MediaCreationTool22H2[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

MediaCreationTool22H2.exe
Size

18.6MB
MD5

aa2ad37bb74c05a49417e3d2f1bd89ce
SHA1

1bf5f814ffe801b4e6f118e829c0d2821d78a60a
SHA256

690c8a63769d444fad47b7ddecee7f24c9333aa735d0bd46587d0df5cf15cde5
SHA512

fab34ccbefbcdcec8f823840c16ae564812d0e063319c4eb4cc1112cf775b8764fea59d0bbafd4774d84b56e08c24056fa96f27425c4060e12eb547c2ae086cc
SSDEEP

196608:MmtHa+5hH1km/Sf7byFXKEBmih9S5rQ5FNFl001p4Ki:Y+5RB/SDbyFBH9eQD/l00/4

Score

1^/10

Malware Config

Signatures

Files

MediaCreationTool22H2.exe
.exe windows:10 windows x86 arch:x86

d715fe1c9f60fa2c4d89588b638bb8e6

Code Sign

33:00:00:03:1a:2c:ba:73:4c:c5:c6:2c:9e:00:00:00:00:03:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-03-2020 18:29

Not After

03-03-2021 18:29

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06-07-2010 20:40

Not After

06-07-2025 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:b9:8b:9e:22:9d:2b:09:db:9a:a5:7b:11:6a:b9:66:e2:c2:ed:34:ed:f3:e6:2b:cc:35:ed:55:83:af:7e:26
Signer

Actual PE Digest

4a:b9:8b:9e:22:9d:2b:09:db:9a:a5:7b:11:6a:b9:66:e2:c2:ed:34:ed:f3:e6:2b:cc:35:ed:55:83:af:7e:26

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP

PDB Paths

SetupPrep.pdb

Imports

advapi32

GetTokenInformation
SetSecurityDescriptorGroup
RegQueryValueExW
OpenThreadToken
AddAccessAllowedAce
DuplicateTokenEx
SetSecurityDescriptorControl
GetLengthSid
RegDeleteValueW
CreateProcessAsUserW
RegOpenKeyExW
InitializeAcl
InitializeSecurityDescriptor
CheckTokenMembership
FreeSid
OpenProcessToken
RegSetValueExW
RegSetKeySecurity
CopySid
RegCreateKeyExW
RegFlushKey
AllocateAndInitializeSid
RegDeleteKeyW
SetTokenInformation
GetAce
SetSecurityDescriptorOwner
RegQueryInfoKeyW
RegEnumKeyW
RegCloseKey
RegNotifyChangeKeyValue
SetSecurityDescriptorDacl
GetTraceEnableLevel
AdjustTokenPrivileges
RegEnumValueW
InitiateSystemShutdownExW
SetSecurityInfo
RegUnLoadKeyW
QueryAllTracesW
GetTraceLoggerHandle
StopTraceW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableFlags

kernel32

DeleteFileW
CloseHandle
GetNativeSystemInfo
LoadLibraryW
FindResourceExW
ResetEvent
LoadResource
GetOverlappedResult
SetFilePointerEx
LocalFree
MoveFileExW
ReplaceFileW
LockFileEx
DeleteCriticalSection
GetCurrentProcessId
CreateProcessW
GetModuleHandleW
FreeLibrary
CopyFileW
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
GetSystemTime
DosDateTimeToFileTime
GetSystemWindowsDirectoryW
MoveFileW
IsWow64Process
GetDriveTypeW
LoadLibraryExW
FlushFileBuffers
LockResource
GetCurrentThread
SetEvent
CreateFileA
VerifyVersionInfoW
IsValidLocale
VerSetConditionMask
IsValidCodePage
MapViewOfFile
CreateFileMappingW
CreatePipe
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
SearchPathW
OutputDebugStringA
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetTickCount64
LocalFileTimeToFileTime
GetTimeZoneInformation
Sleep
GetExitCodeProcess
MultiByteToWideChar
CreateEventW
GetLogicalDriveStringsW
SetFileAttributesW
GetSystemDirectoryW
OpenEventW
GetFileAttributesW
CreateFileW
WaitForSingleObject
SetFilePointer
FindClose
CreateHardLinkW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetVersionExW
SetThreadPreferredUILanguages
GetLocaleInfoW
GetPrivateProfileIntW
InitializeCriticalSection
GlobalUnlock
GlobalLock
MulDiv
FindResourceW
SizeofResource
QueryDosDeviceW
RaiseException
DuplicateHandle
GetShortPathNameW
HeapSize
HeapReAlloc
IsDebuggerPresent
VirtualQuery
GetPriorityClass
GetThreadPriority
OutputDebugStringW
GetExitCodeThread
SetThreadPriority
SetPriorityClass
CreateThread
FormatMessageW
GetPrivateProfileSectionW
GetFileTime
FileTimeToSystemTime
CompareFileTime
CopyFileExW
SetFileInformationByHandle
GetFileInformationByHandle
DeviceIoControl
GetFileInformationByHandleEx
SetCurrentDirectoryW
GetCurrentDirectoryW
GetFinalPathNameByHandleW
GetLongPathNameW
SetLastError
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
SetEnvironmentVariableW
WaitForMultipleObjects
GetModuleFileNameW
SetFileTime
TerminateProcess
ExpandEnvironmentStringsW
WriteFile
GetCurrentProcess
FindNextFileW
GetFullPathNameW
GetCommandLineW
EnterCriticalSection
CompareStringW
GetFileSizeEx
FindFirstFileW
ReadFile
CreateDirectoryW
GetProcessHeap
GetProcAddress
HeapAlloc
GetModuleHandleExW
HeapFree
GetVersionExA
UnmapViewOfFile

user32

GetKeyState
GetFocus
IsChild
GetNextDlgTabItem
GetWindowLongW
RedrawWindow
CopyRect
DrawFocusRect
SetWindowLongW
SystemParametersInfoW
GetDC
GetSysColor
GetClientRect
GetParent
InvalidateRect
LoadStringW
PostMessageW
GetSystemMenu
GetSysColorBrush
ClientToScreen
GetSystemMetrics
IsWindowVisible
FillRect
AdjustWindowRectEx
SetCursor
LoadCursorW
TrackMouseEvent
EnableWindow
EnableMenuItem
DrawTextW
CharUpperW
GetWindowRect
MessageBoxW
ScreenToClient
SendMessageW
SetTimer
PostThreadMessageW
KillTimer
LoadImageW

mfc42u

ord4470
ord4282
ord3084
ord3870
ord2634
ord5977
ord5047
ord543
ord2385
ord1106
ord3614
ord2388
ord817
ord803
ord3579
ord3341
ord5296
ord5299
ord4074
ord4693
ord5303
ord5285
ord4118
ord5711
ord3949
ord565
ord268
ord3397
ord6051
ord4294
ord4279
ord1633
ord323
ord6153
ord640
ord5781
ord470
ord755
ord3568
ord521
ord1571
ord6466
ord600
ord269
ord826
ord3621
ord2406
ord1560
ord4418
ord4616
ord4075
ord3074
ord3820
ord3826
ord3825
ord2971
ord3076
ord2980
ord3257
ord3131
ord4459
ord3254
ord3142
ord2977
ord1202
ord1940
ord6433
ord4221
ord1165
ord3716
ord795
ord2294
ord609
ord1131
ord3658
ord540
ord861
ord2820
ord800
ord4704
ord4992
ord4847
ord4419
ord1767
ord6048
ord5261
ord3133
ord567
ord5273
ord2116
ord2438
ord5257
ord1720
ord6195
ord6193
ord6211
ord5059
ord3744
ord6372
ord2047
ord2640
ord4435
ord4831
ord3793
ord5286
ord4347
ord6370
ord5157
ord2377
ord5237
ord4401
ord818
ord1768
ord4073
ord4621
ord2858
ord2637
ord4155
ord4229
ord1143
ord1808
ord324
ord2078
ord2161
ord3952
ord2506
ord4370
ord641
ord5276
ord3000
ord3087
ord329
ord5978
ord3196
ord4131
ord643
ord1787
ord2567
ord4390
ord3915
ord2372
ord4162
ord2371
ord3871
ord2859
ord3792
ord6278
ord6279
ord5871
ord2397
ord2854
ord1921
ord4270
ord1634
ord2855
ord6303

msvcrt

iswspace
bsearch
__CxxFrameHandler3
__setusermatherr
__p__fmode
_cexit
_exit
realloc
_errno
_wtoi
free
towlower
_wcstoui64
wcstoul
towupper
_vscwprintf
_vsnprintf
_wcsicmp
wcsrchr
exit
wcsncmp
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wcsnicmp
wcsstr
wcschr
_purecall
_vsnwprintf
memcpy_s
_CxxThrowException
__RTDynamicCast
_ftol2
memcmp
memcpy
_initterm
_wcmdln
memmove
_except_handler4_common
_controlfp
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
memset

comctl32

InitCommonControlsEx

ole32

CoUninitialize
CoCreateInstance
CoInitializeEx

shell32

CommandLineToArgvW

ntdll

NtSetInformationThread
NtShutdownSystem
RtlAllocateHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlDosPathNameToNtPathName_U_WithStatus
RtlFreeHeap
NtWriteFile
RtlInitUnicodeString
NtReadFile
RtlReAllocateHeap
NtClose
RtlExpandEnvironmentStrings
NtQueryInformationFile
NtWaitForSingleObject
NtOpenFile
NtDuplicateToken
RtlGetVersion
RtlRaiseStatus
NtYieldExecution
RtlAdjustPrivilege
NtSetInformationProcess

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

wtsapi32

WTSQueryUserToken

wdscore

WdsSetupLogMessageW
ConstructPartialMsgVW
WdsGenericSetupLogInit
CurrentIP
WdsSetupLogDestroy

rpcrt4

I_RpcMapWin32Status
UuidToStringW
RpcStringFreeW
UuidFromStringW

gdi32

CreateICW
CreateSolidBrush
DeleteObject
DeleteDC
StretchBlt
CreateCompatibleDC
BitBlt
SetBrushOrgEx
SetBkMode
GetStockObject
GetObjectW
GetDeviceCaps
CreateFontIndirectW
CreateDIBSection
TranslateCharsetInfo
CreateDCW
EnumFontFamiliesExW
SetTextColor

cabinet

ord23
ord20
ord22

oleaut32

VariantInit
VariantClear
SysFreeString
SysAllocString

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

wimgapi

WIMUnmountImage
WIMInitFileIOCallbacks
WIMSetFileIOCallbackTemporaryPath

bcrypt

BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptCreateHash

uxtheme

IsAppThemed

Sections

.text
Size: 479KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.boxload
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 10.5MB - Virtual size: 10.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d715fe1c9f60fa2c4d89588b638bb8e6

Code Sign

33:00:00:03:1a:2c:ba:73:4c:c5:c6:2c:9e:00:00:00:00:03:1aCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

4a:b9:8b:9e:22:9d:2b:09:db:9a:a5:7b:11:6a:b9:66:e2:c2:ed:34:ed:f3:e6:2b:cc:35:ed:55:83:af:7e:26Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

mfc42u

msvcrt

comctl32

ole32

shell32

ntdll

userenv

wtsapi32

wdscore

rpcrt4

gdi32

cabinet

oleaut32

version

wimgapi

bcrypt

uxtheme

Sections

.text Size: 479KB - Virtual size: 478KB

.data Size: 3KB - Virtual size: 12KB

.idata Size: 11KB - Virtual size: 10KB

.boxload Size: 512B - Virtual size: 64B

.rsrc Size: 10.5MB - Virtual size: 10.5MB

.reloc Size: 26KB - Virtual size: 25KB

33:00:00:03:1a:2c:ba:73:4c:c5:c6:2c:9e:00:00:00:00:03:1a
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

4a:b9:8b:9e:22:9d:2b:09:db:9a:a5:7b:11:6a:b9:66:e2:c2:ed:34:ed:f3:e6:2b:cc:35:ed:55:83:af:7e:26
Signer

.text
Size: 479KB - Virtual size: 478KB

.data
Size: 3KB - Virtual size: 12KB

.idata
Size: 11KB - Virtual size: 10KB

.boxload
Size: 512B - Virtual size: 64B

.rsrc
Size: 10.5MB - Virtual size: 10.5MB

.reloc
Size: 26KB - Virtual size: 25KB