MBSetup[.]exe | Triage™

Resubmissions

09/04/2024, 21:46

240409-1mw8pagc5w

09/04/2024, 21:43

240409-1k3mpacg598

Sharing

Copy URL Twitter E-mail

General

Target
MBSetup.exe
Size 2.5MB
Sample240409-1k3mpacg59
SHA256 74b0bf9c17091ab1c6c61af0aefbc599f1ecc0fff6dee0144a3dfd5cd1f5e18f
MD5 b6d8b7e6f74196f62caba2ca77a7ae91
SHA1 6ac9c99f084b5772440e2f135b8d5365f7f45314
SHA512 ad58bc7b626a13606e3f44df7188b2420e0f31ecb55632eac4b6a05dc1574f1ec1b0ef6b52e11832713c6f8f91c807fe3a815699d0748284993ecc54f2823044
SSDEEP 49152:/5wZat2ranBQjvaq/Gtl8StQyfvE0Z3R0nxiIq2ddBzOnX:/5wZauUBQjvL0SKtQRq2cnX
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

MBSetup.exe

.exe 2.5MB

MBSetup.exe

IMPHASH 63ccd71a76a39a85385ce6d1810f26c1
SHA256 74b0bf9c17091ab1c6c61af0aefbc599f1ecc0fff6dee0144a3dfd5cd1f5e18f
MD5 b6d8b7e6f74196f62caba2ca77a7ae91
SHA1 6ac9c99f084b5772440e2f135b8d5365f7f45314
SHA512 ad58bc7b626a13606e3f44df7188b2420e0f31ecb55632eac4b6a05dc1574f1ec1b0ef6b52e11832713c6f8f91c807fe3a815699d0748284993ecc54f2823044
SSDEEP 49152:/5wZat2ranBQjvaq/Gtl8StQyfvE0Z3R0nxiIq2ddBzOnX:/5wZauUBQjvL0SKtQRq2cnX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Password

ffff

PE Signature issue

Digest

b7:4d:c0:1a:bb:9f:bd:34:4f:89:6b:ee:54:c7:59:61:5d:3f:64:80:e9:36:00:5d:34:e4:13:71:b6:ea:1f:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Chains

Mar 19, 2024

Digest

b7:4d:c0:1a:bb:9f:bd:34:4f:89:6b:ee:54:c7:59:61:5d:3f:64:80:e9:36:00:5d:34:e4:13:71:b6:ea:1f:46

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Chains

Mar 19, 2024

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Malwarebytes Inc.,O=Malwarebytes Inc.,ST=California,C=US

Serial Number

a6:57:f7:78:b3:1a:e5:23:d6:67:13:17:18:d1:6e:b2

Issuer

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 23, 2022 - Mar 16, 2025

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

01:fd:6d:30:fc:a3:ca:51:a8:1b:bc:64:0e:35:03:2d

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Feb 1, 2010 - Jan 18, 2038

Subject

CN=Sectigo RSA Code Signing CA 2,O=Sectigo Limited,C=GB

Serial Number

9e:02:b0:e9:4a:ce:b2:10:9c:a1:e9:83:6b:e0:c2:db

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 25, 2021 - May 24, 2036

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Serial Number

33:00:00:5b:d3:8b:1a:26:bb:49:fb:e5:ca:00:00:00:00:5b:d3

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 19, 2024 - Mar 22, 2024

Subject

CN=Malwarebytes Inc,O=Malwarebytes Inc,L=Santa Clara,ST=CA,C=US

Serial Number

33:00:00:5b:d3:8b:1a:26:bb:49:fb:e5:ca:00:00:00:00:5b:d3

Issuer

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 19, 2024 - Mar 22, 2024

Subject

CN=Microsoft ID Verified CS EOC CA 02,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:fb:7a:5c:32:13:61:df:5d:00:00:00:00:00:05

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

454254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Jenkins\workspace\MBAM-Windows\A_MB5_MBSetup\bin\Win32\Release\MBSetup.pdb

kernel32

LeaveCriticalSection RaiseException EnterCriticalSection GetLastError MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW GetModuleFileNameW InitializeCriticalSectionEx DeleteCriticalSection IsWow64Process GetCurrentProcess VerifyVersionInfoW VerSetConditionMask GetSystemDirectoryW CreateFileW DeviceIoControl CloseHandle GetCurrentThreadId SetLastError Sleep DeleteFileW GlobalFree LockResource FindResourceExW LocalFree FormatMessageW LocalAlloc CallNamedPipeW GetWindowsDirectoryW SetCurrentDirectoryW GetCommandLineW lstrcmpiW CreateMutexW GetNativeSystemInfo GetDiskFreeSpaceExW FindFirstFileW FindClose CreateProcessW FindNextFileW WideCharToMultiByte GlobalAlloc GlobalLock SetThreadUILanguage LoadLibraryW CreateDirectoryW GetLogicalDrives GetTempPathW MoveFileExW InitializeProcThreadAttributeList UpdateProcThreadAttribute DeleteProcThreadAttributeList OpenProcess ResumeThread TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentDirectoryW GetCurrentProcessId GetModuleFileNameA OutputDebugStringW SetEndOfFile WriteConsoleW SetStdHandle GetProcAddress GetModuleHandleW FreeLibrary GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize HeapDestroy DecodePointer MulDiv SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW FindFirstFileExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW AreFileApisANSI CopyFileW DuplicateHandle WaitForSingleObjectEx SwitchToThread GetCurrentThread QueryPerformanceCounter TryEnterCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree SetEvent ResetEvent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA GetVersionExW ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx RtlUnwind ExitProcess GetModuleHandleExW GetCommandLineA ExitThread GetStdHandle WriteFile GetFileType FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile SetFilePointerEx GetFileSizeEx GetDateFormatW

dwmapi

DwmGetWindowAttribute

crypt32

CryptMsgClose CertCloseStore CertFreeCertificateContext CertGetNameStringW CertFindCertificateInStore CryptMsgGetParam CryptQueryObject

rpcrt4

UuidToStringW RpcStringFreeW UuidCreate

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

MBSetup.exe

PE Signature issue

kernel32

dwmapi

crypt32

rpcrt4

generic