lapsus[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
lapsus.exe
Size 82.1MB
Sample260729-rda5eswapd
SHA256 382556489b15798fe97f01324f9a43c9a9548bf83c9cf75be6746d9c2f0dc920
MD5 8763caf06cc2a3061b1cb75ea54793c8
SHA1 c1afe7750071161828e8019f8684156ad7cd1805
SHA512 ba9527ae565a2015526df3b52e01b371613645563b1fe4ae5645970ffbd764cac07f54de98e6b0080336dc7cb8b9027a60e86ed5c41324156d5330057f0f677b
SSDEEP 1572864:mwQQAfb4//VygITZDv+JNQVtVCjhT9Ep386YzU4LQpbOy8aOtHV:mtQGb4hIhv+JNQVt2hT9EpM6YA4yqamV
TLSH
T1F018337EF4E542FCFB9286BC9F1E3E37133363A46F89800E5123509329A1B47566A61D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
lapsus.exe

File Explorer

lapsus.exe

.exe 82.1MB

lapsus.exe

IMPHASH d4655bc891359d0e8c5a8499e8325bd7
SHA256 382556489b15798fe97f01324f9a43c9a9548bf83c9cf75be6746d9c2f0dc920
MD5 8763caf06cc2a3061b1cb75ea54793c8
SHA1 c1afe7750071161828e8019f8684156ad7cd1805
SHA512 ba9527ae565a2015526df3b52e01b371613645563b1fe4ae5645970ffbd764cac07f54de98e6b0080336dc7cb8b9027a60e86ed5c41324156d5330057f0f677b
SSDEEP 1572864:mwQQAfb4//VygITZDv+JNQVtVCjhT9Ep386YzU4LQpbOy8aOtHV:mtQGb4hIhv+JNQVt2hT9EpM6YA4yqamV
TLSH
T1F018337EF4E542FCFB9286BC9F1E3E37133363A46F89800E5123509329A1B47566A61D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

24:38:fa:47:bd:e5:e1:e1:17:cc:9b:c4:7f:26:66:bd:d6:f2:4c:d1:fc:9b:e4:00:fa:c9:fb:d5:ed:47:b1:63

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jul 11, 2026

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:05:9b:7a:bc:51:a1:9e:71:24:18:00:00:00:00:05:9b

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Oct 17, 2026

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:2b:bb:00:50:ff:4d:3b:9a:a1:00:01:00:00:02:2b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

9.0MB

Virtual Size

9.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

lapsus.exe

PE Signature issue

kernel32

msvcrt

user32

generic