mssense[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

mssense.exe
Size

392KB
MD5

9afefc8bcfd361154847384a3420c6ad
SHA1

c51680f315d6247dfb0d885ad5865ab1841088ec
SHA256

1db4d9fe0ec9402e7ee997d5425e73aae2a1ca9093fcc8201d6bfa5b55849f91
SHA512

d4e4f3bfa9dceab981a2326967deb96945fad812fcdb76ceeac639c58648beb3691696196953dc424c9a558ca094e70a45516f72ee929b4c43fff93015f07181
SSDEEP

6144:g5Oe/LU/M6APGU6/yQa3Fx9sl5TMk/enHQ:g5Oe/LLPGU6lKb9srTMkF

Score

1^/10

Malware Config

Signatures

Files

mssense.exe
.exe windows x64

2776a5a54bafeae312255ba0c0e2deab

Code Sign

33:00:00:03:ef:5e:9b:c0:d6:1b:1a:67:fc:00:00:00:00:03:ef
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

13/10/2022, 19:43

Not After

11/10/2023, 19:43

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:01:c5:01:54:db:71:8c:35:52:3b:fe:b7:6c:93:f9:42:70:71:b2:0c:fa:a0:c2:a0:07:ff:ae:67:c9:e1:74
Signer

Actual PE Digest

a9:01:c5:01:54:db:71:8c:35:52:3b:fe:b7:6c:93:f9:42:70:71:b2:0c:fa:a0:c2:a0:07:ff:ae:67:c9:e1:74

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsdup
_o__wcsnicmp
_o___stdio_common_vswprintf
memcmp
_o__wmakepath_s
_o__wsplitpath_s
_o_abort
_o_calloc
_o_ceilf
_o_exit
_o_free
_o_frexp
_o_isspace
_o_ldexp
_o_localeconv
_o_malloc
_o_pow
_o_powf
_o_realloc
_o_setlocale
_o_strtod
_o_strtof
_o_terminate
_o_tolower
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_initial_wide_environment
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o___p__commode
_o___p___wargv
_o___p___argc
strchr
__uncaught_exception
memmove
memcpy
_o__free_base
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__CxxFrameHandler3
memchr

api-ms-win-crt-string-l1-1-0

memset
strcspn
wcsncmp
wcsnlen

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetModuleHandleW
FreeLibrary
GetProcAddress
GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WaitForSingleObject
InitializeCriticalSectionEx
CreateSemaphoreExW
ReleaseMutex
CreateMutexExW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
OpenSemaphoreW
ReleaseSemaphore

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
SetLastError
UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

LCMapStringEx
FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventSetInformation
EventUnregister
EventWriteTransfer

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-com-l1-1-0

CoIncrementMTAUsage

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ntdll

NtDeleteKey
NtDeleteValueKey
VerSetConditionMask
RtlCreateUnicodeString
RtlFreeUnicodeString

kernel32

MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
CreateEventW
SetFileAttributesW
GetFileAttributesW
FindClose
RemoveDirectoryW
FindNextFileW
FindFirstFileW
CompareFileTime
ExpandEnvironmentStringsW
VerifyVersionInfoW
GetVersionExW
GetProductInfo
GetModuleFileNameW
MoveFileExW

advapi32

RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetSecurityDescriptorSacl
DestroyPrivateObjectSecurity
SetNamedSecurityInfoW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey

api-ms-win-crt-locale-l1-1-0

_unlock_locales
_lock_locales

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyHash

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-string-l1-1-0

GetStringTypeW
CompareStringEx

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

Sections

.text
Size: 200KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2776a5a54bafeae312255ba0c0e2deab

Code Sign

33:00:00:03:ef:5e:9b:c0:d6:1b:1a:67:fc:00:00:00:00:03:efCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

a9:01:c5:01:54:db:71:8c:35:52:3b:fe:b7:6c:93:f9:42:70:71:b2:0c:fa:a0:c2:a0:07:ff:ae:67:c9:e1:74Signer

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-com-l1-1-0

version

ntdll

kernel32

advapi32

api-ms-win-crt-locale-l1-1-0

api-ms-win-core-path-l1-1-0

userenv

bcrypt

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-util-l1-1-0

Sections

.text Size: 200KB - Virtual size: 196KB

.rdata Size: 104KB - Virtual size: 101KB

.data Size: 12KB - Virtual size: 14KB

.pdata Size: 16KB - Virtual size: 13KB

.didat Size: 4KB - Virtual size: 32B

.rsrc Size: 36KB - Virtual size: 34KB

.reloc Size: 4KB - Virtual size: 1KB

33:00:00:03:ef:5e:9b:c0:d6:1b:1a:67:fc:00:00:00:00:03:ef
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

a9:01:c5:01:54:db:71:8c:35:52:3b:fe:b7:6c:93:f9:42:70:71:b2:0c:fa:a0:c2:a0:07:ff:ae:67:c9:e1:74
Signer

.text
Size: 200KB - Virtual size: 196KB

.rdata
Size: 104KB - Virtual size: 101KB

.data
Size: 12KB - Virtual size: 14KB

.pdata
Size: 16KB - Virtual size: 13KB

.didat
Size: 4KB - Virtual size: 32B

.rsrc
Size: 36KB - Virtual size: 34KB

.reloc
Size: 4KB - Virtual size: 1KB