winusb[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
winusb.exe
Size 104KB
Sample261020-p585eshy7s
SHA256 3f0d87ad482c32f65a1f3f2723aee06c2ff501e7ff0ec09303aaff39f74e453e
MD5 78e21ddce357215e318e0553d6af0e9e
SHA1 86dc8103b34e0b833fbfca4b017b32bc5db89add
SHA512 afa808df16971601e04c13bbdf1c788a220d6c63467de39397dc83c3e6cec9618c8e36f4c7e8d89820403741d8119ec464ec46aaa72b5a87b3cb4355455ccd64
SSDEEP 3072:oFrFyam/6LG404HpXJxpcjX3p4xOtsjkdT:Yq6P04JZvcjXZ4xOt
TLSH
T18AA34B88FA83A0BEEE1344B1419BF33F9638963168709E23E344DD75DF76AE15500E96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winusb.exe

File Explorer

winusb.exe

.exe 104KB

winusb.exe

IMPHASH e47e12e7fddf79a633b933a9969ca000
SHA256 3f0d87ad482c32f65a1f3f2723aee06c2ff501e7ff0ec09303aaff39f74e453e
MD5 78e21ddce357215e318e0553d6af0e9e
SHA1 86dc8103b34e0b833fbfca4b017b32bc5db89add
SHA512 afa808df16971601e04c13bbdf1c788a220d6c63467de39397dc83c3e6cec9618c8e36f4c7e8d89820403741d8119ec464ec46aaa72b5a87b3cb4355455ccd64
SSDEEP 3072:oFrFyam/6LG404HpXJxpcjX3p4xOtsjkdT:Yq6P04JZvcjXZ4xOt
TLSH
T18AA34B88FA83A0BEEE1344B1419BF33F9638963168709E23E344DD75DF76AE15500E96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5932

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

cfgmgr32

CM_Get_Device_IDW CM_Get_Parent

kernel32

CloseHandle CreateEventA CreateFileA CreateFileMappingA ExitProcess FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExA FindNextFileA FormatMessageA GetACP GetCPInfo GetCommandLineA GetConsoleScreenBufferInfo GetCurrentProcessId GetCurrentThreadId GetEnvironmentStrings GetFileAttributesA GetFileInformationByHandle GetFileType GetFullPathNameA GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStdHandle GetStringTypeW GetTimeZoneInformation GetVersion HeapAlloc HeapFree IsDBCSLeadByteEx IsDebuggerPresent LCMapStringA MapViewOfFile MultiByteToWideChar OpenFileMappingA OutputDebugStringA RaiseException ReadFile RtlUnwind SetConsoleCtrlHandler SetFilePointer SetHandleCount Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAlloc VirtualFree VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA

user32

EnumThreadWindows EnumWindows GetWindowTextA MessageBoxA wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

winusb

WinUsb_AbortPipe WinUsb_ControlTransfer WinUsb_FlushPipe WinUsb_Free WinUsb_GetOverlappedResult WinUsb_Initialize WinUsb_QueryPipe WinUsb_ReadPipe WinUsb_SetPipePolicy WinUsb_WritePipe