wlsetup-all[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
wlsetup-all.exe
Size 131.0MB
Sample260719-asmnbsaz2v
SHA256 072424c82f942f2b43b68b9154e1f3e0c61b7ee39a08372048ed34e09bd2554a
MD5 906689a666d3d9ab4cc951ed6354d0b1
SHA1 14e848bd6b69c4c94c65dd87c1cf70bf8f00992d
SHA512 acc63586c9ef81fceb20ada7ecedd9db390ab7273060e50079e03296e13aab6944140fcd186c4f1263ec497ba1e79100079800718a0911c8f50a7aacf508353a
SSDEEP 3145728:r4jjdxiTIhcTDaT67AaQIxCYMBS4UR8RZuMcUvEkjvHjX:r+WIhGIoXsG8ruMcRkjvz
TLSH
T1BD6833609B98D452DCF3197092ACE2637C3DBAE61F3081C764A8D79D2DA17C08E3566F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
wlsetup-all.exe

File Explorer

wlsetup-all.exe

.exe 131.0MB

wlsetup-all.exe

IMPHASH f18c2f199b20fed75b6c5cea33061fb8
SHA256 072424c82f942f2b43b68b9154e1f3e0c61b7ee39a08372048ed34e09bd2554a
MD5 906689a666d3d9ab4cc951ed6354d0b1
SHA1 14e848bd6b69c4c94c65dd87c1cf70bf8f00992d
SHA512 acc63586c9ef81fceb20ada7ecedd9db390ab7273060e50079e03296e13aab6944140fcd186c4f1263ec497ba1e79100079800718a0911c8f50a7aacf508353a
SSDEEP 3145728:r4jjdxiTIhcTDaT67AaQIxCYMBS4UR8RZuMcUvEkjvHjX:r+WIhGIoXsG8ruMcRkjvz
TLSH
T1BD6833609B98D452DCF3197092ACE2637C3DBAE61F3081C764A8D79D2DA17C08E3566F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

4d:5c:05:77:8b:a2:3b:ff:99:9b:bc:71:8b:b7:69:55:17:82:27:6b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 7, 2014

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7D2E-3782-B0F7,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:37:fe:bd:ed:dc:d2:54:01:6b:00:00:00:00:00:37

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2013 - Jun 27, 2014

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 24, 2013 - Apr 24, 2014

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:33:26:1a:00:00:00:00:00:31

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 31, 2010 - Aug 31, 2020

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:16:68:34:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Apr 3, 2007 - Apr 3, 2021

Minor OS version

Major OS version

Entry point

222614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wlsetup.pdb

advapi32

RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegGetValueW CopySid AddAce OpenProcessToken GetUserNameW GetLengthSid GetSidLengthRequired GetSidSubAuthority InitializeAcl InitializeSid IsValidSid ConvertStringSecurityDescriptorToSecurityDescriptorW SetNamedSecurityInfoW SetSecurityInfo CreateProcessAsUserW AdjustTokenPrivileges DuplicateTokenEx SetTokenInformation ConvertStringSidToSidW TraceEvent RegisterTraceGuidsW UnregisterTraceGuids GetTraceLoggerHandle GetTokenInformation ConvertSidToStringSidW AllocateAndInitializeSid CheckTokenMembership FreeSid LookupPrivilegeValueW CryptAcquireContextW CryptReleaseContext CryptGenRandom CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash OpenThreadToken DuplicateToken ImpersonateLoggedOnUser RevertToSelf RegEnumValueW GetSecurityDescriptorDacl GetSecurityDescriptorOwner CreateWellKnownSid

kernel32

GetNativeSystemInfo GetFileAttributesExW DeleteTimerQueueTimer CreateTimerQueueTimer UnlockFileEx LockFileEx CompareStringEx CreateHardLinkTransactedW MoveFileExW DeleteFileTransactedW SetFileTime GetExitCodeThread WaitForMultipleObjectsEx GetSystemDefaultLocaleName GetComputerNameW CopyFileW GlobalMemoryStatusEx WerRegisterFile GetSystemDefaultLCID GetSystemDefaultUILanguage GetVersionExW CompareStringA GetTempFileNameA GetProductInfo lstrlenW RemoveDirectoryA GetShortPathNameW CreateDirectoryA GetTempPathA FileTimeToDosDateTime GetFullPathNameA GetFileInformationByHandle GetFileAttributesA OpenFileMappingW VirtualFree FileTimeToLocalFileTime DeleteFileA CreateFileA UnmapViewOfFile MapViewOfFile CreateFileMappingW GetNamedPipeServerProcessId CreateNamedPipeW QueryFullProcessImageNameW GetTickCount GetLocalTime GetFileSize GetFileSizeEx CreateMutexW GetFullPathNameW QueueUserWorkItem GetTempPathW FlushInstructionCache OpenProcess SetEnvironmentVariableW GetEnvironmentVariableW VerifyVersionInfoW ExpandEnvironmentStringsW WaitForMultipleObjects SetEnvironmentVariableA CreateProcessW GetExitCodeProcess InterlockedCompareExchange InterlockedExchangeAdd CreateEventW ResetEvent EnumResourceNamesW GetPrivateProfileSectionNamesW GetPrivateProfileSectionW WritePrivateProfileStringW GetPrivateProfileStringW OpenMutexW ReleaseMutex DeviceIoControl SetFileAttributesW RemoveDirectoryW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW GetTempFileNameW CreateDirectoryW LockResource FindResourceExW GetComputerNameExW CreateFileW WriteConsoleW FlushFileBuffers SetStdHandle GetUserDefaultLocaleName SetFilePointerEx OutputDebugStringW GetConsoleCP WideCharToMultiByte SetFilePointer GetConsoleMode ReadFile LCMapStringEx GetLocaleInfoEx GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage HeapSize TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetTickCount64 QueryPerformanceCounter GetStartupInfoW InitOnceExecuteOnce GetLongPathNameW GlobalFree FileTimeToSystemTime GetThreadPriority FreeResource DuplicateHandle FreeLibraryAndExitThread HeapDestroy GetFileType GetProcessHeap WriteFile GetStdHandle GetModuleHandleExW ExitProcess GetCurrentThreadId GetCurrentThread FlsFree CompareFileTime CloseHandle RaiseException FlsSetValue FlsGetValue FlsAlloc VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo SetThreadStackGuarantee HeapReAlloc HeapAlloc HeapFree IsProcessorFeaturePresent IsDebuggerPresent EncodePointer GetCommandLineW DecodePointer InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList ReleaseSemaphore GetTimeZoneInformation GetSystemTime MulDiv LocalAlloc OpenEventW SetEvent GetThreadUILanguage MultiByteToWideChar CompareStringW SystemTimeToFileTime SetDllDirectoryW FindResourceW LoadLibraryW lstrcmpiW FormatMessageW LocalFree SizeofResource LoadResource LoadLibraryExW GetProcAddress GetModuleHandleW GetModuleFileNameW FreeLibrary GetSystemDirectoryW GetSystemTimeAsFileTime SetThreadPriority CreateThread GetCurrentProcessId InterlockedExchange InterlockedDecrement InterlockedIncrement Sleep WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection InitializeCriticalSection HeapSetInformation SetLastError GetLastError CreateSemaphoreW

gdi32

CreateCompatibleDC CreateCompatibleBitmap BitBlt SetBkColor SetTextColor SetBkMode CreatePen CreateSolidBrush SelectObject GetObjectW GetStockObject DeleteObject CreateFontIndirectW DeleteDC Rectangle GetDeviceCaps GetTextExtentPoint32W CreateRectRgn ExcludeClipRect IntersectClipRect RestoreDC GetClipRgn SaveDC SetLayout GetTextMetricsW CreateRoundRectRgn

user32

LoadIconW GetParent GetDesktopWindow AdjustWindowRectEx EndDialog IsWindowVisible ShowWindow CreateWindowExW ChangeWindowMessageFilter GetWindowInfo NotifyWinEvent MapDialogRect IsDialogMessageW GetShellWindow SetWindowLongW GetWindowLongW InflateRect FillRect GetClientRect RedrawWindow EndPaint BeginPaint TranslateAcceleratorW IsWindowEnabled CreateAcceleratorTableW EnableWindow GetNextDlgTabItem BringWindowToTop SetLayeredWindowAttributes GetLayeredWindowAttributes DestroyWindow PostQuitMessage PostMessageW SendMessageTimeoutW GetMessageW GetClassNameW GetWindowTextLengthW GetWindowTextW ReleaseDC GetDC DrawTextW SendMessageW GetSysColor KillTimer GetSystemMetrics SetProcessDefaultLayout GetWindowThreadProcessId SetCursor LoadCursorW TranslateMessage DispatchMessageW PeekMessageW IsWindow SetWindowPos GetWindowPlacement MsgWaitForMultipleObjectsEx SetWindowRgn SetWindowTextW GetWindowRect SetRect CopyRect SystemParametersInfoW InvalidateRect UpdateWindow MapWindowPoints RegisterClassExW CreateDialogIndirectParamW DialogBoxIndirectParamW DefDlgProcW EnumChildWindows PtInRect SetWindowPlacement DefWindowProcW CallWindowProcW GetClassInfoExW GetAncestor GetScrollPos EnableScrollBar SetScrollInfo GetScrollInfo TrackMouseEvent GetFocus GetScrollRange IntersectRect GetSystemMenu EnableMenuItem DrawFocusRect GetDCEx ScreenToClient WindowFromPoint MsgWaitForMultipleObjects SetTimer UnregisterClassW SetFocus CharNextW ExitWindowsEx RegisterWindowMessageW MoveWindow LoadStringW DestroyAcceleratorTable

urlmon

CoInternetGetSession URLOpenStreamW CreateAsyncBindCtx CreateURLMoniker

msi

ord141 ord244 ord240 ord116 ord118 ord115 ord8 ord285 ord286 ord32 ord159 ord113 ord92 ord254 ord270 ord266 ord78 ord150 ord171 ord48 ord195 ord190 ord205 ord238 ord160 ord242 ord70 ord203 ord173 ord88

comctl32

ord17

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrustEx

userenv

UnloadUserProfile

secur32

GetUserNameExW

crypt32

CertVerifyCertificateChainPolicy CryptBinaryToStringW CryptStringToBinaryW

uxtheme

SetWindowTheme

psapi

EnumProcesses

shlwapi

PathAppendW StrStrIW PathIsRelativeW PathFindExtensionW PathIsDirectoryW SHCreateStreamOnFileW SHDeleteValueW SHSetValueW SHGetValueW SHCreateStreamOnFileEx PathRemoveFileSpecW PathRemoveArgsW PathStripPathW PathUnquoteSpacesW PathStripToRootW UrlCreateFromPathW PathCreateFromUrlW PathFindFileNameA PathFileExistsA PathGetDriveNumberA PathIsDirectoryA SHCreateStreamOnFileA StrCmpNIW SHDeleteKeyW PathFileExistsW StrStrA StrRChrA PathFindFileNameW StrRChrW ord437 PathCombineW StrCmpNW

wininet

InternetCrackUrlW InternetCreateUrlW InternetCombineUrlW

gdiplus

GdipDrawImageRectI GdipDrawImagePointRectI GdipDrawImageI GdipDrawImageRectRect GdiplusStartup GdiplusShutdown GdipGetImageWidth GdipGetImageHeight GdipCreateFromHDC GdipDeleteGraphics GdipDrawImageRectRectI GdipAlloc GdipFree GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipCreateFromHWND GdipCreateFontFamilyFromName GdipDeleteFontFamily GdipCreateFont GdipDeleteFont GdipGetLogFontW

winhttp

WinHttpWriteData WinHttpAddRequestHeaders WinHttpSetStatusCallback WinHttpTimeFromSystemTime WinHttpSetCredentials WinHttpGetDefaultProxyConfiguration WinHttpCrackUrl WinHttpGetProxyForUrl WinHttpSetOption WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpQueryHeaders WinHttpGetIEProxyConfigForCurrentUser

cabinet

ord11 ord13 ord14 ord20 ord22 ord23 ord10

ntdll

RtlAllocateHeap VerSetConditionMask NtQuerySystemTime RtlFreeHeap RtlUnwind

oleacc

AccessibleObjectFromWindow LresultFromObject

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wer

WerReportSubmit WerReportSetUIOption WerReportAddFile WerReportSetParameter WerReportCreate WerReportCloseHandle

rstrtmgr

RmEndSession RmStartSession RmRegisterResources RmShutdown RmRestart RmCancelCurrentTask RmAddFilter

ktmw32

CreateTransaction RollbackTransaction CommitTransaction

pdh

PdhOpenQueryW PdhCollectQueryData PdhCloseQuery PdhGetFormattedCounterValue PdhAddEnglishCounterW

wsock32

inet_addr WSACleanup WSAStartup gethostbyname WSAGetLastError

shell32

SHGetKnownFolderPath ord43 SHGetFolderPathW CommandLineToArgvW SHGetFolderPathA ShellExecuteExW SHGetSpecialFolderPathW ord165 SHCreateDirectoryExW SHGetFolderPathAndSubDirW

ole32

CoCreateFreeThreadedMarshaler CoQueryProxyBlanket CoCopyProxy CoCreateGuid CreateStreamOnHGlobal StringFromGUID2 CoInitializeSecurity CoDisconnectObject CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoTaskMemRealloc CoSetProxyBlanket CoTaskMemAlloc CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

VariantClear LoadTypeLibEx VariantChangeType SysAllocStringLen VariantInit LoadTypeLi LoadRegTypeLi SysAllocString SysStringLen VarUI4FromStr VariantCopy SysFreeString

Sharing

General

Malware Config

Signatures

File Explorer

wlsetup-all.exe

PE Signature issue

advapi32

kernel32

gdi32

user32

urlmon

msi

comctl32

wintrust

userenv

secur32

crypt32

uxtheme

psapi

shlwapi

wininet

gdiplus

winhttp

cabinet

ntdll

oleacc

version

wer

rstrtmgr

ktmw32

pdh

wsock32

shell32

ole32

oleaut32

generic