AccessEnum[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AccessEnum.exe
Size 170KB
Sample241112-ld3lsazbqq
SHA256 a4cc61f6c7ed716e4622e12b75f05ea17e79a45f0d8bd6855c340a30ec882b47
MD5 f4cd850fdab64ffbbcc249374ba17f5b
SHA1 90f1abcbf60e24a03407f049ccf67bc25a945ac5
SHA512 42dac16b1bcfb9244364820ab4ae9e6de719c99e70024f1820b80a9eeb049d1c9d90d73fb1045f2459a05a2c5d5a01b265b70489207f88ca06418c768d0cf790
SSDEEP 1536:SNxHRK4LGVq5ZrmjZ4KWWdkmVnTA6uv5RwA9YlHaeX:SHs+5ZrmjZ4KXE2sA
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

AccessEnum.exe

.exe 170KB

AccessEnum.exe

IMPHASH 83787f51a42290311b4f8e08f0802867
SHA256 a4cc61f6c7ed716e4622e12b75f05ea17e79a45f0d8bd6855c340a30ec882b47
MD5 f4cd850fdab64ffbbcc249374ba17f5b
SHA1 90f1abcbf60e24a03407f049ccf67bc25a945ac5
SHA512 42dac16b1bcfb9244364820ab4ae9e6de719c99e70024f1820b80a9eeb049d1c9d90d73fb1045f2459a05a2c5d5a01b265b70489207f88ca06418c768d0cf790
SSDEEP 1536:SNxHRK4LGVq5ZrmjZ4KWWdkmVnTA6uv5RwA9YlHaeX:SHs+5ZrmjZ4KXE2sA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

PE Signature issue

Digest

bc:e2:6e:0f:15:48:9a:32:45:f6:3b:ef:ad:6d:fc:65:37:59:76:36

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Nov 11, 2024

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

Serial Number

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40

Issuer

Timespan

Jan 10, 1997 - Dec 31, 2020

Subject

Serial Number

6a:0b:99:4f:c0:00:1d:ab:11:da:c4:02:a1:66:27:ba

Issuer

Key Usages

KeyUsageContentCommitment, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Apr 26, 2012

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:46:9e:cb:00:04:00:00:00:65

Issuer

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 4, 2006 - Oct 4, 2007

Minor OS version

Major OS version

Entry point

31384

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA GetStartupInfoA LocalAlloc LocalFree OpenProcess CompareStringW GetModuleHandleW GetCurrentProcess FindFirstFileW FindNextFileW FindClose LoadLibraryW GetProcAddress GetLastError CreateThread FormatMessageW SetThreadPriority ResumeThread DeleteFileW GetFileAttributesW Sleep GetEnvironmentVariableW InterlockedIncrement CreateFileW WriteFile CloseHandle InterlockedDecrement lstrlenW

user32

GetSysColor GetDlgItem LoadCursorW GetParent GetSysColorBrush SetCursor InvalidateRect ChildWindowFromPoint CheckDlgButton IsDlgButtonChecked SetDlgItemTextW EndPaint DrawFrameControl EnableWindow DefWindowProcW PostQuitMessage DestroyMenu TrackPopupMenu SetMenuItemInfoW GetWindowRect MoveWindow EndDialog LoadIconW SendMessageW EnableMenuItem GetSubMenu LoadMenuW GetFocus ChildWindowFromPointEx MapWindowPoints SetWindowLongW GetWindowLongW SetWindowTextW CheckMenuItem GetMenuItemInfoW GetMenu CreateDialogParamW GetDlgItemTextW GetClientRect BeginPaint PtInRect wsprintfW IsWindowEnabled DialogBoxParamW SetClassLongW PostMessageW DispatchMessageW TranslateMessage IsDialogMessageW TranslateAcceleratorW GetMessageW LoadAcceleratorsW UpdateWindow ShowWindow RegisterClassExW InflateRect DialogBoxIndirectParamW FindWindowW WaitForInputIdle SetForegroundWindow FindWindowExW SetFocus GetWindowThreadProcessId CreatePopupMenu InsertMenuItemW GetCursorPos SetWindowPos LoadImageW ScreenToClient GetClassNameW DeferWindowPos BeginDeferWindowPos EnumChildWindows EndDeferWindowPos OffsetRect UnionRect GetPropW CallWindowProcW IsZoomed GetSystemMetrics DestroyIcon MessageBoxW SetPropW

gdi32

SetMapMode StartDocW StartPage GetDeviceCaps EndPage EndDoc SetBkMode SetTextColor SelectObject GetStockObject GetObjectW CreateFontIndirectW

comdlg32

PrintDlgW GetOpenFileNameW GetSaveFileNameW

advapi32

GetSidLengthRequired RegEnumKeyExW RegGetKeySecurity RegQueryValueExW RegSetValueExW RegCreateKeyExW RegDeleteValueW InitializeSid LookupAccountNameW GetTokenInformation OpenProcessToken RegCreateKeyW AllocateAndInitializeSid GetSidSubAuthority GetSidSubAuthorityCount GetSidIdentifierAuthority IsValidSid LookupAccountSidW GetLengthSid EqualSid GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetAce GetSecurityDescriptorDacl IsValidSecurityDescriptor RegEnumKeyW RegCloseKey RegQueryInfoKeyW GetFileSecurityW RegOpenKeyExW

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc ShellExecuteW SHGetFileInfoW ShellExecuteExW

ole32

CoInitializeEx

oleaut32

VariantChangeType SetErrorInfo GetErrorInfo VariantClear CreateErrorInfo VariantInit VarDateFromStr SysStringLen SysAllocStringByteLen SysAllocString SysFreeString

comctl32

ord17 ImageList_Create ImageList_ReplaceIcon ImageList_SetBkColor

netapi32

NetUserGetLocalGroups NetApiBufferFree NetWkstaUserGetInfo NetUserGetGroups

mpr

WNetGetConnectionW

msvcrt

_ftol swprintf isspace wcschr _controlfp ??1type_info@@UAE@XZ __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln exit _XcptFilter _exit _onexit __dllonexit _CxxThrowException malloc toupper swscanf vswprintf _wfopen fgetwc fclose strlen strcpy wcscmp _purecall _wcsnicmp iswspace wcsncpy _except_handler3 memset wcscat free wcslen _EH_prolog __CxxFrameHandler ??3@YAXPAX@Z qsort memcpy _wcsdup wcscpy _wcsicmp realloc ??2@YAPAXI@Z

Sharing

General

Malware Config

Signatures

File Explorer

AccessEnum.exe

PE Signature issue

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

netapi32

mpr

msvcrt

generic