Static task
static1
Behavioral task
behavioral1
Sample
9443c6da057fb878c9744e1d91e1e94c669629d61da5a9b526284ea0b39f85bf.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9443c6da057fb878c9744e1d91e1e94c669629d61da5a9b526284ea0b39f85bf.exe
Resource
win10v2004-20220812-en
General
-
Target
9443c6da057fb878c9744e1d91e1e94c669629d61da5a9b526284ea0b39f85bf
-
Size
100KB
-
MD5
d50a84552ef1665c08e0db7a62bce36b
-
SHA1
2c1741df7a6548a0b9928ab4efc9d888d2043d2e
-
SHA256
9443c6da057fb878c9744e1d91e1e94c669629d61da5a9b526284ea0b39f85bf
-
SHA512
c557bd6dad4cd908cefe1c97f1a6e5bf8adf53ef331892ce8e145256e82d8835fb3869cc61eb9a6c079644cef754d25b9bc6561fa3f232be8da3f8238bc8445f
-
SSDEEP
1536:SXJj/Tke8S1XQsk27vVFKfsKCE8tXpEXlbYSwx2Nu4KGhelNqnkJ:0D8Qgsk27vLKfsfpgtYSpaf
Malware Config
Signatures
Files
-
9443c6da057fb878c9744e1d91e1e94c669629d61da5a9b526284ea0b39f85bf.exe windows x86
aa6d7164e4b21dd2bb616e1c3d6ad497
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UpdateResourceW
GetProcAddress
advapi32
InitiateSystemShutdownExA
InitializeSid
LsaNtStatusToWinError
OpenSCManagerW
ObjectDeleteAuditAlarmW
LsaAddAccountRights
StartServiceCtrlDispatcherA
GetManagedApplications
NotifyChangeEventLog
CryptGetKeyParam
GetTrusteeTypeW
CryptGetUserKey
QueryServiceConfigA
ConvertSecurityDescriptorToAccessNamedA
BuildTrusteeWithSidW
GetEffectiveRightsFromAclW
SystemFunction030
CryptAcquireContextA
LsaClearAuditLog
LookupSecurityDescriptorPartsA
RevertToSelf
FreeEncryptionCertificateHashList
GetAce
ElfChangeNotify
QueryServiceStatus
LsaQueryInfoTrustedDomain
ElfReadEventLogA
CryptSignHashA
RegConnectRegistryA
BuildTrusteeWithNameA
GetNamedSecurityInfoExA
EnumServicesStatusExA
LsaOpenAccount
QueryServiceObjectSecurity
QueryAllTracesA
LookupAccountSidA
ConvertAccessToSecurityDescriptorW
ControlTraceA
SystemFunction020
RegQueryValueExA
ReportEventA
SetSecurityDescriptorOwner
CryptAcquireContextW
SystemFunction003
RegLoadKeyA
EqualPrefixSid
SetNamedSecurityInfoExW
AddAce
ObjectPrivilegeAuditAlarmW
AddAccessAllowedAceEx
SystemFunction041
RemoveTraceCallback
EncryptionDisable
RegCreateKeyW
ElfRegisterEventSourceW
QueryServiceStatusEx
OpenServiceW
CreatePrivateObjectSecurity
LsaCreateTrustedDomainEx
StartTraceA
LsaQueryDomainInformationPolicy
CryptDestroyKey
LsaOpenPolicySce
ConvertSecurityDescriptorToAccessW
RegCloseKey
LookupPrivilegeValueA
ChangeServiceConfig2W
SetEntriesInAccessListW
SetSecurityInfoExA
AddAccessAllowedObjectAce
SetEntriesInAclA
ImpersonateAnonymousToken
ObjectCloseAuditAlarmW
QueryServiceLockStatusW
GetFileSecurityW
GetUserNameW
SetEntriesInAuditListA
PrivilegeCheck
GetSidSubAuthority
GetTrusteeFormA
MakeSelfRelativeSD
LsaGetRemoteUserName
SetPrivateObjectSecurityEx
LookupPrivilegeDisplayNameW
SetTraceCallback
CryptExportKey
GetMultipleTrusteeOperationA
InstallApplication
EnumServiceGroupW
RegQueryInfoKeyA
SystemFunction002
LsaAddPrivilegesToAccount
CryptDecrypt
QueryUsersOnEncryptedFile
BuildTrusteeWithObjectsAndNameA
GetSecurityInfo
InitiateSystemShutdownW
GetTrusteeNameA
RegFlushKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSaveKeyA
CryptSignHashW
AllocateAndInitializeSid
EnumServicesStatusExW
SystemFunction008
ReadEventLogA
GetAuditedPermissionsFromAclW
FindFirstFreeAce
OpenServiceA
LsaSetSystemAccessAccount
GetLengthSid
CreatePrivateObjectSecurityEx
LookupAccountNameW
RegUnLoadKeyW
ConvertSDToStringSDRootDomainW
CryptDuplicateHash
RegReplaceKeyA
CryptSetProvParam
UnregisterTraceGuids
ElfBackupEventLogFileW
AddAuditAccessAceEx
ElfReadEventLogW
LsaSetTrustedDomainInfoByName
RegConnectRegistryW
vdmdbg
VDMGetModuleSelector
VDMGetSymbol
VDMGlobalNext
VDMDetectWOW
VDMSetDbgFlags
VDMKillWOW
VDMGetSelectorModule
VDMIsModuleLoaded
VDMTerminateTaskWOW
VDMEnumTaskWOW
VDMEnumProcessWOW
VDMGetSegtablePointer
VDMStartTaskInWOW
VDMEnumTaskWOWEx
VDMGetSegmentInfo
VDMGetThreadContext
user32
DialogBoxParamW
SendMessageA
Sections
.text Size: 27KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ