cdrom[.]sys | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
cdrom.sys
Size 228KB
Sample261017-bgaeasgs71
SHA256 d9200f7c9d0b4112f5b936aac480c010b8074358dd8e014ca1e29d4bb73b0083
MD5 159e87d775eef611fcb3766bb091b739
SHA1 84b778b5c6bd964981d8bb7ed832c383cc71ad7e
SHA512 bdb0cf9720be884d7a09067d3a1e11e5785d74a0c8474e1ddc591023bfdd894cb9ccf951866759dddfd3bc963c92f62d4dc6aaae9d3b43808fdfd404d5a55e33
SSDEEP 3072:7jikiWIuUopEhJ5WJelM9X5CVQSPT3/AVvwk4NZmbMrhl7N8cpWzDV:/ikiWI0ILWJZ5C9PT4V4kkmbIqcpA
TLSH
T164344B99A2A911E5D4FEC2B4CA920236E7F2B4202F7157CF468042755F33BE4ED39B19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cdrom.sys

File Explorer

cdrom.sys

.sys 228KB

cdrom.sys

IMPHASH fea7e3aade4a92d31a7b8fb6b9918785
SHA256 d9200f7c9d0b4112f5b936aac480c010b8074358dd8e014ca1e29d4bb73b0083
MD5 159e87d775eef611fcb3766bb091b739
SHA1 84b778b5c6bd964981d8bb7ed832c383cc71ad7e
SHA512 bdb0cf9720be884d7a09067d3a1e11e5785d74a0c8474e1ddc591023bfdd894cb9ccf951866759dddfd3bc963c92f62d4dc6aaae9d3b43808fdfd404d5a55e33
SSDEEP 3072:7jikiWIuUopEhJ5WJelM9X5CVQSPT3/AVvwk4NZmbMrhl7N8cpWzDV:/ikiWI0ILWJZ5C9PT4V4kkmbIqcpA
TLSH
T164344B99A2A911E5D4FEC2B4CA920236E7F2B4202F7157CF468042755F33BE4ED39B19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cdrom.pdb

ntoskrnl.exe

RtlQueryFeatureConfigurationChangeStamp EtwWriteTransfer KeSetEvent ExAllocatePool2 RtlUnregisterFeatureUsageProvider RtlUnregisterFeatureConfigurationChangeNotification EtwUnregister RtlRecordFeatureUsage MmGetSystemRoutineAddress EtwRegister ExFreePoolWithTag IoWMIRegistrationControl KeInitializeEvent KeWaitForSingleObject KeFlushQueuedDpcs IoInvalidateDeviceRelations IoSetDeviceInterfacePropertyData IoCreateArcName __C_specific_handler KeDelayExecutionThread MmUnlockPages KeAcquireSpinLockRaiseToDpc MmProbeAndLockPages IoReportTargetDeviceChangeAsynchronous IoFreeIrp IoAllocateMdl PoQueryWatchdogTime KeReleaseSpinLock KeLowerIrql strncmp IoFreeMdl IoAllocateIrp IofCallDriver IoDeleteSymbolicLink KfRaiseIrql MmUnmapLockedPages RtlDeleteRegistryValue IoWriteErrorLogEntry RtlQueryRegistryValues strchr IoIs32bitProcess IoAllocateErrorLogEntry RtlNotifyFeatureUsage KeQueryTimeIncrement RtlAnsiStringToUnicodeString KeInitializeMutex PoRegisterPowerSettingCallback MmBuildMdlForNonPagedPool RtlFreeUnicodeString KeReleaseMutex ZwPowerInformation PoUnregisterPowerSettingCallback IoReuseIrp RtlCompareMemory KeSetTimer IoBuildPartialMdl KeInitializeDpc KeInitializeSpinLock KeInitializeTimer KeCancelTimer IofCompleteRequest ObfDereferenceObject IoBuildDeviceIoControlRequest IoBuildSynchronousFsdRequest IoGetAttachedDeviceReference PsIsThreadTerminating RtlQueryFeatureConfiguration KeGetCurrentIrql IoGetConfigurationInformation IoGetDevicePropertyData RtlInitUnicodeString WmiQueryTraceInformation RtlArmFeatureUsageProviderFlushNotification DbgPrintEx RtlCopyUnicodeString RtlRegisterFeatureConfigurationChangeNotification IoCancelIrp _vsnwprintf IoSetHardErrorOrVerifyDevice RtlRegisterFeatureUsageProvider

hal

KeQueryPerformanceCounter

wpprecorder.sys

WppAutoLogTrace imp_WppRecorderReplay WppAutoLogStart WppAutoLogStop

wdfldr.sys

WdfVersionUnbind WdfLdrQueryInterface WdfVersionBind WdfVersionBindClass WdfVersionUnbindClass

Name

.text

Size

76KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

PAGE

Size

76KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

PAGEDATA

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

INIT

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

GFIDS

Size

4KB

Virtual Size

240B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cdrom.sys

ntoskrnl.exe

hal

wpprecorder.sys

wdfldr.sys

generic