MsSense[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

MsSense.exe
Size

509KB
MD5

c311a5744bc0f42b2dbea2c68d1cbd06
SHA1

9e30598eded8386d8050f409ebd86b1fa5ec474e
SHA256

6ea1404c4e81bc30f75d6a202c32485ca1e331b41bf3fd019bfffcc7425707b6
SHA512

220b49a2b202e05e9128d511ea88f947a2d14ad1669051e2c09791373548950a0abbb027dcd4835684af07c93ce4a2191bcf72dc1e10f6a39f4a4f26f1fad7e5
SSDEEP

6144:0iF7KWey5sl2GUEvfREFvLgZIMCGb/yNYE/CflYR72f2VmZtEUfhs1o:0c7KdtqFvLgV/8x/OuRSfyKtEl1o

Score

1^/10

Malware Config

Signatures

Files

MsSense.exe
.exe windows:10 windows x64 arch:x64

fe4dc91f265f917e0c9a896e7c9ca92f

Code Sign

33:00:00:04:6f:5a:72:76:81:13:5a:26:6c:00:00:00:00:04:6f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/02/2024, 19:22

Not After

07/02/2025, 19:22

Subject

CN=Microsoft Windows Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

18:3e:b7:6b:dc:20:ab:0d:7d:26:d0:53:b5:37:e7:67:91:7a:c4:6f:4c:99:2f:29:8e:f5:bf:c4:67:c9:3d:c0
Signer

Actual PE Digest

18:3e:b7:6b:dc:20:ab:0d:7d:26:d0:53:b5:37:e7:67:91:7a:c4:6f:4c:99:2f:29:8e:f5:bf:c4:67:c9:3d:c0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

MsSense.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__ldclass
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsdup
_o__wcsnicmp
_o__wmakepath_s
_o__wsplitpath_s
_o_abort
_o_calloc
_o_ceilf
_o_exit
_o_free
_o_frexp
_o_isalpha
_o_isspace
_o_iswalpha
_o_localeconv
_o_malloc
_o_pow
_o_realloc
_o_setlocale
_o_strtod
_o_strtof
_o_terminate
_o_tolower
_o_wcscpy_s
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
_o__get_initial_wide_environment
_o__free_base
_o__invalid_parameter_noinfo_noreturn
memmove
memcpy
_o__exit
_o__errno
_o__dclass
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___std_exception_destroy
strchr
__std_type_info_compare
__AdjustPointer
__uncaught_exception
_o___std_exception_copy
_o___pctype_func
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o___p__commode
_o___p___wargv
_o__initialize_onexit_table
_o___p___argc
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
__CxxFrameHandler3
__RTDynamicCast
memchr

api-ms-win-crt-string-l1-1-0

wcscmp
wcsnlen
strcspn
wcsncmp
memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExA
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
ResetEvent
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
SetEvent
CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

LCMapStringEx
FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-l1-1-0

CompareStringEx
GetStringTypeW
WideCharToMultiByte

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister
EventSetInformation

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize
InitOnceComplete

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlPcToFileHeader

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-com-l1-1-0

CoIncrementMTAUsage

setupapi

SetupInstallServicesFromInfSectionW
SetupInstallFromInfSectionW
SetupOpenInfFileW
SetupDiGetDeviceInterfaceDetailW
SetupDiGetDevicePropertyW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

ntdll

VerSetConditionMask
RtlInitUnicodeString
RtlCreateUnicodeString
NtDeleteValueKey
RtlFreeUnicodeString
NtDeleteKey

kernel32

DeleteCriticalSection
AcquireSRWLockShared
GetLogicalDrives
ReleaseSRWLockExclusive
InitializeCriticalSectionEx
LeaveCriticalSection
FindVolumeClose
ExpandEnvironmentStringsW
EnterCriticalSection
VerifyVersionInfoW
Sleep
GetWindowsDirectoryW
ReleaseSRWLockShared
GetVersionExW
GetProductInfo
GetModuleFileNameW
AcquireSRWLockExclusive
CompareFileTime
GetDriveTypeW
FindNextVolumeW
GetVolumePathNamesForVolumeNameW
WaitForThreadpoolTimerCallbacks
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetVolumeNameForVolumeMountPointW
FindFirstVolumeW
GetVolumeInformationW
QueryDosDeviceW
MoveFileExW
DeleteFileW
CreateEventW
SetFileAttributesW
GetFileAttributesW
CreateFileW
FindClose
RemoveDirectoryW
DeviceIoControl
FindNextFileW
FindFirstFileW
SetThreadpoolTimer
CloseThreadpoolTimer
GetComputerNameExW

advapi32

GetSecurityDescriptorGroup
ControlService
StartServiceW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetNamedSecurityInfoW
DestroyPrivateObjectSecurity
GetSecurityDescriptorSacl
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
RegCreateKeyExW
RegGetValueW
RegSetValueExW
OpenServiceW
ChangeServiceConfigW
QueryServiceConfigW
CloseServiceHandle
OpenSCManagerW
RegOpenKeyExW

api-ms-win-crt-locale-l1-1-0

_unlock_locales
_lock_locales

iphlpapi

GetIfEntry2
GetUnicastIpAddressTable
FreeMibTable
GetUnicastIpAddressEntry

ws2_32

InetNtopW

api-ms-win-core-path-l1-1-0

PathCchCombine

userenv

GetAllUsersProfileDirectoryW

bcrypt

BCryptCloseAlgorithmProvider
BCryptDestroyHash

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

Sections

.text
Size: 276KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe4dc91f265f917e0c9a896e7c9ca92f

Code Sign

33:00:00:04:6f:5a:72:76:81:13:5a:26:6c:00:00:00:00:04:6fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

18:3e:b7:6b:dc:20:ab:0d:7d:26:d0:53:b5:37:e7:67:91:7a:c4:6f:4c:99:2f:29:8e:f5:bf:c4:67:c9:3d:c0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-com-l1-1-0

setupapi

version

ntdll

kernel32

advapi32

api-ms-win-crt-locale-l1-1-0

iphlpapi

ws2_32

api-ms-win-core-path-l1-1-0

userenv

bcrypt

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-util-l1-1-0

Sections

.text Size: 276KB - Virtual size: 273KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 132KB - Virtual size: 128KB

.data Size: 16KB - Virtual size: 18KB

.pdata Size: 20KB - Virtual size: 17KB

.didat Size: 4KB - Virtual size: 32B

.rsrc Size: 36KB - Virtual size: 34KB

.reloc Size: 4KB - Virtual size: 1KB

33:00:00:04:6f:5a:72:76:81:13:5a:26:6c:00:00:00:00:04:6f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

18:3e:b7:6b:dc:20:ab:0d:7d:26:d0:53:b5:37:e7:67:91:7a:c4:6f:4c:99:2f:29:8e:f5:bf:c4:67:c9:3d:c0
Signer

.text
Size: 276KB - Virtual size: 273KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 132KB - Virtual size: 128KB

.data
Size: 16KB - Virtual size: 18KB

.pdata
Size: 20KB - Virtual size: 17KB

.didat
Size: 4KB - Virtual size: 32B

.rsrc
Size: 36KB - Virtual size: 34KB

.reloc
Size: 4KB - Virtual size: 1KB