popup

Report - HCX.exe

Generic Malware UPX Malicious Library Antivirus PE File PE32 PowerShell
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.06.26 07:51 Machine s1_win7_x6403
Filename HCX.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
AI Score
6
 Behavior Score
8.6
ZERO API file : malware
VT API (file) 40 detected (AIDetectMalware, Makoob, malicious, high confidence, GenericKD, Artemis, Vlgj, confidence, HELI, Attribute, HighConfidence, NSIS, score, TrojanX, Unkl, brbyg, ai score=88, Leonem, Detected, unsafe, F0D1C00FM23)
md5 3e1dfc7cfb1d1a466f31dfa4f69e6018
sha256 9f3dc121257e3bd4b56bf2c7049ef407797edb49c61535c51d02633449ea7062
ssdeep 6144:+DhoMMSoHnTLPGlA7dQCmiFvtzZR9OfMY158K2CTN+xE2:DMMSoHmlAhQCmgtz79OfModPxZ2
imphash 3abe302b6d9a1256e6a915429af4ffd2
impfuzzy 48:T1SK00CO3O7Gn5r+tAlt8tz4eObGLllanBL8EFpV74dT+5EQX/1EowhSv0Qxly6h:TMK0zWO7GR9TqqIrtg
  Network IP location

Signature (20cnts)

Level Description
danger File has been identified by 40 AntiVirus engines on VirusTotal as malicious
watch Creates a suspicious Powershell process
watch One or more non-whitelisted processes were created
watch The process powershell.exe wrote an executable file to disk
watch Tries to unhook Windows functions monitored by Cuckoo
watch Uses Sysinternals tools in order to add additional command line functionality
notice A process created a hidden window
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice Creates a suspicious process
notice Creates hidden or system file
notice Queries for potentially installed applications
notice Uses Windows utilities for basic Windows functionality
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info Uses Windows APIs to generate a cryptographic key

Rules (7cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Antivirus Contains references to security software binaries (download)
watch Malicious_Library_Zero Malicious_Library binaries (upload)
watch UPX_Zero UPX packed file binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)
info PowerShell PowerShell script scripts

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

KERNEL32.dll
 0x407070 GetTempPathA
 0x407074 GetFileSize
 0x407078 GetModuleFileNameA
 0x40707c GetCurrentProcess
 0x407080 CopyFileA
 0x407084 ExitProcess
 0x407088 SetEnvironmentVariableA
 0x40708c Sleep
 0x407090 GetTickCount
 0x407094 GetCommandLineA
 0x407098 lstrlenA
 0x40709c GetVersion
 0x4070a0 SetErrorMode
 0x4070a4 lstrcpynA
 0x4070a8 GetDiskFreeSpaceA
 0x4070ac GlobalUnlock
 0x4070b0 GetWindowsDirectoryA
 0x4070b4 SetCurrentDirectoryA
 0x4070b8 GetLastError
 0x4070bc CreateDirectoryA
 0x4070c0 CreateProcessA
 0x4070c4 RemoveDirectoryA
 0x4070c8 CreateFileA
 0x4070cc GetTempFileNameA
 0x4070d0 ReadFile
 0x4070d4 WriteFile
 0x4070d8 lstrcpyA
 0x4070dc MoveFileExA
 0x4070e0 lstrcatA
 0x4070e4 GetSystemDirectoryA
 0x4070e8 GetProcAddress
 0x4070ec GetExitCodeProcess
 0x4070f0 WaitForSingleObject
 0x4070f4 CompareFileTime
 0x4070f8 SetFileAttributesA
 0x4070fc GetFileAttributesA
 0x407100 GetShortPathNameA
 0x407104 MoveFileA
 0x407108 GetFullPathNameA
 0x40710c SetFileTime
 0x407110 SearchPathA
 0x407114 CloseHandle
 0x407118 lstrcmpiA
 0x40711c CreateThread
 0x407120 GlobalLock
 0x407124 lstrcmpA
 0x407128 FindFirstFileA
 0x40712c FindNextFileA
 0x407130 DeleteFileA
 0x407134 SetFilePointer
 0x407138 GetPrivateProfileStringA
 0x40713c FindClose
 0x407140 MultiByteToWideChar
 0x407144 FreeLibrary
 0x407148 MulDiv
 0x40714c WritePrivateProfileStringA
 0x407150 LoadLibraryExA
 0x407154 GetModuleHandleA
 0x407158 GlobalAlloc
 0x40715c GlobalFree
 0x407160 ExpandEnvironmentStringsA
USER32.dll
 0x407184 ScreenToClient
 0x407188 GetSystemMenu
 0x40718c SetClassLongA
 0x407190 IsWindowEnabled
 0x407194 SetWindowPos
 0x407198 GetSysColor
 0x40719c GetWindowLongA
 0x4071a0 SetCursor
 0x4071a4 LoadCursorA
 0x4071a8 CheckDlgButton
 0x4071ac GetMessagePos
 0x4071b0 LoadBitmapA
 0x4071b4 CallWindowProcA
 0x4071b8 IsWindowVisible
 0x4071bc CloseClipboard
 0x4071c0 SetClipboardData
 0x4071c4 EmptyClipboard
 0x4071c8 PostQuitMessage
 0x4071cc GetWindowRect
 0x4071d0 EnableMenuItem
 0x4071d4 CreatePopupMenu
 0x4071d8 GetSystemMetrics
 0x4071dc SetDlgItemTextA
 0x4071e0 GetDlgItemTextA
 0x4071e4 MessageBoxIndirectA
 0x4071e8 CharPrevA
 0x4071ec DispatchMessageA
 0x4071f0 PeekMessageA
 0x4071f4 ReleaseDC
 0x4071f8 EnableWindow
 0x4071fc InvalidateRect
 0x407200 SendMessageA
 0x407204 DefWindowProcA
 0x407208 BeginPaint
 0x40720c GetClientRect
 0x407210 FillRect
 0x407214 DrawTextA
 0x407218 EndDialog
 0x40721c RegisterClassA
 0x407220 SystemParametersInfoA
 0x407224 CreateWindowExA
 0x407228 GetClassInfoA
 0x40722c DialogBoxParamA
 0x407230 CharNextA
 0x407234 ExitWindowsEx
 0x407238 GetDC
 0x40723c CreateDialogParamA
 0x407240 SetTimer
 0x407244 GetDlgItem
 0x407248 SetWindowLongA
 0x40724c SetForegroundWindow
 0x407250 LoadImageA
 0x407254 IsWindow
 0x407258 SendMessageTimeoutA
 0x40725c FindWindowExA
 0x407260 OpenClipboard
 0x407264 TrackPopupMenu
 0x407268 AppendMenuA
 0x40726c EndPaint
 0x407270 DestroyWindow
 0x407274 wsprintfA
 0x407278 ShowWindow
 0x40727c SetWindowTextA
GDI32.dll
 0x40704c SelectObject
 0x407050 SetBkMode
 0x407054 CreateFontIndirectA
 0x407058 SetTextColor
 0x40705c DeleteObject
 0x407060 GetDeviceCaps
 0x407064 CreateBrushIndirect
 0x407068 SetBkColor
SHELL32.dll
 0x407168 SHGetSpecialFolderLocation
 0x40716c ShellExecuteExA
 0x407170 SHGetPathFromIDListA
 0x407174 SHBrowseForFolderA
 0x407178 SHGetFileInfoA
 0x40717c SHFileOperationA
ADVAPI32.dll
 0x407000 AdjustTokenPrivileges
 0x407004 RegCreateKeyExA
 0x407008 RegOpenKeyExA
 0x40700c SetFileSecurityA
 0x407010 OpenProcessToken
 0x407014 LookupPrivilegeValueA
 0x407018 RegEnumValueA
 0x40701c RegDeleteKeyA
 0x407020 RegDeleteValueA
 0x407024 RegCloseKey
 0x407028 RegSetValueExA
 0x40702c RegQueryValueExA
 0x407030 RegEnumKeyA
COMCTL32.dll
 0x407038 ImageList_Create
 0x40703c ImageList_AddMasked
 0x407040 ImageList_Destroy
 0x407044 None
ole32.dll
 0x407284 OleUninitialize
 0x407288 OleInitialize
 0x40728c CoTaskMemFree
 0x407290 CoCreateInstance

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure