Static task
static1
Behavioral task
behavioral1
Sample
EaseOfAccessDialog.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
EaseOfAccessDialog.exe
Resource
win10v2004-20230220-en
General
-
Target
EaseOfAccessDialog.exe
-
Size
270KB
-
MD5
96a63d3ae879a261676bb2ad0a8b2394
-
SHA1
ce6c4c7ac42385ef09605647df2f524623b8145f
-
SHA256
8983848d824e0273ce4aa6b649c3b27a90a8c8d8ed92148e92e191a3337cf937
-
SHA512
4e0342132e8c038b9293a2721881c6466ceb3cd1f96cba78e80fb0a8813ede40be17846cafd99da627896efd50d627dc7f4760df3ec9b60d0de008daafbae9f2
-
SSDEEP
6144:clpXYSwNOj+jn6uFz2LJGRg4kLNnei36cw:aX0nFCdUc
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EaseOfAccessDialog.exe
Files
-
EaseOfAccessDialog.exe.exe windows x86
bedf389fa878ac844e675709425434fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
EventUnregister
EventRegister
AllocateAndInitializeSid
FreeSid
CheckTokenMembership
TraceMessage
RegGetValueW
RegEnumKeyExW
RegCreateKeyExW
RegSetValueExW
RegLoadMUIStringW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
kernel32
LockResource
OpenJobObjectW
GetLastError
MultiByteToWideChar
IsProcessInJob
DeleteFileW
SizeofResource
LoadResource
FindResourceExW
GetFileAttributesW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
K32GetModuleBaseNameW
K32EnumProcessModules
OpenProcess
ProcessIdToSessionId
K32EnumProcesses
GetThreadUILanguage
ExpandEnvironmentStringsW
VirtualAllocEx
OpenMutexW
GetThreadPreferredUILanguages
MulDiv
GetLocaleInfoEx
ReadProcessMemory
CompareStringOrdinal
VirtualFreeEx
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
HeapSize
HeapFree
HeapReAlloc
HeapDestroy
HeapSetInformation
HeapAlloc
GetProcessHeap
RaiseException
CreateMutexW
CloseHandle
user32
LoadIconW
SetWindowPos
SetWindowTextW
MessageBoxW
SendMessageTimeoutW
SystemParametersInfoW
GetWindowThreadProcessId
GetShellWindow
GetKeyState
SendInput
SetCursor
SetTimer
GetThreadDesktop
KillTimer
LoadCursorW
FindWindowW
IsProcessDPIAware
GetAncestor
GetSystemMetrics
GetUserObjectInformationW
SendMessageW
UnregisterClassA
LoadStringW
msvcrt
_initterm
_wcmdln
__CxxFrameHandler3
_lock
_unlock
__dllonexit
_onexit
__setusermatherr
_except_handler4_common
?terminate@@YAXXZ
_controlfp
??1type_info@@UAE@XZ
wcscspn
wcsspn
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
malloc
calloc
memmove_s
memset
free
memcpy_s
??2@YAPAXI@Z
_purecall
??_V@YAXPAX@Z
_ltow_s
wcsrchr
_wcslwr_s
??_U@YAPAXI@Z
_wtoi
_vsnwprintf
??3@YAXPAX@Z
_wcsicmp
wcsstr
wcschr
ntdll
WinSqmAddToStream
WinSqmIncrementDWORD
WinSqmIsOptedIn
oleacc
GetProcessHandleFromHwnd
AccessibleObjectFromWindow
ole32
CoUninitialize
CoCreateInstance
CoInitialize
comctl32
ord344
shell32
ShellExecuteW
duser
InvalidateGadget
shcore
ord244
dui70
?Release@Value@DirectUI@@QAEXXZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?CustomProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetUnset@Value@DirectUI@@SGPAV12@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
??1CritSecLock@DirectUI@@QAE@XZ
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?SetActive@Element@DirectUI@@QAEJH@Z
RegisterPVLBehaviorFactory
?GetClassInfoPtr@TouchSwitch@DirectUI@@SGPAUIClassInfo@2@XZ
?SetToggleValue@TouchSwitch@DirectUI@@QAEXH@Z
?GetToggleValue@TouchSwitch@DirectUI@@QAEHXZ
?ThemeChange@HWNDElement@DirectUI@@SG?AVUID@@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
??0Element@DirectUI@@QAE@XZ
??1Element@DirectUI@@UAE@XZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SGJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?SliderUpdated@TouchSlider@DirectUI@@SG?AVUID@@XZ
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?Click@TouchButton@DirectUI@@SG?AVUID@@XZ
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
StrToID
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SGPAVElement@2@XZ
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?GetClassInfoPtr@CCPushButton@DirectUI@@SGPAUIClassInfo@2@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
?GetClassInfoW@HWNDElement@DirectUI@@UAEPAUIClassInfo@2@XZ
InitThread
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
UnInitThread
?EndDefer@Element@DirectUI@@QAEXK@Z
UnInitProcessPriv
StartMessagePump
InitProcessPriv
?ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z
?Create@NativeHWNDHost@DirectUI@@SGJPBGPAUHWND__@@PAUHICON__@@HHHHHHIPAPAV12@@Z
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?LoadFromResource@DUIFactory@DirectUI@@QAEJPAUHINSTANCE__@@PBG1PAVElement@2@PAKPAPAV42@1@Z
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?DoubleBuffered@Element@DirectUI@@QAEX_N@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Destroy@Layout@DirectUI@@QAEXXZ
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
??1HWNDElement@DirectUI@@UAE@XZ
??0HWNDElement@DirectUI@@QAE@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
?Register@HWNDElement@DirectUI@@SGJXZ
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?CreateStyleParser@HWNDElement@DirectUI@@UAEJPAPAVDUIXmlParser@2@@Z
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
??1DUIFactory@DirectUI@@QAE@XZ
?DestroyWindow@NativeHWNDHost@DirectUI@@QAEXXZ
Sections
.text Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 204KB - Virtual size: 204KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ