Windows11InstallationAssistant (1)[.]exe

Resubmissions

25/03/2024, 18:47

240325-xfajkaae3y1

25/03/2024, 18:47

25/03/2024, 18:46

25/03/2024, 18:42

25/03/2024, 18:40

Sharing

Copy URL Twitter E-mail

General

Target
Windows11InstallationAssistant (1).exe
Size 4.0MB
Sample240325-xcrcxaff37
SHA256 03a9b3163071ecb41e20b95eb664c3165b9fcaba89f5e5433484d65e8cfa0380
MD5 9efe0c8b7f96c1a7d5bdd52bf07d009d
SHA1 dc6ff2f1c0af472cdc81b05f876c10420a6bbb78
SHA512 b66772e1faeff8c607b6624106530945997fe2105569cbf92cf0eaa31f7bd02ed46b74bae6e9d79b6f51da76445564ed73fe9eb2a6507e3ce5d543781ba227fb
SSDEEP 98304:Fguv/rctyMh4cCE3p8fuCNCzLX/sA2uQqvAVGht5f/LyXtcH//9:SVtyMh9CVPUDk+4QjyXa
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Windows11InstallationAssistant (1).exe

.exe 4.0MB

Windows11InstallationAssistant (1).exe

IMPHASH 007db55b0c9d2f882a812da02400b3b4
SHA256 03a9b3163071ecb41e20b95eb664c3165b9fcaba89f5e5433484d65e8cfa0380
MD5 9efe0c8b7f96c1a7d5bdd52bf07d009d
SHA1 dc6ff2f1c0af472cdc81b05f876c10420a6bbb78
SHA512 b66772e1faeff8c607b6624106530945997fe2105569cbf92cf0eaa31f7bd02ed46b74bae6e9d79b6f51da76445564ed73fe9eb2a6507e3ce5d543781ba227fb
SSDEEP 98304:Fguv/rctyMh4cCE3p8fuCNCzLX/sA2uQqvAVGht5f/LyXtcH//9:SVtyMh9CVPUDk+4QjyXa
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x86 arch:x86

PE Signature issue

Digest

fd:7c:7c:63:da:57:ad:02:42:27:2d:51:8f:c5:8c:a2:2e:12:d4:8a:94:20:12:26:49:95:4a:80:3f:e5:0b:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Mar 22, 2024

Minor OS version

Major OS version

Entry point

465536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

upgraderstub.pdb

advapi32

EnableTraceEx2 RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW QueryTraceW EventUnregister ControlTraceW RegOpenKeyExW RegSetValueExW RegSetKeySecurity EventSetInformation RegCreateKeyExW RegDeleteKeyW EventRegister EventWriteTransfer RegCloseKey StartTraceW GetSecurityDescriptorDacl AdjustTokenPrivileges OpenProcessToken GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorSacl GetSecurityDescriptorControl GetSecurityDescriptorLength GetAclInformation RevertToSelf OpenEncryptedFileRawW WriteEncryptedFileRaw CloseEncryptedFileRaw

kernel32

GetVolumePathNamesForVolumeNameW TlsSetValue TlsGetValue TlsFree TlsAlloc WaitForMultipleObjectsEx GlobalMemoryStatusEx GetVolumeInformationByHandleW UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateSemaphoreW WaitForMultipleObjects GetPrivateProfileSectionW UnlockFileEx LockFileEx InitializeCriticalSectionAndSpinCount CreateEventW GetVolumeInformationW GetCurrentThread SetThreadIdealProcessor GetSystemInfo GetOverlappedResult GetHandleInformation DeleteCriticalSection LocalFree CreateThread GlobalFree DeleteFileW InitOnceComplete GetExitCodeThread GetFileAttributesW LocalAlloc CreateMutexW GetTempPathW InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW GetFullPathNameW GetCommandLineW EnterCriticalSection SetDefaultDllDirectories CompareStringW WritePrivateProfileStringW InitOnceBeginInitialize CreateDirectoryW IsDebuggerPresent DebugBreak GetModuleHandleW GetProcessHeap GetCurrentProcessId CreateMutexExW GetProcAddress HeapAlloc CloseHandle OpenSemaphoreW WaitForSingleObjectEx OutputDebugStringW GetLastError FormatMessageW ReleaseMutex GetCurrentThreadId WaitForSingleObject GetModuleHandleExW ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW GetModuleFileNameA Sleep GetStartupInfoW SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount GetFileInformationByHandleEx FindFirstFileW FindNextFileW DeviceIoControl FindClose CreateFileW SetFileAttributesW GetFileInformationByHandle SetFileInformationByHandle CopyFileExW FlushFileBuffers GetFileSizeEx GetCurrentDirectoryW FreeLibrary LoadLibraryExW GetLongPathNameW GetFinalPathNameByHandleW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetDriveTypeW GetEnvironmentVariableW SetEvent ResetEvent WideCharToMultiByte MultiByteToWideChar RemoveDirectoryW CreateFileA GlobalAlloc SetFilePointerEx ReadFile WriteFile SetFilePointer HeapReAlloc HeapSize GetShortPathNameW SetEndOfFile DuplicateHandle SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime OpenProcess OpenMutexW LoadLibraryW GetTempFileNameW MoveFileW VerifyVersionInfoW UnhandledExceptionFilter VerSetConditionMask

user32

LoadStringW CharUpperW MessageBoxW

msvcrt

memcmp strcpy_s memcpy memmove _wcsicmp wcsrchr _wcsnicmp iswspace towupper _vscwprintf qsort _except_handler4_common _controlfp ??1type_info@@UAE@XZ ?terminate@@YAXXZ _onexit __dllonexit _unlock _lock _acmdln _initterm __setusermatherr _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter _CxxThrowException sprintf_s memmove_s wcschr ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _purecall iswdigit wcsnlen _vsnprintf_s ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1exception@@UAE@XZ memcpy_s _vsnwprintf __CxxFrameHandler3 swscanf_s wcsncmp wcsstr memset

ole32

CoInitialize CoTaskMemFree CoUninitialize

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

shell32

CommandLineToArgvW ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW StrStrIW PathFindFileNameW

cabinet

ord22 ord20 ord23

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ntdll

NtYieldExecution NtQueryInformationFile RtlAdjustPrivilege RtlGetLastNtStatus RtlSetControlSecurityDescriptor RtlFindAceByType NtSetSecurityObject NtQueryVolumeInformationFile NtQueryInformationProcess RtlDosPathNameToNtPathName_U NtCreateFile NtClose RtlInitializeResource RtlAcquireResourceExclusive RtlAcquireResourceShared RtlReleaseResource RtlDeleteResource RtlImpersonateSelf NtSetEaFile DbgPrintEx RtlFreeHeap RtlAllocateHeap RtlNtStatusToDosError NtSetInformationFile RtlReAllocateHeap RtlRaiseStatus

psapi

GetModuleFileNameExW EnumProcesses

bcrypt

BCryptCreateHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty