Overview
overview
10Static
static
3Windows11�...��.exe
windows7-x64
1Windows11�...��.exe
windows10-2004-x64
1data/DisableWD.bat
windows7-x64
10data/DisableWD.bat
windows10-2004-x64
10data/EnableWD.bat
windows7-x64
10data/EnableWD.bat
windows10-2004-x64
10data/MinSudo.exe
windows7-x64
1data/MinSudo.exe
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Windows11轻松设置.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
Windows11轻松设置.exe
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
data/DisableWD.bat
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
data/DisableWD.bat
Resource
win10v2004-20231025-en
Behavioral task
behavioral5
Sample
data/EnableWD.bat
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
data/EnableWD.bat
Resource
win10v2004-20231020-en
Behavioral task
behavioral7
Sample
data/MinSudo.exe
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
data/MinSudo.exe
Resource
win10v2004-20231023-en
General
-
Target
fd513a6113844fe77da976a2505136a7cca09326ad60ab6079071c789a25359a
-
Size
308KB
-
MD5
7dc8d2876e882e968a8737747865ada0
-
SHA1
b27bd3617df67ef5afa307c7b691f921b5fe43f7
-
SHA256
fd513a6113844fe77da976a2505136a7cca09326ad60ab6079071c789a25359a
-
SHA512
ad465e5f0233a0bcf1519b5fe2e81004d9e2d793fc362bcdcfe345af6a2ab2f08493a8ac92d10f79c140455108b9d27c6a0ab88b973350f065e0be7e152acccf
-
SSDEEP
6144:ijg5JVKsHuDNlCDwwkj81wm39eg5Tw1w1KEQ6iF:ijgvoRbwkI1weog5FJiF
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Windows11轻松设置.exe unpack001/data/MinSudo.exe
Files
-
fd513a6113844fe77da976a2505136a7cca09326ad60ab6079071c789a25359a.zip
-
Windows11轻松设置.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 351KB - Virtual size: 350KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 82KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
data/DisableWD.bat
-
data/EnableWD.bat
-
data/MinSudo.exe.exe windows:6 windows x64 arch:x64
67388bde455ae6efd14658691bba0416
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetThreadUILanguage
WaitForSingleObjectEx
LockResource
CloseHandle
FreeConsole
FindResourceExW
LoadResource
AttachConsole
GetCurrentDirectoryW
WriteConsoleW
GetProcessHeap
GetModuleHandleW
WideCharToMultiByte
SleepEx
GetTickCount
GetLastError
MultiByteToWideChar
OpenProcess
SetThreadUILanguage
GetModuleFileNameW
WriteFile
GetStdHandle
GetConsoleOutputCP
GetCurrentProcess
GetCommandLineW
SetLastError
HeapFree
SetConsoleCtrlHandler
HeapAlloc
SizeofResource
GetModuleHandleExW
FreeLibrary
ExitProcess
Sleep
GetProcAddress
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
CloseServiceHandle
OpenSCManagerW
SetTokenInformation
IsWellKnownSid
OpenProcessToken
SetThreadToken
StartServiceW
CreateProcessAsUserW
OpenServiceW
DuplicateTokenEx
QueryServiceStatusEx
GetTokenInformation
shell32
ShellExecuteExW
wtsapi32
WTSEnumerateProcessesW
WTSFreeMemory
WTSEnumerateSessionsW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
msvcrt
_environ
__argc
__argv
?_set_new_mode@@YAHH@Z
_commode
_msize
__getmainargs
realloc
free
malloc
_callnewh
_wcsnicmp
_wcsicmp
_amsg_exit
memset
__C_specific_handler
_CxxThrowException
strstr
wcsstr
__CxxFrameHandler3
__set_app_type
_XcptFilter
?terminate@@YAXXZ
_errno
strcpy_s
_initterm_e
_set_fmode
_initterm
memcpy
memcmp
memmove
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 176B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
data/readme.txt
-
data/smartscreen/disable.reg
-
data/smartscreen/restore.reg