credwiz[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

credwiz.exe
Size

39KB
MD5

19ffb4c1b2042def14ec20365cbe0e7f
SHA1

3c0e69d8ec422545438fc335cfa26cf18579264b
SHA256

dd73d0adbedf9c251c055081279cf152e3e84197f91024474efd4d23fab3c6c3
SHA512

f973c5c4fc586cc6c5919fbf0da4f136f6b70ce42a02871fa5d50e883b6e5113b5835508cbac05cae47e6778806d2ee6c54dc2553a471c00562d593e23f6c119
SSDEEP

768:Ten/md0ztQCEzuAngPhAcgXc8lgEflVcTA9T9xZF+5:4/mdWez9cunlg8lVcTAbxZF+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
credwiz.exe

Files

credwiz.exe
.exe windows x64

1dd00699999764f96356fe23ccde82bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetTokenInformation
DuplicateToken
ImpersonateLoggedOnUser
RevertToSelf
CredRestoreCredentials
CredpEncodeSecret
ConvertStringSecurityDescriptorToSecurityDescriptorW
CredBackupCredentials

kernel32

HeapSetInformation
GetOverlappedResult
LocalFree
SleepEx
GetTempFileNameW
ReadFile
DeleteFileW
CloseHandle
CreateThread
FormatMessageW
CancelIo
HeapFree
HeapAlloc
GetProcessHeap
SetEvent
GetFileSizeEx
GlobalFree
CreateEventW
OpenProcess
DuplicateHandle
CreateFileW
LocalAlloc
GetTempPathW
GetLastError
WaitForMultipleObjects
WriteFile
GetCommandLineW
SetLastError

gdi32

GetObjectW
CreateFontIndirectW

user32

EnableWindow
GetParent
GetDlgItem
SetFocus
SendDlgItemMessageW
GetDlgItemTextW
ShowWindow
LoadStringW
GetWindowLongPtrW
SetWindowTextW
SendMessageW
SetWindowLongPtrW
CheckRadioButton
PostMessageW

msvcrt

__getmainargs
wcsncmp
exit
_amsg_exit
_XcptFilter
swscanf
__C_specific_handler
_exit
_cexit
_vsnwprintf
__set_app_type
_ismbblead
__setusermatherr
_initterm
memset
?terminate@@YAXXZ
_acmdln
_fmode
_commode

rpcrt4

RpcAsyncInitializeHandle
RpcStringBindingComposeW
RpcAsyncCancelCall
Ndr64AsyncClientCall
RpcAsyncCompleteCall
RpcStringFreeW
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcBindingFree
I_RpcExceptionFilter

crypt32

CryptUnprotectData
CryptProtectData

samcli

NetValidatePasswordPolicy

netutils

NetApiBufferFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetStartupInfoW
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

RtlNtStatusToDosError
TpWaitForWait
TpAllocWait
NtOpenProcessToken
NtAdjustPrivilegesToken
NtClose
TpSetWait
TpReleaseWait
NtPrivilegeCheck

comctl32

CreatePropertySheetPageW
PropertySheetW

comdlg32

GetOpenFileNameW
GetSaveFileNameW

msctfmonitor

InitLocalMsCtfMonitor
UninitLocalMsCtfMonitor

shell32

CommandLineToArgvW

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 212B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dd00699999764f96356fe23ccde82bd

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

gdi32

user32

msvcrt

rpcrt4

crypt32

samcli

netutils

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

comctl32

comdlg32

msctfmonitor

shell32

Sections

.text Size: 19KB - Virtual size: 18KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 828B

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 512B - Virtual size: 212B

.text
Size: 19KB - Virtual size: 18KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 828B

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 212B