mscache[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
mscache.exe
Size 356KB
Sample261102-2mlbvsxtfx
SHA256 bde5cdf18eba9d163dce12b0e5544160f5ab2ab1ad5e000a828a5dee132497f2
MD5 b2cfc8c3972edcd043298d9f84b0c7e7
SHA1 33b3d33cbeb385f7c79c1e2d5fb02573c6168b7d
SHA512 ea3074ab7a7bc4abbcd50d60423660de9bb7684f24429bfd60c1a3425e465bc9c2cd078530ab1375d5010cd0dce40c1109e9dd08c1a0b0ff332bad4c940beac6
SSDEEP 6144:/G+peMtOE2S77E+WqrKdl6MjVBQVksfrirv6sNI0AGw:uEX3WgKpj3Dsfrirx0
TLSH
T1CA747E16E79505FDE1B78139CE964902EB727C5E07B0AADF23A049E21F276D04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mscache.exe

File Explorer

mscache.exe

.exe 356KB

mscache.exe

IMPHASH f69a00bbb13352967d6d6ceda0c994ae
SHA256 bde5cdf18eba9d163dce12b0e5544160f5ab2ab1ad5e000a828a5dee132497f2
MD5 b2cfc8c3972edcd043298d9f84b0c7e7
SHA1 33b3d33cbeb385f7c79c1e2d5fb02573c6168b7d
SHA512 ea3074ab7a7bc4abbcd50d60423660de9bb7684f24429bfd60c1a3425e465bc9c2cd078530ab1375d5010cd0dce40c1109e9dd08c1a0b0ff332bad4c940beac6
SSDEEP 6144:/G+peMtOE2S77E+WqrKdl6MjVBQVksfrirv6sNI0AGw:uEX3WgKpj3Dsfrirx0
TLSH
T1CA747E16E79505FDE1B78139CE964902EB727C5E07B0AADF23A049E21F276D04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

124284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptDeriveKeyPBKDF2 BCryptOpenAlgorithmProvider

crypt32

CryptUnprotectData CryptProtectData

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders

ole32

CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromString

advapi32

RegQueryValueExW RegSetValueExW RegCreateKeyExW RegCloseKey RegDeleteTreeW

kernel32

SetFilePointerEx HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FlushFileBuffers GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode WriteConsoleW FreeEnvironmentStringsW UnhandledExceptionFilter CreateDirectoryW GetEnvironmentVariableW CreateFileW FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx ReadFile WriteFile CloseHandle MultiByteToWideChar WideCharToMultiByte GetCurrentProcess FlushInstructionCache VirtualProtect GetModuleHandleW GetProcAddress LoadLibraryA LocalFree GetUserDefaultLCID EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer CompareStringEx GetCPInfo LCMapStringEx GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree HeapReAlloc HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale

Name

.text

Size

247KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

mscache.exe

bcrypt

crypt32

winhttp

ole32

advapi32

kernel32

generic