4004Trickbot_cb4c028a2099a6fde48bb0b440afd02e_php_2019-10-04_08_30.txt

* ID: 4004
* MalFamily: ""

* MalScore: 10.0

* File Name: "Trickbot_cb4c028a2099a6fde48bb0b440afd02e.php"
* File Size: 370505
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "c240d1097b31c965f4464b3e56751576ad40b0ae021363125dfd038c88490038"
* MD5: "cb4c028a2099a6fde48bb0b440afd02e"
* SHA1: "7d1852bbe73a0d37e8fdf7f03c355c87542fc095"
* SHA512: "546a66d3ec196b09e3d380f7d175124c872ae09648dab7fda9038d7a0d54f7dc56812236453fa91d5c19d476c515225d4256ccc0f604d5527b4b07ac8d969b4c"
* CRC32: "E1F345A5"
* SSDEEP: "6144:oKhVeSawYl7YCjs81NxlFHnIGY3wvsxC26VzU36QQm5dlW3HN+Y9gi6ARIf:ph0SxussNxlFHn5Y62664mDk3Nc"

* Process Execution:
    "qcMbxj9N.exe",
    "\u0639\u0623\u0647\u064a\u062e\u0646\u0648\u0584.exe",
    "svchost.exe",
    "services.exe",
    "lsass.exe",
    "WmiApSrv.exe",
    "svchost.exe",
    "WMIADAP.exe",
    "taskhost.exe",
    "WmiPrvSE.exe"


* Executed Commands:
    "\"C:\\ProgramData\\\\xd8\\xb9\\xd8\\xa3\\xd9\\x87\\xd9\\x8a\\xd8\\xae\\xd9\\x86\\xd9\\x88\\xd6\\x84.exe\"",
    "C:\\ProgramData\\\\xd8\\xb9\\xd8\\xa3\\xd9\\x87\\xd9\\x8a\\xd8\\xae\\xd9\\x86\\xd9\\x88\\xd6\\x84.exe ",
    "C:\\Windows\\system32\\svchost.exe",
    "C:\\Windows\\system32\\lsass.exe",
    "C:\\Windows\\system32\\wbem\\WmiApSrv.exe",
    "C:\\Windows\\system32\\svchost.exe -k netsvcs"


* Signatures Detected:

        "Description": "Behavioural detection: Executable code extraction",
        "Details":


        "Description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
        "Details":


        "Description": "Creates RWX memory",
        "Details":


        "Description": "Guard pages use detected - possible anti-debugging.",
        "Details":


        "Description": "A process created a hidden window",
        "Details":

                "Process": "qcMbxj9N.exe -> C:\\ProgramData\\\\xd8\\xb9\\xd8\\xa3\\xd9\\x87\\xd9\\x8a\\xd8\\xae\\xd9\\x86\\xd9\\x88\\xd6\\x84.exe"




        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .data, entropy: 7.96, characteristics: IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE, raw_size: 0x0002d000, virtual_size: 0x0002c428"




        "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
        "Details":

                "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 9237990 times"




        "Description": "Creates a copy of itself",
        "Details":

                "copy": "C:\\ProgramData\\\\xd8\\xb9\\xd8\\xa3\\xd9\\x87\\xd9\\x8a\\xd8\\xae\\xd9\\x86\\xd9\\x88\\xd6\\x84.exe"




        "Description": "Anomalous binary characteristics",
        "Details":

                "anomaly": "Actual checksum does not match that reported in PE header"





* Started Service:
    "KeyIso",
    "wmiApSrv"


* Mutexes:
    "Global\\838B6C9EB27932960",
    "Global\\RefreshRA_Mutex_Lib",
    "Global\\RefreshRA_Mutex",
    "Global\\RefreshRA_Mutex_Flag",
    "Global\\WmiApSrv",
    "Global\\ADAP_WMI_ENTRY"


* Modified Files:
    "C:\\ProgramData\\\\xd8\\xb9\\xd8\\xa3\\xd9\\x87\\xd9\\x8a\\xd8\\xae\\xd9\\x86\\xd9\\x88\\xd6\\x84.exe",
    "C:\\Windows\\sysnative\\LogFiles\\Scm\\5869f1c1-01d7-41f7-84b7-715672259fa8",
    "\\??\\WMIDataDevice",
    "\\??\\PIPE\\samr",
    "C:\\Windows\\sysnative\\wbem\\repository\\WRITABLE.TST",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING1.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING2.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\MAPPING3.MAP",
    "C:\\Windows\\sysnative\\wbem\\repository\\OBJECTS.DATA",
    "C:\\Windows\\sysnative\\wbem\\repository\\INDEX.BTR",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
    "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"


* Deleted Files:

* Modified Registry Keys:
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\wmiApSrv\\Type",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Type",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\PROVIDERS\\Performance\\Performance Refreshed",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ProcessID",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ThrottleDrege",
    "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\Winmgmt\\Parameters\\ServiceDllUnloadOnStop",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\LastServiceStart",
    "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Transports\\Decoupled\\Server",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\CreationTime",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\MarshaledProxy",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\Transports\\Decoupled\\Server\\ProcessIdentifier",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\ConfigValueEssNeedsLoading",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\CIMOM\\List of event-active namespaces",
    "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WBEM\\ESS\\//./root/CIMV2\\SCM Event Provider"


* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: