1c2bdfa5e30cbf8eb92c3764de9b106aa722a81b50641698d2620a49b530b0b4 (SHA256)
1c2bdfa5e30cbf8eb92c3764de9b106aa722a81b50641698d2620a49b530b0b4.exe
Created at 2018-08-28 15:01:00
Notifications (2/4)
Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.
The maximum number of reputation file hash requests (20 per analysis) was exceeded. As a result, the reputation status could not be queried for all file hashes. In order to get the reputation status for all file hashes, please increase the 'Max File Hash Requests' setting in the system configurations.
The overall sleep time of all monitored processes was truncated from "10 minutes" to "10 seconds" to reveal dormant functionality.
The operating system was rebooted during the analysis.
YARA Information
| Applied On | Sample Files, PCAP File, Created Files, Modified Files, Process Dumps |
| Number of YARA matches | 3 |
| Ruleset Name | Rule Name | Rule Description | File Type | Filename | Classification | Severity | Actions |
|---|---|---|---|---|---|---|---|
| APTs | WiltedTulip_Tools_clrlg | Windows eventlog cleaner used in Operation Wilted Tulip (file: clrlg.bat) | Created File | C:\windows\clerlog.bat | - |
5/5
|
|
| Generic | Shellcode_GetPC_fstenv | x86 GetPC code using fstenv; possible shellcode | Created File | \\?\C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe ID NL5VaVIIqOZA.BadNews | - |
3/5
|
|
| Generic | Shellcode_GetPC_fstenv | x86 GetPC code using fstenv; possible shellcode | Process Dump | \ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe ID NL5VaVIIqOZA.BadNews | - |
3/5
|
|
