Static task
static1
Behavioral task
behavioral1
Sample
5d4c8033d268202e05c4fb02772e3d9dadaee6959a3395c1bcf07f3fa31a212a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5d4c8033d268202e05c4fb02772e3d9dadaee6959a3395c1bcf07f3fa31a212a.exe
Resource
win10v2004-20220901-en
General
-
Target
5d4c8033d268202e05c4fb02772e3d9dadaee6959a3395c1bcf07f3fa31a212a
-
Size
51KB
-
MD5
6ed800adbb57f6a8300f8d7143839984
-
SHA1
92c789fd09ffa7b62c42e01a808553f10dbb48ce
-
SHA256
5d4c8033d268202e05c4fb02772e3d9dadaee6959a3395c1bcf07f3fa31a212a
-
SHA512
2044b3637f63617aea574aff998a1aa27c0cf84456f5645e78ab47b8830f843b25be905f130f45596d169f59fb5df6ca78555f5b6a38775d3694f8e4fc7b223e
-
SSDEEP
768:H8uOi64afQ/wFJlcMI9Rk4s+8PrLx4sLwiwUTDyJf46/H7ci5DtPcV8SAkMkJ:H8/BXaQyM6W4srPr14ssiwUIDp0x4kJ
Malware Config
Signatures
Files
-
5d4c8033d268202e05c4fb02772e3d9dadaee6959a3395c1bcf07f3fa31a212a.exe windows x86
633e41f3024f9c39d7a3bd16677b7765
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExFreePoolWithTag
ExAllocatePoolWithTag
IoGetAttachedDeviceReference
memcpy
IoReportTargetDeviceChangeAsynchronous
SeReleaseSubjectContext
SeUnlockSubjectContext
SeAccessCheck
IoGetFileObjectGenericMapping
SeLockSubjectContext
SeCaptureSubjectContext
ZwClose
ZwFlushKey
ZwOpenKey
RtlQueryRegistryValues
memset
RtlWriteRegistryValue
RtlDeleteRegistryValue
memmove
IoForwardIrpSynchronously
IoInvalidateDeviceRelations
RtlInitUnicodeString
IoOpenDeviceRegistryKey
RtlValidSecurityDescriptor
ObSetSecurityObjectByPointer
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlLengthSid
SeExports
RtlGetVersion
IoGetDeviceProperty
RtlSubAuthoritySid
RtlInitializeSid
IoGetDeviceObjectPointer
MmPageEntireDriver
MmResetDriverPaging
KeReleaseSemaphore
IoUnregisterPlugPlayNotification
IoRegisterPlugPlayNotification
IoRegisterLastChanceShutdownNotification
RtlCopyUnicodeString
IoDetachDevice
KeInitializeSemaphore
ObfDereferenceObject
IoDeleteSymbolicLink
IoAttachDeviceToDeviceStack
IoCreateSymbolicLink
IoCreateDevice
IofCompleteRequest
ExQueueWorkItem
IoSetHardErrorOrVerifyDevice
IoInvalidateDeviceState
KeSetEvent
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
PoSetPowerState
PoCallDriver
PoStartNextPowerIrp
IoGetBootDiskInformationLite
RtlCheckRegistryKey
RtlFreeUnicodeString
IoGetDeviceInterfaces
IoWMIRegistrationControl
IoRegisterDeviceInterface
IoSetDeviceInterfaceState
ObfReferenceObject
IoFreeIrp
IoFreeMdl
IoBuildPartialMdl
IoAllocateMdl
IoMakeAssociatedIrp
RtlCompareMemory
IoSetDevicePropertyData
IoGetDevicePropertyData
IoFreeWorkItem
IoQueueWorkItem
IoAllocateWorkItem
IoUnregisterShutdownNotification
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoRegisterDriverReinitialization
IoRegisterBootDriverReinitialization
IoReportDetectedDevice
ZwQueryValueKey
KeTickCount
KeBugCheckEx
RtlUnwind
KeInitializeEvent
IoBuildDeviceIoControlRequest
IofCallDriver
KeWaitForSingleObject
IoDeleteDevice
_vsnwprintf
hal
KfAcquireSpinLock
KfReleaseSpinLock
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1024B - Virtual size: 900B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 44B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1016B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ