WindowsUpdateCore[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WindowsUpdateCore.exe
Size 2.7MB
Sample260619-xdafsaay5j
SHA256 5db0c881c91bf50083b6155b6eba50678ab2538a3c4fc7869b258871ad74e3e5
MD5 33e24173ad0ba5e9b83fe04c92ebc551
SHA1 87ee6726a50c8afa8363790e88aa36ce2f613b19
SHA512 10a00606a74a65c0ff6f669e3f74c0e700d316187651c705a3cfbd4e931d9564dba993f5d9171fdf8e60907347ae405d07b8e9b9ae8c093b8ef17f4131929284
SSDEEP 49152:CFqcdGZVXH98DFpe/1CmBo+xp1cXQDd7H7GZjAkjDOnDuQ+7XQ:rZtXJhcXQD1GZjAkjixiA
TLSH
T1A9D58C1673F801A9D5AF8378C4225607DBF1B0062725EBDF499099A92F33BE15E76332
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
WindowsUpdateCore.exe

File Explorer

WindowsUpdateCore.exe

.exe 2.7MB

WindowsUpdateCore.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 5db0c881c91bf50083b6155b6eba50678ab2538a3c4fc7869b258871ad74e3e5
MD5 33e24173ad0ba5e9b83fe04c92ebc551
SHA1 87ee6726a50c8afa8363790e88aa36ce2f613b19
SHA512 10a00606a74a65c0ff6f669e3f74c0e700d316187651c705a3cfbd4e931d9564dba993f5d9171fdf8e60907347ae405d07b8e9b9ae8c093b8ef17f4131929284
SSDEEP 49152:CFqcdGZVXH98DFpe/1CmBo+xp1cXQDd7H7GZjAkjDOnDuQ+7XQ:rZtXJhcXQD1GZjAkjixiA
TLSH
T1A9D58C1673F801A9D5AF8378C4225607DBF1B0062725EBDF499099A92F33BE15E76332
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr