USBRepair_X64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
USBRepair_X64.exe
Size 2.1MB
Sample240923-pjlf8swejp
SHA256 08dad5de9cbadb265b2c8b6d3eb770eeaa5a8689a8c7dd2d735763dbab417e98
MD5 3fb14840c53566b9158a2f6fe69ec71b
SHA1 05e05e600e4b9903fd2e735ecf096035575d194b
SHA512 457cce60429fa13edb853461cd54fdc9d89aa1bcc4be10db476ac0efef50a5890f2190b6ee1d98513970fa5b5790fab9cd9ab342779e0a4861c2cc464c8fd8d5
SSDEEP 49152:m2EYTb8atv1orq+pEiSDTj1VyvBaE/xfWjK2H/h0+dSIg7f/FI:DXbIrqm/xfUh0IR
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
sample	autoit_exe

File Explorer

USBRepair_X64.exe

.exe 2.1MB

USBRepair_X64.exe

IMPHASH 8e94250c88a6c0e478828f96bcbb1662
SHA256 08dad5de9cbadb265b2c8b6d3eb770eeaa5a8689a8c7dd2d735763dbab417e98
MD5 3fb14840c53566b9158a2f6fe69ec71b
SHA1 05e05e600e4b9903fd2e735ecf096035575d194b
SHA512 457cce60429fa13edb853461cd54fdc9d89aa1bcc4be10db476ac0efef50a5890f2190b6ee1d98513970fa5b5790fab9cd9ab342779e0a4861c2cc464c8fd8d5
SSDEEP 49152:m2EYTb8atv1orq+pEiSDTj1VyvBaE/xfWjK2H/h0+dSIg7f/FI:DXbIrqm/xfUh0IR
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

AutoIT Executable

AutoIT scripts compiled to PE executables.

Digest

13:ac:5c:7b:d1:20:d4:92:b0:ab:62:79:22:74:9d:e0:16:ac:eb:58:ca:ad:05:f7:c2:9b:0f:4b:22:73:c5:28

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Open Source Developer\, Derick Payne,O=Open Source Developer,L=George,C=ZA,1.2.840.113549.1.9.1=#0c13696e666f4072697a6f6e65736f66742e636f6d

Chains

Oct 30, 2023

CN=Open Source Developer\, Derick Payne,O=Open Source Developer,L=George,C=ZA,1.2.840.113549.1.9.1=#0c13696e666f4072697a6f6e65736f66742e636f6d

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Open Source Developer\, Derick Payne,O=Open Source Developer,L=George,C=ZA,1.2.840.113549.1.9.1=#0c13696e666f4072697a6f6e65736f66742e636f6d

Serial Number

76:8a:6a:91:ba:30:15:fa:95:c8:3e:6c:37:f2:7b:ab

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 16, 2023 - Jun 15, 2024

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Serial Number

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 28, 2022 - Jul 27, 2033

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

152732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

wsock32

gethostbyname recv send socket inet_ntoa setsockopt ntohs WSACleanup WSAStartup sendto htons __WSAFDIsSet select accept listen bind inet_addr ioctlsocket recvfrom WSAGetLastError closesocket gethostname connect

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

timeGetTime waveOutSetVolume mciSendStringW

comctl32

ImageList_ReplaceIcon ImageList_Destroy ImageList_Remove ImageList_SetDragCursorImage ImageList_BeginDrag ImageList_DragEnter ImageList_DragLeave ImageList_EndDrag ImageList_DragMove InitCommonControlsEx ImageList_Create

mpr

WNetGetConnectionW WNetCancelConnection2W WNetUseConnectionW WNetAddConnection2W

wininet

HttpOpenRequestW InternetCloseHandle InternetOpenW InternetSetOptionW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW InternetConnectW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetReadFile InternetQueryDataAvailable

psapi

GetProcessMemoryInfo

iphlpapi

IcmpSendEcho IcmpCloseHandle IcmpCreateFile

userenv

DestroyEnvironmentBlock LoadUserProfileW CreateEnvironmentBlock UnloadUserProfile

uxtheme

IsThemeActive

kernel32

WaitForSingleObject HeapAlloc GetProcessHeap HeapFree Sleep GetCurrentThreadId MultiByteToWideChar MulDiv GetVersionExW IsWow64Process GetSystemInfo FreeLibrary LoadLibraryA GetProcAddress SetErrorMode GetModuleFileNameW WideCharToMultiByte lstrcpyW lstrlenW GetModuleHandleW QueryPerformanceCounter VirtualFreeEx OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW SetFilePointerEx SetEndOfFile ReadFile WriteFile FlushFileBuffers TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW SetFileTime GetFileAttributesW FindFirstFileW FindClose GetLongPathNameW GetShortPathNameW DeleteFileW FindNextFileW CopyFileExW GetFullPathNameW CreateDirectoryW RemoveDirectoryW SetSystemPowerState QueryPerformanceFrequency LoadResource LockResource SizeofResource OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl LoadLibraryW GetLocalTime CompareStringW EnterCriticalSection DuplicateHandle GetStdHandle CreatePipe TerminateThread LoadLibraryExW FindResourceExW CopyFileW VirtualFree FormatMessageW GetExitCodeProcess GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileSectionW WritePrivateProfileSectionW GetPrivateProfileSectionNamesW FileTimeToLocalFileTime FileTimeToSystemTime SystemTimeToFileTime LocalFileTimeToFileTime GetDriveTypeW GetDiskFreeSpaceExW GetDiskFreeSpaceW GetVolumeInformationW SetVolumeLabelW CreateHardLinkW SetFileAttributesW CreateEventW SetEvent GetEnvironmentVariableW SetEnvironmentVariableW GlobalLock GlobalUnlock GlobalAlloc GetFileSize GlobalFree GlobalMemoryStatusEx Beep GetSystemDirectoryW HeapReAlloc HeapSize GetComputerNameW GetWindowsDirectoryW GetCurrentProcessId GetProcessIoCounters CreateProcessW GetProcessId SetPriorityClass VirtualAlloc SetCurrentDirectoryW IsDebuggerPresent GetCurrentDirectoryW lstrcmpiW GetLastError RaiseException InitializeCriticalSectionAndSpinCount DeleteCriticalSection RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetSystemTimeAsFileTime CreateThread GetCurrentProcess GetCurrentThread LeaveCriticalSection InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError TlsAlloc ResetEvent WaitForSingleObjectEx TlsGetValue TlsSetValue TlsFree EncodePointer ExitProcess GetModuleHandleExW ExitThread ResumeThread FreeLibraryAndExitThread GetACP GetDateFormatW GetTimeFormatW LCMapStringW GetStringTypeW GetFileType SetStdHandle GetConsoleCP GetConsoleMode ReadConsoleW GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA CloseHandle WriteConsoleW MoveFileW RtlCaptureContext

user32

GetMenuStringW GetSubMenu GetCaretPos IsZoomed GetWindowLongW GetMonitorInfoW SetWindowLongW SetLayeredWindowAttributes FlashWindow GetClassLongPtrW TranslateAcceleratorW IsDialogMessageW GetSysColor InflateRect DrawFocusRect DrawTextW FrameRect DrawFrameControl FillRect PtInRect DestroyAcceleratorTable CreateAcceleratorTableW SetCursor GetWindowDC GetSystemMetrics SetWindowLongPtrW GetActiveWindow CharNextW wsprintfW RedrawWindow DrawMenuBar DestroyMenu SetMenu GetWindowTextLengthW CreateMenu IsDlgButtonChecked DefDlgProcW CallWindowProcW ReleaseCapture SetCapture BlockInput GetMessageW LockWindowUpdate DispatchMessageW TranslateMessage PeekMessageW GetInputState UnregisterHotKey CharLowerBuffW MonitorFromPoint MonitorFromRect LoadImageW mouse_event ExitWindowsEx SetActiveWindow FindWindowExW EnumThreadWindows IsCharUpperW InsertMenuItemW IsMenu TrackPopupMenuEx GetCursorPos DeleteMenu CheckMenuRadioItem GetMenuItemID GetMenuItemCount SetMenuItemInfoW GetMenuItemInfoW SetForegroundWindow IsIconic FindWindowW GetClipboardData keybd_event SendInput GetAsyncKeyState SetKeyboardState GetKeyboardState GetKeyState VkKeyScanW LoadStringW DialogBoxParamW MessageBeep EndDialog SendDlgItemMessageW GetDlgItem SetWindowTextW CopyRect ReleaseDC GetDC EndPaint BeginPaint GetClientRect GetMenu DestroyWindow EnumWindows GetDesktopWindow IsWindow IsWindowEnabled IsWindowVisible EnableWindow InvalidateRect GetWindowThreadProcessId AttachThreadInput GetFocus GetWindowTextW ScreenToClient SendMessageTimeoutW EnumChildWindows CharUpperBuffW GetClassNameW GetParent GetDlgCtrlID SendMessageW MapVirtualKeyW PostMessageW IsCharLowerW IsCharAlphaNumericW IsCharAlphaW GetKeyboardLayoutNameW ClientToScreen RegisterHotKey GetCursorInfo SetWindowPos CopyImage AdjustWindowRectEx SetRect SetClipboardData EmptyClipboard CountClipboardFormats SetMenuDefaultItem CloseClipboard GetWindowRect SetUserObjectSecurity IsClipboardFormatAvailable CloseDesktop CloseWindowStation OpenDesktopW SetProcessWindowStation GetProcessWindowStation OpenWindowStationW GetUserObjectSecurity MessageBoxW DefWindowProcW MoveWindow SetFocus PostQuitMessage KillTimer CreatePopupMenu RegisterWindowMessageW SetTimer ShowWindow CreateWindowExW RegisterClassExW LoadIconW LoadCursorW GetSysColorBrush GetForegroundWindow MessageBoxA DestroyIcon SystemParametersInfoW OpenClipboard GetWindowLongPtrW

gdi32

EndPath DeleteObject GetDeviceCaps ExtCreatePen StrokePath SetPixel CloseFigure LineTo AngleArc MoveToEx Ellipse PolyDraw GetTextExtentPoint32W CreateCompatibleBitmap BeginPath Rectangle SetViewportOrgEx GetObjectW SetBkMode RoundRect SetBkColor CreatePen CreateSolidBrush SetTextColor CreateFontW GetTextFaceW GetStockObject CreateDCW GetPixel DeleteDC GetDIBits StretchBlt SelectObject CreateCompatibleDC StrokeAndFillPath

comdlg32

GetSaveFileNameW GetOpenFileNameW

advapi32

GetAce RegEnumValueW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegCloseKey RegQueryValueExW RegConnectRegistryW InitializeSecurityDescriptor InitializeAcl AdjustTokenPrivileges OpenThreadToken OpenProcessToken LookupPrivilegeValueW DuplicateTokenEx CreateProcessAsUserW CreateProcessWithLogonW GetLengthSid CopySid LogonUserW AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation RegSetValueExW GetSecurityDescriptorDacl GetAclInformation RegCreateKeyExW AddAce SetSecurityDescriptorDacl InitiateSystemShutdownExW GetUserNameW

shell32

DragFinish DragQueryPoint ShellExecuteExW DragQueryFileW SHEmptyRecycleBinW SHGetPathFromIDListW SHBrowseForFolderW SHCreateShellItem SHGetDesktopFolder SHGetSpecialFolderLocation SHGetFolderPathW SHFileOperationW ExtractIconExW Shell_NotifyIconW ShellExecuteW

ole32

CoTaskMemAlloc CoTaskMemFree CLSIDFromString ProgIDFromCLSID CLSIDFromProgID OleSetMenuDescriptor MkParseDisplayName OleSetContainedObject CoCreateInstance IIDFromString StringFromGUID2 CreateStreamOnHGlobal OleInitialize OleUninitialize CoInitialize CoUninitialize GetRunningObjectTable CoGetInstanceFromFile CoGetObject CoInitializeSecurity CoCreateInstanceEx CoSetProxyBlanket

oleaut32

VariantChangeType DispCallFunc CreateStdDispatch CreateDispTypeInfo UnRegisterTypeLi UnRegisterTypeLibForUser RegisterTypeLibForUser RegisterTypeLi LoadTypeLibEx VariantCopyInd VariantTimeToSystemTime SysFreeString SafeArrayDestroyDescriptor SafeArrayDestroyData SafeArrayUnaccessData VariantInit VariantClear VariantCopy SysAllocString SafeArrayCreateVector VarR8FromDec SafeArrayAllocDescriptorEx SafeArrayAllocData SysStringLen SafeArrayGetVartype OleLoadPicture QueryPathOfRegTypeLi SysReAllocString SafeArrayAccessData

Sharing

General

Malware Config

Signatures

File Explorer

USBRepair_X64.exe

wsock32

version

winmm

comctl32

mpr

wininet

psapi

iphlpapi

userenv

uxtheme

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic