TrustedInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

TrustedInstaller.exe
Size

221KB
MD5

8c7c031c030208f3175da88c2d372dab
SHA1

41521c9bade0f61bbd76e20d762bab2824720658
SHA256

74cd2103f2d842816bf78b75c5451693af7727530a2dbc9798090e7b88319d89
SHA512

14a8376c35827df0478eef8c8f6078bb40b3f5d7e64a3079ef27948edb9b7505d45b280d06205bf47812b7b8e582a2a079ac604451b01ab1cfd48d54c8fa06a4
SSDEEP

6144:YKF8Y6SXLodCKupSooMDFOxsVvYiQvUSdI7SAH:YKFj6SXLodCKupHoMDFOxsuk7Ss

Score

1^/10

Malware Config

Signatures

Files

TrustedInstaller.exe
.exe windows:10 windows x64 arch:x64

Password: chiTOWNcubs22!

fdf9535852f9b8ea45ecf34c25954c1c

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:94:78:2c:f1:a0:16:07:95:00:45:06:62:42:48:3d:55:b8:d8:b8:ea:0e:9c:7b:5c:c9:72:33:85:2e:8f:39
Signer

Actual PE Digest

31:94:78:2c:f1:a0:16:07:95:00:45:06:62:42:48:3d:55:b8:d8:b8:ea:0e:9c:7b:5c:c9:72:33:85:2e:8f:39

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TrustedInstaller.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-private-l1-1-0

_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
memmove
_o_exit
_o_free
_o_malloc
_o_terminate
_o_wcstoul
__C_specific_handler
__current_exception
__current_exception_context
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o__exit
_o___stdio_common_vsprintf
_o__errno
wcsstr
wcsrchr
wcschr
_o___p__commode
_o___p___wargv
_o___p___argc
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcscmp
memset

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW
GetModuleHandleExA
LoadLibraryExW
GetModuleFileNameW
GetModuleFileNameA
FreeLibrary
GetProcAddress
GetModuleHandleExW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringA
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoGetClassObject
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoRegisterClassObject
CoGetMalloc
StringFromCLSID
CoResumeClassObjects
StringFromGUID2
CoTaskMemFree
CoRevokeClassObject
CoRevertToSelf
CoUnmarshalInterface
CreateStreamOnHGlobal
CoReleaseMarshalData
CoDisconnectContext
CoGetCallContext
CoMarshalInterface
CoCreateInstance
CoImpersonateClient
CoUninitialize
CoSuspendClassObjects
CoInitializeSecurity
CoInitializeEx

api-ms-win-core-processthreads-l1-1-0

CreateThread
TerminateThread
GetExitCodeThread
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetCurrentProcessId
GetCurrentProcess
GetCurrentThreadId
OpenProcessToken
ExitProcess
GetThreadPriority
SetThreadPriority
GetCurrentThread
OpenThreadToken

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
GetLastError
UnhandledExceptionFilter
SetLastError

api-ms-win-core-synch-l1-1-0

CreateMutexExW
CreateSemaphoreExW
InitializeCriticalSection
WaitForSingleObject
WaitForMultipleObjectsEx
LeaveCriticalSection
TryEnterCriticalSection
OpenSemaphoreW
DeleteCriticalSection
InitializeCriticalSectionEx
WaitForSingleObjectEx
EnterCriticalSection
AcquireSRWLockExclusive
SetEvent
ReleaseMutex
ReleaseSemaphore
CreateEventW
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegEnumValueW
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc
HeapSetInformation

api-ms-win-core-registry-l2-1-0

RegCreateKeyTransactedW
RegOpenKeyTransactedW
RegDeleteKeyW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateFileW
FileTimeToLocalFileTime
SetFileInformationByHandle
DeleteFileW
CompareFileTime
CreateDirectoryW
GetFullPathNameW
GetFileAttributesExW
FindClose
FindNextFileW
FindFirstFileW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer
SetThreadpoolTimer
CloseThreadpoolTimer

api-ms-win-service-management-l1-1-0

OpenServiceW
OpenSCManagerW
CloseServiceHandle

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemWindowsDirectoryW
GetSystemTime
GetSystemDirectoryW
GetSystemTimeAsFileTime

api-ms-win-core-sysinfo-l1-2-0

GetOsSafeBootMode

api-ms-win-core-kernel32-legacy-l1-1-0

LoadLibraryW
WaitForMultipleObjects

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-service-private-l1-1-1

I_ScRegisterPreshutdownRestart

ntdll

NtCreateFile
VerSetConditionMask
NtSetInformationThread
NtQueryInformationThread
RtlRaiseStatus
DbgPrintEx
NtQuerySystemInformation
NtClose

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
ExpandEnvironmentStringsW

api-ms-win-core-file-l2-1-0

MoveFileExW
GetFileInformationByHandleEx

api-ms-win-security-base-l1-1-0

RevertToSelf
AdjustTokenPrivileges
AllocateAndInitializeSid
ImpersonateSelf
CheckTokenMembership
FreeSid

api-ms-win-service-management-l2-1-0

QueryServiceConfigW
ChangeServiceConfigW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-file-l1-2-0

GetTempPathW

Sections

.text
Size: 128KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: chiTOWNcubs22!

fdf9535852f9b8ea45ecf34c25954c1c

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

31:94:78:2c:f1:a0:16:07:95:00:45:06:62:42:48:3d:55:b8:d8:b8:ea:0e:9c:7b:5c:c9:72:33:85:2e:8f:39Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-service-management-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-service-private-l1-1-1

ntdll

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-shutdown-l1-1-0

api-ms-win-core-file-l1-2-0

Sections

.text Size: 128KB - Virtual size: 125KB

.rdata Size: 60KB - Virtual size: 58KB

.data Size: 4KB - Virtual size: 3KB

.pdata Size: 8KB - Virtual size: 6KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 804B

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

31:94:78:2c:f1:a0:16:07:95:00:45:06:62:42:48:3d:55:b8:d8:b8:ea:0e:9c:7b:5c:c9:72:33:85:2e:8f:39
Signer

.text
Size: 128KB - Virtual size: 125KB

.rdata
Size: 60KB - Virtual size: 58KB

.data
Size: 4KB - Virtual size: 3KB

.pdata
Size: 8KB - Virtual size: 6KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 804B