MS-KW92Swift-20-CMD9200-XE3911-XW2900-MI2982-[.]exe

resource
MS-KW92Swift-20-CMD9200-XE3911-XW2900-MI2982-.exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

MS-KW92Swift-20-CMD9200-XE3911-XW2900-MI2982-.exe

IMPHASH 7eae418c7423834ffc3d79b4300bd6fb
SHA256 2e8d23b7f77e7578af862bfb3a5ad652fe19cd2be13da309a65e0402ebdbd7fd
MD5 a1ba70ff00ae2282efe8d2e175611e72
SHA1 2168228311e69214883173b5d8ec63a47b2ea36d
SHA512 775c5b7137156d1c33014c7599ae02c3dc6ab03e549aaa6558c17b65464ffc5905cb24f71a3b15cc97adaefbea39d6f9b3cd8375ef017446ea61084334d8b7b9
SSDEEP 6144:EicFyEa8zeyw8eTpxN/fhrs3xcyYFh1+1zYeRIKg18tHmjVd2TC1DuQM6nMCYkwO:HQa8zeNx9zHOBB+2JrRn5Hwd2+13MRkz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

N/A

Digest Algorithm

N/A

PE Digests Matches

Not matched

Trusted

Not trusted

Minor OS version

0

Major OS version

4

Entry point

13271

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW SetCurrentDirectoryW GetFileAttributesW GetWindowsDirectoryW GetTempPathW GetCommandLineW GetVersion SetErrorMode lstrlenW lstrcpynW GetDiskFreeSpaceW ExitProcess MoveFileW CreateThread GetLastError CreateDirectoryW CreateProcessW RemoveDirectoryW lstrcmpiA CreateFileW GetTempFileNameW WriteFile lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject lstrcmpiW lstrcmpW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle ExpandEnvironmentStringsW GlobalFree GlobalLock GlobalUnlock GlobalAlloc DeleteFileW FindFirstFileW FindNextFileW FindClose SetFilePointer ReadFile MulDiv lstrlenA WideCharToMultiByte MultiByteToWideChar WritePrivateProfileStringW FreeLibrary GetPrivateProfileStringW GetModuleHandleW LoadLibraryExW

user32

GetWindowRect GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos GetSysColor GetWindowLongW SetCursor LoadCursorW CheckDlgButton GetMessagePos CallWindowProcW IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu ScreenToClient EnableMenuItem GetDlgItem SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharPrevW CharNextA wsprintfA DispatchMessageW PeekMessageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect SystemParametersInfoW EndDialog RegisterClassW DialogBoxParamW CreateWindowExW GetClassInfoW DestroyWindow CharNextW ExitWindowsEx SetWindowTextW LoadImageW SetTimer ShowWindow PostQuitMessage wsprintfW SetWindowLongW FindWindowExW IsWindow CreatePopupMenu AppendMenuW GetSystemMetrics DrawTextW EndPaint CreateDialogParamW SendMessageTimeoutW SetForegroundWindow

gdi32

SelectObject SetTextColor SetBkMode CreateFontIndirectW CreateBrushIndirect DeleteObject GetDeviceCaps SetBkColor

shell32

ShellExecuteExW SHGetPathFromIDListW SHGetSpecialFolderLocation SHGetFileInfoW SHFileOperationW SHBrowseForFolderW

advapi32

AdjustTokenPrivileges RegCreateKeyExW RegOpenKeyExW SetFileSecurityW OpenProcessToken LookupPrivilegeValueW RegEnumValueW RegDeleteKeyW RegDeleteValueW RegCloseKey RegSetValueExW RegQueryValueExW RegEnumKeyW

comctl32

ImageList_Create ImageList_AddMasked ord17 ImageList_Destroy

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
SSDEEP 192:BenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XB9IwL:B8+Qlt70Fj/lQRY/9VjjlL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10719

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
MD5 ec9640b70e07141febbe2cd4cc42510f
SHA1 64a5e4b90e5fe62aa40e7ac9e16342ed066f0306
SHA512 47605b217313c7fe6ce3e9a65da156a2fba8d91e4ed23731d3c5e432dd048ff5c8f9ae8bb85a6a39e1eac4e1b6a22862aa72d3b1b1c8255858997cdd4db5d1fe
SSDEEP 192:oRsHeylO012En8pqHtcE0PuAgkOyPIFc:sATI0d8pUP0WAgkBPIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsiemens/sponsorende.bis

SHA256 87f3df1f503ae390960b93de2542582035cde458ddefadf64805b7b8ec871fd9
MD5 0feb6118a23cea0911142c52b37f4c69
SHA1 ba4f2c4593c780b95e1fdaf648632cfba9459853
SHA512 c0da63296a625b59d3dba7c8906c40791a5fc42b872245c4d1b2428268db9af7e5b03904f876e329e2ce327c4113c62f93ed382c85a656e0149d002f0254bf2b
SSDEEP 192:LkEIfbifT/NQkFRgPT8nwtT+Vkwnw2ya0EtdtmJLj:LkrfbINQURgPQwFfwnm7EtmF
MD5 SHA1 SHA512 SSDEEP

Microsiemens/sulphouinic.adr

SHA256 9dd7c337d6947a38e2026cb444a01ae79b6b8931d0275edb6fb7b54449d26d0c
MD5 562c6852658cf346e775cb531a8a1de3
SHA1 78e1fcca57271996a76ae60b01325369dc7c1cc4
SHA512 adcb3e19e071a86d04828487e479ce27207ac1f069f1b0cadb50b08ef68cf277aacfff4d913fc497d9141a05e08ecd835c2902d194b16a8f016936319891ba8a
SSDEEP 96:VfGw5Yk5231xO8SPoqVOIoGtdRg0uObNgpxBceej11Og/BWe8bztSjp/IzVlaxOx:ZTYeRP1XLtIQNKGtecAn8S28lg0h
MD5 SHA1 SHA512 SSDEEP

Microsiemens/unprotuberant.sne

SHA256 19ff0e98d5efc723cc4fded985ec413a509d86b62505ef43fa51c3f4c906e0b3
MD5 6d68dfc8458b3cdc10ada3e574d00010
SHA1 b4f162e18471b046cc57167d66a3038279caf414
SHA512 8afa65b756c1976633cb8e222c8de660a4edae27c5a1df8b6ea9363199d61649c8750613cac6270bc1d32648d7ca0106ce72cacbab1ae2b708f4c15c97b63a4c
SSDEEP 192:7pYWiai7IY+ZFoWkwNDuzO5aUz+zAjaWXUXDrQ0WGF:dYWiP7Id9dKO9RX8Dr5F
MD5 SHA1 SHA512 SSDEEP

Microsiemens/zymosthenic.mel

SHA256 8ef7a0fdc43ca39abeaab74c34f541330b977f410056303a748bad0a94e58fd8
MD5 a84189888ee13dc2c68d83c9bb5099cd
SHA1 4ab1b6d22b7b6ba5f29b2ac07eb5d0b3f84aaf1f
SHA512 591bb3f3c84c820e6f7bb16003b27191224a023f020b0271367bb9dd4d060b35e8a9f06ac2593602912b69c47ee37271b14af3c5e4c28e80ee11a5302b44d7be
SSDEEP 48:s/YZ51YMYMqr7Jf2PONPdbc1wfzlVmHbvSwOtc5xq5xDQWApdTT2fg:BjYMCkPOhdSwfzl4OtH5tQWApN6fg
MD5 SHA1 SHA512 SSDEEP

Monastic/Sammenfat.lys

SHA256 78522100830aa45573a598efe8ff175480b9a6be78ec502e1339fbf57fb2d4a6
MD5 322ef45132ef2144c948b4feda68b84f
SHA1 eefc234f81f58e72a7317327aac6881abe2efefc
SHA512 3dbbd0f9d81ac55823707c3a8a74a12e04666539f7ba7b40d71194c40a6fe516cc18240e94156c1a701df98f71a0759ffd57a7bf6d4b87f2282635c65e39d8b1
SSDEEP 384:rJURkOaoduwAHIMVSDcEeIDL5JL8uUK4LPUOuOaVW:ORkOaSgH5UD1lgf7LPUOuc
MD5 SHA1 SHA512 SSDEEP

Monastic/bughule.dun

SHA256 d5b00e5c84e5b03722024e081a28607e706e044ae7985f86ca6ec988a40980f8
MD5 2b5e80e481ed3bce4fd3ccf5f8c0ad2e
SHA1 66ba6186fe441dd79e5aa3bd6d21375e5c4d6da2
SHA512 49fc27431da5e3502df195c257452c8908b78d59c957ebca3b9b9a1f742539240714c6e2dbb252d2451caa5ad47094c09a659883f11339fba564e4fdecd4fa57
SSDEEP 192:e3iaWylu8ynAznO5Io9hi6O0fcLoHUAB5j:e3/NwA7wIFf070AJ
MD5 SHA1 SHA512 SSDEEP

Monastic/hilary.str

SHA256 b0232023bbd7898ce8474252d23ff0eeb899326de8b59251bf4127882aedd6e3
MD5 f69aa65e4e42734c3c1a44f32b31ac2f
SHA1 81bc3083764e0bcc1f11369ae50594fba6f33e66
SHA512 d4f802c66b773c0c5ff36476d42ffa7a530d31dd5a97a7fac7458d13bdb55f2381086623018d4de41b369223b767d5ddfc870c0af9922b8f0198d524aaaea0bd
SSDEEP 96:Q0NH8riCnGemxW7p2wgmt2puQwkRk5OLnWROh:Jp2LZ9cW2
MD5 SHA1 SHA512 SSDEEP

Monastic/hydrobromate.rea

SHA256 35633f65b3e6fd6020d7cc4f9e46d812da0f346ab6da4f44ac79c70b224cd65b
MD5 a87a1d0f1fec0bd067040741b99db128
SHA1 d2143902337f3e25ed4af72e6fbd9084c31c75f7
SHA512 c1e6b67617031b9b9d4659d4dd518eea433f64d4bcf75508d83130743f27dc212d7b269a0f4c5d02b84a41d38fc5fd376bd5b9fabfbf6a3f07be77d5be5e622b
SSDEEP 192:x16msc8ITrDHynr+/uG8vkaDMXGxljv9whGYcJcxP:n6msLIzynrqJcxSGx59wYZJcxP
MD5 SHA1 SHA512 SSDEEP

Monastic/incalver.eft

SHA256 a428314e3458b16784eae328c019923628dd0f3edef262afcd109785d39378d5
MD5 a38294f7ce0b3e88f4aff867ab5d7529
SHA1 ecb0dc205efbfcc9beac46038a275a13eb566639
SHA512 7ff2e982977975da418b92531ea487080be6ec6ffc0753dc0fa1d443d1520fd787d3e72ed767fc34efcd1f3edee9a9a32b6e04a21af037bba02a9e910752a2bb
SSDEEP 192:0FTbE/EbTYS3xyl3kBS1u/xeKtrhIwNTRlOTz4QMJWhF4+Uv1D1HGN:0tsuxWk3/FxTsz4QiWf7
MD5 SHA1 SHA512 SSDEEP

Monastic/kronprinserne.pro

SHA256 da7e4a541086a75cb8cf91adf43e98d3aca271863727523f071d7f3eaf07d39b
MD5 a9253a057c984b8c5f3ba092406bb8e0
SHA1 829951b20d3475382593b68b6eacd672fdd5298a
SHA512 056bbbea2501b3c577f46a6b54e00b687c8c4ab98424e824df026c5a8bdaa7c0fbeecf6a6e7228e2bfb98b1770b96dd50cc5b9fa2d13665aacbdd5288f1d134b
SSDEEP 384:caw7BzBKXdYVHkOySdX7LBhle+rD+wrV9RFdPbA8QECvK3HdNb:Fw7vK0Byi7nle+rD1rV9/JSWb
MD5 SHA1 SHA512 SSDEEP

Monastic/malhild.cre

SHA256 b0b03d3346c14c9bfd7a57b9ef1bca23784ad19e81b0737e0967893ca2a0fe1e
MD5 b9b9ebb894500bb1701562d246081a1f
SHA1 a54423b3b2ea715a8e602eeaafb48bfd8f04181c
SHA512 a5c1c7e311815fb728b9f05994649bb3a280f30bde9f57157b1965b328ac1b6ce8f172c04bb7c8c211ac6e602ac6c8b05c007c6bf69df790eb4cc5dce8378caf
SSDEEP 96:AXeGEAOx1uV9ne1oK/obiIe6QCkt9ONDIM9eSVEXHOnVL1PboEzmKcVo4ZvNl:AJfimGPHvM9eR4M2dcnP
MD5 SHA1 SHA512 SSDEEP

Monastic/overwin.jen

SHA256 2da7e2d6dacd2c31210ffef5af85446de14432279cea02ba9b8140809f282d33
MD5 8671ad7d3058b9600086d46cde18799b
SHA1 f19e5dd36bfefd3f281a9e7a8be0152fff31b731
SHA512 192e47d9fe794f39f7166346e5371a63057b7d156ff64fd681d69e0351c3b9b6b27b6fb461d2ae137eda104a7b62a1722d62c1dd6295bf3f8a46e68554787e5c
SSDEEP 24:g2X00Whh87hFHvx4J2fSOByAQrYb6lUycUk+9VJBuMX7ovZyUxkNq:W0WYNF5UkUrSAnV7YR6Nq
MD5 SHA1 SHA512 SSDEEP

Monastic/scenopinidae.spi

SHA256 98b789a3f7931abc1652b492003ac3040cd80b1c454e5e3becf58ea3c817af1a
MD5 265ef22c9b52e285cbcb7c98559258c3
SHA1 55482a05fda66b250170e055647b6c716201ed7d
SHA512 2e0387d23a924b5366f0f4c53696f386b889bec7607f288196357303ac8830d72a99d79ec509d57474e9769acd22e0e57fc4ea3fed2433c11f9d3c86fc84c37a
SSDEEP 96:5PBoNlgYNzSQcHQIgXjhec5LzaYHnlwxfeui/GPwJ:5PBoNlgYNGQcHQI6jsc5LVnexfRi/GIJ
MD5 SHA1 SHA512 SSDEEP

Monastic/sikkerhedkopieringer.Lap

SHA256 626f706e305d5c35593b0dd049f0cd265b6b7615aa344ddd2a52aa5fb4c19f0f
MD5 25622088bd754739c403739e7e92c2fe
SHA1 1d948c1b18ed5a105df1f8f78a5aef586b5d46d3
SHA512 266344ca9b7aa70658e8386a1ad568f95d3b67d0fbd3b1e8a7124fbb052c936fabf6b38aa5c08309635e8da83fa621375a5524c82e0a2f2749481fd6c01febc3
SSDEEP 384:0nX5EfIeSK+w+FBT2qqMPIRQ/pRV16+eFzKgWW3ol+C0AE:0nXCIrU+F12nunbPeFdWhl+C0l
MD5 SHA1 SHA512 SSDEEP

Monastic/skifteprotokoller.ufo

SHA256 8c65e2f9c7b063ede9e44ff16a16246abcb3c4bbdee8e23f67b9c7409e4a7fb3
MD5 c86874d5180ceed9d23e5adfb9ab87f3
SHA1 4c2a2e122f3af3829b44ade99c960aa0409391d7
SHA512 afbe99968ab7ecb233f3a0c4c174f339750eb5e384477cb006874ab5b1a6eb6503ccc3438fa6d07d05635e83f83c6c0ae36745812389b166255d006b26e5584b
SSDEEP 384:B0UU/EcTD4SWr78XxkYCf8vc83P5s4OdxvigYY:B0LH/Wr78+P0EasBdxvtYY
MD5 SHA1 SHA512 SSDEEP

Monastic/snefalds.mum

SHA256 be3b1b0ad860cbdf1461563239a3a7ab778b639057e53e89d2a6af5c952e9ce1
MD5 1e1ae985f9c0c7cb83666365a44c9d49
SHA1 3bb97e7376f192f42e37fd1ed1ea71746aa35b27
SHA512 6475f97b61d185206cc95da54edfff0b523390a5f41f95be47b1a76d3d3497084aedb8eed1f02120df24e569de2a668782ad390441d82f490a53f1e07f8d3b36
SSDEEP 192:9gnX9p6Bp3hjEJHiVBdynSNm7W3jf4gashF46lhi2WHq4xDFXik8Iv6bnpIHS1:ymJ4JCTmSKWkFl6Dif/DFyk8Iv6bnpIc
MD5 SHA1 SHA512 SSDEEP

Praemisser12.cha

SHA256 46235a9cf6ee1b4e886653fbcbb1dc5a6845d4de8d1d1f83f984c16c1cdc6b3b
MD5 f002ff1e3bfc914007868266ddbed61a
SHA1 8349c3596c01dcf4fadd5d8e278abd060656e008
SHA512 27258720fb08b87aca0fcc629e8a4df822bc39b6c64e6e6289129d11b587d7a67e62999c50697b9a27e1a4c1d470b92b9a3d2e8031207f528bf0208f23a08856
SSDEEP 96:vGIH9P8txG62Hm2g0faJIBSbIs7/3nE1R/:+wmzCglJIsNM
MD5 SHA1 SHA512 SSDEEP

Temporality.Aut

SHA256 d12dfc70aea0039f9ffb6dfca169c12c7325519937faed81a909a1f91181aeb9
MD5 4c96f5fc956ff3a775f503691a70fd51
SHA1 69b9ab1ca4bc870ec10176bd9a38c2308565bcda
SHA512 8546d57382c4b98ca68e2fb2145befcf1d2192e0e1c677cc8b1de0470867dd605345b9eec62b7fa80f16c267a1919a484f42fcd97709388c5d76861041c345f4
SSDEEP 6144:bZGMIFe8ViorT2F7pU8CbGF/1NtTOoqb0NOo12rsdj3V:Tg6u876zS1tKpbkR1YM3V
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer

MS-KW92Swift-20-CMD9200-XE3911-XW2900-MI2982-.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

Microsiemens/sponsorende.bis

Microsiemens/sulphouinic.adr

Microsiemens/unprotuberant.sne

Microsiemens/zymosthenic.mel

Monastic/Sammenfat.lys

Monastic/bughule.dun

Monastic/hilary.str

Monastic/hydrobromate.rea

Monastic/incalver.eft

Monastic/kronprinserne.pro

Monastic/malhild.cre

Monastic/overwin.jen

Monastic/scenopinidae.spi

Monastic/sikkerhedkopieringer.Lap

Monastic/skifteprotokoller.ufo

Monastic/snefalds.mum

Praemisser12.cha

Temporality.Aut