Static task
static1
Behavioral task
behavioral1
Sample
06ad90d3597208021bc027af3941efb90631a735eb76e247df5720c707f16727.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
06ad90d3597208021bc027af3941efb90631a735eb76e247df5720c707f16727.exe
Resource
win10v2004-20220812-en
General
-
Target
06ad90d3597208021bc027af3941efb90631a735eb76e247df5720c707f16727
-
Size
1.2MB
-
MD5
457fe1c74e66f9af9aa02ba7e4505d3a
-
SHA1
b36effeb174750f0ddcc40e4e9487d3907acd290
-
SHA256
06ad90d3597208021bc027af3941efb90631a735eb76e247df5720c707f16727
-
SHA512
bb1b8f43b14a354bb8cece1f288b3ba62cd8196b11976e3c0c7eb9084649234f85e42f4e4c7b7fcf607e3973b3f2bb55e9b7ac757d1277a3ca00888b2eb95ceb
-
SSDEEP
12288:7ZLmjJmnVtq2YIs5QehGffcmiteozd27sTBZtQX7CRfMyq:7xmFmnVg2YufUmisozdYstZt+Cl
Malware Config
Signatures
Files
-
06ad90d3597208021bc027af3941efb90631a735eb76e247df5720c707f16727.exe windows x86
e2167e6209a72d135f21fc3a66b96042
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
SetServiceStatus
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
LookupAccountSidW
ConvertSidToStringSidW
GetLengthSid
FreeSid
AllocateAndInitializeSid
GetTokenInformation
AddAccessDeniedAceEx
AddAccessAllowedAceEx
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
ConvertStringSidToSidW
EqualSid
OpenThreadToken
DuplicateToken
CheckTokenMembership
PrivilegeCheck
AccessCheck
CreateWellKnownSid
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
TraceMessage
DeregisterEventSource
ReportEventW
RegisterEventSourceW
GetAce
AddAce
LookupAccountNameW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
CopySid
GetAclInformation
kernel32
SetErrorMode
GetDiskFreeSpaceW
CreateDirectoryW
SetFileAttributesW
WriteFile
EncodePointer
DeleteFileW
FormatMessageW
HeapFree
GetProcessHeap
HeapAlloc
GetVolumeInformationW
GetEnvironmentVariableW
GetVersionExW
GetTimeZoneInformation
GetSystemWindowsDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
FindFirstVolumeW
FindNextVolumeW
FindFirstFileW
FindNextFileW
ExpandEnvironmentStringsW
FindClose
LoadLibraryExW
GetModuleHandleW
GetComputerNameExW
GetVolumePathNamesForVolumeNameW
ReadFile
DefineDosDeviceW
FindVolumeClose
GetComputerNameW
SetLastError
GetCurrentThread
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
MoveFileExW
GetFileAttributesW
GetSystemTimeAsFileTime
LocalAlloc
GetTickCount64
FlushFileBuffers
SetThreadPriority
WaitForMultipleObjects
ResumeThread
DeleteVolumeMountPointW
RaiseException
lstrlenW
QueryDosDeviceW
SetVolumeMountPointW
GetDriveTypeW
CreateFileW
ResetEvent
DeviceIoControl
GetSystemDirectoryW
GetVolumePathNameW
GetVolumeNameForVolumeMountPointW
LocalFree
HeapSetInformation
GetCommandLineW
CompareStringW
OpenThread
CreateWaitableTimerW
CreateEventW
SetEvent
GetCurrentThreadId
CancelWaitableTimer
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
Sleep
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
CreateThread
GetLastError
WaitForSingleObject
CloseHandle
user32
LoadStringW
UnregisterDeviceNotification
RegisterDeviceNotificationW
msvcrt
_CxxThrowException
_beginthreadex
memcpy
malloc
memset
_errno
realloc
memmove
wcsncmp
free
_wcsicmp
_wcsnicmp
qsort
_wcslwr
_snwscanf_s
_vsnwprintf
strncmp
wcsnlen
_ultow_s
wcscpy_s
wcscat_s
swprintf_s
wcstoul
wcschr
wcsrchr
iswspace
towupper
wcsstr
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
memcpy_s
memmove_s
??0exception@@QAE@XZ
_callnewh
__wgetmainargs
_cexit
_exit
_XcptFilter
__CxxFrameHandler3
_purecall
_vscwprintf
_wcsupr
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_controlfp
atl
ord58
ord18
ord32
ord30
ord20
ord17
ord23
ord16
ole32
CoImpersonateClient
CoRevertToSelf
CoTaskMemRealloc
CoSetProxyBlanket
CoUninitialize
StringFromCLSID
CoGetObjectContext
CoFreeUnusedLibraries
CLSIDFromString
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CoInitialize
CoInitializeSecurity
CoCreateInstance
CoDisconnectContext
CoInitializeEx
shlwapi
SHDeleteKeyW
oleaut32
VariantInit
SysFreeString
SysAllocStringLen
SysAllocString
SysStringLen
LoadRegTypeLi
VariantClear
VariantCopy
VariantChangeType
rpcrt4
UuidToStringW
I_RpcBindingInqLocalClientPID
RpcStringFreeW
ntdll
RtlStringFromGUID
RtlGetVersion
NtCreateEvent
NtDeviceIoControlFile
NtWaitForSingleObject
NtResetEvent
LdrGetDllHandle
RtlInitAnsiString
LdrGetProcedureAddress
NtAllocateUuids
RtlFreeUnicodeString
RtlGUIDFromString
NtOpenFile
RtlNtStatusToDosErrorNoTeb
NtQueryVolumeInformationFile
NtQuerySystemInformation
NtFreezeTransactions
NtThawTransactions
NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
RtlAllocateHeap
RtlFreeHeap
NtDeleteKey
NtSetValueKey
NtQueryValueKey
NtDeleteValueKey
NtCreateKey
NtSetSecurityObject
RtlAllocateAndInitializeSid
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAceEx
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
RtlLengthSecurityDescriptor
RtlSetOwnerSecurityDescriptor
RtlFreeSid
NtOpenThreadToken
NtOpenProcessToken
NtAdjustPrivilegesToken
NtLoadKey
NtUnloadKey
NtQueryAttributesFile
NtQueryKey
NtEnumerateKey
NtOpenKey
NtFreezeRegistry
NtThawRegistry
RtlNtStatusToDosError
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject
DbgBreakPoint
vsstrace
?TranslateProviderError@CVssFunctionTracer@@QAAXUCVssDebugInfo@@U_GUID@@PBGZZ
?AddOperation@CVssFunctionTracer@@QAAXUCVssDebugInfo@@IZZ
?AddContext@CVssFunctionTracer@@QAEXUCVssDebugInfo@@IPBG@Z
?TraceBuffer@CVssFunctionTracer@@QAEXUCVssDebugInfo@@KPAE@Z
?TranslateInternalLovelaceError@CVssFunctionTracer@@QAAXUCVssDebugInfo@@JHPBGZZ
?TranslateInternalProviderError@CVssFunctionTracer@@QAAXUCVssDebugInfo@@JJPBGZZ
?Exit@CVssFunctionTracer@@QAE_N_N@Z
??0CVssDebugInfo@@QAE@PBGPBDKKK@Z
??0CVssDebugInfo@@QAE@ABU0@@Z
?TranslateWin32Error@CVssFunctionTracer@@QAAXUCVssDebugInfo@@PBGZZ
?ComDisableSEH@CVssFunctionTracer@@QAEXUCVssDebugInfo@@@Z
?ms_bInitialized@CVssSKU@@0HA
?Initialize@CVssSKU@@CGXXZ
?ms_eSKU@CVssSKU@@0W4EVssSKUType@1@A
?CoCreateInstanceWithLog@CVssFunctionTracer@@QAEXUCVssDebugInfo@@U_GUID@@PBGK1PAPAUIUnknown@@@Z
?CheckForError@CVssFunctionTracer@@QAAXUCVssDebugInfo@@PBG@Z
?LogGenericWarning@CVssFunctionTracer@@QAAXUCVssDebugInfo@@PBGZZ
??6CVssDebugInfo@@QAE?AU0@H@Z
?ThrowIf@CVssFunctionTracer@@QAAXHUCVssDebugInfo@@JPBGZZ
??6CVssDebugInfo@@QAE?AU0@J@Z
?LogError@CVssFunctionTracer@@QAAXKUCVssDebugInfo@@GPAG@Z
??1CVssDebugInfo@@QAE@XZ
?TranslateGenericError@CVssFunctionTracer@@QAAXUCVssDebugInfo@@JPBGZZ
??0CVssFunctionTracer@@QAE@UCVssDebugInfo@@PBG@Z
?Throw@CVssFunctionTracer@@QAAXUCVssDebugInfo@@JPBGZZ
?GetHr@CVssFunctionTracer@@QAEJXZ
?HrSucceeded@CVssFunctionTracer@@QAE_NXZ
?SetHr@CVssFunctionTracer@@QAEJJ@Z
?HrFailed@CVssFunctionTracer@@QAE_NXZ
?ms_bTransportableShadowsAllowed@CVssSKU@@0HA
?CheckForErrorInternal@CVssFunctionTracer@@QAAXUCVssDebugInfo@@PBG@Z
??6CVssDebugInfo@@QAE?AU0@PBG@Z
?AddContextEx@CVssFunctionTracer@@QAAXUCVssDebugInfo@@IPBGZZ
?ThrowOutOfMemory@CVssFunctionTracer@@QAAXUCVssDebugInfo@@@Z
?TranslateError@CVssFunctionTracer@@QAAXUCVssDebugInfo@@JPBG@Z
?InterpretWaitForMultipleObjects@CVssFunctionTracer@@QAEXK@Z
?ExitCachedMode@CBsDbgTrace@@QAEXXZ
?EnterCachedMode@CBsDbgTrace@@QAEXXZ
?GetTraceFileVolume@CBsDbgTrace@@QAEPAGXZ
?g_cDbgTrace@@3VCBsDbgTrace@@A
??6CVssDebugInfo@@QAE?AU0@K@Z
?TranslateWriterReturnCode@CVssFunctionTracer@@QAAXUCVssDebugInfo@@PBGZZ
??6CVssDebugInfo@@QAE?AU0@U_GUID@@@Z
?LogSecurityAudit@CVssFunctionTracer@@QAAXKUCVssDebugInfo@@@Z
?AddOperation@CVssFunctionTracer@@QAAXUCVssDebugInfo@@PBGZZ
?ReThrow@CVssFunctionTracer@@QAEXXZ
?AddGenericErrorContext@CVssFunctionTracer@@QAAXUCVssDebugInfo@@JPBGZZ
?LogGenericInfo@CVssFunctionTracer@@QAAXUCVssDebugInfo@@PBGZZ
??6CVssDebugInfo@@QAE?AU0@PAD@Z
?Trace@CVssFunctionTracer@@QAAXUCVssDebugInfo@@PBGZZ
??1CVssFunctionTracer@@QAE@XZ
?Exit@CVssFunctionTracer@@QAEPAGPAG@Z
setupapi
CM_Locate_DevNodeW
CM_Get_Device_IDW
CM_Get_Device_ID_Size_Ex
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiOpenDeviceInfoW
CM_Reenumerate_DevNode_Ex
CM_Get_Device_ID_List_ExW
CM_Get_Parent
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsW
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiCreateDeviceInfoList
CM_Get_Device_ID_List_Size_ExW
vssapi
CreateWriterEx
?LoadVssSnapshotSetDescription@@YGJPBGPAPAVIVssSnapshotSetDescription@@U_GUID@@@Z
CreateWriter
?CreateVssSnapshotSetDescription@@YGJU_GUID@@JPAPAVIVssSnapshotSetDescription@@@Z
VssFreeSnapshotPropertiesInternal
netapi32
NetShareAdd
NetShareDel
NetShareGetInfo
NetShareEnum
NetLocalGroupGetMembers
NetApiBufferFree
clusapi
OpenCluster
CloseCluster
GetNodeClusterState
xolehlp
ord9
ord8
Sections
.text Size: 865KB - Virtual size: 865KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 67KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PACK Size: 164KB - Virtual size: 424KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE