Static task
static1
General
-
Target
wmpnetwk.exe
-
Size
934KB
-
MD5
6c3853e313811781692b526bddb4c9e2
-
SHA1
5dc9b9c5ffb6bad3d8f60e7671e803e09e357ff0
-
SHA256
714598a490f88c7b771d4211bfd4eb319ebab85f6ea5a66e829f99c32f361b95
-
SHA512
06f8acea6ea4740562ff07debace302b658a4b2f9c01605c3a9a7c41ec1241e7440695d608fe2b30bd07f13a37bf3502ce360ab556adb65b1ab9bbe98539f460
-
SSDEEP
12288:RGTEh3SNxBMTPomLcDeDgjGPGE0IJ5QV2O3ROoqXh2HZl+UKTRlyTy:iSEmYD6gjGPG45QVDkfXNlyTy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource wmpnetwk.exe
Files
-
wmpnetwk.exe.exe windows x64
a08e847309c757a892d0d0a5273bcb4c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
EventRegister
EventUnregister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventWriteTransfer
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegCloseKey
CreateServiceW
RegOpenKeyExW
ChangeServiceConfig2W
QueryServiceStatusEx
ControlService
DeleteService
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CopySid
GetLengthSid
IsValidSid
InitializeAcl
AddAce
GetAclInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
GetNamedSecurityInfoW
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
ConvertStringSidToSidW
RegCreateKeyExW
RegSetKeySecurity
RegEnumKeyExW
RegGetValueW
EventWriteEx
SetSecurityInfo
GetSecurityInfo
SetSecurityDescriptorControl
GetAce
EqualSid
StartServiceW
ChangeServiceConfigW
LookupAccountSidW
kernel32
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
CompareStringOrdinal
SetProcessWorkingSetSize
ResetEvent
IsWow64Process
lstrcmpW
PowerClearRequest
DeleteTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer
FindResourceW
CompareStringA
GetFullPathNameW
MultiByteToWideChar
MulDiv
RegisterWaitForSingleObject
UnregisterWaitEx
FormatMessageW
GetProcessHeap
HeapFree
CreateThread
WaitForMultipleObjects
GetStringTypeExW
lstrcmpiW
GetComputerNameW
GetDynamicTimeZoneInformation
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesExW
TzSpecificLocalTimeToSystemTime
GetCurrentThreadId
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
WideCharToMultiByte
DelayLoadFailureHook
ResolveDelayLoadedAPI
PowerSetRequest
GetTickCount64
WaitForSingleObject
CreateEventW
GetTickCount
Sleep
PowerCreateRequest
SetLastError
GetLastError
SetEvent
OpenEventW
RegDeleteKeyExW
RegQueryInfoKeyW
RegGetKeySecurity
OutputDebugStringA
GetModuleHandleW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
LocalFree
CompareStringW
FindResourceExW
LoadResource
LockResource
SizeofResource
HeapSetInformation
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
RaiseException
GetModuleFileNameW
msvcrt
_ui64tow_s
_ltow_s
_XcptFilter
memmove
memcpy
_CxxThrowException
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
_i64tow_s
_amsg_exit
__wgetmainargs
__set_app_type
exit
__dllonexit
?what@exception@@UEBAPEBDXZ
ceil
floor
memcmp
_onexit
wcsrchr
realloc
??1type_info@@UEAA@XZ
memset
_unlock
_lock
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_callnewh
_strlwr_s
strncmp
_ultoa_s
_ultow_s
_wtol
_wtoi
qsort_s
_wcsicmp
_vsnwprintf
swscanf
wcsstr
wcstol
_wcslwr_s
_wcsnicmp
wcsncmp
iswdigit
towupper
_wcstoui64
wcstoul
_errno
_purecall
calloc
malloc
wcscpy_s
free
_wputenv
memmove_s
memcpy_s
__C_specific_handler
??_V@YAXPEAX@Z
__CxxFrameHandler3
??3@YAXPEAX@Z
_exit
??0exception@@QEAA@AEBQEBDH@Z
strchr
wcscmp
user32
UnregisterPowerSettingNotification
DispatchMessageW
wvsprintfW
MsgWaitForMultipleObjectsEx
CharUpperW
PeekMessageW
CharUpperBuffW
UnregisterClassA
RegisterPowerSettingNotification
oleaut32
SysFreeString
SysAllocString
LoadTypeLi
SysStringLen
UnRegisterTypeLi
LoadRegTypeLi
SysAllocStringLen
VariantInit
SystemTimeToVariantTime
VariantTimeToSystemTime
SafeArrayUnlock
SafeArrayPtrOfIndex
SafeArrayLock
SetErrorInfo
CreateErrorInfo
SafeArrayCopy
SafeArrayCreate
SafeArrayDestroy
VariantClear
RegisterTypeLi
ole32
CoSetProxyBlanket
StringFromGUID2
CoCreateGuid
CLSIDFromProgID
IIDFromString
CoTaskMemFree
CoUnmarshalInterface
CoReleaseMarshalData
CoMarshalInterface
CreateStreamOnHGlobal
PropVariantClear
CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
wsock32
WSAGetLastError
iphlpapi
SendARP
GetIpNetEntry2
CancelIPChangeNotify
ResolveIpNetEntry2
GetIpAddrTable
GetBestInterfaceEx
GetAdaptersAddresses
NotifyIpInterfaceChange
NotifyAddrChange
CancelMibChangeNotify2
shlwapi
PathCreateFromUrlW
PathFindExtensionW
PathFindFileNameW
ord168
ord219
PathRemoveExtensionW
StrChrW
ntdll
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtQueryKey
NtDeleteKey
userenv
UnregisterGPNotification
RegisterGPNotification
netapi32
NetApiBufferFree
NetShareGetInfo
propsys
PropVariantToStringAlloc
PSGetPropertyDescriptionByName
InitPropVariantFromCLSID
PSGetPropertyKeyFromName
PropVariantToString
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Sections
.text Size: 672KB - Virtual size: 672KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 151KB - Virtual size: 151KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 14KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 264B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ