Procmon[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

Procmon.exe
Size

1.9MB
MD5

4bd398d8c4ef11067c869caa24d3a870
SHA1

f341ed4b909c8ea8cd52b52619bc54f5fae930e1
SHA256

c551d5c37d2305552665441b98e039ffba165b5cdbcb54d83b2152f0b7a96651
SHA512

c5172858024c5f850fd9fe2423c74cc754ffaf36e22177221327063bb7859ec3b9aa9bd4ea3959ce4a642f1630bfcf4fcdd3b1a2c0a67c1601dbaf16cbb1d1ab
SSDEEP

24576:moXb5+Pv8kXl7ZH4YtdpmDnJbKLGw/o7FynfahSjkAGrOM0wUr9l:modwv8k7ZYEdIJuLGco7YRYr9Ur9l

Score

1^/10

Malware Config

Signatures

Files

Procmon.exe
.exe windows x86

cdbb030bb600d39828bb5d032319a445

Code Sign

33:00:00:00:59:d6:73:cd:51:8e:f0:22:c5:00:00:00:00:00:59
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/05/2014, 17:13

Not After

23/08/2015, 17:13

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:cc:23:a0:64:8c:6c:07:5a:92:77:c4:f7:8b:9f:1a:c2:e9:ef:72
Signer

Actual PE Digest

61:cc:23:a0:64:8c:6c:07:5a:92:77:c4:f7:8b:9f:1a:c2:e9:ef:72

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

closesocket
listen
recv
bind
accept
getsockname
connect
inet_ntoa
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
htons
inet_addr
htonl
WSAStartup
ntohs
WSAGetLastError
gethostbyname
socket
send

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

netapi32

NetApiBufferFree
NetWkstaGetInfo

comctl32

InitCommonControlsEx
ImageList_Destroy
ImageList_DrawEx
ord17
ImageList_Create
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_Add
ImageList_SetOverlayImage
ImageList_GetIcon
ImageList_GetIconSize
CreateToolbarEx
CreateStatusWindowW

fltlib

FilterReplyMessage
FilterGetMessage
FilterConnectCommunicationPort
FilterSendMessage

kernel32

GlobalUnlock
CompareStringW
GetLocaleInfoW
TryEnterCriticalSection
GetFileSize
SetEndOfFile
SetFilePointer
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateFileW
GetVersion
WriteFile
ReadFile
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
FormatMessageW
GetTimeFormatW
GetDateFormatW
GetNumberFormatW
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapSize
GlobalLock
GetCurrentThread
SetThreadPriority
SetEvent
ResetEvent
ReleaseSemaphore
WaitForMultipleObjects
CreateEventW
CreateSemaphoreW
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
SetProcessShutdownParameters
GetFileAttributesExW
GetComputerNameW
SetConsoleCtrlHandler
GetCurrentProcessId
OpenThread
GetThreadContext
LoadLibraryA
GetSystemDirectoryA
FindClose
FindFirstFileW
FindNextFileW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
IsValidCodePage
GetCommandLineA
GetCurrentThreadId
ExitThread
IsProcessorFeaturePresent
IsDebuggerPresent
HeapReAlloc
DecodePointer
EncodePointer
RtlUnwind
RaiseException
WideCharToMultiByte
MultiByteToWideChar
lstrlenA
GlobalAlloc
CreateProcessW
OpenProcess
EnumResourceNamesW
LoadLibraryExW
GetVersionExW
GetFileAttributesW
GetFullPathNameW
GetSystemInfo
VirtualFree
GlobalMemoryStatusEx
DeleteFileW
SetFileAttributesW
GetCurrentDirectoryW
GetSystemDirectoryW
FindResourceW
ExpandEnvironmentStringsW
GetModuleHandleExW
GetProcessHeap
GetStdHandle
GetConsoleCP
GetConsoleMode
GetStringTypeW
SizeofResource
LoadResource
SetLastError
GetLastError
GetCurrentProcess
LockResource
VirtualAlloc
DeleteCriticalSection
InitializeCriticalSection
GetSystemTimeAsFileTime
CloseHandle
Sleep
WaitForSingleObject
LeaveCriticalSection
EnterCriticalSection
CreateThread
GetModuleFileNameW
GetCommandLineW
LocalFree
LocalAlloc
GlobalAddAtomW
GetModuleHandleW
LoadLibraryW
GetTickCount
MulDiv
GetProcAddress
FreeLibrary
InterlockedDecrement
InterlockedIncrement
GetACP
GetOEMCP
GetFileType
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
OutputDebugStringW
SetStdHandle
FlushFileBuffers
WriteConsoleW
ReadConsoleW
ExitProcess
GetCPInfo

user32

EnumChildWindows
GetClassNameW
LoadBitmapW
IsDialogMessageW
GetWindowDC
WindowFromPoint
EnableMenuItem
CheckMenuItem
DestroyMenu
CreatePopupMenu
GetMenu
LoadMenuW
TranslateAcceleratorW
LoadAcceleratorsW
IsWindowEnabled
KillTimer
CheckRadioButton
GetDlgItemTextW
GetDlgItemInt
SetDlgItemInt
CreateDialogParamW
IsZoomed
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPlacement
GetWindowPlacement
FlashWindowEx
RegisterClassW
PostQuitMessage
DispatchMessageW
TranslateMessage
GetMessageW
DrawFrameControl
RegisterWindowMessageW
GetWindow
GetActiveWindow
LoadImageW
ClientToScreen
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetWindowThreadProcessId
FindWindowExW
FindWindowW
SetForegroundWindow
IsIconic
WaitForInputIdle
CreateIconFromResourceEx
PtInRect
EqualRect
MonitorFromPoint
GetIconInfo
DrawIconEx
DestroyIcon
LoadIconW
SetClassLongW
FrameRect
GetMenuItemCount
IsDlgButtonChecked
DestroyWindow
PostMessageW
LoadStringW
MessageBoxW
GetAncestor
GetDesktopWindow
EnableWindow
DialogBoxParamW
ChildWindowFromPoint
GetWindowTextW
SetDlgItemTextW
MoveWindow
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetScrollInfo
SetScrollInfo
LoadCursorW
GetParent
GetClassLongW
UnionRect
ScreenToClient
MessageBeep
SetWindowTextA
SetActiveWindow
SetMenuDefaultItem
GetMenuItemInfoW
InsertMenuItemW
SetMenuInfo
TrackPopupMenu
DeleteMenu
SetWindowLongW
GetWindowLongW
OffsetRect
IntersectRect
InflateRect
FillRect
GetSysColorBrush
GetSysColor
MapWindowPoints
GetCursorPos
SetCursor
GetWindowRect
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
ValidateRect
InvalidateRect
GetUpdateRgn
GetUpdateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
UpdateWindow
GetMonitorInfoW
InsertMenuW
DrawTextW
GetSystemMetrics
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetFocus
SetFocus
SetWindowPos
ShowWindow
CreateWindowExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
SendMessageW
GetCursor
GetSubMenu
CheckDlgButton

gdi32

CreateRectRgn
CreateRectRgnIndirect
EndDoc
CreatePen
SetROP2
SaveDC
RestoreDC
Rectangle
GdiFlush
SetPixel
GetPixel
CreateFontW
Polygon
MoveToEx
LineTo
GetBitmapBits
GetObjectW
CreateFontIndirectW
EndPage
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
StartDocW
SetMapMode
Polyline
GetTextMetricsW
SetTextColor
SetBkMode
SetBkColor
SelectObject
SelectClipRgn
RectInRegion
GetStockObject
GetDeviceCaps
GetBkMode
GetBkColor
DeleteObject
DeleteDC
CreateSolidBrush
StartPage

comdlg32

GetSaveFileNameW
GetOpenFileNameW
ChooseColorW
FindTextW
ChooseFontW
PrintDlgW

advapi32

RegOpenKeyExA
RegQueryValueExA
RegEnumValueW
ConvertStringSidToSidW
ConvertSidToStringSidW
RegSetValueW
RegOpenKeyExW
RegEnumKeyW
RegCreateKeyExW
LookupAccountSidW
MapGenericMask
GetLengthSid
FreeSid
AllocateAndInitializeSid
EqualSid
GetTokenInformation
RegOpenKeyW
RegDeleteValueW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegCreateKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
CommandLineToArgvW
DragQueryFileW
SHChangeNotify
ShellExecuteW
SHGetSpecialFolderLocation
SHGetMalloc
ShellExecuteExW
SHGetFileInfoW

ole32

CoSetProxyBlanket
CoCreateInstance
CreateBindCtx
OleInitialize
RegisterDragDrop
ReleaseStgMedium
CoInitialize

oleaut32

SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetElement
SysStringLen
VariantClear
VariantChangeType
SysAllocStringByteLen
VariantTimeToSystemTime
SysAllocStringLen
SysFreeString
SysAllocString
VariantInit

shlwapi

SHAutoComplete

Sections

.text
Size: 554KB - Virtual size: 554KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cdbb030bb600d39828bb5d032319a445

Code Sign

33:00:00:00:59:d6:73:cd:51:8e:f0:22:c5:00:00:00:00:00:59Certificate

Extended Key Usages

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:caCertificate

Extended Key Usages

61:33:26:1a:00:00:00:00:00:31Certificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

61:cc:23:a0:64:8c:6c:07:5a:92:77:c4:f7:8b:9f:1a:c2:e9:ef:72Signer

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

version

netapi32

comctl32

fltlib

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

Sections

.text Size: 554KB - Virtual size: 554KB

.rdata Size: 155KB - Virtual size: 154KB

.data Size: 6KB - Virtual size: 37KB

.rsrc Size: 1.2MB - Virtual size: 1.2MB

.reloc Size: 35KB - Virtual size: 35KB

33:00:00:00:59:d6:73:cd:51:8e:f0:22:c5:00:00:00:00:00:59
Certificate

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:cc:23:a0:64:8c:6c:07:5a:92:77:c4:f7:8b:9f:1a:c2:e9:ef:72
Signer

.text
Size: 554KB - Virtual size: 554KB

.rdata
Size: 155KB - Virtual size: 154KB

.data
Size: 6KB - Virtual size: 37KB

.rsrc
Size: 1.2MB - Virtual size: 1.2MB

.reloc
Size: 35KB - Virtual size: 35KB