Static task
static1
Behavioral task
behavioral1
Sample
ManagementEventWatcher.exe
Resource
win11-20240426-en
General
-
Target
ManagementEventWatcher.exe
-
Size
380KB
-
MD5
f9f38e6529580e00ea8755b07d5c1255
-
SHA1
4cd85e53da1a056614a048771f6dea791ceb3190
-
SHA256
dafaf426f351c74ed3ab56fe35810f115260c21ccf28149d135310bf314b9bc8
-
SHA512
1cf7765abeb53258172b9789555866f97f82cb94ebe03f39f5e996f37835922bc1154c8ddf5086b967330ebd1e3a0321bf1f673f8d107c2e958f6ecf42db475a
-
SSDEEP
6144:yCqSFsY1idk+H7N2P0xh5OF8Y19DYDYmJ4Aef8A06cxzdZtY:yRSFsYsN28xhAFjDmYmJgpcxzp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ManagementEventWatcher.exe
Files
-
ManagementEventWatcher.exe.exe windows:4 windows x64 arch:x64
Password: zxc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 305KB - Virtual size: 305KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 74KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ