WhatInStartup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WhatInStartup.exe
Size 128KB
Sample260628-etb1fafs2j
SHA256 15099976118e7caa876f4d33fc948e29009509115557a62a9c897024dc62d26d
MD5 61f69c0c83c2e8e86b63b79965783a78
SHA1 86d71bd90fea9da846923a0cb4987a0a83d9293d
SHA512 da05c98c61f1fec808e0b8040d92c401cbac2ee101ba8d9961d1230850b425737695cb7c265c9464b3457cd1dba08068e47d53ea1e63d95632cbcd45d3082027
SSDEEP 3072:K+JhssBSJ0qvMSFfE+X6FQwYOXrw96Z27IS1:nqvMS5E+KZXrC6u
TLSH
T1ABD3394633F405A8E87BDA79CD324623C7B2BCA55934876F03A4CD9A1F23352BD25726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
sample	Nirsoft

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
WhatInStartup.exe

File Explorer

WhatInStartup.exe

.exe 128KB

WhatInStartup.exe

IMPHASH e5d2f07a34e93db9597ffc4bdab6ac2e
SHA256 15099976118e7caa876f4d33fc948e29009509115557a62a9c897024dc62d26d
MD5 61f69c0c83c2e8e86b63b79965783a78
SHA1 86d71bd90fea9da846923a0cb4987a0a83d9293d
SHA512 da05c98c61f1fec808e0b8040d92c401cbac2ee101ba8d9961d1230850b425737695cb7c265c9464b3457cd1dba08068e47d53ea1e63d95632cbcd45d3082027
SSDEEP 3072:K+JhssBSJ0qvMSFfE+X6FQwYOXrw96Z27IS1:nqvMS5E+KZXrC6u
TLSH
T1ABD3394633F405A8E87BDA79CD324623C7B2BCA55934876F03A4CD9A1F23352BD25726
MD5 SHA1 SHA512 SSDEEP TLSH

Detected Nirsoft tools

Free utilities often used by attackers which can steal passwords, product keys, etc.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ea:6b:36:8e:81:28:22:8f:bd:3a:ab:03:a1:e3:ce:03:14:6f:66:85

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Chains

Jun 25, 2013

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Subject

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Serial Number

42:1a:f2:94:09:84:19:1f:52:0a:4b:c6:24:26:a7:4b

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Jun 7, 2005 - May 30, 2020

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 10, 2010 - May 10, 2015

Subject

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

10:70:9d:4f:f5:54:08:d7:30:60:01:d8:ea:91:75:bb

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 24, 2011 - May 30, 2020

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=52583,STREET=5 Hashoshanim st.,L=Ramat Gan,ST=Gush Dan,C=IL

Serial Number

a1:a3:e7:28:0e:0a:2d:f1:2f:84:30:96:49:82:05:19

Issuer

CN=COMODO Code Signing CA 2,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 17, 2012 - Sep 17, 2014

Minor OS version

Major OS version

Entry point

82576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

f:\projects\vs2005\whatinstartup\x64\release\WhatInStartup.pdb

msvcrt

_initterm __wgetmainargs _wcmdln exit _cexit _exit _c_exit _XcptFilter __C_specific_handler _onexit __dllonexit _wcslwr strlen qsort _itow __setusermatherr _commode _fmode __set_app_type malloc _memicmp free wcschr modf memcmp wcstoul wcsrchr wcscmp ??3@YAXPEAX@Z ??2@YAPEAX_K@Z memcpy wcslen _purecall _wtoi _wcsicmp wcscpy memset wcscat _snwprintf wcsncat

comctl32

ImageList_AddMasked CreateStatusWindowW ord17 ImageList_Create ImageList_SetImageCount CreateToolbarEx

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

kernel32

FindNextChangeNotification SearchPathW RemoveDirectoryW EnumResourceTypesW Sleep WinExec GetCurrentThreadId FindFirstChangeNotificationW WaitForSingleObject FindCloseChangeNotification MoveFileW ResetEvent CreateEventW GetStartupInfoW GetFileSize ReadProcessMemory GetProcessTimes OpenProcess CloseHandle CompareFileTime FileTimeToLocalFileTime FileTimeToSystemTime GetProcAddress FreeLibrary LoadLibraryW FormatMessageW GetVersionExW FindNextFileW FindFirstFileW GetModuleHandleW GetTimeFormatW FindClose GetFileAttributesW WriteFile ReadFile GetModuleFileNameW GetWindowsDirectoryW CreateFileW FindResourceW LoadResource LocalFree GlobalAlloc LoadLibraryExW GetNumberFormatW lstrcpyW lstrlenW LockResource SetFileAttributesW WideCharToMultiByte GlobalUnlock GetTempPathW GetLocaleInfoW CreateDirectoryW GetDateFormatW GlobalLock SizeofResource GetTempFileNameW GetLastError GetPrivateProfileStringW WritePrivateProfileStringW GetPrivateProfileIntW EnumResourceNamesW DeleteFileW SetErrorMode CreateProcessW GetComputerNameW ExitProcess GetCurrentProcessId GetCurrentProcess

user32

SetForegroundWindow AttachThreadInput EnumWindows GetWindowThreadProcessId SetCursor LoadCursorW GetSysColorBrush ShowWindow ChildWindowFromPoint SetWindowTextW GetMessageW SetDlgItemTextW BeginPaint GetDlgItemTextW GetClientRect GetSystemMetrics DeferWindowPos CreateWindowExW SendDlgItemMessageW EndDialog GetWindowRect GetDlgItem GetDlgItemInt InvalidateRect EndPaint GetWindow DrawFrameControl SetDlgItemInt GetWindowPlacement LoadAcceleratorsW DefWindowProcW PostMessageW SendMessageW RegisterClassW MessageBoxW TranslateAcceleratorW SetWindowPlacement SetMenu LoadImageW GetWindowLongW SetWindowLongW EndDeferWindowPos BeginDeferWindowPos SetFocus GetMenuItemCount CheckMenuItem GetMenuStringW GetCursorPos SetClipboardData GetSysColor EnableWindow MapWindowPoints CloseClipboard GetMenu EmptyClipboard GetDC EnableMenuItem GetSubMenu ReleaseDC GetClassNameW OpenClipboard MoveWindow GetDlgCtrlID DestroyMenu GetParent CreateDialogParamW DialogBoxParamW EnumChildWindows LoadStringW SetWindowPos DestroyWindow GetWindowTextW LoadMenuW ModifyMenuW GetMenuItemInfoW DestroyIcon LoadIconW IsDialogMessageW DispatchMessageW SetTimer TranslateMessage DrawTextExW FindWindowW IsWindowVisible KillTimer RegisterWindowMessageW TrackPopupMenu PostQuitMessage UpdateWindow

gdi32

SetBkMode DeleteObject GetStockObject GetTextExtentPoint32W SetBkColor SelectObject GetDeviceCaps SetTextColor CreateFontIndirectW

comdlg32

FindTextW GetSaveFileNameW GetOpenFileNameW

advapi32

RegLoadKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegCloseKey RegSetValueExW RegUnLoadKeyW RegQueryValueExW RegNotifyChangeKeyValue

shell32

ShellExecuteW Shell_NotifyIconW ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHGetMalloc SHGetFileInfoW

ole32

CoCreateInstance CoUninitialize CoInitialize

Sharing

General

Malware Config

Signatures

File Explorer

WhatInStartup.exe

PE Signature issue

msvcrt

comctl32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

generic