MsIo64[.]sys | Triage™

General

Target
MsIo64.sys
Size 19KB
Sample261022-2npexaf15x
SHA256 a7261f13f11c3b845c27cfeeb1cdc6a9400090cebd8e5adbf8c506c1fd9811de
MD5 8663ab852d5194d55f37dc68789c9f0b
SHA1 1713e57ec78402e61b0bf43e9bbb1a6f0ce24678
SHA512 39b5ce868b7c95108f5739db82d9e11cca1ee69c1c2d70a5afd56449ab50c43abc5e531a01242d4d8f41c56e107de2ea9e296066536ded67aa68a05c02a14c60
SSDEEP 384:KcueHK6u5wT+k0X9TnflsJZvh36Y+R9z2:pu9FYue136Yi9z
TLSH
T147927ED196684042D9A7EC308369EF93FC39B7C31B2041DF15A9D9942DA37C4A73875D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

MsIo64.sys

.sys 19KB

MsIo64.sys

IMPHASH 12a08688ec92616a8b639d85cc13a3ed
SHA256 a7261f13f11c3b845c27cfeeb1cdc6a9400090cebd8e5adbf8c506c1fd9811de
MD5 8663ab852d5194d55f37dc68789c9f0b
SHA1 1713e57ec78402e61b0bf43e9bbb1a6f0ce24678
SHA512 39b5ce868b7c95108f5739db82d9e11cca1ee69c1c2d70a5afd56449ab50c43abc5e531a01242d4d8f41c56e107de2ea9e296066536ded67aa68a05c02a14c60
SSDEEP 384:KcueHK6u5wT+k0X9TnflsJZvh36Y+R9z2:pu9FYue136Yi9z
TLSH
T147927ED196684042D9A7EC308369EF93FC39B7C31B2041DF15A9D9942DA37C4A73875D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

f3:ff:6d:f9:2d:d8:ca:95:ac:c4:39:c6:e4:c8:22:55:bc:17:42:66:86:37:40:ea:18:56:23:b1:13:c4:8e:9e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Dec 11, 2023

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 6, 2023 - Apr 3, 2024

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 15, 2014 - Oct 15, 2029

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3703-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:d4:e4:e9:03:2f:c0:ac:69:ac:00:01:00:00:01:d4

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 25, 2023 - Feb 1, 2024

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

2

Major OS version

5

Entry point

20496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\cti_cy\documents\01.cti\01.project\01.ddr4_rgb\02.io\01.msio\drv\amd64\MsIo64.pdb

Name

.text

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

520B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

INIT

Size

1024B

Virtual Size

690B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

912B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

MsIo64.sys

ntoskrnl.exe

hal

generic

Sharing

General

Malware Config

Signatures

File Explorer

MsIo64.sys

ntoskrnl.exe

hal

generic