sysupdate[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
sysupdate.exe
Size 394KB
Sample260729-1mdrcafc68
SHA256 b0b13059a912d087feb7200a882305b1a93d9211b0c7edc3d3a5f6eea7868580
MD5 c94b3e7821fa8f5d7043fac96f17f812
SHA1 acd9b363b079eadb7eedd68b9e0af2b89ca29f1e
SHA512 9e59ebadf9634f91e90fe0d43a11529d9b698c545d6ccc1f7cd67b85c9c34c5ad5dd498cb3cb044f11cf464bcf1748b0f690d56e5c4a70ebfef4b32be0ab5b8c
SSDEEP 6144:IIPo1sHwAMgvdPJacrm9GcehUSbOs1xYDBTpzpA+yISy4gy3:sgdPJ5r0GcO3bOsz4zpAMZE
TLSH
T17F848C56F3A500F9D1B7D138C9934906E772F8864760AACF03905AA61F376E0BE3E752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sysupdate.exe

File Explorer

sysupdate.exe

.exe 394KB

sysupdate.exe

IMPHASH 126d90ad09066c60b637df15f365ca9d
SHA256 b0b13059a912d087feb7200a882305b1a93d9211b0c7edc3d3a5f6eea7868580
MD5 c94b3e7821fa8f5d7043fac96f17f812
SHA1 acd9b363b079eadb7eedd68b9e0af2b89ca29f1e
SHA512 9e59ebadf9634f91e90fe0d43a11529d9b698c545d6ccc1f7cd67b85c9c34c5ad5dd498cb3cb044f11cf464bcf1748b0f690d56e5c4a70ebfef4b32be0ab5b8c
SSDEEP 6144:IIPo1sHwAMgvdPJacrm9GcehUSbOs1xYDBTpzpA+yISy4gy3:sgdPJ5r0GcO3bOsz4zpAMZE
TLSH
T17F848C56F3A500F9D1B7D138C9934906E772F8864760AACF03905AA61F376E0BE3E752
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

200340

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

shlwapi

SHDeleteValueW SHDeleteKeyW PathAppendW

advapi32

GetTokenInformation RegOpenKeyExW RegCloseKey OpenProcessToken RegQueryValueExW RegDeleteKeyW

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader RtlUnwind NtRaiseHardError RtlAdjustPrivilege

kernel32

SetEndOfFile GetFileType SetFilePointerEx GetFileSizeEx EnumSystemLocalesW FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc WriteConsoleW HeapSize GetProcessHeap WriteProcessMemory GetCurrentProcess WaitForSingleObject GetModuleHandleA GetExitCodeThread TerminateThread CloseHandle GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx CheckRemoteDebuggerPresent OpenProcess LoadLibraryW VirtualProtectEx GetCurrentProcessId GetCurrentThread GetFileAttributesW CreateToolhelp32Snapshot Process32NextW Process32FirstW ExitProcess FindFirstFileW FindNextFileW FindClose DeleteFileW SetConsoleTextAttribute GetStdHandle SetConsoleTitleA TerminateProcess Thread32Next Thread32First Sleep K32GetModuleInformation K32EnumProcessModules OpenThread MultiByteToWideChar GetTempPathA ReadProcessMemory GetModuleHandleW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW IsDebuggerPresent QueryPerformanceCounter CompareStringW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindFirstFileExW GetFileAttributesExW GetFullPathNameW SetFileInformationByHandle AreFileApisANSI GetLastError GetFileInformationByHandleEx WideCharToMultiByte QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId InitializeCriticalSectionEx GetSystemTimeAsFileTime WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW HeapFree GetExitCodeProcess CreateProcessW HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect

user32

FindWindowW FindWindowA

iphlpapi

GetAdaptersInfo

shell32

SHGetFolderPathW

urlmon

URLOpenBlockingStreamA