IESettingSync.pdb
Static task
static1
Behavioral task
behavioral1
Sample
IESettingSync.exe
Resource
win10v2004-20240412-en
General
-
Target
IESettingSync.exe
-
Size
584KB
-
MD5
648ef2046d6957414b5e2cbf7ed90dca
-
SHA1
3fcbc19dbedfd9c36ccb0470117f0000dac9a2a1
-
SHA256
9047ed31c39d14b08b624a82376a523531a7e3808d233cb545ecb598fd9fc928
-
SHA512
582d999bad999bcef94734b5aa3e12195ec2096345b6e5844b0653a4ceedab02807a82334221b5b8e8efb44462a36a75422de45c0a958ec35f576e8d6d4baf9d
-
SSDEEP
12288:14VylLlrvIkGodeNSFADplDQMJMpsPFcsi3manDvFv3:iVylLlrvIkGodcSFAzDQMJMpsPGs4jDR
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource IESettingSync.exe
Files
-
IESettingSync.exe.exe windows:10 windows x64 arch:x64
4a0135d4eae5ebc76178da56c7202f90
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
advapi32
EventUnregister
EventSetInformation
EventRegister
EventWriteEx
OpenProcessToken
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetSecurityInfo
GetSecurityInfo
kernel32
HeapAlloc
GetProcAddress
CreateMutexExW
AcquireSRWLockShared
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
GetSystemTimeAsFileTime
DebugBreak
IsDebuggerPresent
FormatMessageW
RaiseException
ResolveDelayLoadedAPI
HeapReAlloc
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateThreadpoolTimer
ReleaseSRWLockShared
Sleep
CreateEventW
OutputDebugStringW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
WaitForThreadpoolTimerCallbacks
InitializeCriticalSectionEx
CreateMutexW
SetThreadpoolTimer
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
CloseThreadpoolTimer
AcquireSRWLockExclusive
LeaveCriticalSection
ReleaseSRWLockExclusive
DelayLoadFailureHook
WaitForMultipleObjects
GetModuleHandleExW
ReleaseSemaphore
EnterCriticalSection
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
GetLastError
msvcp_win
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
_Cnd_destroy_in_situ
_Cnd_broadcast
_Mtx_unlock
_Cnd_wait
_Mtx_init_in_situ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?__ExceptionPtrCreate@@YAXPEAX@Z
_Cnd_init_in_situ
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?_Throw_C_error@std@@YAXH@Z
?_XGetLastError@std@@YAXXZ
?__ExceptionPtrToBool@@YA_NPEBX@Z
_Mtx_destroy_in_situ
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_lock
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
_initterm
api-ms-win-crt-private-l1-1-0
_o__get_errno
_o__get_narrow_winmain_command_line
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcsnicmp
_o_exit
_o_free
_o_iswalnum
_o_malloc
_o_pow
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcstok_s
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
_CxxThrowException
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o__exit
_o__errno
_o___p__commode
_o__crt_atexit
_o__configure_narrow_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
__std_terminate
__CxxFrameHandler4
__std_type_info_compare
wcsrchr
wcschr
wcsstr
memcmp
memcpy
memmove
api-ms-win-crt-string-l1-1-0
memset
wcsncmp
shlwapi
ord187
ord600
ord647
ord599
PathGetDriveNumberW
PathIsUNCW
PathStripPathW
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsW
UrlEscapeW
AssocGetPerceivedType
SHStrDupW
ord212
SHCreateStreamOnFileEx
SHRegGetValueW
ord219
ord568
ord213
ord12
ord184
ord214
SHOpenRegStream2W
PathRelativePathToW
PathGetCharTypeW
ntdll
RtlMapGenericMask
RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlNtStatusToDosErrorNoTeb
RtlSubscribeWnfStateChangeNotification
NtQueryWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
api-ms-win-core-winrt-string-l1-1-0
WindowsDeleteString
WindowsCreateString
WindowsGetStringRawBuffer
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoInitialize
RoUninitialize
RoGetActivationFactory
api-ms-win-core-winrt-error-l1-1-0
RoOriginateError
SetRestrictedErrorInfo
RoTransformError
api-ms-win-core-errorhandling-l1-1-0
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetStartupInfoW
GetCurrentProcess
OpenThreadToken
GetCurrentThread
CreateProcessW
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
api-ms-win-core-path-l1-1-0
PathAllocCombine
PathCchRemoveFileSpec
PathCchCombine
PathAllocCanonicalize
api-ms-win-core-file-l1-1-0
GetFileAttributesW
GetTempFileNameW
FindFirstFileW
SetFileAttributesW
GetFileAttributesExW
GetFileTime
GetDriveTypeW
FindNextFileW
RemoveDirectoryW
CreateFileW
CompareFileTime
FindClose
SetFileTime
DeleteFileW
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
CreateEventExW
SetEvent
InitializeCriticalSectionAndSpinCount
ResetEvent
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-registry-l1-1-0
RegCreateKeyExW
RegGetValueW
RegEnumValueW
RegSetValueExW
RegDeleteKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryInfoKeyW
RegDeleteTreeW
RegEnumKeyExW
api-ms-win-core-heap-l2-1-0
LocalFree
LocalAlloc
LocalReAlloc
api-ms-win-core-io-l1-1-0
DeviceIoControl
sspicli
GetUserNameExW
api-ms-win-security-base-l1-1-0
IsValidSid
GetTokenInformation
GetSecurityDescriptorSacl
AddAccessDeniedAceEx
AddAce
GetSecurityDescriptorControl
CopySid
AddAccessAllowedAceEx
EqualSid
GetAclInformation
GetAce
DeleteAce
GetLengthSid
InitializeAcl
crypt32
CryptProtectData
CryptUnprotectData
api-ms-win-core-libraryloader-l1-2-0
FindStringOrdinal
FreeLibrary
api-ms-win-core-localization-l1-2-0
LCMapStringEx
api-ms-win-core-file-l2-1-0
CopyFileExW
CreateHardLinkW
MoveFileExW
api-ms-win-core-file-l1-2-0
GetTempPathW
cabinet
ord40
ord43
ord45
ord35
ord30
ord33
api-ms-win-core-psapi-l1-1-0
QueryFullProcessImageNameW
api-ms-win-core-synch-l1-2-0
InitOnceExecuteOnce
mpr
WNetGetConnectionW
bcrypt
BCryptOpenAlgorithmProvider
BCryptCreateHash
BCryptHashData
BCryptFinishHash
BCryptDestroyHash
BCryptCloseAlgorithmProvider
BCryptGetProperty
api-ms-win-core-winrt-error-l1-1-1
RoGetMatchingRestrictedErrorInfo
api-ms-win-shcore-taskpool-l1-1-0
SHTaskPoolGetUniqueContext
SHTaskPoolQueueTask
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
umpdc
Pdcv2ActivationClientUnregister
Pdcv2ActivationClientRegister
Pdcv2ActivationClientDeactivate
Pdcv2ActivationClientActivate
iertutil
ord791
ord594
ord398
ord597
ord670
ord793
ord650
ord797
ord796
ord654
settingsyncdownloadhelper
DownloadSettingUnits
Sections
.text Size: 436KB - Virtual size: 432KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 100KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 4KB - Virtual size: 560B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ