SettingSyncHost[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

SettingSyncHost.exe
Size

774KB
MD5

4012933f9bd80d2ff9748da37d1d90b7
SHA1

1f1494cfc11a7d8efa3d1986622cf2a18cad2348
SHA256

c7d6e7f2c05f4ec715865556f34e887a73726168e283094a063f92ef9ae91534
SHA512

cbdf01cbfe806900900fb45c689537d263d019ebe910fa3628e03c81f87a97801050fe625eafb4568d443e41f3d4bf5a753fee16b33744faac2aaee01b86565c
SSDEEP

24576:23TdE7GjMy7y/KSnGBgEbQTwjkLf7CAR938AR5E:OTdE7GjMgbkwj29MARu

Score

1^/10

Malware Config

Signatures

Files

SettingSyncHost.exe
.exe windows:10 windows x86

8872e42058372aab0ab5ac752e0addd2

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:96:61:ac:4d:9c:a8:3f:97:8b:ae:71:90:9b:fa:36:b8:dd:e1:25:3a:b2:99:8d:5e:c8:03:79:bf:06:36:a0
Signer

Actual PE Digest

31:96:61:ac:4d:9c:a8:3f:97:8b:ae:71:90:9b:fa:36:b8:dd:e1:25:3a:b2:99:8d:5e:c8:03:79:bf:06:36:a0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__dllonexit
_unlock
_lock
_onexit
__CxxFrameHandler3
srand
_callnewh
?terminate@@YAXXZ
_controlfp
_initterm
_wcsnicmp
wcsncpy_s
_ftol2
__setusermatherr
_vsnwprintf
__p__fmode
??1type_info@@UAE@XZ
wcsncmp
_CxxThrowException
malloc
rand
_wcmdln
swscanf_s
_exit
exit
__set_app_type
__wgetmainargs
_except_handler4_common
_amsg_exit
__p__commode
_XcptFilter
free
realloc
_wcsicmp
toupper
_wcstoui64
??1exception@@UAE@XZ
_get_errno
_set_errno
_purecall
??0exception@@QAE@ABV0@@Z
memcpy_s
_vsnprintf_s
strncmp
memmove_s
memmove
_cexit
memcpy
memcmp
wcsstr
wcstok_s
wcschr
time
iswalnum
??0exception@@QAE@XZ
memset

api-ms-win-core-libraryloader-l1-2-0

LoadResource
GetProcAddress
SizeofResource
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
LockResource

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
InitializeSRWLock
InitializeCriticalSection
OpenSemaphoreW
WaitForSingleObjectEx
WaitForSingleObject
CreateMutexExW
ReleaseMutex
TryAcquireSRWLockExclusive
InitializeCriticalSectionEx
ResetEvent
ReleaseSemaphore
ReleaseSRWLockShared
SetEvent
CreateSemaphoreExW
DeleteCriticalSection
EnterCriticalSection
CreateEventW
ReleaseSRWLockExclusive
CreateEventExW
AcquireSRWLockShared
AcquireSRWLockExclusive
OpenEventW

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
SetPriorityClass
SetThreadPriority
GetCurrentThread
ProcessIdToSessionId
CreateProcessW
TerminateProcess
OpenThreadToken
OpenProcessToken
GetCurrentThreadId
GetStartupInfoW
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetUserGeoID
GetGeoInfoW
LCMapStringEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoRevokeClassObject
CoFreeUnusedLibraries
CoTaskMemRealloc
CoTaskMemAlloc
CoEnableCallCancellation
CoDisableCallCancellation
CoUninitialize
CoGetMalloc
StringFromCLSID
CoGetApartmentType
CoResumeClassObjects
StringFromGUID2
CLSIDFromString
CoGetCallContext
CoCreateFreeThreadedMarshaler
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoReleaseMarshalData
CoCancelCall
CoAddRefServerProcess
CoRegisterClassObject
StringFromIID
CoTaskMemFree
CoCreateGuid
CoWaitForMultipleHandles
CoReleaseServerProcess
PropVariantClear
CoSetProxyBlanket

api-ms-win-core-winrt-string-l1-1-0

WindowsStringHasEmbeddedNull
WindowsGetStringRawBuffer
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsCompareStringOrdinal
WindowsDeleteString
WindowsCreateString

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringOrdinal

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation
EventProviderEnabled

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-file-l1-1-0

GetFileAttributesW
FindFirstFileW
DeleteFileW
CompareFileTime
FindClose
RemoveDirectoryW
SetFileTime
CreateFileW
WriteFile
SetFileAttributesW
CreateDirectoryW
FindNextFileW
GetTempFileNameW
GetFullPathNameW
GetFileAttributesExW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegEnumValueW
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegOpenCurrentUser
RegQueryInfoKeyW

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceLoggerHandle
TraceMessage
RegisterTraceGuidsW
GetTraceEnableLevel
UnregisterTraceGuids
GetTraceEnableFlags

ntdll

RtlUnsubscribeWnfNotificationWaitForCompletion
NtSetInformationFile
RtlConvertSidToUnicodeString
RtlFreeUnicodeString
RtlSubscribeWnfStateChangeNotification
NtSetInformationThread
NtSetInformationProcess
NtPowerInformation
RtlGetSuiteMask
RtlPublishWnfStateData
NtCreateWnfStateName
NtQueryWnfStateData
EtwTraceMessage
EtwEventActivityIdControl
EtwEventWriteTransfer
RtlNtStatusToDosError

api-ms-win-shcore-thread-l1-1-0

SHCreateThreadWithHandle

api-ms-win-core-libraryloader-l1-2-1

FindResourceW

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream
IStream_Copy
SHOpenRegStream2W
IStream_Size
SHCreateStreamOnFileW
IStream_Write
IStream_Read
IStream_Reset
IStream_WriteStr

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemDirectoryW
GetTickCount64
GetSystemTime
GetVersionExW
GetSystemTimeAsFileTime

api-ms-win-shcore-obsolete-l1-1-0

SHStrDupW
CommandLineToArgvW

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoOriginateErrorW
RoTransformError
RoOriginateError

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-winrt-l1-1-0

RoRegisterActivationFactories
RoGetActivationFactory
RoRevokeActivationFactories
RoActivateInstance

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CloseThreadpoolWait
CreateThreadpoolTimer
CreateThreadpoolWait
CloseThreadpoolTimer
SetThreadpoolWait
SetThreadpoolTimer

api-ms-win-core-string-l2-1-0

CharLowerBuffW

api-ms-win-core-path-l1-1-0

PathAllocCombine
PathCchAppend

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueueTimer
DeleteTimerQueueTimer

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW
StrToIntExW
QISearch

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-shlwapi-legacy-l1-1-0

PathGetCharTypeW
PathStripPathW

rpcrt4

UuidCreate

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeExW

shcore

ord190

policymanager

PolicyManager_GetPolicyInt

umpdc

PdcTaskClientRegister
PdcTaskClientRequest
PdcTaskClientUnregister
Pdcv2ActivationClientRegister
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientActivate
Pdcv2ActivationClientDeactivate

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
GetTokenInformation
GetSidSubAuthority
CreateWellKnownSid

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW

userenv

GetProfileType

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-shcore-registry-l1-1-0

SHDeleteValueW
SHDeleteKeyW
SHRegGetValueW
SHSetValueW
SHRegSetPathW
SHRegGetPathW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

propsys

PSPropertyBag_WriteStr
PropVariantToBoolean
PropVariantToStringAlloc
PropVariantToUInt32
PSCreateMemoryPropertyStore
PSPropertyBag_WriteUnknown

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-core-url-l1-1-0

UrlEscapeW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

Sections

.text
Size: 704KB - Virtual size: 704KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8872e42058372aab0ab5ac752e0addd2

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

31:96:61:ac:4d:9c:a8:3f:97:8b:ae:71:90:9b:fa:36:b8:dd:e1:25:3a:b2:99:8d:5e:c8:03:79:bf:06:36:a0Signer

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

ntdll

api-ms-win-shcore-thread-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-shcore-stream-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-shcore-obsolete-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-shlwapi-legacy-l1-1-0

rpcrt4

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-power-base-l1-1-0

api-ms-win-core-version-l1-1-0

shcore

policymanager

umpdc

api-ms-win-core-apiquery-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-provider-l1-1-0

userenv

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-shcore-registry-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

propsys

api-ms-win-core-psapi-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-core-url-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

Sections

.text Size: 704KB - Virtual size: 704KB

.data Size: 1024B - Virtual size: 3KB

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

31:96:61:ac:4d:9c:a8:3f:97:8b:ae:71:90:9b:fa:36:b8:dd:e1:25:3a:b2:99:8d:5e:c8:03:79:bf:06:36:a0
Signer

.text
Size: 704KB - Virtual size: 704KB

.data
Size: 1024B - Virtual size: 3KB

.idata
Size: 12KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 192B

.rsrc
Size: 9KB - Virtual size: 8KB

.reloc
Size: 36KB - Virtual size: 36KB