wuauclt[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

wuauclt.exe
Size

1.8MB
MD5

4d45fa5dd472e526cdf376d077ebd61b
SHA1

61e8cd1e92549c404c3ad2570e98d81b563bcffd
SHA256

971e53c90306a7b13ac6ad1726360aab5dcab418839d4ed53735cbc1e2b40bcf
SHA512

a303326b80a3a778e6caa210c3baccab3619fa91fd3c5a89802a7072081a6ef093a18146e504321e14580b0b19635775b9648468961c1870ca084d137570849f
SSDEEP

49152:WOIU6iMGtlqfVwASO9Jj7v4+AHAoJK4dZhqZwdPrg:w+yKHDdXqwlg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
wuauclt.exe

Files

wuauclt.exe
.exe windows:6 windows x64 arch:x64

e28e4e32012deb9923a5cada46a7cbd9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WaitForMultipleObjects
CreateFileW
GetCurrentThreadId
Sleep
DeleteFileW
CloseHandle
LoadLibraryW
CreateThread
HeapAlloc
GetCurrentDirectoryW
Beep
GetProcAddress
GetCurrentProcessId
GetProcessHeap
IsDebuggerPresent
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetCurrentProcess
GetStdHandle
GetEnvironmentVariableW
GetFileType
GetModuleHandleW
DeleteFiber
TerminateProcess
RtlVirtualUnwind
QueryPerformanceCounter
GetSystemTimeAsFileTime
ConvertFiberToThread
WideCharToMultiByte
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
FreeLibrary
LoadLibraryA
FindClose
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
WriteFile
FindNextFileW
HeapFree
GetFileSizeEx
FindFirstFileW
MultiByteToWideChar
ReadFile

user32

ExitWindowsEx
GetWindowLongPtrW
SetWindowPos
UnhookWinEvent
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
MessageBoxW
SetWinEventHook
MessageBoxA

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
OpenProcessToken

winhttp

WinHttpCloseHandle
WinHttpReadData
WinHttpSendRequest
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpOpen
WinHttpReceiveResponse
WinHttpOpenRequest

shlwapi

StrCmpW
PathRemoveExtensionW
PathFindExtensionW

ws2_32

closesocket
WSASetLastError
send
recv
WSAGetLastError
WSACleanup

bcrypt

BCryptGenRandom

vcruntime140

memcmp
memcpy
memmove
memset
strchr
memchr
strrchr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
__current_exception_context
__current_exception
__C_specific_handler
strstr
wcsstr

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_invalid_parameter_noinfo
_register_onexit_function
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
raise
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
terminate
_get_initial_narrow_environment
_initialize_narrow_environment
strerror_s
_configure_narrow_argv
_errno
_crt_atexit
signal
_seh_filter_exe
_set_app_type

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fclose
__stdio_common_vfprintf
__stdio_common_vsscanf
fputs
__stdio_common_vsprintf
_set_fmode
feof
ferror
fflush
fgets
fopen
_wfopen
_fileno
__p__commode
fread
fseek
_setmode
fwrite
__stdio_common_vswprintf
ftell

api-ms-win-crt-heap-l1-1-0

free
realloc
malloc
_set_new_mode
_callnewh

api-ms-win-crt-string-l1-1-0

strcspn
isspace
_stricmp
_strnicmp
strspn
strncpy
strncmp
strcmp

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
atoi

api-ms-win-crt-time-l1-1-0

_time64
_gmtime64_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 457KB - Virtual size: 457KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e28e4e32012deb9923a5cada46a7cbd9

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

winhttp

shlwapi

ws2_32

bcrypt

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 457KB - Virtual size: 457KB

.data Size: 7KB - Virtual size: 21KB

.pdata Size: 47KB - Virtual size: 47KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 457KB - Virtual size: 457KB

.data
Size: 7KB - Virtual size: 21KB

.pdata
Size: 47KB - Virtual size: 47KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 19KB - Virtual size: 18KB