Exes_858aa93d356ee7cc28dd17939ed57214_exe_2019-07-17_03_30.txt

* MalFamily: "Malicious"

* MalScore: 10.0

* File Name: "Exes_858aa93d356ee7cc28dd17939ed57214.exe"
* File Size: 624544
* File Type: "PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"
* SHA256: "ad900a992a2cb945720704d20a72bfd5335d53af4321e71e582a943a170e7e8f"
* MD5: "858aa93d356ee7cc28dd17939ed57214"
* SHA1: "a39753fc5309d41f38951175a55360681faf0648"
* SHA512: "76dd556d2116553702612949bde7998c2901878031108b5517eb84b44dace30be3c3827db27534c1a3aabbce525f8fa4f47bec09f82c5d752662681cb03900ba"
* CRC32: "421A7879"
* SSDEEP: "12288:+RJQOJyBYJbzxLEPqG0XSkbueiagy8qtRzAXXDV1SJi/6:eqPqV9bBUvkxAnDToiy"

* Process Execution:
    "Exes_858aa93d356ee7cc28dd17939ed57214.exe",
    "cmd.exe",
    "cmd.exe",
    "cmd.exe",
    "tmp.exe",
    "svchosts.exe",
    "dw20.exe"


* Executed Commands:
    "cmd.exe /c copy \"C:/Users/user/AppData/Local/Temp/Exes_858aa93d356ee7cc28dd17939ed57214.exe\" \"%appdata%\\MicrosoftEdgeH\\svchosts.exe\" /Y",
    "cmd.exe /c echo zoneTransferZoneID = 2 > %appdata%\\MicrosoftEdgeH\\svchosts.exe:Zone.Identifier",
    "cmd.exe /c ren \"%appdata%\\MicrosoftEdgeH\\svchosts.exe.jpg\" svchosts.exe",
    "C:\\Users\\user\\AppData\\Roaming\\tmp.exe ",
    "\"C:\\Users\\user\\AppData\\Local\\Temp\\svchosts.exe\"",
    "dw20.exe -x -s 452"


* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "Reads data out of its own binary image",
        "Details":

                "self_read": "process: Exes_858aa93d356ee7cc28dd17939ed57214.exe, pid: 1664, offset: 0x00000000, length: 0x00001000"


                "self_read": "process: Exes_858aa93d356ee7cc28dd17939ed57214.exe, pid: 1664, offset: 0x00000080, length: 0x00000200"




        "Description": "A process created a hidden window",
        "Details":

                "Process": "Exes_858aa93d356ee7cc28dd17939ed57214.exe -> cmd.exe"


                "Process": "Exes_858aa93d356ee7cc28dd17939ed57214.exe -> cmd.exe"


                "Process": "Exes_858aa93d356ee7cc28dd17939ed57214.exe -> cmd.exe"




        "Description": "Drops a binary and executes it",
        "Details":

                "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\svchosts.exe"


                "binary": "C:\\Users\\user\\AppData\\Roaming\\tmp.exe"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .text, entropy: 7.78, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00074400, virtual_size: 0x000743e0"




        "Description": "Anomalous .NET characteristics",
        "Details":

                "anomalous_version": "Assembly version is set to 0"




        "Description": "Executed a process and injected code into it, probably while unpacking",
        "Details":

                "Injection": "Exes_858aa93d356ee7cc28dd17939ed57214.exe(1664) -> svchosts.exe(2744)"




        "Description": "Creates a hidden or system file",
        "Details":

                "file": "C:\\Users\\user\\AppData\\Roaming\\MicrosoftEdgeH"




        "Description": "File has been identified by 22 Antiviruses on VirusTotal as malicious",
        "Details":

                "FireEye": "Generic.mg.858aa93d356ee7cc"


                "Symantec": "ML.Attribute.HighConfidence"


                "APEX": "Malicious"


                "Paloalto": "generic.ml"


                "Kaspersky": "HEUR:Trojan-PSW.MSIL.QQPass.gen"


                "Endgame": "malicious (high confidence)"


                "Comodo": "TrojWare.MSIL.Kryptik.ES@4qkzd4"


                "F-Secure": "Trojan.TR/Dropper.Gen"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "BehavesLike.Win32.Trojan.jh"


                "Trapmine": "malicious.moderate.ml.score"


                "SentinelOne": "DFI - Malicious PE"


                "Avira": "TR/Dropper.Gen"


                "Microsoft": "Trojan:Win32/Fuerboos.C!cl"


                "ZoneAlarm": "HEUR:Trojan-PSW.MSIL.QQPass.gen"


                "Cylance": "Unsafe"


                "ESET-NOD32": "a variant of MSIL/Kryptik.SEZ"


                "Rising": "Trojan.MSIL/Injector!1.B1D5 (CLASSIC)"


                "eGambit": "Unsafe.AI_Score_81%"


                "Fortinet": "MSIL/Generic.AP.1C7AD98!tr"


                "CrowdStrike": "win/malicious_confidence_100% (D)"


                "Qihoo-360": "HEUR/QVM03.0.90B3.Malware.Gen"




        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "dropped": "clamav:Win.Malware.Razy-6952874-0, sha256:d56b2e5eb58e9008604706424e2b7fab14334943d341d56499c070c52b0f2a8f , guest_paths:C:\\Users\\user\\AppData\\Roaming\\tmp.exe, type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\Users\\user\\AppData\\Roaming\\MicrosoftEdgeH\\svchosts.exe"




        "Description": "Attempts to interact with an Alternate Data Stream (ADS)",
        "Details":

                "file": "C:Exes_858aa93d356ee7cc28dd17939ed57214.exe"





* Started Service:

* Mutexes:
    "Global\\CLR_CASOFF_MUTEX",
    "CicLoadWinStaWinSta0",
    "Local\\MSCTF.CtfMonitorInstMutexDefault1",
    "Global\\081a890a-a83e-11e9-b470-18c086cd4732"


* Modified Files:
    "\\??\\PIPE\\srvsvc",
    "C:\\Users\\user\\AppData\\Roaming\\MicrosoftEdgeH\\svchosts.exe.lnk",
    "C:\\Users\\user\\AppData\\Local\\Temp\\MicrosoftEdgeH\\svchosts.exe.jpg",
    "C:\\Users\\user\\AppData\\Roaming\\tmp.exe",
    "C:\\Users\\user\\AppData\\Local\\Temp\\svchosts.exe",
    "C:\\Users\\user\\AppData\\Roaming\\MicrosoftEdgeH\\svchosts.exe",
    "C:\\Users\\user\\AppData\\Roaming\\MicrosoftEdgeH\\svchosts.exe:Zone.Identifier",
    "C:\\Users\\user\\AppData\\Local\\Microsoft\\Windows\\WER\\ReportArchive\\AppCrash_svchosts.exe_26b694c817c8b668e62154e2ce1d4cc4e5bc36b_070c9373\\Report.wer"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\FindMe",
    "C:\\Users\\user\\AppData\\Roaming\\svchosts.exe",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\security.config.cch.1664.6303890",
    "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\enterprisesec.config.cch.1664.6303890",
    "C:\\Users\\user\\AppData\\Roaming\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.1664.6303906"


* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: