ScreenShot
| Created | 2024.08.02 07:43 | Machine | s1_win7_x6403 |
| Filename | pon.exe | ||
| Type | PE32+ executable (GUI) x86-64, for MS Windows | ||
| AI Score |
|
Behavior Score |
|
| ZERO API | file : clean | ||
| VT API (file) | 13 detected (AIDetectMalware, Malicious, Artemis, KillFiles2, Casdet, susgen, PossibleThreat, PALLAS, confidence) | ||
| md5 | 3fbad097793fab9c62bbebb2a2d5e530 | ||
| sha256 | 10f87101da792e5d4276553e22e45aae4123340ab7ce203007cdaa98715f6ecb | ||
| ssdeep | 192:OjvgzcS8f1S3dj6Zo+irqZveZ+tK8G9n+kD2WcixkGJi/VGu4igmWznUQZvx55Xd:Or2qf1ScG+8iC8KZ9npxvQ | ||
| imphash | 0141624ec75102605a71ad2282c112f2 | ||
| impfuzzy | 24:sItigS1ofKDBx4ozud2sQ4wxnyWPWUUiYgMyWNwJLTfaZhJCzAbDyJLBSBOvAK40:ltbS1yK9Hq5Q/P8N2fqjC51mBMQSLMA | ||
Network IP location
Signature (12cnts)
| Level | Description |
|---|---|
| watch | Attempts to modify Explorer settings to prevent hidden files from being displayed |
| watch | Deletes a large number of files from the system indicative of ransomware |
| watch | Detects VirtualBox through the presence of a file |
| watch | Drops 137 unknown file mime types indicative of ransomware writing encrypted files back to disk |
| watch | File has been identified by 13 AntiVirus engines on VirusTotal as malicious |
| notice | Checks for the Locally Unique Identifier on the system for a suspicious privilege |
| notice | Creates a suspicious process |
| notice | Executes one or more WMI queries |
| notice | Uses Windows utilities for basic Windows functionality |
| info | Checks amount of memory in system |
| info | Queries for the computername |
| info | This executable has a PDB path |
Rules (5cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| watch | Antivirus | Contains references to security software | binaries (download) |
| watch | UPX_Zero | UPX packed file | binaries (upload) |
| info | IsPE64 | (no description) | binaries (upload) |
| info | OS_Processor_Check_Zero | OS Processor Check | binaries (upload) |
| info | PE_Header_Zero | PE File Signature | binaries (upload) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|
Suricata ids
PE API
IAT(Import Address Table) Library
KERNEL32.dll
0x140003020 Sleep
0x140003028 GetConsoleWindow
0x140003030 AllocConsole
0x140003038 SetFileAttributesW
0x140003040 RtlVirtualUnwind
0x140003048 UnhandledExceptionFilter
0x140003050 SetUnhandledExceptionFilter
0x140003058 GetCurrentProcess
0x140003060 RtlLookupFunctionEntry
0x140003068 TerminateProcess
0x140003070 IsProcessorFeaturePresent
0x140003078 GetModuleHandleW
0x140003080 GetStartupInfoW
0x140003088 IsDebuggerPresent
0x140003090 QueryPerformanceCounter
0x140003098 GetCurrentProcessId
0x1400030a0 GetCurrentThreadId
0x1400030a8 GetSystemTimeAsFileTime
0x1400030b0 InitializeSListHead
0x1400030b8 RtlCaptureContext
USER32.dll
0x1400030d8 ShowWindow
0x1400030e0 GetKeyState
0x1400030e8 SendInput
ADVAPI32.dll
0x140003000 RegSetValueExA
0x140003008 RegOpenKeyExA
0x140003010 RegCloseKey
SHELL32.dll
0x1400030c8 SHEmptyRecycleBinW
ole32.dll
0x140003230 CoCreateInstance
0x140003238 CoInitializeEx
VCRUNTIME140.dll
0x1400030f8 __current_exception_context
0x140003100 __std_exception_copy
0x140003108 memset
0x140003110 memcpy
0x140003118 __C_specific_handler
0x140003120 __current_exception
0x140003128 __std_exception_destroy
0x140003130 _CxxThrowException
api-ms-win-crt-heap-l1-1-0.dll
0x140003140 _callnewh
0x140003148 free
0x140003150 malloc
0x140003158 _set_new_mode
api-ms-win-crt-runtime-l1-1-0.dll
0x140003188 _initialize_onexit_table
0x140003190 _register_onexit_function
0x140003198 _exit
0x1400031a0 _crt_atexit
0x1400031a8 _cexit
0x1400031b0 terminate
0x1400031b8 _register_thread_local_exe_atexit_callback
0x1400031c0 _seh_filter_exe
0x1400031c8 exit
0x1400031d0 _get_narrow_winmain_command_line
0x1400031d8 _initialize_narrow_environment
0x1400031e0 _configure_narrow_argv
0x1400031e8 _c_exit
0x1400031f0 _set_app_type
0x1400031f8 _initterm_e
0x140003200 system
0x140003208 _initterm
api-ms-win-crt-math-l1-1-0.dll
0x140003178 __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll
0x140003218 _set_fmode
0x140003220 __p__commode
api-ms-win-crt-locale-l1-1-0.dll
0x140003168 _configthreadlocale
EAT(Export Address Table) is none
KERNEL32.dll
0x140003020 Sleep
0x140003028 GetConsoleWindow
0x140003030 AllocConsole
0x140003038 SetFileAttributesW
0x140003040 RtlVirtualUnwind
0x140003048 UnhandledExceptionFilter
0x140003050 SetUnhandledExceptionFilter
0x140003058 GetCurrentProcess
0x140003060 RtlLookupFunctionEntry
0x140003068 TerminateProcess
0x140003070 IsProcessorFeaturePresent
0x140003078 GetModuleHandleW
0x140003080 GetStartupInfoW
0x140003088 IsDebuggerPresent
0x140003090 QueryPerformanceCounter
0x140003098 GetCurrentProcessId
0x1400030a0 GetCurrentThreadId
0x1400030a8 GetSystemTimeAsFileTime
0x1400030b0 InitializeSListHead
0x1400030b8 RtlCaptureContext
USER32.dll
0x1400030d8 ShowWindow
0x1400030e0 GetKeyState
0x1400030e8 SendInput
ADVAPI32.dll
0x140003000 RegSetValueExA
0x140003008 RegOpenKeyExA
0x140003010 RegCloseKey
SHELL32.dll
0x1400030c8 SHEmptyRecycleBinW
ole32.dll
0x140003230 CoCreateInstance
0x140003238 CoInitializeEx
VCRUNTIME140.dll
0x1400030f8 __current_exception_context
0x140003100 __std_exception_copy
0x140003108 memset
0x140003110 memcpy
0x140003118 __C_specific_handler
0x140003120 __current_exception
0x140003128 __std_exception_destroy
0x140003130 _CxxThrowException
api-ms-win-crt-heap-l1-1-0.dll
0x140003140 _callnewh
0x140003148 free
0x140003150 malloc
0x140003158 _set_new_mode
api-ms-win-crt-runtime-l1-1-0.dll
0x140003188 _initialize_onexit_table
0x140003190 _register_onexit_function
0x140003198 _exit
0x1400031a0 _crt_atexit
0x1400031a8 _cexit
0x1400031b0 terminate
0x1400031b8 _register_thread_local_exe_atexit_callback
0x1400031c0 _seh_filter_exe
0x1400031c8 exit
0x1400031d0 _get_narrow_winmain_command_line
0x1400031d8 _initialize_narrow_environment
0x1400031e0 _configure_narrow_argv
0x1400031e8 _c_exit
0x1400031f0 _set_app_type
0x1400031f8 _initterm_e
0x140003200 system
0x140003208 _initterm
api-ms-win-crt-math-l1-1-0.dll
0x140003178 __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll
0x140003218 _set_fmode
0x140003220 __p__commode
api-ms-win-crt-locale-l1-1-0.dll
0x140003168 _configthreadlocale
EAT(Export Address Table) is none