CredentialEnrollmentManager[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

CredentialEnrollmentManager.exe
Size

404KB
MD5

0d2b9dbbb4402c047ac4c760077c2dbd
SHA1

9cf16a5d8829e4f053e6f1aa7bc6123103e17cb1
SHA256

742ec1e4e0887f4d2b86b82a03d27bc508e165cd4e67953129bb5e4ccf4efacc
SHA512

f4982cb8f647ce5a3a19ae612056dd9934386a48edc9ce043fdbca28895d04baf3b04a9e150d4db326ced9460cc30dca6fd06c682359982e0e3c653852fbb782
SSDEEP

12288:bJqwpDQkr1gM4RIaRPoVNo2lK7vxdqcbZ:LpEu1B4qaRPoVNo2sJdq6Z

Score

1^/10

Malware Config

Signatures

Files

CredentialEnrollmentManager.exe
.exe windows:10 windows x64 arch:x64

98dd386d52673a05579ded997d0be5fa

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:76:b4:d2:43:c6:d6:a8:e5:e8:08:fa:b9:a5:76:74:c0:25:7b:45:9f:0e:c6:77:0c:da:c0:7c:0a:93:f6:fc
Signer

Actual PE Digest

b5:76:b4:d2:43:c6:d6:a8:e5:e8:08:fa:b9:a5:76:74:c0:25:7b:45:9f:0e:c6:77:0c:da:c0:7c:0a:93:f6:fc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_register_thread_local_exe_atexit_callback
_initterm_e
_c_exit

api-ms-win-crt-private-l1-1-0

_o__get_errno
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
memmove
_o_ceilf
_o_exit
_o_free
_o_malloc
_o_memcpy_s
_o_terminate
__C_specific_handler
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
wcschr
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

LoadResource
LockResource
GetModuleHandleW
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
FindResourceExW

api-ms-win-core-synch-l1-1-0

OpenSemaphoreW
EnterCriticalSection
CreateMutexExW
CreateEventExW
CreateSemaphoreExW
InitializeCriticalSectionEx
ReleaseSemaphore
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeSRWLock
LeaveCriticalSection
OpenEventW
ResetEvent
TryAcquireSRWLockExclusive
CreateEventW
InitializeCriticalSectionAndSpinCount
SetEvent
DeleteCriticalSection
WaitForSingleObjectEx
ReleaseMutex
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

api-ms-win-core-heap-l1-1-0

HeapFree
HeapAlloc
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
OpenProcessToken
TerminateProcess
GetCurrentThread
GetStartupInfoW
OpenThreadToken
GetCurrentProcess
GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation
EventActivityIdControl

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-service-core-l1-1-0

SetServiceStatus
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW

api-ms-win-core-winrt-l1-1-0

RoRevokeActivationFactories
RoRegisterActivationFactories
RoGetActivationFactory
RoActivateInstance
RoUninitialize
RoInitialize

api-ms-win-core-com-l1-1-0

CoCreateInstance
CoGetInterfaceAndReleaseStream
CoInitializeSecurity
CoMarshalInterface
CoAddRefServerProcess
CoReleaseMarshalData
CoReleaseServerProcess
CoRevokeClassObject
CoResumeClassObjects
CoRegisterClassObject
CoDecrementMTAUsage
CreateStreamOnHGlobal
PropVariantClear
CoTaskMemAlloc
CoWaitForMultipleHandles
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoDisconnectContext
CoTaskMemRealloc

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError
RoOriginateErrorW
SetRestrictedErrorInfo
GetRestrictedErrorInfo
RoTransformError

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW

api-ms-win-security-base-l1-1-0

GetLengthSid
GetTokenInformation
CopySid
MakeAbsoluteSD
CheckTokenMembership

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference
WindowsCreateString
WindowsStringHasEmbeddedNull
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsDeleteString
WindowsIsStringEmpty
WindowsCompareStringOrdinal

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount64
GetComputerNameExW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

combase

ord69
ord68
ord66
ord67

msvcp_win

_Mtx_destroy_in_situ
_Cnd_register_at_thread_exit
_Cnd_timedwait
_Mtx_init_in_situ
?__ExceptionPtrCreate@@YAXPEAX@Z
?_Throw_Cpp_error@std@@YAXH@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
_Query_perf_counter
_Query_perf_frequency
_Xtime_get_ticks
_Cnd_unregister_at_thread_exit
_Mtx_lock
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
_Mtx_unlock
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Cnd_wait
_Mtx_current_owns

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegGetValueW
RegQueryValueExW

api-ms-win-core-com-l1-1-1

RoGetAgileReference

api-ms-win-core-winrt-error-l1-1-1

IsErrorPropagationEnabled
RoReportFailedDelegate
RoGetMatchingRestrictedErrorInfo

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

oleaut32

SafeArrayGetLBound
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayAccessData
SafeArrayDestroy
SafeArrayGetVartype
SafeArrayGetElemsize
SafeArrayGetDim
SafeArrayGetUBound

ntdll

RtlCompareUnicodeString
NtQueryInformationToken
RtlNtStatusToDosErrorNoTeb
RtlInitUnicodeString
RtlFreeHeap
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlIsMultiSessionSku
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlIsMultiUsersInSessionSku
RtlAllocateHeap
RtlInitString

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedFileLocationW
GetPersistedRegistryLocationW

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics

api-ms-win-security-lsalookup-l1-1-2

LsaLookupUserAccountType

api-ms-win-core-sysinfo-l2-1-0

GetUserNameW

api-ms-win-shcore-sysinfo-l1-1-0

IsOS

sspicli

LsaDeregisterLogonProcess
LsaCallAuthenticationPackage
LsaLookupAuthenticationPackage
LsaConnectUntrusted
LogonUserExExW
LsaFreeReturnBuffer

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaFreeMemory
LsaOpenPolicy
LsaLookupSids

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrChrW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-rtcore-ntuser-private-l1-1-0

GetWindowBand

api-ms-win-rtcore-ntuser-window-l1-1-0

GetWindowThreadProcessId
GetPropW

api-ms-win-core-atoms-l1-1-0

GlobalGetAtomNameW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 260KB - Virtual size: 259KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

98dd386d52673a05579ded997d0be5fa

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

b5:76:b4:d2:43:c6:d6:a8:e5:e8:08:fa:b9:a5:76:74:c0:25:7b:45:9f:0e:c6:77:0c:da:c0:7c:0a:93:f6:fcSigner

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

combase

msvcp_win

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-shcore-taskpool-l1-1-0

oleaut32

ntdll

api-ms-win-core-heap-l2-1-0

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-ntuser-sysparams-l1-1-0

api-ms-win-security-lsalookup-l1-1-2

api-ms-win-core-sysinfo-l2-1-0

api-ms-win-shcore-sysinfo-l1-1-0

sspicli

api-ms-win-core-apiquery-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-rtcore-ntuser-private-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-atoms-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 260KB - Virtual size: 259KB

.rdata Size: 92KB - Virtual size: 88KB

.data Size: 4KB - Virtual size: 5KB

.pdata Size: 20KB - Virtual size: 16KB

.didat Size: 4KB - Virtual size: 448B

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

b5:76:b4:d2:43:c6:d6:a8:e5:e8:08:fa:b9:a5:76:74:c0:25:7b:45:9f:0e:c6:77:0c:da:c0:7c:0a:93:f6:fc
Signer

.text
Size: 260KB - Virtual size: 259KB

.rdata
Size: 92KB - Virtual size: 88KB

.data
Size: 4KB - Virtual size: 5KB

.pdata
Size: 20KB - Virtual size: 16KB

.didat
Size: 4KB - Virtual size: 448B

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB