Static task
static1
Behavioral task
behavioral1
Sample
EaseOfAccessDialog.exe
Resource
win10v2004-20231020-en
General
-
Target
EaseOfAccessDialog.exe
-
Size
94KB
-
MD5
93f7631f80a4b0e38c70ac3192620f2d
-
SHA1
1320b0482d04f600c6c545786220657f30e0a86c
-
SHA256
c13e249449604b6ac4a545637022e00d629faf4cbb6d50a51871a3abe31c3717
-
SHA512
de3b31fda8b35bc27af2c399d6576cce685a0bdc1d7e29d566b75a9e12f85a448461dbda1e581eea0653a43bc15707c7562205a007e6753142abf2e70e34c7bc
-
SSDEEP
1536:KoRQABqlOTXof5+x/QlnebHGhfCGSPLOXdbDWPGgUMja1qzWO0vmTZB1+hKW/GJT:3QKqlOu+ilersfCGSiXzwCaWM7jv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource EaseOfAccessDialog.exe
Files
-
EaseOfAccessDialog.exe.exe windows:10 windows x86
33c6c3c6644c13bfb28fadbd464794bf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
EventUnregister
EventRegister
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
TraceMessage
RegGetValueW
RegEnumValueW
RegDeleteTreeW
RegLoadMUIStringW
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegCreateKeyExW
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
EventWriteTransfer
EventSetInformation
RegSetValueExW
RegOpenKeyExW
kernel32
HeapSize
HeapReAlloc
VirtualQuery
GetSystemInfo
AcquireSRWLockExclusive
HeapSetInformation
RaiseException
ReleaseSRWLockExclusive
LoadLibraryExA
VirtualProtect
OOBEComplete
IsProcessInJob
OpenJobObjectW
FreeLibrary
HeapAlloc
SizeofResource
GetProductInfo
IsDebuggerPresent
CreateMutexExW
OpenSemaphoreW
WaitForSingleObjectEx
InitOnceComplete
OutputDebugStringW
FormatMessageW
ReleaseMutex
WaitForSingleObject
ReleaseSemaphore
CreateSemaphoreExW
InitOnceBeginInitialize
K32GetModuleBaseNameW
K32EnumProcessModules
ProcessIdToSessionId
K32EnumProcesses
DeleteFileW
GetFileAttributesW
DeleteProcThreadAttributeList
CreateProcessW
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
OpenProcess
SetLastError
GetProcAddress
DebugBreak
GetModuleFileNameA
GetModuleHandleExW
LocalFree
GetThreadUILanguage
MulDiv
OpenMutexW
VirtualFreeEx
ReadProcessMemory
VirtualAllocEx
GetThreadPreferredUILanguages
CompareStringOrdinal
GetLocaleInfoEx
ExpandEnvironmentStringsW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetProcessHeap
InitializeCriticalSection
HeapDestroy
CreateMutexW
LoadResource
FindResourceExW
CloseHandle
LockResource
GetLastError
MultiByteToWideChar
HeapFree
user32
SetWindowTextW
MessageBoxW
LoadStringW
SystemParametersInfoW
SetWindowPos
LoadIconW
SetDesktopColorTransform
SendNotifyMessageW
GetWindowThreadProcessId
GetShellWindow
GetKeyState
SendInput
SendMessageW
GetSystemMetrics
GetThreadDesktop
SetTimer
IsProcessDPIAware
FindWindowW
LoadCursorW
SetCursor
GetUserObjectInformationW
KillTimer
GetAncestor
UnregisterClassA
msvcrt
?terminate@@YAXXZ
_controlfp
??1type_info@@UAE@XZ
_ltow_s
_wcslwr_s
wcscspn
wcsspn
_unlock
_lock
__CxxFrameHandler3
_wcmdln
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
calloc
memmove_s
_callnewh
malloc
free
wcsrchr
_wtoi
wcschr
_vsnwprintf
wcsstr
_wcsicmp
_except_handler4_common
_onexit
exit
memcpy_s
_purecall
__dllonexit
memset
ntdll
WinSqmIncrementDWORD
NtQueryWnfStateData
WinSqmIsOptedIn
WinSqmAddToStream
oleacc
AccessibleObjectFromWindow
GetProcessHandleFromHwnd
ole32
CoUninitialize
CoCreateInstance
CoInitialize
api-ms-win-core-winrt-error-l1-1-0
SetRestrictedErrorInfo
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
comctl32
ord344
shell32
ShellExecuteW
duser
InvalidateGadget
shcore
ord244
IsProcessInIsolatedContainer
dui70
?GetValue@Element@DirectUI@@QAEPAVValue@2@P6GPBUPropertyInfo@2@XZHPAUUpdateCache@2@@Z
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?CustomProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetOnText@TouchSwitch@DirectUI@@QAEPBGPAPAVValue@2@@Z
?GetOffText@TouchSwitch@DirectUI@@QAEPBGPAPAVValue@2@@Z
?Release@Value@DirectUI@@QAEXXZ
??1CritSecLock@DirectUI@@QAE@XZ
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
??0ClassInfoBase@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
??0Element@DirectUI@@QAE@XZ
??1Element@DirectUI@@UAE@XZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?IsDescendent@Element@DirectUI@@QAE_NPAV12@@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?GetRoot@Element@DirectUI@@QAEPAV12@XZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?Register@Element@DirectUI@@SGJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetClassInfoPtr@TouchSwitch@DirectUI@@SGPAUIClassInfo@2@XZ
?SetToggleValue@TouchSwitch@DirectUI@@QAEXH@Z
?GetToggleValue@TouchSwitch@DirectUI@@QAEHXZ
?Click@TouchButton@DirectUI@@SG?AVUID@@XZ
?ThemeChange@HWNDElement@DirectUI@@SG?AVUID@@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?SliderUpdated@TouchSlider@DirectUI@@SG?AVUID@@XZ
RegisterPVLBehaviorFactory
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
?GetClassInfoPtr@CCPushButton@DirectUI@@SGPAUIClassInfo@2@XZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetKeyFocusedElement@HWNDElement@DirectUI@@SGPAVElement@2@XZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?CanSetFocus@HWNDElement@DirectUI@@UAE_NXZ
?IsMSAAEnabled@HWNDElement@DirectUI@@UAE_NXZ
?GetHWND@HWNDElement@DirectUI@@UAEPAUHWND__@@XZ
InitProcessPriv
InitThread
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
?EndDefer@Element@DirectUI@@QAEXK@Z
UnInitProcessPriv
StartMessagePump
UnInitThread
?ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z
?Create@NativeHWNDHost@DirectUI@@SGJPBGPAUHWND__@@PAUHICON__@@HHHHHHIPAPAV12@@Z
?_OnUIStateChanged@HWNDElement@DirectUI@@MAEXGG@Z
?Initialize@HWNDElement@DirectUI@@QAEJPAUHWND__@@_NIPAVElement@2@PAK@Z
??1HWNDElement@DirectUI@@UAE@XZ
??0HWNDElement@DirectUI@@QAE@XZ
?GetAccessibleImpl@HWNDElement@DirectUI@@UAEJPAPAUIAccessible@@@Z
?Register@HWNDElement@DirectUI@@SGJXZ
?GetWindowClassNameAndStyle@HWNDElement@DirectUI@@UAEXPAPBGPAI@Z
?WndProc@HWNDElement@DirectUI@@UAEJPAUHWND__@@IIJ@Z
?CreateStyleParser@HWNDElement@DirectUI@@UAEJPAPAVDUIXmlParser@2@@Z
?RemoveTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?ActivateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@K@Z
?UpdateTooltip@HWNDElement@DirectUI@@UAEXPAVElement@2@@Z
?OnCompositionChanged@HWNDElement@DirectUI@@UAEXXZ
?OnWmSettingChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnWmThemeChanged@HWNDElement@DirectUI@@UAEXIJ@Z
?OnGetDlgCode@HWNDElement@DirectUI@@UAEXPAUtagMSG@@PAJ@Z
?OnNoChildWithShortcutFound@HWNDElement@DirectUI@@UAEXPAUKeyboardEvent@2@@Z
?OnInput@HWNDElement@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnImmersiveColorSchemeChanged@HWNDElement@DirectUI@@UAEXXZ
?OnThemeChanged@HWNDElement@DirectUI@@UAEXPAUThemeChangedEvent@2@@Z
?OnEvent@HWNDElement@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDElement@DirectUI@@UAEXXZ
?OnGroupChanged@HWNDElement@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@HWNDElement@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?GetUiaFocusDelegate@Element@DirectUI@@UAEPAV12@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?GetUIAElementProvider@Element@DirectUI@@UAEJABU_GUID@@PAPAX@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?DoubleBuffered@Element@DirectUI@@QAEX_N@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?GetImmersiveFocusRectOffsets@Element@DirectUI@@UAEXPAUtagRECT@@@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?RemoveBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?AddBehavior@Element@DirectUI@@UAEJPAUIDuiBehavior@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?Destroy@Layout@DirectUI@@QAEXXZ
?Create@FillLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?LoadFromResource@DUIFactory@DirectUI@@QAEJPAUHINSTANCE__@@PBG1PAVElement@2@PAKPAPAV42@1@Z
??1DUIFactory@DirectUI@@QAE@XZ
?DestroyWindow@NativeHWNDHost@DirectUI@@QAEXXZ
?GetClassInfoW@HWNDElement@DirectUI@@UAEPAUIClassInfo@2@XZ
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ