consent[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

consent.exe
Size

102KB
MD5

0afea18b9ccfbab4ea5526dd94f40d5e
SHA1

0403736e4cb4a0b7998a111510ead7c063003264
SHA256

31419d48be5dc3397d42adea3ed8ade710f986e02581a29b76afe6d9609c7ff8
SHA512

671134959cb4dc90a4f13bd19a27a339e58c3b7954d944388ae173348623aa94acdc2c142a2bfad7772c951dda1c7b831eb0aa5959cf36a2a8fb323c3947ac86
SSDEEP

1536:qDwim5ivc8NGxlz8O0hZTR3NkwuzDlG8N:qDwigiNIPwh5R30zZrN

Score

1^/10

Malware Config

Signatures

Files

consent.exe
.exe windows:6 windows x86 arch:x86

3f38f9b645eebc120f6dfe0b37f41f22

Code Sign

33:00:00:01:06:2f:03:6b:ee:bf:4e:7e:60:00:00:00:00:01:06
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:179E-4BB0-8246,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:5e:e2:da:26:23:c5:f8:82:2b:00:01:00:00:00:5e
Certificate

Issuer

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/09/2018, 20:38

Not After

06/09/2019, 20:38

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0a:59:2b:00:00:00:00:00:3b
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

11/02/2016, 23:24

Not After

09/05/2021, 23:28

Subject

CN=Microsoft Windows Verification PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

eb:d3:07:99:06:9b:af:54:12:af:b8:ec:d3:95:6a:3e:fc:0d:69:67
Signer

Actual PE Digest

eb:d3:07:99:06:9b:af:54:12:af:b8:ec:d3:95:6a:3e:fc:0d:69:67

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

consent.pdb

Imports

advapi32

GetTokenInformation
RegGetValueW
RevertToSelf
ImpersonateLoggedOnUser
MakeAbsoluteSD
ConvertStringSecurityDescriptorToSecurityDescriptorW
EventRegister
EventWriteTransfer
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeSid
GetSidLengthRequired

kernel32

GetCurrentThreadId
GetCurrentProcessId
ReleaseMutex
Sleep
LoadLibraryW
SetEvent
GetTickCount
GetExitCodeThread
WaitForMultipleObjects
ResumeThread
CreateEventW
GetProcAddress
GetLocaleInfoW
GetCurrentProcess
GetCommandLineW
CreateFileW
SetPriorityClass
HeapSetInformation
UnmapViewOfFile
VirtualQuery
MapViewOfFile
CreateFileMappingW
DelayLoadFailureHook
InterlockedCompareExchange
LoadLibraryExA
GetDriveTypeW
LoadLibraryExW
FreeLibrary
GetUserPreferredUILanguages
SetThreadPreferredUILanguages
QueueUserWorkItem
GetModuleHandleW
WaitForSingleObject
CreateThread
GetModuleHandleExW
CloseHandle
FindResourceExW
LoadResource
LockResource
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedExchange
LocalAlloc
LocalFree
GetLastError
GlobalFree

gdi32

SetDCBrushColor
GetStockObject
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteObject
DeleteDC
GetLayout
BitBlt
CreateCompatibleBitmap

user32

GetForegroundWindow
FlashWindowEx
SetPropW
DestroyWindow
PostMessageW
UnregisterClassW
DispatchMessageW
TranslateMessage
GetMessageW
GetDesktopWindow
CreateWindowExW
RegisterClassW
LoadCursorW
GetWindowRect
SendMessageW
SetThreadDesktop
GetParent
GetDC
FillRect
GetAncestor
GetPropW
ShowWindow
DefWindowProcW
BeginPaint
GetWindowDC
ReleaseDC
EndPaint
PostQuitMessage
GetWindowLongW
SetWindowLongW
GetThreadDesktop
OpenInputDesktop
CloseDesktop
GetUserObjectInformationW
LoadIconW
DestroyIcon
GetSystemMetrics
LoadStringW
OpenDesktopW

msvcrt

_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
memset
__p__fmode
wcschr
wcsrchr
_amsg_exit
_wcsicmp
_wtoi
_errno
_wtol
_vsnwprintf
__set_app_type
_controlfp
__setusermatherr
swscanf_s
__p__commode
__getmainargs
?terminate@@YAXXZ
memcpy
_except_handler4_common

ntdll

EtwSendNotification
EtwTraceMessage
RtlSubAuthoritySid
RtlNtStatusToDosError
NtQueryInformationToken
RtlNtStatusToDosErrorNoTeb
NtDuplicateToken
RtlEqualSid
WinSqmAddToStreamEx
RtlImageNtHeaderEx
EtwEventRegister
NtOpenProcess
EtwEventUnregister
NtQueryVolumeInformationFile
NtWriteVirtualMemory
RtlAllocateHeap
NtReadVirtualMemory
NtDuplicateObject
RtlFreeHeap
RtlLengthRequiredSid
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceLoggerHandle
EtwGetTraceEnableLevel
EtwGetTraceEnableFlags
EtwEventWrite
RtlInitializeSid
RtlAdjustPrivilege
NtClose
RtlInitString
NtAllocateLocallyUniqueId

ole32

CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoTaskMemFree

msimg32

AlphaBlend

wmsgapi

WmsgSendMessage

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

winmm

PlaySoundW

userenv

LoadUserProfileW
UnloadUserProfile

winsta

WinStationQueryInformationW

crypt32

CertFreeCertificateContext

msctfmonitor

UninitLocalMsCtfMonitor
InitLocalMsCtfMonitor

comctl32

ord345

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

consent
Size: 512B - Virtual size: 98B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3f38f9b645eebc120f6dfe0b37f41f22

Code Sign

33:00:00:01:06:2f:03:6b:ee:bf:4e:7e:60:00:00:00:00:01:06Certificate

Extended Key Usages

33:00:00:00:5e:e2:da:26:23:c5:f8:82:2b:00:01:00:00:00:5eCertificate

Extended Key Usages

61:0a:59:2b:00:00:00:00:00:3bCertificate

Key Usages

61:16:68:34:00:00:00:00:00:1cCertificate

Extended Key Usages

Key Usages

eb:d3:07:99:06:9b:af:54:12:af:b8:ec:d3:95:6a:3e:fc:0d:69:67Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

ole32

msimg32

wmsgapi

wtsapi32

winmm

userenv

winsta

crypt32

msctfmonitor

comctl32

Sections

.text Size: 41KB - Virtual size: 40KB

.data Size: 1KB - Virtual size: 1KB

consent Size: 512B - Virtual size: 98B

.rsrc Size: 49KB - Virtual size: 49KB

.reloc Size: 2KB - Virtual size: 2KB

33:00:00:01:06:2f:03:6b:ee:bf:4e:7e:60:00:00:00:00:01:06
Certificate

33:00:00:00:5e:e2:da:26:23:c5:f8:82:2b:00:01:00:00:00:5e
Certificate

61:0a:59:2b:00:00:00:00:00:3b
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

eb:d3:07:99:06:9b:af:54:12:af:b8:ec:d3:95:6a:3e:fc:0d:69:67
Signer

.text
Size: 41KB - Virtual size: 40KB

.data
Size: 1KB - Virtual size: 1KB

consent
Size: 512B - Virtual size: 98B

.rsrc
Size: 49KB - Virtual size: 49KB

.reloc
Size: 2KB - Virtual size: 2KB