Microsoft Service Network[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft Service Network.exe
Size 74.1MB
Sample260818-qdtfbsshkh
SHA256 8d082f1d60b2a879cbbec17ec00daf14aa30b4385303eaa591454deda1e4ff3f
MD5 16a2ebf1ed38667725c86ff5a4507a6b
SHA1 51f194bb0d193bd7430f45ee5beb961c996aa756
SHA512 0631e79f134dfd9a7643aa0353b186af0819ea456ba3142868c88d9bd4f2429223d093d457b94dff1c5465a83cf2e3d4aaea7689142ce05a7c8d4c88da798553
SSDEEP 786432:+0ifLRfkjSvnffgcwBuVwe+336PD5SfNwyUZ+bN87vXE4X/Rhya5Q:+0if9fku3fgKVS6dWXg+bN8DJ3
TLSH
T16308CF1E727460ECC87AC075C9178647E7F9786613385ADF21A08B7A2F13AF1897E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Microsoft Service Network.exe

File Explorer

Microsoft Service Network.exe

.exe 74.1MB

Microsoft Service Network.exe

IMPHASH 29996170b4b3e3d75cdff76ea6d7f32f
SHA256 8d082f1d60b2a879cbbec17ec00daf14aa30b4385303eaa591454deda1e4ff3f
MD5 16a2ebf1ed38667725c86ff5a4507a6b
SHA1 51f194bb0d193bd7430f45ee5beb961c996aa756
SHA512 0631e79f134dfd9a7643aa0353b186af0819ea456ba3142868c88d9bd4f2429223d093d457b94dff1c5465a83cf2e3d4aaea7689142ce05a7c8d4c88da798553
SSDEEP 786432:+0ifLRfkjSvnffgcwBuVwe+336PD5SfNwyUZ+bN87vXE4X/Rhya5Q:+0if9fku3fgKVS6dWXg+bN8DJ3
TLSH
T16308CF1E727460ECC87AC075C9178647E7F9786613385ADF21A08B7A2F13AF1897E721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30305180

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

GetAdaptersInfo

kernel32

GetProcAddress GetVolumeInformationA CloseHandle GetCurrentThread SetThreadPriority GetLastError VirtualAlloc VirtualProtect VirtualFree GetLargePageMinimum LocalFree FormatMessageA WinExec GetCurrentProcessId OpenProcess GetVersionExW FreeLibrary GetModuleHandleW LoadLibraryA K32EnumProcessModules K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW WriteConsoleW GetConsoleScreenBufferInfo SetConsoleTextAttribute LoadLibraryW ExpandEnvironmentStringsA VerSetConditionMask VerifyVersionInfoW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetEnvironmentVariableW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileExW FindNextFileW FlushFileBuffers GetDriveTypeW GetFileAttributesW GetFileInformationByHandle GetFileType GetFinalPathNameByHandleW SetFileInformationByHandle SetFileTime DuplicateHandle SetLastError Sleep GetSystemTime GetSystemInfo VirtualQuery CreateFileMappingW MapViewOfFile UnmapViewOfFile SetConsoleCtrlHandler SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte GetProcessTimes GetNativeSystemInfo SearchPathW WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessW CreateJobObjectW AssignProcessToJobObject SetInformationJobObject CreateFileA GetFileAttributesA SetFilePointerEx WriteFile MapViewOfFileEx CreateFileMappingA GetTempPathA GetTempFileNameA GetLocaleInfoA RaiseException GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceCounter QueryPerformanceFrequency RtlCaptureContext SetUnhandledExceptionFilter ReleaseSemaphore CreateThread ExitThread CreateSemaphoreA CreateWaitableTimerA HeapCreate HeapDestroy SetStdHandle GetEnvironmentVariableA LocalAlloc GetSystemDirectoryW LoadLibraryExW GetFullPathNameW OutputDebugStringW GetACP IsValidCodePage GetProcessHeap HeapSize HeapReAlloc CreatePipe GetFileAttributesExW GetFileSizeEx SetConsoleMode GetConsoleMode ExitProcess GetCurrentProcess CheckRemoteDebuggerPresent IsDebuggerPresent GetCommandLineW GetStdHandle GetOEMCP GetTimeZoneInformation RemoveDirectoryW GetEnvironmentStringsW GetModuleHandleA GetModuleFileNameW EnumSystemLocalesW GetUserDefaultLCID LoadLibraryExA WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSectionEx RtlPcToFileHeader InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent InitOnceExecuteOnce FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetLocaleInfoEx InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwindEx RtlUnwind FreeLibraryAndExitThread ReadFile GetConsoleOutputCP ReadConsoleW SetEndOfFile HeapValidate HeapWalk DeleteFileW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetEnvironmentVariableW GetCommandLineA HeapFree HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale FreeEnvironmentStringsW

user32

CharUpperW

shell32

CommandLineToArgvW SHGetKnownFolderPath

ole32

CoTaskMemFree

advapi32

LookupPrivilegeValueA CryptGenRandom CryptReleaseContext CryptAcquireContextW OpenProcessToken AdjustTokenPrivileges RegQueryValueExW RegOpenKeyExW RegCloseKey GetTokenInformation

dbghelp

ImageNtHeader

Name

.text

Size

29.4MB

Virtual Size

29.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15.9MB

Virtual Size

15.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27.4MB

Virtual Size

28.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_randomn

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

172KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

183KB

Virtual Size

182KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=25, id=259, version=30795,

count=238, id=261, version=30795,

count=45, id=260, version=30795,

count=20, id=260, version=30034,

count=12, id=259, version=30034,

count=4, id=253, version=28518,

count=114, id=261, version=30034,

count=1, id=262, version=30795,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=16, id=206, productName=VS2012 build 50727, version=50727,

count=1203, productName=Unmarked objects (old),

count=17, id=257, version=30795,

count=335, id=1, productName=Unmarked objects,

count=3, id=259, version=30147,

count=19, id=260, version=30147,

count=819, id=261, version=30147,

count=1, id=255, version=30147,

count=1, id=151,

count=1, id=258, version=30147,