uacbypass[.]exe | Triage™

General

Target
uacbypass.exe
Size 218KB
Sample261107-pxtd1ads7j
SHA256 97194aea5237e9bb661d8ee0b42c09322715189d3a690eec4f503e1fbdb74601
MD5 1a43f7a825aef29a17195d23641c40cc
SHA1 9c24f19b8c00ede283b8390a1e981285428aef3e
SHA512 80aeb1a828aaf3ede9aa9e3cf980faec338e0bdf92cb9501ce72379d5f8a10de1b62a01684284030059b2d736a5867a6a32ff2d1303e74132d14a7f181ef195e
SSDEEP 3072:hk2BANPHIgsj2E5TC1PIQL7yH043Xv8f5dtI6n+PuDY27a5Y262VvZsdKoEiPx:hk2BANPHIgsj2E5TC1oH0S87F+mqu5P
TLSH
T16C247D05A7D509FEE1B7C579CD814901DB72BC464BB0EADF07A009A68F27AD09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
uacbypass.exe

File Explorer

uacbypass.exe

.exe 218KB

uacbypass.exe

IMPHASH 744245bc47003ddb04db0a0766139929
SHA256 97194aea5237e9bb661d8ee0b42c09322715189d3a690eec4f503e1fbdb74601
MD5 1a43f7a825aef29a17195d23641c40cc
SHA1 9c24f19b8c00ede283b8390a1e981285428aef3e
SHA512 80aeb1a828aaf3ede9aa9e3cf980faec338e0bdf92cb9501ce72379d5f8a10de1b62a01684284030059b2d736a5867a6a32ff2d1303e74132d14a7f181ef195e
SSDEEP 3072:hk2BANPHIgsj2E5TC1PIQL7yH043Xv8f5dtI6n+PuDY27a5Y262VvZsdKoEiPx:hk2BANPHIgsj2E5TC1oH0S87F+mqu5P
TLSH
T16C247D05A7D509FEE1B7C579CD814901DB72BC464BB0EADF07A009A68F27AD09E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

39740

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoGetObject CoInitializeEx CoUninitialize

advapi32

RegQueryValueExW StartServiceW QueryServiceConfigW OpenServiceW OpenProcessToken GetTokenInformation LookupPrivilegeNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW EnumServicesStatusExW RegSetValueExW RegDeleteTreeW CloseServiceHandle CreateServiceW DeleteService OpenSCManagerW

user32

SendMessageTimeoutW

kernel32

SetEndOfFile WriteConsoleW SetLastError HeapReAlloc HeapSize CreateFileW CreateDirectoryW DeleteFileW GetFileAttributesW GetShortPathNameW GetTempPathW CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId CreateProcessW GetTickCount GetTickCount64 GetSystemDirectoryW GetModuleFileNameW CopyFileW MultiByteToWideChar WideCharToMultiByte SetConsoleOutputCP RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW FlushFileBuffers RtlPcToFileHeader RaiseException RtlUnwindEx EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetFileType ReadFile GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap

Name

.text

Size

141KB

Virtual Size

140KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

uacbypass.exe

ole32

advapi32

user32

kernel32

generic