Static task
static1
Behavioral task
behavioral1
Sample
EaseOfAccessDialog.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
EaseOfAccessDialog.exe
Resource
win10v2004-20230220-en
General
-
Target
EaseOfAccessDialog.exe
-
Size
273KB
-
MD5
9a503b2cea238ed22fb1e4f7c025393b
-
SHA1
bb82dfd3092c17b9c5e5d716226871bea163c3c2
-
SHA256
54577dffa8cfc712e30957504b026d5bccafcf17462efa155be830598394b9a0
-
SHA512
018107b8311ebbd7f597244b4b5a2479d453e3eb81d02b39b965eadf8126cec543cdc618aa76387b49516459e39dd79a74f04936c96bdbf00a285903cd74c01d
-
SSDEEP
6144:VdHsWQ9OjCcWorOj+jn6uFz2LJGRg4kLNnei36cw2j:/MWQ9O+0lFCdUcNj
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EaseOfAccessDialog.exe
Files
-
EaseOfAccessDialog.exe.exe windows x86
a5bb34ab6dde5b928d1a48b30316afcf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
EventUnregister
EventRegister
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
TraceMessage
RegLoadMUIStringW
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegGetValueW
kernel32
VirtualAllocEx
LeaveCriticalSection
IsProcessInJob
OpenJobObjectW
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapSetInformation
RaiseException
HeapAlloc
GetProcessHeap
SizeofResource
CreateMutexW
MultiByteToWideChar
GetLastError
LockResource
CloseHandle
FindResourceExW
LoadResource
K32GetModuleBaseNameW
K32EnumProcessModules
ProcessIdToSessionId
K32EnumProcesses
DeleteFileW
GetFileAttributesW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
OpenProcess
GetThreadUILanguage
MulDiv
OpenMutexW
VirtualFreeEx
ReadProcessMemory
GetThreadPreferredUILanguages
CompareStringOrdinal
GetLocaleInfoEx
ExpandEnvironmentStringsW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
user32
SetWindowPos
LoadIconW
GetAncestor
KillTimer
GetUserObjectInformationW
SetCursor
LoadCursorW
FindWindowW
SetWindowTextW
SetTimer
SystemParametersInfoW
GetSystemMetrics
SendMessageW
SendInput
GetKeyState
GetShellWindow
GetWindowThreadProcessId
SendNotifyMessageW
MessageBoxW
GetThreadDesktop
LoadStringW
IsProcessDPIAware
UnregisterClassA
msvcrt
_purecall
memcpy_s
free
malloc
_callnewh
memset
memmove_s
calloc
_XcptFilter
__p__commode
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
_wcmdln
__CxxFrameHandler3
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
_controlfp
_except_handler4_common
??1type_info@@UAE@XZ
_ltow_s
_wcslwr_s
wcscspn
wcsspn
wcsrchr
_wtoi
wcschr
_vsnwprintf
wcsstr
_wcsicmp
ntdll
WinSqmIncrementDWORD
NtQueryWnfStateData
WinSqmIsOptedIn
WinSqmAddToStream
oleacc
GetProcessHandleFromHwnd
AccessibleObjectFromWindow
ole32
CoUninitialize
CoCreateInstance
CoInitialize
comctl32
ord344
shell32
ShellExecuteW
duser
InvalidateGadget
shcore
ord244
dui70
?Release@Value@DirectUI@@QAEXXZ
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?CustomProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetOnText@TouchSwitch@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetOffText@TouchSwitch@DirectUI@@QAEPBGPAPAVValue@2@@Z
??1CritSecLock@DirectUI@@QAE@XZ
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
??0Element@DirectUI@@QAE@XZ
??1Element@DirectUI@@UAE@XZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SGJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetClassInfoPtr@TouchSwitch@DirectUI@@SGPAUIClassInfo@2@XZ
?SetToggleValue@TouchSwitch@DirectUI@@QAEXH@Z
?GetToggleValue@TouchSwitch@DirectUI@@QAEHXZ
?Click@TouchButton@DirectUI@@SG?AVUID@@XZ
?ThemeChange@HWNDElement@DirectUI@@SG?AVUID@@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?SliderUpdated@TouchSlider@DirectUI@@SG?AVUID@@XZ
RegisterPVLBehaviorFactory
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
?GetClassInfoPtr@CCPushButton@DirectUI@@SGPAUIClassInfo@2@XZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SGPAVElement@2@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
InitProcessPriv
InitThread
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
?EndDefer@Element@DirectUI@@QAEXK@Z
UnInitProcessPriv
StartMessagePump
UnInitThread
?ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z
?Create@NativeHWNDHost@DirectUI@@SGJPBGPAUHWND__@@PAUHICON__@@HHHHHHIPAPAV12@@Z
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
??1HWNDElement@DirectUI@@UAE@XZ
??0HWNDElement@DirectUI@@QAE@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
?Register@HWNDElement@DirectUI@@SGJXZ
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?CreateStyleParser@HWNDElement@DirectUI@@UAEJPAPAVDUIXmlParser@2@@Z
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?DoubleBuffered@Element@DirectUI@@QAEX_N@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Destroy@Layout@DirectUI@@QAEXXZ
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?LoadFromResource@DUIFactory@DirectUI@@QAEJPAUHINSTANCE__@@PBG1PAVElement@2@PAKPAPAV42@1@Z
??1DUIFactory@DirectUI@@QAE@XZ
?DestroyWindow@NativeHWNDHost@DirectUI@@QAEXXZ
?GetClassInfoW@HWNDElement@DirectUI@@UAEPAUIClassInfo@2@XZ
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
Sections
.text Size: 50KB - Virtual size: 49KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ