Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
inquiry.pdf.exe

Overview

General Information

Sample Name:inquiry.pdf.exe
Analysis ID:715157
MD5:6236e43da1b2c6279760e6b2b7e2d40f
SHA1:a24221417ff9c0d169bf17b7f242824fe61d3b72
SHA256:b4056e17199edd889d2b77c02865136c47ab29566717c2f86ae8911c02e2994a
Tags:exe
Infos:

Detection

AveMaria, DarkTortilla, UACMe
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected DarkTortilla Crypter
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected UACMe UAC Bypass tool
Yara detected AveMaria stealer
Multi AV Scanner detection for domain / URL
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Initial sample is a PE file and has a suspicious name
Writes to foreign memory regions
Increases the number of concurrent connection per server for Internet Explorer
Contains functionality to hide user accounts
Machine Learning detection for sample
Uses ping.exe to check the status of other devices and networks
Injects a PE file into a foreign processes
Uses ping.exe to sleep
Creates an undocumented autostart registry key
Machine Learning detection for dropped file
C2 URLs / IPs found in malware configuration
Hides that the sample has been downloaded from the Internet (zone.identifier)
Uses an obfuscated file name to hide its real file extension (double extension)
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to launch a process as a different user
Sample execution stops while process was sleeping (likely an evasion)
Yara detected Credential Stealer
JA3 SSL client fingerprint seen in connection with other malware
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Installs a raw input device (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Drops PE files
Detected TCP or UDP traffic on non-standard ports
Binary contains a suspicious time stamp
Uses reg.exe to modify the Windows registry
Dropped file seen in connection with other malware
Creates a process in suspended mode (likely to inject code)

Classification

  • System is w10x64
  • inquiry.pdf.exe (PID: 5896 cmdline: C:\Users\user\Desktop\inquiry.pdf.exe MD5: 6236E43DA1B2C6279760E6B2B7E2D40F)
    • cmd.exe (PID: 2148 cmdline: cmd" /c ping 127.0.0.1 -n 7 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\user\AppData\Roaming\glonkjhg.exe, MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 5868 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • PING.EXE (PID: 612 cmdline: ping 127.0.0.1 -n 7 MD5: 70C24A306F768936563ABDADB9CA9108)
      • reg.exe (PID: 4684 cmdline: REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\user\AppData\Roaming\glonkjhg.exe," MD5: CEE2A7E57DF2A159A065A34913A055C2)
    • cmd.exe (PID: 3272 cmdline: cmd" /c ping 127.0.0.1 -n 12 > nul && copy "C:\Users\user\Desktop\inquiry.pdf.exe" "C:\Users\user\AppData\Roaming\glonkjhg.exe" && ping 127.0.0.1 -n 12 > nul && "C:\Users\user\AppData\Roaming\glonkjhg.exe MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • conhost.exe (PID: 4496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
      • PING.EXE (PID: 636 cmdline: ping 127.0.0.1 -n 12 MD5: 70C24A306F768936563ABDADB9CA9108)
      • PING.EXE (PID: 5244 cmdline: ping 127.0.0.1 -n 12 MD5: 70C24A306F768936563ABDADB9CA9108)
      • glonkjhg.exe (PID: 4760 cmdline: C:\Users\user\AppData\Roaming\glonkjhg.exe MD5: 6236E43DA1B2C6279760E6B2B7E2D40F)
        • AddInProcess32.exe (PID: 2400 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)
        • AddInProcess32.exe (PID: 1916 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe MD5: F2A47587431C466535F3C3D3427724BE)
        • jhFFFffkl.exe (PID: 4896 cmdline: "C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)
          • jhFFFffkl.exe (PID: 6060 cmdline: "C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)
        • jhFFFffkl.exe (PID: 4184 cmdline: "C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)
          • jhFFFffkl.exe (PID: 3932 cmdline: "C:\Users\user\AppData\Local\Temp\jhFFFffkl.exe" MD5: 0E362E7005823D0BEC3719B902ED6D62)
  • cleanup
{"C2 url": "hannoyputa.giize.com", "port": 3027}
SourceRuleDescriptionAuthorStrings
00000013.00000000.404261855.0000000000A54000.00000040.00000400.00020000.00000000.sdmpCodoso_Gh0st_1Detects Codoso APT Gh0st MalwareFlorian Roth
  • 0xdf0:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
  • 0xdf0:$c1: Elevation:Administrator!new:
00000013.00000000.404261855.0000000000A54000.00000040.00000400.00020000.00000000.sdmpJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
    00000014.00000003.485883886.0000000000EA6000.00000004.00000020.00020000.00000000.sdmpCodoso_Gh0st_1Detects Codoso APT Gh0st MalwareFlorian Roth
    • 0x1f48:$x3: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
    • 0x1f48:$c1: Elevation:Administrator!new:
    00000014.00000003.485883886.0000000000EA6000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
      00000014.00000003.485883886.0000000000EA6000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security