nsWscSvc[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
nsWscSvc.exe
Size 1.0MB
Sample260718-xc2tmsdv2x
SHA256 6b1332ed243dc0d540a7997ded8180b0a2629335f37b804c908f514ef4ad0d87
MD5 d24ad24072fb293979224e86a03f71d9
SHA1 da1e6f6e3e4df03075c5edcd858d9879d61ece4c
SHA512 aa4e65e15f022c56d8860f0f63e73f13e252f0b8fac0a4526a7f1f6bca9cb20b22d11368f291a80394e1f8568e883a1874d9a855474e9fc4ab65d63e7b8b4d56
SSDEEP 12288:KJp4vnjMXKZiWbyKAhdOsXI6XMeyx7e0SVdyjhpcqPPaaKkU6mICIbm4:KJqvnjCCiqAPOS1yx79S0bRKhIja4
TLSH
T1BD355B29EB7840E0C0A2D5B485515B2AFBB27C9A2F6196CB5070A56D3F33AF0DD38717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

nsWscSvc.exe

.exe 1.0MB

nsWscSvc.exe

IMPHASH 0e641365e918156365a8b2ad4e2a9290
SHA256 6b1332ed243dc0d540a7997ded8180b0a2629335f37b804c908f514ef4ad0d87
MD5 d24ad24072fb293979224e86a03f71d9
SHA1 da1e6f6e3e4df03075c5edcd858d9879d61ece4c
SHA512 aa4e65e15f022c56d8860f0f63e73f13e252f0b8fac0a4526a7f1f6bca9cb20b22d11368f291a80394e1f8568e883a1874d9a855474e9fc4ab65d63e7b8b4d56
SSDEEP 12288:KJp4vnjMXKZiWbyKAhdOsXI6XMeyx7e0SVdyjhpcqPPaaKkU6mICIbm4:KJqvnjCCiqAPOS1yx79S0bRKhIja4
TLSH
T1BD355B29EB7840E0C0A2D5B485515B2AFBB27C9A2F6196CB5070A56D3F33AF0DD38717
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

18:46:46:5d:24:d0:5c:76:03:02:6f:b1:74:51:e8:59:e2:45:c7:1f:aa:4e:a5:7c:d9:95:64:de:ce:3a:43:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Chains

Mar 4, 2022

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

18:46:46:5d:24:d0:5c:76:03:02:6f:b1:74:51:e8:59:e2:45:c7:1f:aa:4e:a5:7c:d9:95:64:de:ce:3a:43:d1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,POSTALCODE=85281,STREET=60 E. Rio Salado Pkwy Suite 600,L=Tempe,ST=Arizona,C=US

Chains

Mar 4, 2022

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,POSTALCODE=85281,STREET=60 E. Rio Salado Pkwy Suite 600,L=Tempe,ST=Arizona,C=US

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,POSTALCODE=85281,STREET=60 E. Rio Salado Pkwy Suite 600,L=Tempe,ST=Arizona,C=US

Serial Number

ba:5f:e5:a4:aa:e3:4f:22:5f:dc:f4:92:5c:8f:d5:7d

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 24, 2021 - Mar 11, 2022

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Serial Number

33:00:00:00:44:b7:3f:fc:ef:5a:cf:a2:7a:00:00:00:00:00:44

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 22, 2015 - Jul 22, 2025

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=NortonLifeLock Inc.,OU=Norton Product Engineering - CM,O=NortonLifeLock Inc.,L=Tempe,ST=Arizona,C=US

Serial Number

0b:be:91:35:61:37:61:3e:57:68:3e:60:3e:c5:38:bd

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 17, 2021 - May 21, 2024

Minor OS version

Major OS version

Entry point

290520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\bld_area\Norton_Internet_Security_22.22.2_14\VS141\Bin\x64\Release\nsWscSvc.pdb

kernel32

GetCurrentThread GetCurrentProcess GetSystemInfo GetSystemDefaultUILanguage GetUserDefaultUILanguage SetFilePointer WriteFile FlushFileBuffers SetEndOfFile DeleteFileW CreateDirectoryW FileTimeToSystemTime GetTempPathW TerminateProcess CreateProcessW VirtualAlloc VirtualFree CreateSemaphoreW ReleaseSemaphore DuplicateHandle GetSystemTime GetCurrentProcessId ProcessIdToSessionId VirtualQuery OpenProcess GetSystemTimeAsFileTime GetLongPathNameW GetSystemDirectoryW lstrlenA RtlCaptureContext FindNextFileW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx GetStartupInfoW QueryPerformanceCounter InitializeSListHead QueryDosDeviceW ExpandEnvironmentStringsW SetLastError lstrcmpA lstrcmpW RtlUnwindEx RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue GetModuleHandleW TlsFree GetFileAttributesExW VirtualProtect ExitProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW GetFileType CompareStringW LCMapStringW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW lstrlenW WaitForMultipleObjects GetTickCount WaitForMultipleObjectsEx GetCurrentThreadId WideCharToMultiByte GetProcAddress FindClose FindFirstFileW ResetEvent SetEvent CreateEventW GetFileAttributesW GetModuleFileNameW CreateFileW ReadFile CloseHandle GetFileSize MultiByteToWideChar InitializeCriticalSection LeaveCriticalSection EnterCriticalSection OutputDebugStringW IsDebuggerPresent FindResourceExW FindResourceW LoadResource LockResource SizeofResource VerifyVersionInfoW VerSetConditionMask CreateThread WaitForSingleObject FreeLibrary LoadLibraryExW TlsSetValue LoadLibraryW LoadLibraryExA GetProcessTimes GetProcessHeap DeleteCriticalSection HeapDestroy HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionAndSpinCount LocalFree HeapFree ReadProcessMemory

user32

MsgWaitForMultipleObjectsEx PeekMessageW IsWindowUnicode GetMessageA GetMessageW TranslateMessage DispatchMessageA DispatchMessageW wsprintfW

advapi32

MakeSelfRelativeSD SetSecurityDescriptorDacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetAclInformation AddAce InitializeAcl GetSidSubAuthorityCount RegSetKeySecurity IsValidSid GetLengthSid ConvertSidToStringSidW CopySid TraceMessage ControlTraceW RegOpenKeyExW RegQueryValueExW RegCloseKey GetTraceLoggerHandle GetTraceEnableLevel GetTraceEnableFlags RegisterTraceGuidsW UnregisterTraceGuids GetSidSubAuthority InitializeSid GetSidLengthRequired ConvertStringSecurityDescriptorToSecurityDescriptorW AdjustTokenPrivileges LookupPrivilegeValueW FreeSid EqualSid GetTokenInformation OpenProcessToken OpenThreadToken AllocateAndInitializeSid RegEnumKeyExW RegQueryInfoKeyW RegEnumValueW RegSetValueExW RegDeleteValueW RegCreateKeyExW CloseServiceHandle ChangeServiceConfig2W OpenServiceW OpenSCManagerW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW GetSecurityDescriptorLength GetSecurityDescriptorControl MakeAbsoluteSD InitializeSecurityDescriptor LookupAccountSidW GetSecurityDescriptorSacl

rpcrt4

RpcBindingFromStringBindingW RpcBindingSetAuthInfoW RpcServerRegisterIfEx RpcServerUseProtseqEpW RpcServerUnregisterIf NdrClientCall3 NdrServerCallAll NdrServerCall2 RpcBindingSetAuthInfoExW RpcBindingToStringBindingW RpcStringBindingParseW RpcRaiseException RpcBindingInqAuthClientW RpcStringFreeW UuidCreate RpcServerInqCallAttributesW RpcStringBindingComposeW RpcRevertToSelf RpcImpersonateClient RpcSmDestroyClientContext RpcBindingFree

ole32

StringFromIID CLSIDFromString CoUninitialize StringFromGUID2 CoCreateGuid CoCreateInstance CoTaskMemFree CoInitializeEx

oleaut32

SafeArrayAccessData SafeArrayUnaccessData SafeArrayCreateVector SafeArrayLock SafeArrayPtrOfIndex SafeArrayUnlock SafeArrayCreate SysStringByteLen SysAllocStringByteLen VariantCopyInd SysFreeString SysStringLen SysAllocString VariantInit VariantClear

shlwapi

PathAddBackslashW SHDeleteKeyW PathAppendW PathIsUNCServerW PathRemoveFileSpecW SHDeleteEmptyKeyW

crypt32

CertGetNameStringW CertNameToStrW CryptQueryObject CryptMsgGetParam CertFindCertificateInStore CertFreeCertificateContext CertCloseStore CryptMsgClose CertGetEnhancedKeyUsage

wintrust

CryptCATAdminCalcHashFromFileHandle CryptCATAdminReleaseContext CryptCATAdminAcquireContext CryptCATAdminReleaseCatalogContext CryptCATCatalogInfoFromContext CryptCATAdminEnumCatalogFromHash WintrustGetRegPolicyFlags WinVerifyTrust

Sharing

General

Malware Config

Signatures

File Explorer

nsWscSvc.exe

kernel32

user32

advapi32

rpcrt4

ole32

oleaut32

shlwapi

crypt32

wintrust

generic