Static task
static1
Behavioral task
behavioral1
Sample
setup_think-cell_33094.exe
Resource
win10v2004-20230621-de
General
-
Target
setup_think-cell_33094.exe
-
Size
60.4MB
-
MD5
3cc0dc6936e28966308974761efb218b
-
SHA1
35e5c2cc8be66d1f293c4a9df7221c7fe43744b0
-
SHA256
fd46df85e8e4ff42b589a42ca7cb035323d2c2f81c46b6ad850c3f1d669e09c1
-
SHA512
e9b3d9eeeca84341a46f47130bd7576081843a6171383164bb21ac1fa8bfa4f7f18f99abc8c2754eccf0caf69e7ad4e309eee210db7dbd163d145d36ea5ab030
-
SSDEEP
1572864:FMY63T/M5BbbuJTG38Ah1MTkK9eBcG59k:FMY63TU5luYh1M9uBHk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource setup_think-cell_33094.exe
Files
-
setup_think-cell_33094.exe.exe windows x86
c664aa2393ff3fc3f4c8f682a586f503
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
userenv
GetProfileType
kernel32
GetModuleHandleExW
VirtualQuery
TlsGetValue
TlsSetValue
GetTickCount
GetEnvironmentVariableW
CreateDirectoryW
GetSystemDirectoryW
LoadResource
LockResource
SizeofResource
FindResourceW
IsDebuggerPresent
GetCommandLineW
DeleteFileW
GetTempPathW
CompareStringOrdinal
CreateFileW
SetFileAttributesW
GetCurrentThread
SetThreadPriority
GetThreadPriority
RemoveDirectoryW
MoveFileExW
GetExitCodeProcess
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
OpenMutexW
CreateEventExW
CreatePrivateNamespaceW
OpenPrivateNamespaceW
ClosePrivateNamespace
CreateBoundaryDescriptorW
AddSIDToBoundaryDescriptor
DeleteBoundaryDescriptor
LocalAlloc
GetDriveTypeW
GetFullPathNameW
GetVolumeInformationW
GetVolumePathNameW
TerminateProcess
VerSetConditionMask
FreeLibrary
GetTimeZoneInformation
GetCurrentProcess
ExpandEnvironmentStringsW
CreateThread
K32EnumProcessModules
ReadFile
WriteFile
GetOverlappedResult
CreateEventW
DuplicateHandle
ConnectNamedPipe
CreateNamedPipeW
CancelIo
CreateProcessW
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetFileAttributesW
SetEndOfFile
SetFilePointerEx
DeviceIoControl
AreFileApisANSI
RtlUnwind
InterlockedExchange
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
GetVersionExW
LoadLibraryExW
HeapSize
VirtualFree
VirtualProtect
VirtualAlloc
GetUserPreferredUILanguages
GetCurrentThreadId
WideCharToMultiByte
FormatMessageW
FormatMessageA
LocalFree
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetStartupInfoW
TlsFree
TlsAlloc
TerminateThread
GetCurrentProcessId
QueueUserAPC
WaitForMultipleObjects
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
PeekNamedPipe
SetLastError
GetLastError
RaiseException
CloseHandle
DecodePointer
OutputDebugStringA
GetSystemInfo
MultiByteToWideChar
LoadLibraryExA
FreeLibraryAndExitThread
GetThreadTimes
OutputDebugStringW
UnregisterWait
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
WriteConsoleW
HeapReAlloc
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
InitializeSListHead
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
HeapAlloc
HeapFree
GetACP
GetStdHandle
ExitProcess
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetStdHandle
EncodePointer
QueryPerformanceCounter
WaitForSingleObjectEx
Sleep
SwitchToThread
IsProcessorFeaturePresent
GetStringTypeW
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
GetFileType
user32
GetUserObjectInformationW
GetProcessWindowStation
CharUpperBuffW
MessageBoxW
RegisterWindowMessageW
advapi32
CreateRestrictedToken
CreateProcessAsUserW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteTreeW
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
CheckTokenMembership
OpenProcessToken
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorControl
AddMandatoryAce
InitializeAcl
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
RegOpenKeyExW
RegCloseKey
CreateWellKnownSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
shell32
SHGetKnownFolderPath
ShellExecuteExW
ole32
CoTaskMemFree
CoInitializeEx
CoUninitialize
oleaut32
SysFreeString
GetErrorInfo
SetErrorInfo
SysStringLen
ws2_32
WSAStartup
WSACleanup
msi
ord92
ord151
ord153
ord78
ord163
ord160
ord159
ord32
ord8
ord20
ord125
Sections
.text Size: 668KB - Virtual size: 668KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 229KB - Virtual size: 229KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 78KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 59.4MB - Virtual size: 59.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ