regedit[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

regedit.exe
Size

592KB
MD5

9337f6f1190c3e2f66be84b046760101
SHA1

29435dc467af965f1a1ad1bb129cadeef3c1b99c
SHA256

2cf1761ba311f1c3a927b87a4c0bb5f691f728e0b0e7de6bcb3a236a6f87d3bc
SHA512

7d70ec532afaaa72f4a39aa167eb161910ad19ee2a5dc0766be5f854e85ca04088edd06ac275268016cb4cb3c73974914c2ef79d7d278f237909c7b1b1e73d49
SSDEEP

12288:CGgDv0Gaz4BhEKR37uA32/KgiQRZ66z24VZbdrpgrXN2LWzmidN41U:MrSz4fEKR375EKgi6Z66z24VZbFpgJ2y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
regedit.exe

Files

regedit.exe
.exe windows:10 windows x64 arch:x64

5abecebf26ef1611baeacb62b7b4e2a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

regedit.pdb

Imports

gdi32

SetTextAlign
SetROP2
GetTextExtentPoint32W
Polyline
GetStockObject
StartPage
AbortDoc
EndDoc
DeleteDC
SetViewportOrgEx
SetAbortProc
StartDocW
EndPage
CreatePatternBrush
CreateBitmap
PatBlt
SelectClipRgn
GetObjectW
ExcludeClipRect
SelectObject
GetDeviceCaps
TranslateCharsetInfo
GetTextMetricsW
SetTextColor
SetBkColor
DeleteObject
CreateFontIndirectW
CreatePen
ExtTextOutW

user32

CreateCaret
EmptyClipboard
CloseClipboard
SetTimer
OpenClipboard
GetSubMenu
SetCaretPos
GetWindowLongPtrW
MessageBeep
GetSystemMetrics
EndDialog
HideCaret
SetWindowLongPtrW
SetWindowPos
GetDC
GetWindowRect
LoadMenuW
CharLowerW
GetKeyState
DefWindowProcW
RegisterClipboardFormatW
SetScrollInfo
GetWindowTextW
GetParent
IsDlgButtonChecked
GetDlgItemTextW
SendMessageW
CheckRadioButton
GetDlgItemInt
CallWindowProcW
GetWindowTextLengthW
EnableWindow
SetCursorPos
IsIconic
GetDpiForSystem
ShowCursor
RegisterClassW
UpdateWindow
DialogBoxParamW
PostQuitMessage
CheckMenuItem
GetSystemMetricsForDpi
SetWindowLongW
SetCursor
InsertMenuW
EndDeferWindowPos
DrawMenuBar
GetProcessDefaultLayout
LoadIconW
TranslateMessage
TranslateAcceleratorW
GetSysColor
SetThreadDpiAwarenessContext
SetMenuDefaultItem
SetWindowPlacement
SetMenuItemInfoW
ClientToScreen
DestroyIcon
DispatchMessageW
BeginDeferWindowPos
ShowWindow
LoadStringW
LoadAcceleratorsW
GetWindowPlacement
RegisterClassExW
SetWindowTextW
ScreenToClient
DeleteMenu
CreateWindowExW
GetDpiForWindow
InsertMenuItemW
GetMenu
GetMenuItemID
PostMessageW
GetMenuItemInfoW
DeferWindowPos
GetMessageW
GetWindowLongW
GetClientRect
CharNextW
DestroyWindow
CreateDialogParamW
CheckDlgButton
IntersectRect
GetMessagePos
ModifyMenuW
DrawAnimatedRects
SetForegroundWindow
FindWindowW
BringWindowToTop
GetLastActivePopup
PeekMessageW
IsDialogMessageW
MessageBoxW
GetWindow
CharUpperBuffW
IsCharAlphaNumericW
CharUpperW
SetRect
DrawFocusRect
GetDlgCtrlID
RedrawWindow
MapWindowPoints
SendDlgItemMessageW
MoveWindow
DestroyMenu
SetFocus
GetClipboardData
ScrollWindowEx
LoadCursorW
DestroyCaret
SetCapture
SetClipboardData
TrackPopupMenuEx
GetDlgItem
IsClipboardFormatAvailable
ShowCaret
KillTimer
EnableMenuItem
ReleaseCapture
InvalidateRect
ReleaseDC
BeginPaint
EndPaint
SetDlgItemTextW
LoadImageW

msvcrt

__CxxFrameHandler3
__setusermatherr
wcstok
memcpy
_onexit
memset
memcmp
?terminate@@YAXXZ
__dllonexit
_unlock
_vsnwprintf
_lock
_acmdln
_commode
memcpy_s
_purecall
atoi
memmove_s
wcschr
_fmode
isspace
_initterm
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
free
_wcsdup
iswprint
_resetstkoflw
__C_specific_handler
wcsncmp
wcsrchr
_wcsnicmp
memmove

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
GetProcAddress

api-ms-win-core-localization-l1-2-0

GetACP
FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalAlloc
GlobalAlloc
LocalFree
LocalReAlloc

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock
GlobalLock

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegSetKeySecurity
RegGetValueW
RegLoadKeyW
RegUnLoadKeyW
RegEnumValueW
RegFlushKey
RegDeleteValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegRestoreKeyW
RegSetValueExA

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceComplete
InitOnceBeginInitialize

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionEx
CreateMutexExW
WaitForSingleObjectEx
DeleteCriticalSection
OpenSemaphoreW
AcquireSRWLockExclusive
WaitForSingleObject
ReleaseMutex
ReleaseSRWLockShared
EnterCriticalSection
ReleaseSemaphore
CreateSemaphoreExW
ReleaseSRWLockExclusive
LeaveCriticalSection
AcquireSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree
HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventUnregister
EventSetInformation
EventWriteTransfer

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CreateThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

ExitProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
OpenProcessToken
GetCurrentThreadId

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l2-1-0

RegCreateKeyW
RegOpenKeyW
RegSaveKeyW
RegDeleteKeyW
RegEnumKeyW
RegConnectRegistryW
RegSetValueW

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-path-l1-1-0

PathCchAddBackslash
PathCchCombine

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-largeinteger-l1-1-0

MulDiv

api-ms-win-core-windowserrorreporting-l1-1-3

RegisterApplicationRestart

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpW
lstrcmpiW

ntdll

RtlFreeUnicodeString
RtlCreateUnicodeString
RtlAllocateHeap
RtlFreeHeap
RtlCmDecodeMemIoResource
RtlIoDecodeMemIoResource
RtlInitUnicodeString

api-ms-win-core-processenvironment-l1-1-0

SearchPathW
GetCommandLineW

api-ms-win-core-file-l1-1-0

WriteFile
DeleteFileW
GetFileSize
GetLongPathNameW
FileTimeToLocalFileTime
CreateFileW
ReadFile
SetFilePointer

api-ms-win-security-provider-l1-1-0

GetSecurityInfo
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetSecurityInfo

api-ms-win-security-base-l1-1-0

InitializeAcl
GetSecurityDescriptorControl
InitializeSecurityDescriptor
AdjustTokenPrivileges
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetSidSubAuthority
SetSecurityDescriptorOwner
GetSidSubAuthorityCount
IsValidSecurityDescriptor
GetSecurityDescriptorGroup
SetSecurityDescriptorSacl
SetSecurityDescriptorGroup
MapGenericMask
GetSecurityDescriptorOwner

api-ms-win-security-lsalookup-l2-1-0

LookupAccountSidW
LookupPrivilegeValueW

authz

AuthzFreeResourceManager
AuthzFreeContext
AuthzInitializeContextFromSid
AuthzInitializeResourceManager
AuthzAccessCheck

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW
QISearch
StrChrIW
StrRChrW
StrChrW
StrToIntW

api-ms-win-shell-dataobject-l1-1-1

DragQueryFileW

api-ms-win-core-registry-private-l1-1-0

RegRenameKey

api-ms-win-shlwapi-winrt-storage-l1-1-1

ShellMessageBoxW

comctl32

ord17
InitCommonControlsEx
ord236
ord337
ord329
ord338
ord334
ord340
ord2
ImageList_Destroy
ord4
ImageList_Create
ord384
ImageList_SetBkColor
ImageList_ReplaceIcon
ord410
ord413

ulib

?Compare@OBJECT@@UEBAJPEBV1@@Z
??1OBJECT@@UEAA@XZ
?QueryChCount@WSTRING@@QEBAKXZ
?SetClassDescriptor@OBJECT@@IEAAXPEBVCLASS_DESCRIPTOR@@@Z
??0OBJECT@@IEAA@XZ
?SPrintfAppend@DSTRING@@UEAAEPEBGZZ
?SPrintf@DSTRING@@UEAAEPEBGZZ
?NewBuf@DSTRING@@UEAAEK@Z
?Resize@DSTRING@@UEAAEK@Z
?Initialize@ARRAY@@QEAAEKK@Z
??0ARRAY@@QEAA@XZ
?DebugDump@OBJECT@@UEBAXE@Z
?GetWSTR@WSTRING@@QEBAPEBGXZ
?Initialize@WSTRING@@QEAAEPEBGK@Z
?Initialize@WSTRING@@QEAAEPEBV1@KK@Z
?Strcat@WSTRING@@QEAAEPEBV1@@Z
??0DSTRING@@QEAA@XZ
??1DSTRING@@UEAA@XZ

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 196KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 332KB - Virtual size: 329KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 560B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5abecebf26ef1611baeacb62b7b4e2a6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

gdi32

user32

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-path-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-largeinteger-l1-1-0

api-ms-win-core-windowserrorreporting-l1-1-3

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

authz

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-shell-dataobject-l1-1-1

api-ms-win-core-registry-private-l1-1-0

api-ms-win-shlwapi-winrt-storage-l1-1-1

comctl32

ulib

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 196KB - Virtual size: 193KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 36KB - Virtual size: 34KB

.data Size: 4KB - Virtual size: 267KB

.pdata Size: 8KB - Virtual size: 7KB

.didat Size: 4KB - Virtual size: 160B

.rsrc Size: 332KB - Virtual size: 329KB

.reloc Size: 4KB - Virtual size: 560B

.text
Size: 196KB - Virtual size: 193KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 36KB - Virtual size: 34KB

.data
Size: 4KB - Virtual size: 267KB

.pdata
Size: 8KB - Virtual size: 7KB

.didat
Size: 4KB - Virtual size: 160B

.rsrc
Size: 332KB - Virtual size: 329KB

.reloc
Size: 4KB - Virtual size: 560B