Static task
static1
Behavioral task
behavioral1
Sample
BitsArbitraryFileMoveExploit.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
BitsArbitraryFileMoveExploit.exe
Resource
win10v2004-20230220-en
General
-
Target
BitsArbitraryFileMoveExploit.exe
-
Size
920KB
-
MD5
da26fb84c103109da7b738d0c1b0612c
-
SHA1
4373fefdec70547cb513be8e908997033197dc86
-
SHA256
5b9407df404506219bd672a33440783c5c214eefa7feb9923c6f9fded8183610
-
SHA512
c05f74eb24f4729d0e355013791bcf8e4f6493346de6c8c9e5f3d0c68fc5ff450ffb13f4bba6ddaf1e97cbc7e34a66a24bd81b69fd53de2b852a623dc259aba4
-
SSDEEP
12288:xfAOepN634z3YrKsCaYalAzPLG75WFfj7WempBaO5:hAO2N634z3hsCaYalAnG7yf/Wtac
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource BitsArbitraryFileMoveExploit.exe
Files
-
BitsArbitraryFileMoveExploit.exe.exe windows x64
309796be824484fd53021aaad9a6ee86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
CreateProcessAsUserW
user32
UnregisterClassW
ole32
CoInitializeEx
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoTaskMemFree
StringFromCLSID
CLSIDFromString
CoCreateInstance
CoGetStdMarshalEx
CoMarshalInterface
CoUninitialize
CreateStreamOnHGlobal
StringFromIID
CoCreateGuid
CoInitialize
oleaut32
SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
CreateErrorInfo
SetErrorInfo
VariantChangeType
VariantInit
VariantClear
GetErrorInfo
CreateTypeLib2
LoadTypeLi
kernel32
SetFilePointerEx
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapAlloc
GetModuleFileNameA
HeapQueryInformation
HeapReAlloc
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetProcessHeap
OutputDebugStringA
CreateThread
WaitForSingleObjectEx
GetCurrentThreadId
GetCurrentThread
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LoadLibraryExW
CreateFileW
DeleteFileW
FindFirstFileW
FindNextFileW
GetFileSize
QueryDosDeviceW
ReadFile
WriteFile
DecodePointer
CloseHandle
RaiseException
GetLastError
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
CreateEventW
GetCurrentProcess
GetCurrentProcessId
ProcessIdToSessionId
GetWindowsDirectoryW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
IsWow64Process
GetModuleFileNameW
LocalAlloc
LocalFree
FormatMessageW
lstrlenW
CopyFileW
GetStdHandle
CreateDirectoryW
GetFileAttributesW
RemoveDirectoryW
GetTempPathW
Sleep
SetConsoleTextAttribute
SetLastError
GetFullPathNameW
GetModuleHandleW
GetProcAddress
GetFileInformationByHandle
DeviceIoControl
GetOverlappedResult
WaitForSingleObject
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
DuplicateHandle
EnterCriticalSection
LeaveCriticalSection
lstrlenA
MultiByteToWideChar
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
FreeLibrary
SetConsoleCtrlHandler
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetSystemInfo
EncodePointer
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
AreFileApisANSI
GetFileType
WriteConsoleW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineW
FatalAppExitA
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetTickCount
CreateSemaphoreW
HeapSize
HeapValidate
VirtualQuery
shell32
ShellExecuteW
shlwapi
PathFindFileNameW
PathIsDirectoryW
PathRemoveFileSpecW
Sections
.text Size: 662KB - Virtual size: 661KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 201KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ