fsutil[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

fsutil.exe
Size

168KB
MD5

b53d90b1c9dda01362cded33b776f0e0
SHA1

c6b727ab311705d40b15b9b91caa66df11a3080c
SHA256

2a15c4f22ff41bad92f2eae6ba5b2fac7c5a34a1092e53a8b390cab3d09dcea3
SHA512

bf2293acd009f15e8538ccc73b04cb5fd837e2c7bffd00c427d48bc69d9b1ccaaf0272a79f8632f997140e4ce4f2a239effe476623a63022dd561b7478f16cbf
SSDEEP

3072:Yy93iOgwEagxk08H1pXaH+nCevykBRlaLwFZpOWGZzc0Fz8:HgwC6RVk5CvaLwFZpOWWF

Score

1^/10

Malware Config

Signatures

Files

fsutil.exe
.exe windows:10 windows x86 arch:x86

841afaa35e86115b5773d0e216d73544

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:2d:cb:0d:77:13:03:38:01:f2:ff:96:39:62:19:ce:8b:08:00:81:ac:7a:38:02:20:5f:72:6e:6f:d8:60:6a
Signer

Actual PE Digest

47:2d:cb:0d:77:13:03:38:01:f2:ff:96:39:62:19:ce:8b:08:00:81:ac:7a:38:02:20:5f:72:6e:6f:d8:60:6a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

fsutil.pdb

Imports

msvcrt

memcpy
_local_unwind4
memmove
wcschr
_controlfp
?terminate@@YAXXZ
_except_handler4_common
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
__set_app_type
_amsg_exit
__p__commode
wcstol
wcstok_s
_wcstoui64
wcstoul
iswctype
_errno
exit
_wcsdup
wcsncpy_s
memcpy_s
wcscpy_s
realloc
towupper
_wtoi
wcsrchr
wcscat_s
isalpha
isdigit
_wcsicmp
toupper
__wgetmainargs
setlocale
calloc
_vsnwprintf
wprintf
swprintf_s
malloc
free
_wcsnicmp
_XcptFilter
memset

ntdll

NtClose
RtlVerifyVersionInfo
VerSetConditionMask
NtQuerySystemInformation
RtlTimeToTimeFields
RtlStringFromGUID
NtEnumerateTransactionObject
RtlGetOwnerSecurityDescriptor
RtlAllocateHeap
NtQuerySecurityObject
RtlInitializeCriticalSection
RtlFreeUnicodeString
RtlConvertSidToUnicodeString
NtCreateFile
RtlFreeHeap
NtFlushBuffersFileEx
RtlSetCurrentTransaction
RtlGetCurrentTransaction
NtSetQuotaInformationFile
NtQueryQuotaInformationFile
RtlLengthSid
NtSetVolumeInformationFile
NtOpenFile
RtlInitUnicodeString
NtQueryVolumeInformationFile
NtQueryEaFile
NtQueryInformationFile
RtlNtStatusToDosError
NtSetInformationFile
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlDosPathNameToNtPathName_U

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegCloseKey

api-ms-win-core-file-l1-1-0

GetFinalPathNameByHandleW
WriteFile
GetVolumeInformationW
GetVolumePathNameW
SetFilePointerEx
QueryDosDeviceW
DeleteFileW
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
GetFileSizeEx
GetDiskFreeSpaceExW
FindFirstFileW
FindNextFileW
GetLogicalDriveStringsW
GetDriveTypeW
GetFileInformationByHandle
SetEndOfFile
FindClose
GetTempFileNameW
GetFileType
CreateDirectoryW
GetFileAttributesW
CreateFileW
GetFullPathNameW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetComputerNameExW
GetSystemDirectoryW
GetTickCount
GetWindowsDirectoryW
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
FreeLibrary
LoadLibraryExA
GetModuleFileNameA

api-ms-win-security-base-l1-1-0

FreeSid
CheckTokenMembership
AdjustTokenPrivileges
AllocateAndInitializeSid

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId
CreateProcessW

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW
LookupAccountNameW
LookupAccountSidW

api-ms-win-core-com-l1-1-0

StringFromGUID2
IIDFromString
CoTaskMemFree
StringFromIID

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx
SetThreadUILanguage
FormatMessageW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-file-l2-1-0

CreateHardLinkW
GetFileInformationByHandleEx

api-ms-win-core-file-l2-1-1

OpenFileById

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-file-l1-2-2

FindFirstFileNameW
FindNextFileNameW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapSetInformation
HeapFree
GetProcessHeap

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW
LookupAccountNameLocalW

api-ms-win-core-timezone-l1-1-0

SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive
WaitForSingleObject
ReleaseSRWLockExclusive

api-ms-win-core-console-l1-1-0

GetConsoleMode
SetConsoleCtrlHandler
WriteConsoleW
GetConsoleOutputCP

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
GetStdHandle
ExpandEnvironmentStringsW

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
GetTempPathW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-security-lsapolicy-l1-1-0

LsaOpenPolicy
LsaFreeMemory
LsaLookupSids

api-ms-win-core-localization-l2-1-0

GetNumberFormatEx

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-eventing-provider-l1-1-0

EventSetInformation
EventWriteTransfer
EventUnregister
EventProviderEnabled
EventRegister

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualQuery

Sections

.text
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

841afaa35e86115b5773d0e216d73544

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

47:2d:cb:0d:77:13:03:38:01:f2:ff:96:39:62:19:ce:8b:08:00:81:ac:7a:38:02:20:5f:72:6e:6f:d8:60:6aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-file-l2-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-heap-l1-1-0

api-ms-win-security-lsalookup-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-localization-l2-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-memory-l1-1-0

Sections

.text Size: 136KB - Virtual size: 136KB

.data Size: 4KB - Virtual size: 5KB

.idata Size: 7KB - Virtual size: 7KB

.didat Size: 512B - Virtual size: 60B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 7KB - Virtual size: 6KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

47:2d:cb:0d:77:13:03:38:01:f2:ff:96:39:62:19:ce:8b:08:00:81:ac:7a:38:02:20:5f:72:6e:6f:d8:60:6a
Signer

.text
Size: 136KB - Virtual size: 136KB

.data
Size: 4KB - Virtual size: 5KB

.idata
Size: 7KB - Virtual size: 7KB

.didat
Size: 512B - Virtual size: 60B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 7KB - Virtual size: 6KB