Static task
static1
Behavioral task
behavioral1
Sample
MdSched.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
MdSched.exe
Resource
win10v2004-20230703-en
General
-
Target
MdSched.exe
-
Size
90KB
-
MD5
26f5dba1fb3b8e477bf3941879b23e59
-
SHA1
b16fe1174f84b5b04a865c0e1200efc486df7d0f
-
SHA256
bc516f17afc7658c4f20726272d9ce9f77c83dd5575307b15dbbdeca6f04d273
-
SHA512
ecb85b5435a2d35478857c269f9a61244cb3a0105aeb782201ce79b305d85b68a29b09a05c5070af02951c0de69a5618967de7ddf674271f988b340abe448cdc
-
SSDEEP
1536:yt3ItM+oMQwH9m+65tFI720+VpmDOzc4JNWxwB1MjVJmRc:yytMbEH9e/FO+VQDUcUNWs+jm6
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource MdSched.exe
Files
-
MdSched.exe.exe windows x64
aaa5d23775a803f6978426a3c7a1f259
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
LookupPrivilegeValueW
OpenProcessToken
AdjustTokenPrivileges
EventWrite
InitiateShutdownW
EventRegister
RegCloseKey
RegCreateKeyExW
RegSetValueExW
EventUnregister
kernel32
SetUnhandledExceptionFilter
Sleep
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentProcess
HeapSetInformation
CompareStringW
GetLastError
GetModuleHandleW
QueryPerformanceCounter
CloseHandle
UnhandledExceptionFilter
GetTickCount
TerminateProcess
user32
LoadStringW
msvcrt
__C_specific_handler
_commode
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
free
_callnewh
malloc
?terminate@@YAXXZ
_fmode
memset
ntdll
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
comctl32
ord345
bcd
BcdCloseObject
BcdCloseStore
BcdSetElementData
BcdOpenObject
BcdOpenSystemStore
Sections
.text Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 468B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 72KB - Virtual size: 71KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 84B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ