USN[.]Journal[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
USN.Journal.exe
Size 376KB
Sample260628-xcmpqact5p
SHA256 ec02a614eceb566e4e51a5c3bb9451b4705c376e3329e2c75e5da61629bc78d8
MD5 378c741dd3623d2e0671177e09da2d62
SHA1 5f94662584ee3e95e65a47694cd189408ea1e3cd
SHA512 35235f27544a8b0b222a48f683dcb9e7d6fc1e414faa18ff8d92a6bf4304552699916112dfaf02b501d8a829af3a5306cd6535c74574f90f1dc95ffc47ecf388
SSDEEP 6144:5tCb2LrXWyPppzYotYXF19rRVQYXSZTNcvKOt4eOLExUuw4VMG2Nh8XvzuJdZbyf:5rLrMRQwC3+rt
TLSH
T1018485277A174587D3505A78C064F799CB2273E86EA78343AA2138A8F944BC35E3D7F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
USN.Journal.exe

File Explorer

USN.Journal.exe

.exe 376KB

USN.Journal.exe

IMPHASH 6cf39405430258b62d2a9b457faab3f0
SHA256 ec02a614eceb566e4e51a5c3bb9451b4705c376e3329e2c75e5da61629bc78d8
MD5 378c741dd3623d2e0671177e09da2d62
SHA1 5f94662584ee3e95e65a47694cd189408ea1e3cd
SHA512 35235f27544a8b0b222a48f683dcb9e7d6fc1e414faa18ff8d92a6bf4304552699916112dfaf02b501d8a829af3a5306cd6535c74574f90f1dc95ffc47ecf388
SSDEEP 6144:5tCb2LrXWyPppzYotYXF19rRVQYXSZTNcvKOt4eOLExUuw4VMG2Nh8XvzuJdZbyf:5rLrMRQwC3+rt
TLSH
T1018485277A174587D3505A78C064F799CB2273E86EA78343AA2138A8F944BC35E3D7F1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

274432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle FileTimeToLocalFileTime DeleteCriticalSection WideCharToMultiByte RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess CreateFileA IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleA WaitForSingleObject FileTimeToSystemTime OpenFileById InitializeCriticalSection LeaveCriticalSection SetThreadPriority GetDriveTypeA GetFinalPathNameByHandleW DeviceIoControl EnterCriticalSection TerminateProcess GetLogicalDrives RtlCaptureContext

user32

wsprintfA PostMessageA GetWindowTextA SetClassLongPtrA FrameRect GetDC FillRect MessageBoxW InflateRect DispatchMessageA ShowWindow MoveWindow DefWindowProcA GetWindowTextW ReleaseDC InvalidateRect SetForegroundWindow GetMessageA UpdateWindow RegisterClassExA PostQuitMessage DrawTextW GetDlgItem GetClientRect LoadIconA SendMessageA CreateWindowExA TranslateMessage

gdi32

CreatePen SetBkMode DeleteObject GetStockObject GetTextExtentPoint32A SelectObject SetTextColor SetBkColor RoundRect CreateSolidBrush

shell32

ShellExecuteW

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

comctl32

InitCommonControlsEx

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception _CxxThrowException __C_specific_handler memset memcpy memcmp __std_exception_copy __std_exception_destroy memmove

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _seh_filter_exe terminate _set_app_type _get_narrow_winmain_command_line _beginthreadex _exit _invalid_parameter_noinfo_noreturn exit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _initterm_e _initterm _cexit

api-ms-win-crt-string-l1-1-0

tolower wcsncpy_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

190KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd003

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

USN.Journal.exe

kernel32

user32

gdi32

shell32

msvcp140

comctl32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic