fsutil[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fsutil.exe
Size

168KB
MD5

88b58eb5d891632f6842a07ec568bb34
SHA1

909ec5311670660e9a872aaa5029baea564ee442
SHA256

91dbd74be3db47c8d804706a1b12aecf8abf644841c6a2d2d86cb210714913cc
SHA512

f784cfbf3a3c65eb9f3a504b5482b11ef7295de2d09ae1d72f7c188013e4c6f63ae882dfd2084ed6640113f88e522d16b4f0782f53bd5e15d6aede19462ec62b
SSDEEP

3072:Uy9I5r191VQywBx8RqpmbbzKrnBH/qkEI1BRlL+rqsWonREe+:m191VBSKY23ACcBRlL+rqsWs0

Score

1^/10

Malware Config

Signatures

Files

fsutil.exe
.exe windows:10 windows x86 arch:x86

841afaa35e86115b5773d0e216d73544

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:30:e2:ed:66:16:7b:26:92:3c:11:6a:d2:ec:1b:3f:5b:65:54:6d:51:6e:2d:b6:cc:45:4a:5c:d4:59:8d:72
Signer

Actual PE Digest

5e:30:e2:ed:66:16:7b:26:92:3c:11:6a:d2:ec:1b:3f:5b:65:54:6d:51:6e:2d:b6:cc:45:4a:5c:d4:59:8d:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

fsutil.pdb

Imports

msvcrt

memcpy
_local_unwind4
memmove
wcschr
_controlfp
?terminate@@YAXXZ
_except_handler4_common
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
__set_app_type
_amsg_exit
__p__commode
wcstol
wcstok_s
_wcstoui64
wcstoul
iswctype
_errno
exit
_wcsdup
wcsncpy_s
memcpy_s
wcscpy_s
realloc
towupper
_wtoi
wcsrchr
wcscat_s
isalpha
isdigit
_wcsicmp
toupper
__wgetmainargs
setlocale
calloc
_vsnwprintf
wprintf
swprintf_s
malloc
free
_wcsnicmp
_XcptFilter
memset

ntdll

NtClose
RtlVerifyVersionInfo
VerSetConditionMask
NtQuerySystemInformation
RtlTimeToTimeFields
RtlStringFromGUID
NtEnumerateTransactionObject
RtlGetOwnerSecurityDescriptor
RtlAllocateHeap
NtQuerySecurityObject
RtlInitializeCriticalSection
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
NtCreateFile
RtlFreeHeap
NtFlushBuffersFileEx
RtlSetCurrentTransaction
RtlGetCurrentTransaction
NtSetQuotaInformationFile
NtQueryQuotaInformationFile
RtlLengthSid
NtSetVolumeInformationFile
NtOpenFile
RtlInitUnicodeString
NtQueryVolumeInformationFile
NtQueryEaFile
NtQueryInformationFile
RtlNtStatusToDosError
NtSetInformationFile
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlDosPathNameToNtPathName_U

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

api-ms-win-core-file-l1-1-0

GetFinalPathNameByHandleW
WriteFile
GetVolumeInformationW
GetVolumePathNameW
SetFilePointerEx
QueryDosDeviceW
DeleteFileW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
GetFileSizeEx
GetDiskFreeSpaceExW
FindFirstFileW
FindNextFileW
GetLogicalDriveStringsW
GetDriveTypeW
GetFileInformationByHandle
SetEndOfFile
FindClose
GetTempFileNameW
GetFileType
CreateDirectoryW
GetFileAttributesW
CreateFileW
GetFullPathNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetComputerNameExW
GetSystemDirectoryW
GetTickCount
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExA
GetModuleFileNameA

api-ms-win-security-base-l1-1-0

FreeSid
CheckTokenMembership
AdjustTokenPrivileges
AllocateAndInitializeSid

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
CreateProcessW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW

api-ms-win-core-com-l1-1-0

StringFromGUID2
IIDFromString
CoTaskMemFree
StringFromIID

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
SetThreadUILanguage
FormatMessageW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-0

CreateHardLinkW
GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-file-l1-2-2

FindFirstFileNameW
FindNextFileNameW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSetInformation
HeapFree
GetProcessHeap

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW
LookupAccountNameLocalW

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
WaitForSingleObject
ReleaseSRWLockExclusive

api-ms-win-core-console-l1-1-0

GetConsoleMode
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleOutputCP

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
GetStdHandle
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
GetTempPathW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-lsapolicy-l1-1-0

LsaOpenPolicy
LsaFreeMemory
LsaLookupSids

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventProviderEnabled
EventRegister

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

841afaa35e86115b5773d0e216d73544

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

5e:30:e2:ed:66:16:7b:26:92:3c:11:6a:d2:ec:1b:3f:5b:65:54:6d:51:6e:2d:b6:cc:45:4a:5c:d4:59:8d:72Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-heap-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-localization-l2-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-memory-l1-1-0

Sections

.text Size: 136KB - Virtual size: 136KB

.data Size: 4KB - Virtual size: 5KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 60B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

5e:30:e2:ed:66:16:7b:26:92:3c:11:6a:d2:ec:1b:3f:5b:65:54:6d:51:6e:2d:b6:cc:45:4a:5c:d4:59:8d:72
Signer

.text
Size: 136KB - Virtual size: 136KB

.data
Size: 4KB - Virtual size: 5KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 60B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB