FA

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.14012596914

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021FD52B		0_2_021FD52B
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F5521		0_2_021F5521
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F5574		0_2_021F5574

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	RDTSC instruction interceptor: First address: 00000000021FE4B4 second address: 00000000021FE4B4 instructions:
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	RDTSC instruction interceptor: First address: 0000000002201AA0 second address: 0000000002201AA0 instructions:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	RDTSC instruction interceptor: First address: 00000000021FE4B4 second address: 00000000021FE4B4 instructions:
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	RDTSC instruction interceptor: First address: 00000000021FDC02 second address: 00000000021FDDA2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b mov esi, dword ptr [ebp+00000223h] 0x00000011 mov dword ptr [ebp+0000021Bh], eax 0x00000017 mov eax, esi 0x00000019 push eax 0x0000001a cmp dl, cl 0x0000001c mov eax, dword ptr [ebp+0000021Bh] 0x00000022 mov dword ptr [ebp+0000019Ch], ebx 0x00000028 test dx, F826h 0x0000002d mov ebx, edx 0x0000002f test bx, 655Ch 0x00000034 push ebx 0x00000035 mov ebx, dword ptr [ebp+0000019Ch] 0x0000003b call 00007F79C8CDA548h 0x00000040 test edx, ebx 0x00000042 mov esi, dword ptr [esp+04h] 0x00000046 mov eax, 020D0734h 0x0000004b xor eax, 97E8A2A4h 0x00000050 jmp 00007F79C8CDA5A9h 0x00000055 test dx, bx 0x00000058 xor eax, 66496E64h 0x0000005d sub eax, F3ACB6EFh 0x00000062 test ax, cx 0x00000065 test ax, ax 0x00000068 mov dword ptr [ebp+000001DCh], ebx 0x0000006e mov ebx, FD8668ABh 0x00000073 pushad 0x00000074 mov edx, 00000025h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	RDTSC instruction interceptor: First address: 00000000021FDDA2 second address: 00000000021FDDA2 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 add ebx, 2EB48951h 0x00000009 xor ebx, 4D05852Ah 0x0000000f test ah, ah 0x00000011 sub ebx, 613F7432h 0x00000017 cmp byte ptr [esi], bl 0x00000019 mov ebx, dword ptr [ebp+000001DCh] 0x0000001f jnc 00007F79C8CDA55Dh 0x00000021 mov ebx, eax 0x00000023 test dh, ch 0x00000025 shl eax, 05h 0x00000028 add eax, ebx 0x0000002a movzx ecx, byte ptr [esi] 0x0000002d test bh, dh 0x0000002f add eax, ecx 0x00000031 xor eax, 87814D76h 0x00000036 test dh, dh 0x00000038 inc esi 0x00000039 mov dword ptr [ebp+00000199h], ecx 0x0000003f mov ecx, 8083BC92h 0x00000044 cmp edx, E060B676h 0x0000004a test al, bl 0x0000004c xor ecx, 15B192FBh 0x00000052 xor ecx, 1B76C997h 0x00000058 test ecx, eax 0x0000005a xor ecx, 8E44E7FEh 0x00000060 cmp ebx, D7C88536h 0x00000066 cmp dh, FFFFFFD5h 0x00000069 cmp byte ptr [esi], cl 0x0000006b mov ecx, dword ptr [ebp+00000199h] 0x00000071 jne 00007F79C8CDA47Eh 0x00000077 mov dword ptr [ebp+000001DCh], ebx 0x0000007d mov ebx, FD8668ABh 0x00000082 pushad 0x00000083 mov edx, 00000025h 0x00000088 rdtsc
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	RDTSC instruction interceptor: First address: 0000000002201903 second address: 0000000002201903 instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 cmp dword ptr [ebp+000001DAh], ebx 0x00000009 jne 00007F79C8CDA4C6h 0x0000000b xor dword ptr [eax], edx 0x0000000d add eax, 04h 0x00000010 mov dword ptr [ebp+000001DAh], eax 0x00000016 pushad 0x00000017 mov eax, 000000FCh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	RDTSC instruction interceptor: First address: 0000000002201AA0 second address: 0000000002201AA0 instructions:
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	RDTSC instruction interceptor: First address: 00000000021FF545 second address: 00000000021FDDA2 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b push ecx 0x0000000c mov ecx, dword ptr [ebp+000001B8h] 0x00000012 test bh, dh 0x00000014 mov dword ptr [ebp+0000020Fh], edx 0x0000001a mov edx, ecx 0x0000001c cmp ch, dh 0x0000001e push edx 0x0000001f cmp eax, D3D4D650h 0x00000024 mov edx, dword ptr [ebp+0000020Fh] 0x0000002a mov dword ptr [ebp+0000024Ah], ecx 0x00000030 mov ecx, esi 0x00000032 push ecx 0x00000033 mov ecx, dword ptr [ebp+0000024Ah] 0x00000039 test dl, cl 0x0000003b mov dword ptr [ebp+00000210h], eax 0x00000041 mov eax, esi 0x00000043 push eax 0x00000044 cmp ah, dh 0x00000046 mov eax, dword ptr [ebp+00000210h] 0x0000004c cmp cx, bx 0x0000004f add dword ptr [esp], ecx 0x00000052 call 00007F79C8CD8BEEh 0x00000057 test edx, ebx 0x00000059 mov esi, dword ptr [esp+04h] 0x0000005d mov eax, 020D0734h 0x00000062 xor eax, 97E8A2A4h 0x00000067 jmp 00007F79C8CDA5A9h 0x0000006c test dx, bx 0x0000006f xor eax, 66496E64h 0x00000074 sub eax, F3ACB6EFh 0x00000079 test ax, cx 0x0000007c test ax, ax 0x0000007f mov dword ptr [ebp+000001DCh], ebx 0x00000085 mov ebx, FD8668ABh 0x0000008a pushad 0x0000008b mov edx, 00000025h 0x00000090 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe

Code function: 0_2_021FCE12 rdtsc

0_2_021FCE12

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe

Process Stats: CPU usage > 90% for more than 60s

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe

Code function: 0_2_021FCE12 rdtsc

0_2_021FCE12

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021FE347 mov eax, dword ptr fs:[00000030h]		0_2_021FE347
Source: C:\Users\user\Desktop\June-July_Commission_List_Summary-2021.exe	Code function: 0_2_021F5521 mov eax, dword ptr fs:[00000030h]		0_2_021F5521

Program does not show much activity (idle)

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Source: June-July_Commission_List_Summary-2021.exe, 00000000.00000002.757153981.0000000000D60000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: June-July_Commission_List_Summary-2021.exe, 00000000.00000002.757153981.0000000000D60000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: June-July_Commission_List_Summary-2021.exe, 00000000.00000002.757153981.0000000000D60000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: June-July_Commission_List_Summary-2021.exe, 00000000.00000002.757153981.0000000000D60000.00000002.00000001.sdmp	Binary or memory string: Progmanlock