Windows Analysis Report ZM80M76Nwv.exe
Overview
General Information
Detection
Score: | 56 |
Range: | 0 - 100 |
Whitelisted: | false |
Confidence: | 100% |
Signatures
Classification
Process Tree |
---|
|
Malware Configuration |
---|
No configs have been found |
---|
Yara Overview |
---|
No yara matches |
---|
Sigma Overview |
---|
No Sigma rule has matched |
---|
Jbx Signature Overview |
---|
Click to jump to signature section
AV Detection: |
---|
Multi AV Scanner detection for submitted file | Show sources |
Source: | Virustotal: | Perma Link |
Machine Learning detection for sample | Show sources |
Source: | Joe Sandbox ML: |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | String found in binary or memory: |
System Summary: |
---|
PE file has nameless sections | Show sources |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Process created: |
Source: | Code function: | 5_2_02E3E448 |
Source: | Static PE information: |
Source: | Static PE information: |
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Virustotal: |
Source: | Key opened: | Jump to behavior |
Source: | Process created: | ||
Source: | Process created: |
Source: | Mutant created: |
Source: | File created: | Jump to behavior |
Source: | Classification label: |
Source: | File read: | Jump to behavior | ||
Source: | File read: | Jump to behavior |
Source: | Static PE information: |
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: | ||
Source: | Binary string: |
Source: | Static PE information: |
Source: | Code function: | 5_2_02E3E87C |
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Static PE information: | ||
Source: | Static PE information: |
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior | ||
Source: | Process information set: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Source: | Process queried: | Jump to behavior |
Source: | Binary or memory string: | ||
Source: | Binary or memory string: | ||
Source: | Binary or memory string: |
Mitre Att&ck Matrix |
---|
Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Valid Accounts | Windows Management Instrumentation | Path Interception | Process Injection1 | Virtualization/Sandbox Evasion1 | OS Credential Dumping | Security Software Discovery21 | Remote Services | Archive Collected Data1 | Exfiltration Over Other Network Medium | Encrypted Channel1 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
Default Accounts | Scheduled Task/Job | Boot or Logon Initialization Scripts | Boot or Logon Initialization Scripts | Software Packing2 | LSASS Memory | Virtualization/Sandbox Evasion1 | Remote Desktop Protocol | Data from Removable Media | Exfiltration Over Bluetooth | Junk Data | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | Process Injection1 | Security Account Manager | System Information Discovery1 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Steganography | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Obfuscated Files or Information2 | NTDS | Remote System Discovery1 | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud |
Behavior Graph |
---|
Screenshots |
---|
Thumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
Antivirus, Machine Learning and Genetic Malware Detection |
---|
Initial Sample |
---|
Source | Detection | Scanner | Label | Link |
---|---|---|---|---|
36% | Virustotal | Browse | ||
100% | Joe Sandbox ML |
Dropped Files |
---|
No Antivirus matches |
---|
Unpacked PE Files |
---|
No Antivirus matches |
---|
Domains |
---|
No Antivirus matches |
---|
URLs |
---|
No Antivirus matches |
---|
Domains and IPs |
---|
Contacted Domains |
---|
No contacted domains info |
---|
URLs from Memory and Binaries |
---|
Name | Source | Malicious | Antivirus Detection | Reputation |
---|---|---|---|---|
false | high |
Contacted IPs |
---|
No contacted IP infos |
---|
General Information |
---|
Joe Sandbox Version: | 34.0.0 Boulder Opal |
Analysis ID: | 528754 |
Start date: | 25.11.2021 |
Start time: | 18:41:32 |
Joe Sandbox Product: | CloudBasic |
Overall analysis duration: | 0h 5m 32s |
Hypervisor based Inspection enabled: | false |
Report type: | full |
Sample file name: | ZM80M76Nwv.exe |
Cookbook file name: | default.jbs |
Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
Run name: | Run with higher sleep bypass |
Number of analysed new started processes analysed: | 24 |
Number of new started drivers analysed: | 0 |
Number of existing processes analysed: | 0 |
Number of existing drivers analysed: | 0 |
Number of injected processes analysed: | 0 |
Technologies: |
|
Analysis Mode: | default |
Analysis stop reason: | Timeout |
Detection: | MAL |
Classification: | mal56.winEXE@2/6@0/0 |
EGA Information: | Failed |
HDC Information: |
|
HCA Information: |
|
Cookbook Comments: |
|
Warnings: | Show All
|
Simulations |
---|
Behavior and APIs |
---|
No simulations |
---|
Joe Sandbox View / Context |
---|
Created / dropped Files |
---|
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 65536 |
Entropy (8bit): | 0.6258743708536602 |
Encrypted: | false |
SSDEEP: | 96:SoFUlGrJUltJhDsoL7DsNfBpXIQcQvc6QcEDMcw3Dj+HbHg6ZAXGng5FMTPSkvPQ:PulGrqli/tHBUZMXAjE/u7s2S274It0 |
MD5: | 19408E6E9A097D01C1408A5B214C378F |
SHA1: | D1CCDAED4435B2B852BC79E5A0A4BB624664D284 |
SHA-256: | A8559ED8829B7499B8F538B7E0043CB4980914F30A156F20FC6A4CA5032C5668 |
SHA-512: | 3AAF13C9AD312EEA17D7878286E98C39BF752D75945268154C220D4D99D429314B0113E16FE1A8567F5293499088910B6A92F7E5B24852A02D9084175D7934BF |
Malicious: | true |
Reputation: | low |
Preview: |
|
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 18276 |
Entropy (8bit): | 2.1601715702588473 |
Encrypted: | false |
SSDEEP: | 96:5+8ic8//8TKyKk8i7k7yXsE711pP46o9WInWIX4IxI82sIm:zi38O/HOlXsG1w6obI8Nd |
MD5: | AA07C4322ED29AAC22E3EC3E318B2E8B |
SHA1: | 83F73A121B5DC65AF15725B27B0F6ED654A8002F |
SHA-256: | 83A38AE6518192230E8912A628E41EEB405F3875B57419B64718D1D6C2C538C9 |
SHA-512: | 2247064BB0E9ACE9798FC3C13621B2771CBD966F9EBDCDC118A3ABC4392CBF71EF537FD55B5BC0599D1FD7B4C1632A32463E664AC0B019BD0664DC782FE96EC6 |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 8294 |
Entropy (8bit): | 3.6987375138268868 |
Encrypted: | false |
SSDEEP: | 192:Rrl7r3GLNio66x1WG6YFuSUARgmfQSjCprH89bglsf1Am:RrlsNil6x1WG6YsSUARgmfQSjg+fn |
MD5: | F7C108B5E2078F71E7BF26CE678AA29C |
SHA1: | ED98E1F5C7165B1DDD4844C2953C62C77FDFC567 |
SHA-256: | 33E61ABB54F4A0C385CD1359889F8E8BF728E6312519BB7AF3A9DB870E365DEC |
SHA-512: | FD30FEA3B93AF7DFB4E598143AB83CB14CFC148E5BADF868918E9DFF9B737C41043034359059104BA5FC6A20531340ACFAC4670E044300359BAEC37E60790A4F |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 4568 |
Entropy (8bit): | 4.4670051098294765 |
Encrypted: | false |
SSDEEP: | 48:cvIwSD8zsXJgtWI9WIWSC8BB8fm8M4Js5TlFh+q8RbmxWR5taKgd:uITf5NhSN8JM3IaKgd |
MD5: | D96FC25ABD017BB81E1242EFF22422B1 |
SHA1: | 055C3EF36EC0FEEFD33472A2A27047037A78D5DF |
SHA-256: | 70328CF19D05D4465E132A8EE394ACF3FCE8A18D807466846DE58612800AB29C |
SHA-512: | F3E452389A9A7F08CD653D66E4711278B61B8A13A5202EE839D504981233B78CBFABA34EBDA2BF5173E69B24FD5D49DC564760B8B8C6A1F7D23A750E7B27EA94 |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 1572864 |
Entropy (8bit): | 4.273308087069104 |
Encrypted: | false |
SSDEEP: | 12288:DakSJ7FNIgRjl+RL2npEK81nIpmRiphu4SYXbyA+5N/fiWsF+Bq3C:ekSJ7FNIgRjl+RBE |
MD5: | C8CE14535E2682B31019BA8E0276D461 |
SHA1: | 6BB8647EA8659D8DBFEB0D895E842B3F528AEBC6 |
SHA-256: | 0DE0C60006456CC2CC0633BBBAF11BDE968F8CA1F253D2A84569CDEA6E4B5B77 |
SHA-512: | C673FC446426598673AC773434BA55A267423FCCCAE7563758318BB277429D433E3942D36BBFEB8663A7BF5A32E1BAAF6AB8B78BBF7B39E0966497BD5EFFB956 |
Malicious: | false |
Reputation: | low |
Preview: |
|
Process: | C:\Windows\SysWOW64\WerFault.exe |
File Type: | |
Category: | dropped |
Size (bytes): | 24576 |
Entropy (8bit): | 3.9937708026732737 |
Encrypted: | false |
SSDEEP: | 384:ciZ65Rftx1XPJ4X0sFFn37koPBqXHSeq5QMVyi6+/Dl4Lk4rZd1DoXznEFZVpJ:TZkRftx1/J4XRFF37hBqXyeq5QMVyi63 |
MD5: | 9954518259FF27EC7245FFE962F4302A |
SHA1: | DEF4FC7A27E2C1B41863668744FF1DD4120215BF |
SHA-256: | BE4D5726CB994C30CBB74F00477E7ADAA6525EBB3F8AA4F89C20A0CE04A27154 |
SHA-512: | C9439E17357A35710D13F9C30DCA80B99B9B59C7725EFF6C3F849C4DAB6DC6F5E56A907D8CE39E86895CBC9F74F288BE7606FB0DD0EA809A63B4F54F05B1F846 |
Malicious: | false |
Reputation: | low |
Preview: |
|
Static File Info |
---|
General | |
---|---|
File type: | |
Entropy (8bit): | 7.997292727076848 |
TrID: |
|
File name: | ZM80M76Nwv.exe |
File size: | 236703 |
MD5: | 3c93f57536f15046b52f4340edba42da |
SHA1: | a7b4f2c0390ebc7c4b7aa5bbfbb60503aba08955 |
SHA256: | 493ea8db7e8d8554d3f3c1dcbcf661dc5027892b02d262dfdcb58372e257191b |
SHA512: | ef0370f11683092dd06e96b387e031a2966a90d3aad94fd161442af23350b05244cf69798d3eda425b010ba66207675cf41726cd99a489c625da359dfaee7793 |
SSDEEP: | 6144:SOIiujNUOuPzzt0z6IVI0mEoP/RYjwYbylp:S0uvGyuGmzPSjwYbylp |
File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....0.a.................4...........P.......P....@..........................po.....V.B.................................... |
File Icon |
---|
Icon Hash: | 00828e8e8686b000 |
Static PE Info |
---|
General | |
---|---|
Entrypoint: | 0x425000 |
Entrypoint Section: | |
Digitally signed: | false |
Imagebase: | 0x400000 |
Subsystem: | windows gui |
Image File Characteristics: | 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED |
DLL Characteristics: | TERMINAL_SERVER_AWARE, NX_COMPAT |
Time Stamp: | 0x61993087 [Sat Nov 20 17:29:43 2021 UTC] |
TLS Callbacks: | |
CLR (.Net) Version: | |
OS Version Major: | 6 |
OS Version Minor: | 0 |
File Version Major: | 6 |
File Version Minor: | 0 |
Subsystem Version Major: | 6 |
Subsystem Version Minor: | 0 |
Import Hash: |
Entrypoint Preview |
---|
Instruction |
---|
push 00AAB001h |
call 00007FF6A0ECE7F6h |
ret |
ret |
sub dword ptr [edi-5Ch], edx |
sub esp, 7Ah |
lds eax, fword ptr [eax] |
jnbe 00007FF6A0ECE79Eh |
and esi, dword ptr [edx+1F2EE19Ch] |
mov ch, BBh |
dec esi |
cmp edi, edi |
push ss |
pop eax |
jecxz 00007FF6A0ECE7F0h |
jnc 00007FF6A0ECE840h |
mov esp, D092331Ah |
in eax, dx |
pop ds |
int3 |
cmp byte ptr [ecx-5Eh], dh |
push ds |
shr byte ptr [ebx-6174F0A8h], FFFFFFA8h |
insb |
out 44h, eax |
mov al, 6Ah |
inc dh |
and eax, 7D091FFAh |
scasb |
jno 00007FF6A0ECE7D7h |
test eax, 6008DB81h |
popfd |
loop 00007FF6A0ECE829h |
or cl, FFFFFF88h |
cmpsb |
mov byte ptr [04D15535h], al |
sub eax, DFE4C75Ah |
Data Directories |
---|
Name | Virtual Address | Virtual Size | Is in Section |
---|---|---|---|
IMAGE_DIRECTORY_ENTRY_EXPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IMPORT | 0x6abc7c | 0x194 | .AqWcUFG |
IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x6aa000 | 0x5b9 | .rsrc |
IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_TLS | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x100000 |
Sections |
---|
Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
---|---|---|---|---|---|---|---|---|
0x1000 | 0x21fc2 | 0x0 | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ | |
0x23000 | 0x1306 | 0x0 | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ | |
0x25000 | 0xf000 | 0x7a00 | False | 1.00051229508 | data | 7.99401104881 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ | |
0x34000 | 0x2000 | 0x400 | False | 1.0107421875 | data | 7.78065343968 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ | |
0x36000 | 0x26966a | 0x0 | unknown | unknown | unknown | unknown | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ | |
0x2a0000 | 0x40a000 | 0x3dc000 | unknown | unknown | unknown | unknown | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ | |
.rsrc | 0x6aa000 | 0x1000 | 0x600 | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
.AqWcUFG | 0x6ab000 | 0x4b000 | 0x4aa00 | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
.adata | 0x6f6000 | 0x1000 | 0x0 | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
Network Behavior |
---|
No network behavior found |
---|
Code Manipulations |
---|
Statistics |
---|
CPU Usage |
---|
Click to jump to process
Memory Usage |
---|
Click to jump to process
High Level Behavior Distribution |
---|
back
Click to dive into process behavior distribution
Behavior |
---|
Click to jump to process
System Behavior |
---|
General |
---|
Start time: | 18:42:34 |
Start date: | 25/11/2021 |
Path: | C:\Users\user\Desktop\ZM80M76Nwv.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0x400000 |
File size: | 236703 bytes |
MD5 hash: | 3C93F57536F15046B52F4340EDBA42DA |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | low |
General |
---|
Start time: | 18:42:36 |
Start date: | 25/11/2021 |
Path: | C:\Windows\SysWOW64\WerFault.exe |
Wow64 process (32bit): | true |
Commandline: | |
Imagebase: | 0xb10000 |
File size: | 434592 bytes |
MD5 hash: | 9E2B8ACAD48ECCA55C0230D63623661B |
Has elevated privileges: | true |
Has administrator privileges: | true |
Programmed in: | C, C++ or other language |
Reputation: | high |
Disassembly |
---|
Code Analysis |
---|
Executed Functions |
---|
Non-executed Functions |
---|
Function 02E3E448, Relevance: .3, Instructions: 305COMMON
Memory Dump Source |
|
Similarity |
|
Uniqueness |
Uniqueness Score: -1.00% |