�L��\��&k�Hr<��+̋r���r�m^��Kz�%^�$Eݢg��o�,���@ ������dKy��iW���C�m�c�֚���z8��)� 0;k��(Os��Ŝ����,TJ�\U�f@z�d�eÎ`ߖX)o;�W�A��o�}G��������ʑ���gm���V�m�W��{�[}Lzƪq��[E>�{N���؟��Y ����D� s���ע�_)~��5��%��Ȑ��&��⊺��צD��z�/���+�M�bˋ&�Q>���`(��I���峸�К�J�7�� �ћ��w���~��7����v�����2�E7�k��GTt�y�3��J�N.�^����t�ZE�,��7����/�n�N�함w?&��dZ�|�*Y5!d6�S����?�er�ߐ|~/�LȚ��Ձ�A7��s<�(߰���#�D����S<�f��tZĐ�~��[z�XC[s��j�t�[����}56 J�lj�8gڻu��Z���4�z�I�n�5�[�W�O�c G�W�N����5G7ݑ��Y���w��s_E��T�Q%-a�{�5�A�LR�|fi͒���M%�?<�G 81J��\��.T嬏��5]��4���s���2�tL���K90�Dʽ̨�����q�/��"�����J��x����}�/b�)�[��Ȉ�ż�P4[?W!�-����LR�&Ņ؞�I��/����ل`��Ф�ab�[6 � ��MHУ$0KJ�7yq`�����$�1��IK�!�cr��|�-S���4f�{QVq�?�Ͱ�������������&��4�Wi�����u{�>�gm�� 4�����m�A��/��C��6�nB��Iy��-@�cYE��sUԝ��l�&�)��V�m�QuW�5��*��$���4Cv�S���5��[~up;��t 2w���b��SI�k}�I�([���.5�����p �,5X�f�(ۏ}+�"���R�Վ� ���h���R)n�^`��.`EA/\c���ab�?6y?�"�eA�s���a����6R�,ſڋ[���e8ce@��}���"�em���f��-�/B��ˡ��Nj�!�"'� )hu�@oO�n��Mz�z�a���~��d���R����T���,6�>ԃk�+Dd1U9�k�����ܰD�,'(#������'3�-�zI�d*\c����±������JW����K���:Ѱ��6 ����*Z��}5S�z�t_3����X�on��*cO���-V��c2ā�TrhnJ6�!vp;�59{�����X�D�Ώ�.\eY�|� _F��z� ORM��gxĔh딘rǓ-���e� �M".x�����Pq����ȍ����n/�ʤF e��šB����;A<�7�\��2�SDG�����w��2����n+>�����Z(��S� ���/�u�J��\�:�������4���N��9���.��Z��v�b�_������ �v3P��Z�=m�.S�T�W�&�xH�C��<�p7�Y���<Z ���� �� pC�X7�C�NWw�M�4�;U�Q�܀Z��1��$s��p����CL�@8�W��C%.O_��~rɽm���"��Ùı�?�1��5��D��u��Y� 䍭Ďe��W62����T�*4�N4=c)����*=��T������� �M;�uj�ahͅꈟ0V��霣ִ�E��t�d�ٿz��xzU�}x�?�B�������[:��_$���&�{��>�:U��9��M���畢��ދw�n���fK��6(ҭ4#���\�^���U��Ë���_�*wP�]�Y�A<'Y�:�ϬJ�����Cb�K�C����JQ��1�y�lJ�A�bT�C�m0_N���g�h5 �k^ ���clO�$G�LE9v��*�ؾ�o�<��@��[W%��qx��� \K�z�EO��aU��J6���.�d�*V9o;$uO�6G�%�&�d�?�����|Cf�g���ҠO&?~"J/\+3���M�L�c�Cfe��,U����4wgJ��C�/�Kڑ�6>ϭ~2�ǰ^xj��g�\g��>tN�L*�-�*��F�������M0�.j0C���1}ך��5�ݬ5���o(�� ���D��ңi�+*�:yc��>�/π�R-�@����B����f���o�A��+(^>b�?���Ë�`c(��o�6�`MB�F@�h�)�:}��X������d7_�Kǧ|��E�q]�FY⯵4�\�uS����}���\�hv��m�m&����bs�2��q3jjT�D�7�{��N���F�$P�p��or��[��/���du�?ba��9�a�HX*Y�C���IL����Y1���Cm�����W�G*%p$�p�Ѯb�g�M����U�`~�ӝX�S�2�ly�9p�U���ֿ��H O⡽����2f�+�d�Q����*F��BFa�d�M��$'7�zr�(l����7iC�Nf��Z%`&Q�\0=�X�"�Bݸ���i�'s���oq�����2"*W��T��a&���������lV��}�/$Hu�p̿g�jq3� �J���ʩ��>~�� |'�C���%����YX�~#T�L%,-��ۘ��pWf��GUQa��F���[Ԙ����=���.��da#�=m�9[��G�(�N��P�f`r���U�Y3w�B��S������'�Hs�~F�a�q?�hez�ܱ�rZ���1s^m�^�i��F=� �R��"���Q���M�M;]X��k���l���\E��(��[5Gw"g)��9���z�euk��$�.w�&kH�2���%�Ɂ�z��x;�K��P�Ee^iA���Zߖɡ"�.�?��p�G� �^.�a�����d�-�c��˺3~+�N���y�6_�W'�W���d ���A�YD2ݣ��ԏ�,J6a���d��;q���� �]^��b��$C7n�/�1�J�|���!�:���7*�{��'O�����ϛ�C�ڞ_��G�!����B>v�߁fӉ���x%#ׂ0��uSg�\�xI�z��t�L h���+r��
Static task
static1
Behavioral task
behavioral1
Sample
aaads.zip
Resource
win10v2004-20240508-en
General
-
Target
aaads.zip
-
Size
33.7MB
-
MD5
07b60e7c0a2a941d413ed3042d8c061b
-
SHA1
6212c87dd75eab0fb2b97ebc263e12ec61f97426
-
SHA256
d1c1b6e3adaad59a2c2aea043e12f136b6946abe00d54afbc812b91ba8219373
-
SHA512
995f4a5b8662260d39f7d5751ce6dc89be649128b465339a96c5c6fc66bea2e2eb931bd0ca73444704deddf71330dd09f93a02ba155bb7464d5680b7e5c413da
-
SSDEEP
786432:rryqHehePvm09qV64hVHO94HqlyVDPL+Tsksc8WoVej1:ricmXhhi4H3+3do4j1
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Fix_Windows_Home.exe
Files
-
aaads.zip.zip
-
Fix_Windows_Home.exe.exe windows:6 windows x64 arch:x64
b350eb070bc7d0f71a627aa37c320ef8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
InitializeCriticalSectionEx
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextA
CharUpperBuffW
advapi32
OpenProcessToken
msvcp140
??1_Lockit@std@@QEAA@XZ
winhttp
WinHttpCloseHandle
ntdll
VerSetConditionMask
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertGetCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strrchr
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-math-l1-1-0
_dsign
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
_time64
shell32
ShellExecuteA
Exports
Exports
Sections
.text Size: - Virtual size: 512KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 5.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.HQ" Size: - Virtual size: 16.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Xc@ Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.|[{ Size: 23.9MB - Virtual size: 23.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
Process_Hacker_-_Undetected.exe.exe windows:5 windows x86 arch:x86
Code Sign
7d:e6:61:e7:bb:da:51:bc:4d:35:6f:66:65:69:34:faCertificate
IssuerCN=MobileDENot Before29/06/2019, 20:37Not After31/12/2039, 23:59SubjectCN=MobileDEExtended Key Usages
ExtKeyUsageCodeSigning
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
7d:e6:61:e7:bb:da:51:bc:4d:35:6f:66:65:69:34:faCertificate
IssuerCN=MobileDENot Before29/06/2019, 20:37Not After31/12/2039, 23:59SubjectCN=MobileDEExtended Key Usages
ExtKeyUsageCodeSigning
8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate
IssuerCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBNot Before23/10/2020, 00:00Not After22/01/2032, 23:59SubjectCN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate
IssuerCN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=USNot Before02/05/2019, 00:00Not After18/01/2038, 23:59SubjectCN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GBExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
93:4f:69:e7:55:8e:b9:38:48:b3:1f:a6:4b:a4:f4:0f:3c:d6:dc:7c:d3:b0:a4:b8:15:5d:61:e7:f3:cc:a8:e8Signer
Actual PE Digest93:4f:69:e7:55:8e:b9:38:48:b3:1f:a6:4b:a4:f4:0f:3c:d6:dc:7c:d3:b0:a4:b8:15:5d:61:e7:f3:cc:a8:e8Digest Algorithmsha256PE Digest Matchestruee3:b5:d7:ef:e5:19:88:80:99:cc:6d:a9:57:33:d2:c5:19:41:41:4cSigner
Actual PE Digeste3:b5:d7:ef:e5:19:88:80:99:cc:6d:a9:57:33:d2:c5:19:41:41:4cDigest Algorithmsha1PE Digest MatchestrueHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 163KB - Virtual size: 356KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 43KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 40KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 22KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 6KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8.1MB - Virtual size: 6.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.38rlqw Size: 7B - Virtual size: 7B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Zoi1JH Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE