Static task
static1
Behavioral task
behavioral1
Sample
1a0c4a8945c05225b62f32f46e6e8e145dce111fcbed9e7bf3c1cc2ca42efe0b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1a0c4a8945c05225b62f32f46e6e8e145dce111fcbed9e7bf3c1cc2ca42efe0b.exe
Resource
win10v2004-20220901-en
General
-
Target
1a0c4a8945c05225b62f32f46e6e8e145dce111fcbed9e7bf3c1cc2ca42efe0b
-
Size
52KB
-
MD5
5903780d7a4088b5f9b231b41c9d3cf0
-
SHA1
27f3ffcf83622a87f330ab7da1fcf23820b5b758
-
SHA256
1a0c4a8945c05225b62f32f46e6e8e145dce111fcbed9e7bf3c1cc2ca42efe0b
-
SHA512
93875da79ef37271c83833674633dde01d19ae4ff83bd302d3cae725b57e3156eb4bc188c540d678b9986347ddc52fb39e7eb0f2f9d31e3d819b1bf542801ebb
-
SSDEEP
768:YK6BdF/4kwA2Aezw5YokDNrChLJBoWcH1yaXD3bo7WT6:YLn+NAr5DzJc1NU7q6
Malware Config
Signatures
Files
-
1a0c4a8945c05225b62f32f46e6e8e145dce111fcbed9e7bf3c1cc2ca42efe0b.exe windows x86
cf262754661937fdaa6ffdcce7eb41eb
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
hal
KfAcquireSpinLock
READ_PORT_UCHAR
KfRaiseIrql
KfLowerIrql
WRITE_PORT_UCHAR
KfReleaseSpinLock
KeGetCurrentIrql
KeStallExecutionProcessor
ntoskrnl.exe
IoBuildDeviceIoControlRequest
KeInitializeEvent
IoStartPacket
IoAcquireRemoveLockEx
memmove
ObfDereferenceObject
IoGetAttachedDeviceReference
ExAllocatePoolWithTag
WRITE_REGISTER_UCHAR
READ_REGISTER_UCHAR
MmMapIoSpace
KeInsertQueueDpc
KeSetTimer
KeSynchronizeExecution
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
IoAllocateController
IoDeleteController
MmUnmapIoSpace
KeDelayExecutionThread
RtlQueryRegistryValues
RtlAppendUnicodeToString
wcslen
RtlInitUnicodeString
KeInitializeTimer
KeInitializeSpinLock
IoCreateController
IoInvalidateDeviceState
PoStartNextPowerIrp
PoSetPowerState
KeBugCheckEx
ZwSetValueKey
ZwClose
ZwOpenKey
KeQueryTimeIncrement
KeTickCount
_allmul
IofCallDriver
DbgBreakPointWithStatus
KdDebuggerEnabled
KdDebuggerNotPresent
_except_handler3
IoConnectInterrupt
KeInitializeDpc
KeRemoveQueueDpc
RtlFreeUnicodeString
IoSetDeviceInterfaceState
IoDisconnectInterrupt
KeSetTimerEx
IoFreeIrp
_wcsupr
_alldiv
IoAllocateIrp
MmLockPagableDataSection
IoUnregisterPlugPlayNotification
IoFreeWorkItem
wcscmp
IoQueueWorkItem
IoAllocateWorkItem
KeInitializeTimerEx
IoRegisterPlugPlayNotification
IoInitializeRemoveLockEx
IoDeleteDevice
IoAttachDeviceToDeviceStack
IoCreateDevice
KeSetEvent
IoQueryDeviceDescription
IoRegisterDeviceInterface
ExQueueWorkItem
IoDetachDevice
ExReleaseFastMutexUnsafe
ExAcquireFastMutexUnsafe
IoReleaseRemoveLockAndWaitEx
IoWMIRegistrationControl
PoCallDriver
KeWaitForSingleObject
IoAllocateErrorLogEntry
IoWriteErrorLogEntry
KeCancelTimer
KefAcquireSpinLockAtDpcLevel
ExFreePoolWithTag
KefReleaseSpinLockFromDpcLevel
IoFreeController
IoStartNextPacket
IoReleaseRemoveLockEx
IoOpenDeviceRegistryKey
IofCompleteRequest
wmilib.sys
WmiSystemControl
WmiCompleteRequest
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 256B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
PAGE Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGEMOUC Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
INIT Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ