��z�^����\�}0��8!E��� o߇U� ��,g,t�2�lV�TJ pY���[��17:x�͐x�&����/ HY�����y�������3������u�^I�W�Q�Wg^&��l�D��Z��V��Aģ�a'��R����(�Y@)+n���:�p2l�E�+X.�aŐ��V���)����م2>�G{n�[�C��P�(�������;*T&g?Դ��)�ɳ�5����!�fo���'ٰ�&��Ooc���Ē|0����>�u�GU���Z�y|]#㽩K��"-Q��n�� �}%L--��2EBcD_�$!3�N�Ȍp~ݱ�/~�}�@�U��Du�1���L�Ϳ�4�#��!@�3u�Q��"]���O�2YJ�:����m��kS��O8� w�7w������J��%dЦP0����AF$��.�zK'Oe��7;���dV�-���4D�q�@Z�1ɲ~j�υ�&Hl���L�(r�I����聑(>+q��y��A#�Qdܗ �D;xX��cI�C�ě"]?,}���e�Ğ6��=�����eA��Jk�d�D��'���h p��@:�䣴K�I1��w��><;�,�˫:������H|Âs�9/�m�ҽ��5��6$���W��#Aa��R tSx�m����L�zI��F��&�sR���8rd��]������t"PȜ�K*/o��NH�bA��Lk>;��Yp�&{���2QU�Ы2T.�T��U��`57��n��x'ϸt�t�zI��R�M4adb,=�*���r�Y�\ � =-�;�d�U�#���(��>J8�6rO*���0X��!���n�ا(K��[�t�wџ�d\�!Q����_��X Q'���*��Z��s2���Z{�M����&� D�`�&�Z���\T�`��5a �I ;L��ij�fb��êD�� �P۰3�.ڌX~��i�o�7fކ(�Ϸ���1��I��q�t��r��7e5*O��{�3�H�YM�����Q�?uC�@��Ci2�ɳ��Y)`���;G�=��!���{�B{����%Js=�����j�) !��(I�Q�����y*v�a��m��o�bS}*s��;�e��X���Y���lTA#��m ����Qc�v���hw��iX����T�I�϶th������x]1�ݵ�w��H#h����x�e�t�qX�����4��$nK����}��I�4ur��D8���2�QA?�hQ�r R!�E7&U� �KZ��x+�`vd�B1��,��|2UX�js�ߖ�łW>��b�'M����^n\b*`��=��o�1�ڼ�i��4ܦ�Oy�\�P攵��m*A<Y!\b�4F�m��ߺ��G��/wQѨVC��!�_]��2S�k�s�(�/2�Rq�^L+/���P���� R�X����\`X�$N� n($�IS1�>�k�i�\9&�ݩ����(���ia{(�A@`<?_#�k��������V�� H��l��I�pj�<����J�G��f��%?em���{~�T�>��۲��^�::G<}����� �(*ɧ��$/Xk"���";���j�L�nD[9[����;;��.���5���d*u�Ơ�ik���X��7����g��\�ꚣ�a����@�˅��9ؖ��� �+���T(5/e�w�p��9M#�?k ���1��fG=�/�,q��O�=�z4h1�v����� ��s�Ov��<��Ǡ+ǃwJ���̫/-.��:��@����,ީ��*T�����A��� ������f����33:﨨Z_@b�� 4�u���)N�r2q�<�i3Jv�����U!�n�y$�<���/�R��n���ܡ�cYL�.�$o�c>�ch%�b6���|�M�U�%����G8�7`G�u�{�Z���6���:�7B}�^L�wa�W�n�teZ�>">ʝ*��F|7�0��y[��{�����ŧ ۄ\��]!$�3��t[͜���&{Ev<��g;�8���.��k�G�\�JP��7�7��s������$���3�u�A?������i`x��I�[�3���9��Cr�g�I�96���bL�d~�\�Ќ�����x���L�ܔ��4���9�A_�X.��5A�|j��>XR�2���!Ż�����7��;� .]�t�f�w]��_��W��+d��+;ynF�*^��CZ����g�g�+�H-G�����x�CՇS4Qh�-�d,����&!���� T���w��FJ.�b:\e���(W�e�pF�ӱ+b���,>����z�^@�PRdes�:�. ���\��Js�]����`�����@.����Ѡ�h����9N�yx����&y�����ɧ��9�9+p;;�� �ai����Q�i�l���~ z$����Nm�I˄��D�*@�����c����ը�,';���\z.�C��s���k�Hp�t:Q \�g�$b�t����Ĕ��|a��5d�&+>h&�5%��ԑ��[=m_*�Ø�Z�)3ڞAr���Uw=����.�)¨_e:�:���&9��Z��|������@8��S�5�?1���g��������n��w����coX�3_��ו��t��ΗFϐU�Q"�T%8p7��0|��� ���,���j]YҡC��(���H |�߲�MB}��QY����E���u�nx-_�3w��Bwh[�s) �A��n��K\��H����_�=��@��UD��`��u�~$DZ�[�88'M�X��m �r�;~�7�����S @s�̉?�-��"a��O�IPB��}u�� [���q�Gww�6�0��>��a;U�����K�(^���i(��!|����v5��p4� �+���D%��m��#�*��f���k�0�Md��~�7 �J�=�e]���Rz�<����^ ���9�8�'�99�Ļ��e)5���W:S��Pgxn�"�#E�a�4L���� �:�P�3�Lx~�n�e2�X��"1�C��K����u֙�b�c��{�;����s�H�Y���(�����ʭ��e4ٌ�`�?�A+~��W�O�tl!�/����L�C�
Static task
static1
Behavioral task
behavioral1
Sample
uowmnu.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
uowmnu.exe
Resource
win10v2004-20241007-en
General
-
Target
uowmnu.exe
-
Size
4.3MB
-
MD5
42e0ac0d0463f698503865b789a3493c
-
SHA1
9289d6a5f0dd85a45a12c79be0ebe692f1b63faa
-
SHA256
ac754bd88d89ee3c0cbf109a266df7d45c3f1864a23b37d0ac208a69e74224c9
-
SHA512
04863d140c4a21d60d735baa0fc1ad4a8d7015dedce6cb576027556d363a5ea56312ac4b1c44090bda6c90e159f22d3b66dc1df8d8cf618ed4db909e3de7d18f
-
SSDEEP
98304:gul0/QxOOLRUHKjqWnxOa1jf+jRLmvO+olnTDQnOtkqo+jrSf8:P2/IOli/nzjf+tLtrlTDqOt3mf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource uowmnu.exe
Files
-
uowmnu.exe.exe windows:6 windows x64 arch:x64
262b9605deafdb994970c30f8ab867f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
msvcrt
wcstoul
ntdll
RtlLookupFunctionEntry
advapi32
QueryAllTracesW
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle
kernel32
GetFileType
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowTextW
CharUpperBuffW
ole32
CoInitializeEx
comctl32
ord412
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 418KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 184KB - Virtual size: 183KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.yctjje Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.smezy Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ffzex Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ichnc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jmmsdp Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ