fsutil[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fsutil.exe
Size

196KB
MD5

1fcd762e521102f8666752c3724f07a4
SHA1

c2654ea4d771fa27e7231f66a0415157a916366f
SHA256

06ef2743261086a7a302e1f8c31b5476e76406feb5ac46b09c0c1507953e779d
SHA512

42fa494ce72902b0f79ed49eb2f4ce344d7ae4e2c5415c200294e76b6c75d1dd1eb3664ab660d308a22afc4879d1c0383c9c884f296d150745d871286a80b3ea
SSDEEP

6144:FXPAO2uB3MoOrQtY+ke2Nk3TunhJ94ukxwc:1AOd85QtT2Nk3Tun79Kx

Score

1^/10

Malware Config

Signatures

Files

fsutil.exe
.exe windows:10 windows x86 arch:x86

396a19b2f5016a7923fb04bba9ffe1cd

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:a6:e5:d3:0b:53:12:df:69:08:34:23:49:8f:b4:65:45:69:f5:94:be:65:94:8a:42:38:9e:ac:b1:28:68:93
Signer

Actual PE Digest

37:a6:e5:d3:0b:53:12:df:69:08:34:23:49:8f:b4:65:45:69:f5:94:be:65:94:8a:42:38:9e:ac:b1:28:68:93

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

fsutil.pdb

Imports

msvcrt

wcstol
calloc
wcschr
_errno
_XcptFilter
_pclose
_amsg_exit
fgetws
wcstok_s
_wcstoui64
__wgetmainargs
__set_app_type
_wpopen
iswctype
_wcsdup
wcsncpy_s
_exit
_cexit
__p__fmode
memcpy_s
__setusermatherr
wcscpy_s
realloc
_initterm
towupper
_wtoi
wcsrchr
wcscat_s
isalpha
isdigit
toupper
mbstowcs_s
wcstoul
_except_handler4_common
?terminate@@YAXXZ
_controlfp
setlocale
_vsnwprintf
wprintf
swprintf_s
malloc
_wcsicmp
free
memcpy
_local_unwind4
exit
_wcsnicmp
__p__commode
memset

ntdll

RtlInitializeBitMap
RtlSetBits
RtlSetBit
NtFlushBuffersFileEx
NtClose
RtlVerifyVersionInfo
VerSetConditionMask
RtlGetLastNtStatus
NtQuerySystemInformation
RtlTimeToTimeFields
RtlStringFromGUID
NtEnumerateTransactionObject
RtlGetOwnerSecurityDescriptor
RtlAllocateHeap
NtQuerySecurityObject
RtlConvertSidToUnicodeString
NtCreateFile
RtlFreeHeap
RtlDosPathNameToNtPathName_U
RtlSetCurrentTransaction
RtlNumberOfSetBits
NtSetQuotaInformationFile
NtQueryQuotaInformationFile
RtlInitializeCriticalSection
RtlLengthSid
NtSetVolumeInformationFile
NtOpenFile
RtlInitUnicodeString
NtQueryVolumeInformationFile
NtQueryEaFile
NtQueryInformationFile
NtSetInformationFile
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlWriteRegistryValue
RtlDeleteRegistryValue
RtlFreeUnicodeString
RtlQueryRegistryValuesEx
RtlNtStatusToDosError
RtlGetVersion
RtlGetCurrentTransaction

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegSetValueExW

api-ms-win-core-file-l1-1-0

GetTempFileNameW
FindNextFileW
ReadFile
WriteFile
QueryDosDeviceW
GetFullPathNameW
GetFileType
GetFileAttributesW
CreateDirectoryW
FindVolumeClose
CreateFileW
FindNextVolumeW
FindFirstVolumeW
GetFileInformationByHandle
FindFirstFileW
FindClose
GetDiskFreeSpaceExW
DeleteFileW
SetFilePointerEx
GetVolumePathNameW
GetDriveTypeW
GetLogicalDriveStringsW
GetFileSizeEx
GetFinalPathNameByHandleW
SetEndOfFile
GetVolumeInformationW

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetSystemDirectoryW
GetTickCount
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetVersionExW
GetSystemInfo

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processtopology-obsolete-l1-1-0

GetActiveProcessorCount

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
LoadLibraryExA

api-ms-win-core-sysinfo-l1-2-6

GetDeveloperDriveEnablementState

fltlib

FilterFindClose
FilterVolumeInstanceFindNext
FilterVolumeInstanceFindFirst

api-ms-win-security-base-l1-1-0

AdjustTokenPrivileges
FreeSid
CheckTokenMembership
AllocateAndInitializeSid

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
CreateProcessW
GetCurrentThreadId
GetCurrentProcess
TerminateProcess
OpenProcessToken

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW

api-ms-win-core-com-l1-1-0

StringFromGUID2
IIDFromString
StringFromIID
CoTaskMemFree

api-ms-win-core-localization-l1-2-0

SetThreadUILanguage
GetLocaleInfoEx
FormatMessageW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx
CreateHardLinkW

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-file-l1-2-2

FindNextFileNameW
FindFirstFileNameW

api-ms-win-core-heap-l1-1-0

HeapFree
HeapSetInformation
GetProcessHeap
HeapAlloc

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
ReleaseSRWLockExclusive
AcquireSRWLockExclusive

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW
LookupAccountNameLocalW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-console-l1-1-0

WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
SetConsoleCtrlHandler

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetStdHandle

api-ms-win-core-file-l1-2-0

GetVolumePathNamesForVolumeNameW
GetVolumeNameForVolumeMountPointW

api-ms-win-core-file-l1-2-4

GetTempPath2W

api-ms-win-core-namedpipe-l1-1-0

CreatePipe

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-security-lsapolicy-l1-1-0

LsaOpenPolicy
LsaFreeMemory
LsaLookupSids

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

fmifs

ClearPerMachineFileSystemState
CreatePerMachineFileSystemStateKey

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualProtect

Sections

.text
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

396a19b2f5016a7923fb04bba9ffe1cd

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

37:a6:e5:d3:0b:53:12:df:69:08:34:23:49:8f:b4:65:45:69:f5:94:be:65:94:8a:42:38:9e:ac:b1:28:68:93Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-sysinfo-l1-2-6

fltlib

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-heap-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-4

api-ms-win-core-namedpipe-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-localization-l2-1-0

fmifs

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-memory-l1-1-0

Sections

.text Size: 161KB - Virtual size: 160KB

.data Size: 6KB - Virtual size: 7KB

.idata Size: 8KB - Virtual size: 8KB

.didat Size: 512B - Virtual size: 60B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

37:a6:e5:d3:0b:53:12:df:69:08:34:23:49:8f:b4:65:45:69:f5:94:be:65:94:8a:42:38:9e:ac:b1:28:68:93
Signer

.text
Size: 161KB - Virtual size: 160KB

.data
Size: 6KB - Virtual size: 7KB

.idata
Size: 8KB - Virtual size: 8KB

.didat
Size: 512B - Virtual size: 60B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB