WindowsMigrationAssistantSetup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
WindowsMigrationAssistantSetup.exe
Size 59.6MB
Sample260719-ryrynsfv7s
SHA256 f87069fd551df641ecbd295331706d502eabd54398036b1ab4a31afbd658f324
MD5 f31a28e8a4c50654340d9bf636c24fb1
SHA1 458bb43d96880603cee0086277e64b16f936a2e7
SHA512 4f567a9615cb5dfc87a36625980361961e55eb312aacd2ff9cc3e8f08dcc10dd42ed0e45e99caa931a02996d5e424ed22c5ae078c86b71a3cada1f406bf9e05f
SSDEEP 1572864:uTDkFpTYwAJGLtYI7wkRKLdjMBOFyXZuQDQM6HScL:uTDk/gKYIzKLtMBOG7DQLye
TLSH
T132D73385B2778C23F198BA3440128690F181E4E29FA156FE138B973D5F79C466F7BA1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

WindowsMigrationAssistantSetup.exe

.exe 59.6MB

WindowsMigrationAssistantSetup.exe

IMPHASH ac4a2657285a6d3a9d6e39e46afd4342
SHA256 f87069fd551df641ecbd295331706d502eabd54398036b1ab4a31afbd658f324
MD5 f31a28e8a4c50654340d9bf636c24fb1
SHA1 458bb43d96880603cee0086277e64b16f936a2e7
SHA512 4f567a9615cb5dfc87a36625980361961e55eb312aacd2ff9cc3e8f08dcc10dd42ed0e45e99caa931a02996d5e424ed22c5ae078c86b71a3cada1f406bf9e05f
SSDEEP 1572864:uTDkFpTYwAJGLtYI7wkRKLdjMBOFyXZuQDQM6HScL:uTDk/gKYIzKLtMBOG7DQLye
TLSH
T132D73385B2778C23F198BA3440128690F181E4E29FA156FE138B973D5F79C466F7BA1C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Password

infected

Digest

d2:d2:8b:88:32:14:b1:e7:d6:d2:df:cb:30:81:a9:82:bc:e4:0b:eb:bb:28:81:43:6c:bd:8b:78:31:ec:ee:4b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Nov 14, 2023

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

b3:8e:99:bb:24:ba:5f:a1:8f:3f:ba:de:3c:b8:5b:ee:b8:db:0e:4e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Chains

Nov 14, 2023

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=Apple Inc.,O=Apple Inc.,L=Cupertino,ST=California,C=US

Serial Number

04:a3:e6:f3:cd:96:66:66:93:9a:e9:b6:5a:9d:43:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 30, 2023 - Jul 30, 2024

Minor OS version

Major OS version

Entry point

12314

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BWA\ABE3EBD1-E675-0\DefenestrationWinPackageData_Final-52\srcroot\setup\Release\setup.pdb

kernel32

CreateDirectoryA CreateFileA DeleteFileA LocalFileTimeToFileTime RemoveDirectoryA SetFileAttributesA SetFileTime CloseHandle GetLastError WaitForSingleObject CreateMutexA GetCurrentProcess GetCurrentProcessId GetExitCodeProcess CreateProcessA GetTickCount GetSystemDirectoryA FreeLibrary FreeResource GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource LocalAlloc LocalFree SetProcessWorkingSetSize DosDateTimeToFileTime FindResourceA GetTempPathA SetStdHandle HeapAlloc HeapFree GetProcessHeap GetLocalTime LoadLibraryExA LoadLibraryA DecodePointer HeapReAlloc HeapSize GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetFilePointerEx ReadFile MultiByteToWideChar GetConsoleMode ReadConsoleW WriteFile WideCharToMultiByte GetConsoleCP CreateFileW GetFileType GetStdHandle ExitProcess GetModuleHandleExW GetACP LCMapStringW FlushFileBuffers WriteConsoleW SetEndOfFile FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

GetSystemMetrics ShowWindow DestroyWindow CreateWindowExA SendMessageA UpdateWindow

Sharing

General

Malware Config

Signatures

File Explorer

WindowsMigrationAssistantSetup.exe

kernel32

user32

generic