temp[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
temp.exe
Size 342KB
Sample260724-cnczfaeb56
SHA256 347aea0556212e2564709ef3c8677f75cc0ab24f83d03cfa1a98680d29a437cd
MD5 93dc52d67761a6be9b5d03fe1384b5da
SHA1 82032be8f005e936d0358e5d4f823ef0d1c1df35
SHA512 675facbd6b70d29effdbf0ffe946642e66fb8c126ce359bd64be08796a0c938f6c3741d3a04e2d56515769d39d688a7e077fe0ea3ace7bb45f9d5742bed6a5bb
SSDEEP 6144:i6C/VHDE0iDvGehPabUZjUJ8wTwn1sGbRzOZ3SsxhU7wib5VYpxM7ZLeSZB1jVZz:4/VHDHgGEapdlKlUEAm
TLSH
T1EF746D15A79604ECE377D478C9678926FAB77C414721D9EF07A0086A2F26EF0B736312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
temp.exe

File Explorer

temp.exe

.exe 342KB

temp.exe

IMPHASH 74921cfc9d02986c0ea8c85cfdd18d7f
SHA256 347aea0556212e2564709ef3c8677f75cc0ab24f83d03cfa1a98680d29a437cd
MD5 93dc52d67761a6be9b5d03fe1384b5da
SHA1 82032be8f005e936d0358e5d4f823ef0d1c1df35
SHA512 675facbd6b70d29effdbf0ffe946642e66fb8c126ce359bd64be08796a0c938f6c3741d3a04e2d56515769d39d688a7e077fe0ea3ace7bb45f9d5742bed6a5bb
SSDEEP 6144:i6C/VHDE0iDvGehPabUZjUJ8wTwn1sGbRzOZ3SsxhU7wib5VYpxM7ZLeSZB1jVZz:4/VHDHgGEapdlKlUEAm
TLSH
T1EF746D15A79604ECE377D478C9678926FAB77C414721D9EF07A0086A2F26EF0B736312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

225792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetConsoleMode GetTempPathA CopyFileA GetLastError GetFileAttributesA DeleteFileA DeleteFileW CloseHandle LoadLibraryW GetWindowsDirectoryW GetProcAddress LocalFree MoveFileExW DeleteCriticalSection Sleep CreateProcessW GetModuleHandleW FreeLibrary CopyFileW GetTempFileNameW SetConsoleOutputCP GetSystemTimeAsFileTime GetTempFileNameA VirtualQuery GetDriveTypeW SetUnhandledExceptionFilter GetExitCodeProcess GetLocaleInfoEx InitializeSListHead QueryPerformanceCounter MultiByteToWideChar SetFileAttributesW GetModuleHandleA GetCurrentDirectoryA GetSystemDirectoryW GetFileAttributesW CreateFileW WaitForSingleObject FindClose InitializeCriticalSectionEx GetTempPathW SetEndOfFile GetEnvironmentVariableW GetModuleFileNameW SetFileTime RemoveDirectoryW VirtualAlloc DeviceIoControl SetConsoleMode ExpandEnvironmentStringsW WriteFile GetStdHandle GetCurrentProcess FindNextFileW SetConsoleTitleA VirtualFree FindFirstFileA FindFirstFileW GetCurrentProcessId GetLogicalDrives OutputDebugStringW IsDebuggerPresent CreateDirectoryW GetFileAttributesExW SetFileInformationByHandle CreateFile2 FormatMessageA AreFileApisANSI GetFileInformationByHandleEx WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive GetCurrentThreadId

user32

MessageBoxA

advapi32

AdjustTokenPrivileges RegCloseKey RegEnumKeyW RegOpenKeyA QueryServiceStatus CloseServiceHandle ClearEventLogW OpenSCManagerW RegDeleteKeyW AllocateAndInitializeSid LookupPrivilegeValueA SetEntriesInAclW RegCreateKeyExW CloseEventLog SetNamedSecurityInfoW ControlService RegEnumKeyExW RegSetValueExW RegSetValueExA OpenProcessToken FreeSid OpenEventLogW RegOpenKeyExW RegCreateKeyW RegDeleteValueW OpenServiceW RegOpenKeyW RegEnumValueW RegQueryValueExW

ole32

CoInitialize StringFromGUID2 CoCreateInstance

oleaut32

SysFreeString

msvcp140

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Xtime_get_ticks _Query_perf_counter _Mtx_lock ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Query_perf_frequency ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

shlwapi

SHDeleteKeyW

urlmon

URLDownloadToFileW URLDownloadToFileA

ntdll

NtClose NtQuerySystemInformation

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memchr __current_exception_context __std_exception_destroy __std_exception_copy wcsstr __std_terminate strstr strchr __current_exception _CxxThrowException wcsrchr memcmp memset memcpy memmove __C_specific_handler

api-ms-win-crt-stdio-l1-1-0

fputc __acrt_iob_func __p__commode _set_fmode _get_stream_buffer_pointers fflush __stdio_common_vsprintf_s _fseeki64 fread fsetpos __stdio_common_vswprintf_s fgetc getchar ungetc __stdio_common_vfprintf setvbuf fgetpos __stdio_common_vsprintf fopen_s fwrite fclose

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-string-l1-1-0

wcslen strnlen wcscat_s wcscpy_s _wcsnicmp _stricmp _wcsicmp strlen isalnum tolower

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

wcstombs_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _initialize_onexit_table _get_initial_narrow_environment _initialize_narrow_environment _initterm_e exit _exit __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv abort terminate _initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr