�㵓��n�»�fY%�ƀo�L�28ޔ�o����En�ǹw�M@�,��, ������~/�^�y/0�D�?���Ν�B�������vq%g�+^�k��.�M�#0�:���ߙ�k�p��%�w]�T�: �ӧ��6_��� ���Z�_��k���Y������ň���D�@�#����d:qQ�5�D ��ٍ0j,N�φ��i�,���36i�m���}u��=���3� �I�n�ޫK��9���a٣ ���� �>��F� ��V6*�ktt��K�k!>vV�o��k�����+I�)T�E8��dݽC�R�c{:��xW����u�vc���P���h�����.&-��ABFv�����b�lXsOh�c�:]��6��<�[��^����x��-4����p�["����7���As(t�r)��������!�M#�$]{5�D%�M)�oh�32LQ�uy��p��'�g��sFNE�9���0�(�g�̘�eup%����-��Z]@݀�-34R���=�b�v�se��{KF����%W�������K�PQ��Q��7�H�am"��[�����qFX��z�qŝ�8����ո���>�-�ОD��BH���V�3�O8���n\������e{������]TZ��!vJ1���'t;�0x6���hFP��L���sj���D���E��B��9�����S�&�Z�7n���f��D>)zD��m��9fK���6�w�a�� Y��0Q����Ԥ���:@�/(�P�� v�B�_l�gw�d]8��2n+6b<��4�<�V��� �����Ꮾ��H���L ��7v3C�c}��bY8_�[�a%�B���_�T�LKv�����>xR1�}���U�D��&5=�$�x3�f�Lv[QC�Ut]�E�Õ#�X����O�����:G����UZ���ȉe-������z��A�J���]���D�����f�e�℻���RU����������ٍ��I�X����c�q�<�}�v[�yG������*���$#�����]{؝�W�v�v��V��k�[�{�`89���Z�J �|�<����i/n�"O�4���Uo�p+3����6W˹�Ɉ�@�p�4�LS�+٩Co霸Qc�H�������}�Γ��{1�j mPC~Ȁ��M#���*�i���Ov�� Tn<l=�3����s�Jė�����WȆ^,�i6��N�e6����ҷ:`���d�Є�#�1��(v��]��*����^�� 7�-��,ZF`���m�)Ʉsr��(�~��5�4B��M �/�D9��~a��J�;�=�O)}`�[�);���,��ՄV{�\��V��E������{K�o�d1���ާ����A����I��fW��8f^��a�$�p�L]��[�6B$�1̓=mҽ�>@��.���VG~�sX��<Q�J�/�鉐�,���\�D.��J�҃7~�$v� �ٻ>j��Cذ�4c\�.��zf�^���V���b�NU����7�C�юs��������aBU�vR+��)DS�ϗ����2�����h�A"�XEy_j��Y� �>���B��)��x�~Y5��!���P��>��z��c���gj1�u�.bg�V�kf�#H<�s����$a#TT������ �s� ̖���jV��� (|d�9V`<�1���jϸtX�d��Ž駕�3���q���9�]���R�0@������ù�d1'���b���S� ��P^�c�������(3�-4�؇!���l��[�c0����׆�� ��f��I��1�Xy$���7���H�ܓ(E���2���ʻ8r��d�/N�E'0�V�\�'�Z�+�ѐ���������;�Ȋ�-�J�gQo�v��O_ ����U�Kt���,�ϓo��_��US~��M?���b~(����Kx�����S#7�Di曠�>G���J��))���M:&ʼnt����m �K;A����Z�ѧ���W�GEY�jd��wP����&�rL`@����3e����N!_zUW�Z���vzv�t|�"���5�T�To���=3���n ��L嘚�!�f��}��t�5@ksӶ����o�4�o�GH�K��%Qo���M������Nx����a���T�inaFē�p��Plj�� mA,�i�������qQM�p�g�����s,5\Z`�\���ӯ��F�LQ��P���vGfX�?�.K�8��{��Kk����H&s#ا�h�q��z���'�S�aaR��][�Q� ���iZ%3Ǿw�u��J��M-�Nr��aOQGD_//���*ˏ���S����̝(�M:s�{:wte���;��Ϝ&�+��d;i��0�a���@�u�/}_��i���)�d�B�Ⱦ����`��kI7D!�wPk����է��-�hG�Zs�x��6�$�:F��W�P�*3SA:����5u�:��OY҃��G;�d�n���C^���i��9��q��|��eY|���(}}&�e �h�{�������~�S��O����eU�t��,G��W�[�`�uı�>?��Qj4b��%��7 ,|�CS�A��`���c����A+�e9�vf(��%�� 2�ܾ����n��ُM�0>�k���L2�r�u���Ü�E� $�|��Y��0N�dy��r3�yޓP�����rƔ��C�ٳ�j$���#ֹ�-�x܌N�0GQ�.g��2d�x5�K������J�����%ɠ���ZƮ�8^�ͷ�u��2Hp?���C b:萞���{O\���N����p���^�R�OoU5���o�(+���S�p���( L�K@�1��q"b�~�B$wT�r�9���a�ڛ�`a\��&�$�����G���m˷ry�ٺ�~y��;' �X�� �hB�O*��b���ӈ'�~��L��3}\H4��N���^�J��c����x֜i��Y�s������Sˇ���n)��4͒��Ԁa�\�R�.��>!��&����s����V�❥Q�����<��yy�d��(L�0��٣�0��]l1D�f�
Static task
static1
Behavioral task
behavioral1
Sample
mmc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
mmc.exe
Resource
win10v2004-20231215-en
General
-
Target
mmc.exe
-
Size
3.4MB
-
MD5
97dd1a23a0dfc98e6bdbc5a4331fc8b0
-
SHA1
74ca1c07ab765fb580d8b6bfb42080db2e0ddf04
-
SHA256
1e1d1aef41921e1359e7e050f4592979d6edfbfd5619b171d26d7043eaaa49dc
-
SHA512
7de4566161c8167122d3f6df5b4b07d9ff7149a69b476a4cca619f1556c5b4894c00a6559c32e816d4a0591285f0c82c120fe19d5dd2bdc20f842249ffd6dbaa
-
SSDEEP
98304:zKCaPBSnlHwmIlk959gPCVdwFvJF7cIne:zOSTV5fVdwFvD7He
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource mmc.exe
Files
-
mmc.exe.exe windows:5 windows x86 arch:x86
e35636f50e50d3f56a29db4bbdf8fbb9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSACleanup
winmm
mixerGetLineControlsW
version
VerQueryValueW
comctl32
ImageList_ReplaceIcon
psapi
GetModuleFileNameExW
wininet
InternetCloseHandle
kernel32
GetVersionExW
LocalAlloc
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
DestroyAcceleratorTable
gdi32
CreateDCW
comdlg32
CommDlgExtendedError
advapi32
UnlockServiceDatabase
shell32
DragQueryPoint
ole32
CoInitialize
oleaut32
GetActiveObject
Exports
Exports
Sections
.text Size: 644KB - Virtual size: 644KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 36KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
d 9L Size: 948KB - Virtual size: 948KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
n4&) Size: 164KB - Virtual size: 164KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
wHO= Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
GSC Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ