regedit[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

regedit.exe
Size

540KB
MD5

0da3b7b307fbf6d3aa2e0353d6bb81e7
SHA1

1e1cb6e08516df408f6823c1f3ef6ab114e58c31
SHA256

50955323ff4d69a05ef4a97d7af4d48bdcdf59d6624cdb72931778fdb39e7d8b
SHA512

4e32d52f7960eb6041bacd9fa2d90c6ea2a174076555b831c791dea2ceec14a4638e4d8b48e75fb9141615ea78bfdc2c5469f6db77197060ddda0bc40cb67a7c
SSDEEP

12288:WEXyAWB6wiVyjK5M+zQRZ66z24VZbdrpgrXN2LWzmidN41U:6AWAwioK5MY6Z66z24VZbFpgJ2LWzmiN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
regedit.exe

Files

regedit.exe
.exe windows:10 windows x64 arch:x64

aba5c899a3a92e9a15873ad4446c2072

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

regedit.pdb

Imports

gdi32

SetTextAlign
SetROP2
TranslateCharsetInfo
Polyline
GetStockObject
GetTextExtentPoint32W
StartPage
AbortDoc
EndDoc
DeleteDC
SetViewportOrgEx
SetAbortProc
StartDocW
EndPage
CreatePatternBrush
CreateBitmap
PatBlt
SelectClipRgn
GetObjectW
ExcludeClipRect
SelectObject
GetDeviceCaps
GetTextMetricsW
SetTextColor
SetBkColor
DeleteObject
CreateFontIndirectW
CreatePen
ExtTextOutW

user32

CreateCaret
EmptyClipboard
CloseClipboard
SetTimer
OpenClipboard
GetSubMenu
SetCaretPos
GetWindowLongPtrW
MessageBeep
GetSystemMetrics
EndDialog
HideCaret
SetWindowLongPtrW
SetWindowPos
GetDC
GetWindowRect
LoadMenuW
CharLowerW
GetKeyState
DefWindowProcW
RegisterClipboardFormatW
SetScrollInfo
GetWindowTextW
GetParent
IsDlgButtonChecked
GetDlgItemTextW
SendMessageW
CheckRadioButton
GetDlgItemInt
CallWindowProcW
GetWindowTextLengthW
EnableWindow
SetCursorPos
IsIconic
GetDpiForSystem
ShowCursor
LoadImageW
RegisterClassW
DialogBoxParamW
PostQuitMessage
CheckMenuItem
GetSystemMetricsForDpi
SetWindowLongW
SetCursor
InsertMenuW
EndDeferWindowPos
DrawMenuBar
GetProcessDefaultLayout
LoadIconW
TranslateMessage
TranslateAcceleratorW
GetSysColor
SetThreadDpiAwarenessContext
SetMenuDefaultItem
SetWindowPlacement
SetMenuItemInfoW
ClientToScreen
DestroyIcon
DispatchMessageW
BeginDeferWindowPos
ShowWindow
LoadStringW
LoadAcceleratorsW
GetWindowPlacement
RegisterClassExW
SetWindowTextW
ScreenToClient
DeleteMenu
CreateWindowExW
GetDpiForWindow
InsertMenuItemW
GetMenu
GetMenuItemID
PostMessageW
GetMenuItemInfoW
DeferWindowPos
GetMessageW
GetWindowLongW
GetClientRect
CharNextW
DestroyWindow
CreateDialogParamW
CheckDlgButton
IntersectRect
GetMessagePos
ModifyMenuW
DrawAnimatedRects
SetForegroundWindow
FindWindowW
BringWindowToTop
GetLastActivePopup
PeekMessageW
IsDialogMessageW
MessageBoxW
GetWindow
CharUpperBuffW
IsCharAlphaNumericW
CharUpperW
SetRect
DrawFocusRect
GetDlgCtrlID
RedrawWindow
SetDlgItemTextW
MapWindowPoints
SendDlgItemMessageW
MoveWindow
DestroyMenu
SetFocus
GetClipboardData
ScrollWindowEx
LoadCursorW
DestroyCaret
SetCapture
SetClipboardData
TrackPopupMenuEx
GetDlgItem
IsClipboardFormatAvailable
ShowCaret
KillTimer
EnableMenuItem
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
UpdateWindow

msvcrt

exit
_unlock
_exit
_ismbblead
__setusermatherr
_initterm
memcpy
_acmdln
_fmode
_commode
__CxxFrameHandler3
_lock
memmove
?terminate@@YAXXZ
_vsnwprintf
atoi
wcstok
_onexit
__dllonexit
_cexit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
free
_wcsdup
iswprint
_resetstkoflw
__C_specific_handler
wcsncmp
wcsrchr
_wcsnicmp
isspace
wcschr
_purecall
memcpy_s
memset

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleExW
FreeLibrary
GetModuleHandleW
GetModuleFileNameA

api-ms-win-core-localization-l1-2-0

GetACP
FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc
GlobalAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock
GlobalUnlock

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegUnLoadKeyW
RegCreateKeyExW
RegLoadKeyW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegSetValueExA
RegFlushKey
RegSetKeySecurity
RegEnumValueW
RegOpenKeyExW
RegRestoreKeyW
RegQueryInfoKeyW
RegGetValueW
RegQueryValueExW

api-ms-win-core-registry-l2-1-0

RegSaveKeyW
RegCreateKeyW
RegEnumKeyW
RegSetValueW
RegConnectRegistryW
RegOpenKeyW
RegDeleteKeyW

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
CreateMutexExW
WaitForSingleObject
OpenSemaphoreW
CreateSemaphoreExW
WaitForSingleObjectEx
ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc
HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetLastError

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemAlloc

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
CompareStringOrdinal
MultiByteToWideChar

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetStartupInfoW
OpenProcessToken
ExitProcess
TerminateProcess
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-path-l1-1-0

PathCchAddBackslash
PathCchCombine

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-windowserrorreporting-l1-1-3

RegisterApplicationRestart

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

ntdll

RtlCmDecodeMemIoResource
RtlFreeUnicodeString
RtlInitUnicodeString
RtlCreateUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlIoDecodeMemIoResource

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
GetCommandLineW

api-ms-win-core-file-l1-1-0

FileTimeToLocalFileTime
DeleteFileW
GetFileSize
GetLongPathNameW
ReadFile
WriteFile
SetFilePointer
CreateFileW

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
SetNamedSecurityInfoW
SetSecurityInfo
GetNamedSecurityInfoW

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorOwner
GetSecurityDescriptorOwner
SetSecurityDescriptorSacl
IsValidSecurityDescriptor
GetSecurityDescriptorDacl
GetSidSubAuthorityCount
InitializeAcl
MapGenericMask
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetSecurityDescriptorSacl
AdjustTokenPrivileges
InitializeSecurityDescriptor
SetSecurityDescriptorGroup
GetSecurityDescriptorGroup
GetSidSubAuthority

api-ms-win-security-lsalookup-l2-1-0

LookupPrivilegeValueW
LookupAccountSidW

authz

AuthzAccessCheck
AuthzFreeContext
AuthzInitializeContextFromSid
AuthzInitializeResourceManager
AuthzFreeResourceManager

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrToIntW
StrChrIW
QISearch
StrRChrW
StrStrIW
StrChrW

api-ms-win-shell-dataobject-l1-1-1

DragQueryFileW

api-ms-win-core-registry-private-l1-1-0

RegRenameKey

api-ms-win-shlwapi-winrt-storage-l1-1-1

ShellMessageBoxW

comctl32

ord338
ord334
ord340
ord2
ImageList_Destroy
ord337
ImageList_Create
ord384
ImageList_SetBkColor
ImageList_ReplaceIcon
ord410
ord413
ord329
ord236
InitCommonControlsEx
ord17
ord4

ulib

?Compare@OBJECT@@UEBAJPEBV1@@Z
??1OBJECT@@UEAA@XZ
?QueryChCount@WSTRING@@QEBAKXZ
?SetClassDescriptor@OBJECT@@IEAAXPEBVCLASS_DESCRIPTOR@@@Z
??0OBJECT@@IEAA@XZ
?SPrintfAppend@DSTRING@@UEAAEPEBGZZ
?SPrintf@DSTRING@@UEAAEPEBGZZ
?NewBuf@DSTRING@@UEAAEK@Z
?Resize@DSTRING@@UEAAEK@Z
?Initialize@ARRAY@@QEAAEKK@Z
??0ARRAY@@QEAA@XZ
??1DSTRING@@UEAA@XZ
?GetWSTR@WSTRING@@QEBAPEBGXZ
?Initialize@WSTRING@@QEAAEPEBGK@Z
?Initialize@WSTRING@@QEAAEPEBV1@KK@Z
?Strcat@WSTRING@@QEAAEPEBV1@@Z
?DebugDump@OBJECT@@UEBAXE@Z
??0DSTRING@@QEAA@XZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 432B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aba5c899a3a92e9a15873ad4446c2072

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-3

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

authz

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shell-dataobject-l1-1-1

api-ms-win-core-registry-private-l1-1-0

api-ms-win-shlwapi-winrt-storage-l1-1-1

comctl32

ulib

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 152KB - Virtual size: 151KB

.rdata Size: 32KB - Virtual size: 29KB

.data Size: 4KB - Virtual size: 266KB

.pdata Size: 8KB - Virtual size: 5KB

.didat Size: 4KB - Virtual size: 160B

.rsrc Size: 332KB - Virtual size: 329KB

.reloc Size: 4KB - Virtual size: 432B

.text
Size: 152KB - Virtual size: 151KB

.rdata
Size: 32KB - Virtual size: 29KB

.data
Size: 4KB - Virtual size: 266KB

.pdata
Size: 8KB - Virtual size: 5KB

.didat
Size: 4KB - Virtual size: 160B

.rsrc
Size: 332KB - Virtual size: 329KB

.reloc
Size: 4KB - Virtual size: 432B