ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
wiasvc.bat
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
wiasvc.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
wiasvc32.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
wiasvc32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
wiasvc64.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
wiasvc64.dll
Resource
win10v2004-20240426-en
General
-
Target
51cc96fe79f9bd66651476a6a6fb61232302c74e273f21246ab0a47b51c07fb0.cab
-
Size
1.3MB
-
MD5
66f6a7c5ebbabe401e72c77c6aa5b727
-
SHA1
63ee908224dbbc595865725b71772d0269f14b53
-
SHA256
51cc96fe79f9bd66651476a6a6fb61232302c74e273f21246ab0a47b51c07fb0
-
SHA512
63e8c26544e236ffba2d9e1e40598f0cab94af2215a388097baaa16c11e78f97b5070fec07f4c0fac260c7968ad1f789c7568c53fca74d7031e8aae082269219
-
SSDEEP
24576:DNbEuzeRdzHLgsoGIEC+usLz9u6QTuygsUW50jku/mqPS6WN9Mi0NTB:dK3bJCj0Y6VFM0AAXK6ejCB
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/wiasvc32.dll unpack001/wiasvc64.dll
Files
-
51cc96fe79f9bd66651476a6a6fb61232302c74e273f21246ab0a47b51c07fb0.cab.cab
-
wiasvc.bat.bat .vbs
-
wiasvc.ini
-
wiasvc32.dll.dll windows:5 windows x86 arch:x86
6300c875744f8dbfd28c9a73de93dc15
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
SetLastError
HeapAlloc
HeapFree
CreateEventW
CloseHandle
SetEvent
GetModuleFileNameW
WaitForSingleObject
Sleep
LoadLibraryW
GetLocalTime
GetComputerNameW
UnmapViewOfFile
GetTickCount
CreateFileW
GetFileSize
LocalAlloc
ReadFile
LocalFree
GetTempPathW
GetTempFileNameW
DeleteFileW
WriteFile
CopyFileW
CreateProcessW
OpenProcess
GetLastError
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapReAlloc
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStringTypeW
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
HeapSize
RaiseException
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
MultiByteToWideChar
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetModuleHandleW
HeapDestroy
GetProcAddress
MapViewOfFile
CreateFileMappingW
advapi32
OpenProcessToken
CreateProcessAsUserW
shell32
CommandLineToArgvW
SHGetFolderPathW
wininet
InternetGetConnectedState
InternetOpenW
InternetConnectW
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestW
HttpEndRequestW
InternetQueryDataAvailable
InternetReadFile
FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache
shlwapi
StrTrimW
Exports
Exports
Sections
.text Size: 56KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.puimn0 Size: 568KB - Virtual size: 567KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
wiasvc64.dll.dll windows:5 windows x64 arch:x64
8b3df00b282dbdaccc3482970cbbaeb9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
Imports
kernel32
SetLastError
HeapAlloc
HeapFree
CreateEventW
CloseHandle
SetEvent
GetModuleFileNameW
WaitForSingleObject
Sleep
LoadLibraryW
GetLocalTime
GetComputerNameW
UnmapViewOfFile
GetTickCount
CreateFileW
GetFileSize
LocalAlloc
ReadFile
LocalFree
GetTempPathW
GetTempFileNameW
DeleteFileW
WriteFile
CopyFileW
CreateProcessW
OpenProcess
GetLastError
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapReAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FlsGetValue
FlsFree
FlsAlloc
GetStringTypeW
RtlUnwindEx
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
RaiseException
RtlPcToFileHeader
LeaveCriticalSection
EnterCriticalSection
LCMapStringW
MultiByteToWideChar
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetModuleHandleW
RtlLookupFunctionEntry
GetProcAddress
MapViewOfFile
CreateFileMappingW
advapi32
OpenProcessToken
CreateProcessAsUserW
shell32
CommandLineToArgvW
SHGetFolderPathW
wininet
InternetGetConnectedState
InternetOpenW
InternetConnectW
InternetCloseHandle
HttpOpenRequestW
HttpSendRequestW
HttpEndRequestW
InternetQueryDataAvailable
InternetReadFile
FindFirstUrlCacheEntryW
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindCloseUrlCache
shlwapi
StrTrimW
Exports
Exports
ServiceMain
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.piuy0 Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 832B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ