Static task
static1
Behavioral task
behavioral1
Sample
Utilman.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Utilman.exe
Resource
win10v2004-20230220-en
General
-
Target
Utilman.exe
-
Size
88KB
-
MD5
cfa57ade08c13f439fc5cd2d6bcda399
-
SHA1
5629d305b07a9a098a3bebdc284524e2bfeee9c7
-
SHA256
1b83e1865fa78e29fe9f5afb3c8e1b22c0f510155a72e3cea8740080a4f8283f
-
SHA512
d8d68093b764b566dcb5de2af3d542bc2bdf2d1c6f4fb546d6038323267836b9a686b08c3dc079fed9616641f9c7a821f63a0405b79d411b3ceabb4700ee0793
-
SSDEEP
1536:1s+qeRXtHvg38xs+BOeE5fbEpyZAav1HH+gzPlliSPTcqgoLSbgvVoZtnBYMVGht:aMRXq38xMHbDtNeiN2+T1V
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Utilman.exe
Files
-
Utilman.exe.exe windows x86
3bd29d15021d65c6569f62bbcd68785c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegQueryValueExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegDeleteValueW
EventRegister
EventWriteTransfer
RegEnumValueW
EventUnregister
EventSetInformation
RegDeleteTreeW
RegEnumKeyExW
RegCreateKeyExW
TraceMessage
RegLoadMUIStringW
RegGetValueW
kernel32
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
HeapReAlloc
HeapSize
RaiseException
CloseHandle
GetCurrentThreadId
OpenMutexW
GetProductInfo
OpenEventW
CreateEventW
GetThreadUILanguage
MulDiv
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
GetThreadPreferredUILanguages
GetLocaleInfoEx
IsProcessInJob
OpenJobObjectW
CompareStringOrdinal
IsDebuggerPresent
DebugBreak
CreateMutexExW
GetProcAddress
OpenSemaphoreW
WaitForSingleObjectEx
InitOnceComplete
OutputDebugStringW
FormatMessageW
ReleaseMutex
ProcessIdToSessionId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
CreateSemaphoreExW
InitOnceBeginInitialize
GetModuleFileNameA
K32GetModuleBaseNameW
K32EnumProcessModules
K32EnumProcesses
FindResourceExW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
DeleteFileW
GetFileAttributesW
HeapFree
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
SetThreadUILanguage
HeapSetInformation
Sleep
ExpandEnvironmentStringsW
GetCurrentProcessId
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
GetLastError
OpenProcess
InitializeProcThreadAttributeList
HeapAlloc
GetProcessHeap
user32
KillTimer
GetAncestor
SendMessageW
SetDesktopColorTransform
SendNotifyMessageW
GetWindowThreadProcessId
GetShellWindow
GetTaskmanWindow
SetCursor
LoadCursorW
GetKeyState
SendInput
PostMessageW
SystemParametersInfoW
FindWindowW
IsProcessDPIAware
SetTimer
UnregisterClassA
GetSystemMetrics
SetWindowPos
GetThreadDesktop
GetUserObjectInformationW
msvcrt
_cexit
_exit
_except_handler4_common
_lock
malloc
_wtoi
wcsrchr
wcsspn
wcscspn
memcpy_s
memmove_s
_wcslwr_s
_purecall
_wcmdln
_ltow_s
wcschr
__setusermatherr
_callnewh
??1type_info@@UAE@XZ
_unlock
__dllonexit
_onexit
exit
__set_app_type
__CxxFrameHandler3
calloc
_initterm
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
free
wcsstr
_wcsicmp
_vsnwprintf
__p__fmode
_controlfp
?terminate@@YAXXZ
memset
ntdll
WinSqmAddToStream
NtQueryWnfStateData
WinSqmIsOptedIn
ole32
CoInitialize
CoUninitialize
CoCreateInstance
oleacc
AccessibleObjectFromWindow
GetProcessHandleFromHwnd
comctl32
ord344
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
shell32
ShellExecuteW
duser
InvalidateGadget
dui70
?GetOffText@TouchSwitch@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetOnText@TouchSwitch@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?CustomProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?Release@Value@DirectUI@@QAEXXZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
??1CritSecLock@DirectUI@@QAE@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
UnInitThread
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
StartMessagePump
UnInitProcessPriv
?Destroy@Element@DirectUI@@QAEJ_N@Z
??0Element@DirectUI@@QAE@XZ
RegisterPVLBehaviorFactory
?SliderUpdated@TouchSlider@DirectUI@@SG?AVUID@@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?ThemeChange@HWNDElement@DirectUI@@SG?AVUID@@XZ
InitProcessPriv
InitThread
?Click@TouchButton@DirectUI@@SG?AVUID@@XZ
StrToID
?GetToggleValue@TouchSwitch@DirectUI@@QAEHXZ
?SetToggleValue@TouchSwitch@DirectUI@@QAEXH@Z
?GetClassInfoPtr@TouchSwitch@DirectUI@@SGPAUIClassInfo@2@XZ
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?Register@Element@DirectUI@@SGJXZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
??1Element@DirectUI@@UAE@XZ
shcore
ord244
Sections
.text Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.imrsiv Size: - Virtual size: 4B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ