Windows11InstallationAssistant (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Windows11InstallationAssistant (1).exe
Size 4.0MB
Sample260922-vner5sw1cs
SHA256 837f97852c2e8f4242cde4dbf863ed0db117082d2eebfb7c3f1f37f9b6e89758
MD5 8eb03b7f178eccb8bd71ca6390e924cc
SHA1 8ac232df39c6c1a9caa1b35dc521df7bc3dbde6b
SHA512 cf37bf2ba5d720b6c435d5eb98822565cf2192dcba709655e8fdd9e80661c67a6a4101be676e826c7a3cd0b2ee7163cd5639ed56403ae66ce3911ce483dbb9d8
SSDEEP 98304:egiywctyoh4cCg2/b0NN2dR1UjICj63dzBEVht5f/LyXtcH/i:RBtyoh9CggQIPCj6NwjyXv
TLSH
T1D816E0C366E40129E5FF6A345A79127D446BBD6C5BF3C18F12870DA81B30AACED34726
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Windows11InstallationAssistant (1).exe

.exe 4.0MB

Windows11InstallationAssistant (1).exe

IMPHASH 007db55b0c9d2f882a812da02400b3b4
SHA256 837f97852c2e8f4242cde4dbf863ed0db117082d2eebfb7c3f1f37f9b6e89758
MD5 8eb03b7f178eccb8bd71ca6390e924cc
SHA1 8ac232df39c6c1a9caa1b35dc521df7bc3dbde6b
SHA512 cf37bf2ba5d720b6c435d5eb98822565cf2192dcba709655e8fdd9e80661c67a6a4101be676e826c7a3cd0b2ee7163cd5639ed56403ae66ce3911ce483dbb9d8
SSDEEP 98304:egiywctyoh4cCg2/b0NN2dR1UjICj63dzBEVht5f/LyXtcH/i:RBtyoh9CggQIPCj6NwjyXv
TLSH
T1D816E0C366E40129E5FF6A345A79127D446BBD6C5BF3C18F12870DA81B30AACED34726
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Digest

ec:88:44:40:7b:35:d5:54:71:ba:a3:59:86:5e:36:f6:a3:6e:8b:3b:11:c9:f5:73:c9:27:67:9d:c8:9e:5a:47

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Sep 26, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:86:e7:71:94:b9:4d:ff:09:fb:00:00:00:00:00:86

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 8, 2025 - May 6, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A000-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:08:78:9d:58:5d:92:c7:d9:52:00:01:00:00:02:08

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 30, 2025 - Apr 22, 2026

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

465536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

upgraderstub.pdb

advapi32

EnableTraceEx2 RegQueryValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW QueryTraceW EventUnregister ControlTraceW RegOpenKeyExW RegSetValueExW RegSetKeySecurity EventSetInformation RegCreateKeyExW RegDeleteKeyW EventRegister EventWriteTransfer RegCloseKey StartTraceW GetSecurityDescriptorDacl AdjustTokenPrivileges OpenProcessToken GetSecurityDescriptorOwner GetSecurityDescriptorGroup GetSecurityDescriptorSacl GetSecurityDescriptorControl GetSecurityDescriptorLength GetAclInformation RevertToSelf OpenEncryptedFileRawW WriteEncryptedFileRaw CloseEncryptedFileRaw

kernel32

GetVolumePathNamesForVolumeNameW TlsSetValue TlsGetValue TlsFree TlsAlloc WaitForMultipleObjectsEx GlobalMemoryStatusEx GetVolumeInformationByHandleW UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateSemaphoreW WaitForMultipleObjects GetPrivateProfileSectionW UnlockFileEx LockFileEx InitializeCriticalSectionAndSpinCount CreateEventW GetVolumeInformationW GetCurrentThread SetThreadIdealProcessor GetSystemInfo GetOverlappedResult GetHandleInformation DeleteCriticalSection LocalFree CreateThread GlobalFree DeleteFileW InitOnceComplete GetExitCodeThread GetFileAttributesW LocalAlloc CreateMutexW GetTempPathW InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW GetFullPathNameW GetCommandLineW EnterCriticalSection SetDefaultDllDirectories CompareStringW WritePrivateProfileStringW InitOnceBeginInitialize CreateDirectoryW IsDebuggerPresent DebugBreak GetModuleHandleW GetProcessHeap GetCurrentProcessId CreateMutexExW GetProcAddress HeapAlloc CloseHandle OpenSemaphoreW WaitForSingleObjectEx OutputDebugStringW GetLastError FormatMessageW ReleaseMutex GetCurrentThreadId WaitForSingleObject GetModuleHandleExW ReleaseSemaphore SetLastError HeapFree CreateSemaphoreExW GetModuleFileNameA Sleep GetStartupInfoW SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount GetFileInformationByHandleEx FindFirstFileW FindNextFileW DeviceIoControl FindClose CreateFileW SetFileAttributesW GetFileInformationByHandle SetFileInformationByHandle CopyFileExW FlushFileBuffers GetFileSizeEx GetCurrentDirectoryW FreeLibrary LoadLibraryExW GetLongPathNameW GetFinalPathNameByHandleW GetVolumePathNameW GetVolumeNameForVolumeMountPointW GetDriveTypeW GetEnvironmentVariableW SetEvent ResetEvent WideCharToMultiByte MultiByteToWideChar RemoveDirectoryW CreateFileA GlobalAlloc SetFilePointerEx ReadFile WriteFile SetFilePointer HeapReAlloc HeapSize GetShortPathNameW SetEndOfFile DuplicateHandle SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime OpenProcess OpenMutexW LoadLibraryW GetTempFileNameW MoveFileW VerifyVersionInfoW UnhandledExceptionFilter VerSetConditionMask

user32

LoadStringW CharUpperW MessageBoxW

msvcrt

memcmp strcpy_s memcpy memmove _wcsicmp wcsrchr _wcsnicmp iswspace towupper _vscwprintf qsort _except_handler4_common _controlfp ??1type_info@@UAE@XZ ?terminate@@YAXXZ _onexit __dllonexit _unlock _lock _acmdln _initterm __setusermatherr _ismbblead __p__fmode _cexit _exit exit __set_app_type __getmainargs _amsg_exit __p__commode _XcptFilter _CxxThrowException sprintf_s memmove_s wcschr ??0exception@@QAE@ABQBD@Z ?what@exception@@UBEPBDXZ _purecall iswdigit wcsnlen _vsnprintf_s ??0exception@@QAE@ABV0@@Z ??0exception@@QAE@XZ ??1exception@@UAE@XZ memcpy_s _vsnwprintf __CxxFrameHandler3 swscanf_s wcsncmp wcsstr memset

ole32

CoInitialize CoTaskMemFree CoUninitialize

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

shell32

CommandLineToArgvW ShellExecuteExW SHGetSpecialFolderPathW

shlwapi

PathRemoveFileSpecW StrStrIW PathFindFileNameW

cabinet

ord22 ord20 ord23

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

ntdll

NtYieldExecution NtQueryInformationFile RtlAdjustPrivilege RtlGetLastNtStatus RtlSetControlSecurityDescriptor RtlFindAceByType NtSetSecurityObject NtQueryVolumeInformationFile NtQueryInformationProcess RtlDosPathNameToNtPathName_U NtCreateFile NtClose RtlInitializeResource RtlAcquireResourceExclusive RtlAcquireResourceShared RtlReleaseResource RtlDeleteResource RtlImpersonateSelf NtSetEaFile DbgPrintEx RtlFreeHeap RtlAllocateHeap RtlNtStatusToDosError NtSetInformationFile RtlReAllocateHeap RtlRaiseStatus

psapi

GetModuleFileNameExW EnumProcesses

bcrypt

BCryptCreateHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty

Sharing

General

Malware Config

Signatures

File Explorer

Windows11InstallationAssistant (1).exe

advapi32

kernel32

user32

msvcrt

ole32

rpcrt4

shell32

shlwapi

cabinet

version

ntdll

psapi

bcrypt

generic