RemovableMediaAccessUtility.exe
This report is generated from a file or URL submitted to this webservice on January 11th 2018 23:24:29 (UTC)
Guest System: Windows 7 32 bit, Home Premium, 6.1 (build 7601), Service Pack 1
Report generated by
Falcon Sandbox v7.21 © Hybrid Analysis
Incident Response
Risk Assessment
- Persistence
- Modifies System Certificates Settings
- Fingerprint
- Reads the active computer name
- Evasive
- Possibly checks for the presence of an Antivirus engine
Indicators
Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.
-
Malicious Indicators 2
-
System Security
-
Modifies System Certificates Settings
- details
-
"<Input Sample>" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CERTIFICATES"; Key: "DAF0601BDE2C89437E10146B9A91ABDBBD83A802")
"<Input Sample>" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CERTIFICATES\DAF0601BDE2C89437E10146B9A91ABDBBD83A802"; Key: "BLOB")
"<Input Sample>" (Access type: "DELETE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CERTIFICATES\DAF0601BDE2C89437E10146B9A91ABDBBD83A802")
"<Input Sample>" (Access type: "DELETE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CERTIFICATES")
"<Input Sample>" (Access type: "DELETE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CRLS")
"<Input Sample>" (Access type: "DELETE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CTLS")
"<Input Sample>" (Access type: "DELETE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE") - source
- Registry Access
- relevance
- 8/10
-
Modifies System Certificates Settings
-
Unusual Characteristics
-
Checks for a resource fork (ADS) file
- details
- "<Input Sample>" checked file "C:"
- source
- API Call
- relevance
- 5/10
-
Checks for a resource fork (ADS) file
-
Suspicious Indicators 9
-
Anti-Detection/Stealthyness
-
Possibly checks for the presence of an Antivirus engine
- details
-
"Symantec" (Indicator: "symantec")
"Symantec." (Indicator: "symantec") - source
- File/Memory
- relevance
- 3/10
-
Possibly checks for the presence of an Antivirus engine
-
Anti-Reverse Engineering
-
Possibly checks for known debuggers/analysis tools
- details
-
"KatakanaPhoneticExtensions" (Indicator: "icext")
"PhoneticExtensions" (Indicator: "icext") - source
- File/Memory
- relevance
- 2/10
-
Possibly checks for known debuggers/analysis tools
-
Cryptographic Related
-
Found a cryptographic related string
- details
-
"DES" (Indicator: "des"; File: "00014590-00002236.00000001.18087.0152A000.00000002.mdmp")
"BLOWFISH" (Indicator: "blowfish"; File: "00014590-00002236.00000001.18087.0152A000.00000002.mdmp")
"AES128" (Indicator: "aes128"; File: "00014590-00002236.00000001.18087.0152A000.00000002.mdmp")
"AES192" (Indicator: "aes192"; File: "00014590-00002236.00000001.18087.0152A000.00000002.mdmp")
"AES256" (Indicator: "aes256"; File: "00014590-00002236.00000001.18087.0152A000.00000002.mdmp")
"CAST5" (Indicator: "cast5"; File: "00014590-00002236.00000001.18087.0152A000.00000002.mdmp") - source
- File/Memory
- relevance
- 10/10
-
Found a cryptographic related string
-
Environment Awareness
-
Reads the active computer name
- details
- "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME")
- source
- Registry Access
- relevance
- 5/10
-
Reads the active computer name
-
Installation/Persistance
-
Monitors specific registry key for changes
- details
- "<Input Sample>" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\crypt32" (Filter: 4; Subtree: 0)
- source
- API Call
- relevance
- 4/10
-
Monitors specific registry key for changes
-
Network Related
-
Found potential IP address in binary/memory
- details
-
Heuristic match: "2.5.29.37.0"
Heuristic match: "1.3.6.1.4.1.311.10.3.4" - source
- File/Memory
- relevance
- 3/10
-
Found potential IP address in binary/memory
-
Unusual Characteristics
-
CRC value set in PE header does not match actual value
- details
- "117bb209c3b0973dc076faa323599d77852eaa455c491ca73159090fd2aa1111.exe.bin" claimed CRC 4233014 while the actual is CRC 4242389
- source
- Static Parser
- relevance
- 10/10
-
Imports suspicious APIs
- details
-
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
GetUserNameW
RegOpenKeyExW
RegEnumKeyW
RegEnumKeyExW
RegDeleteKeyW
CryptEncryptMessage
GetDriveTypeW
GetFileAttributesA
LockResource
GetFileAttributesW
UnhandledExceptionFilter
FindResourceExW
OutputDebugStringA
DeviceIoControl
CopyFileW
OutputDebugStringW
GetModuleFileNameW
IsDebuggerPresent
GetVersionExA
GetModuleFileNameA
LoadLibraryA
LoadLibraryExW
CreateThread
ExitThread
TerminateProcess
GetModuleHandleExW
LoadLibraryW
GetVersionExW
GetTickCount
VirtualProtect
GetFileSize
GetStartupInfoW
CreateDirectoryW
DeleteFileW
GetProcAddress
GetTempFileNameW
WriteFile
GetFileSizeEx
FindNextFileW
FindFirstFileW
FindFirstFileExW
GetTempPathW
CreateFileW
CreateFileA
GetCommandLineW
GetModuleHandleA
GetModuleHandleW
GetFileAttributesExW
FindResourceW
Sleep
VirtualAlloc
ShellExecuteW
SetWindowsHookExW
GetUpdateRect
GetLastActivePopup
FindWindowW
GetWindowThreadProcessId - source
- Static Parser
- relevance
- 1/10
-
Reads information about supported languages
- details
- "<Input Sample>" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")
- source
- Registry Access
- relevance
- 3/10
-
CRC value set in PE header does not match actual value
-
Informative 11
-
Environment Awareness
-
Contains ability to query the machine version
- details
- GetVersionExW@KERNEL32.dll (Show Stream)
- source
- Hybrid Analysis Technology
- relevance
- 1/10
-
Contains ability to query the machine version
-
External Systems
-
Sample was identified as clean by Antivirus engines
- details
- 0/67 Antivirus vendors marked sample as malicious (0% detection rate)
- source
- External System
- relevance
- 10/10
-
Sample was identified as clean by Antivirus engines
-
General
-
Accesses System Certificates Settings
- details
-
"<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE"; Key: "")
"<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CERTIFICATES"; Key: "")
"<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CRLS"; Key: "")
"<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CTLS"; Key: "")
"<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CERTIFICATES\DAF0601BDE2C89437E10146B9A91ABDBBD83A802"; Key: "")
"<Input Sample>" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ENCRYPTION ANYWHERE REMOVABLE STORAGE\CERTIFICATES\DAF0601BDE2C89437E10146B9A91ABDBBD83A802"; Key: "BLOB") - source
- Registry Access
- relevance
- 10/10
-
Contains PDB pathways
- details
- "C:\buildsvn\darwin_seec\workDir\me\distribution\Release\Win32\EERAccessUtility.pdb"
- source
- File/Memory
- relevance
- 1/10
-
Creates mutants
- details
-
"\Sessions\1\BaseNamedObjects\GuardianEdgeAccessUtility"
"GuardianEdgeAccessUtility" - source
- Created Mutant
- relevance
- 3/10
-
The input sample is signed with a certificate
- details
-
The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information)
The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information)
The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign
Inc.", C=US" (SHA1: CC:85:2D:B4:BF:71:63:9D:E8:C5:AA:43:45:9D:FB:98:32:3A:71:16; see report for more information)
The input sample is signed with a certificate issued by "CN=Microsoft Code Verification Root, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US" (SHA1: 57:53:4C:CC:33:91:4C:41:F7:0E:2C:BB:21:03:A1:DB:18:81:7D:8B; see report for more information)
The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign
Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign
Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information) - source
- Certificate Data
- relevance
- 10/10
-
Accesses System Certificates Settings
-
Installation/Persistance
-
Connects to LPC ports
- details
- "<Input Sample>" connecting to "\ThemeApiPort"
- source
- API Call
- relevance
- 1/10
-
Touches files in the Windows directory
- details
-
"<Input Sample>" touched file "%WINDIR%\System32\en-US\setupapi.dll.mui"
"<Input Sample>" touched file "%WINDIR%\System32\oleaccrc.dll"
"<Input Sample>" touched file "%WINDIR%\Globalization\Sorting\SortDefault.nls"
"<Input Sample>" touched file "%WINDIR%\System32\imageres.dll"
"<Input Sample>" touched file "%WINDIR%\System32\en-US\imageres.dll.mui" - source
- API Call
- relevance
- 7/10
-
Connects to LPC ports
-
Network Related
-
Found potential URL in binary/memory
- details
-
Pattern match: "http://www.w3.org/XML/1998/namespace"
Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"
Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd"
Pattern match: "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"
Pattern match: "http://www.w3.org/1999/xhtml"
Pattern match: "http://www.w3.org/2000/xmlns/"
Pattern match: "http://www.w3.org/2001/XMLSchema"
Pattern match: "http://relaxng.org/ns/structure/1.0"
Pattern match: "http://www.w3.org/2001/XMLSchema-instance"
Heuristic match: "GNU.sparse.name"
Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" - source
- File/Memory
- relevance
- 10/10
-
Found potential URL in binary/memory
-
System Security
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
- details
- "<Input Sample>" opened "\Device\KsecDD"
- source
- API Call
- relevance
- 10/10
-
Opens the Kernel Security Device Driver (KsecDD) of Windows
-
Unusual Characteristics
-
Matched Compiler/Packer signature
- details
- "117bb209c3b0973dc076faa323599d77852eaa455c491ca73159090fd2aa1111.exe.bin" was detected as "VC8 -> Microsoft Corporation"
- source
- Static Parser
- relevance
- 10/10
-
Matched Compiler/Packer signature
File Details
RemovableMediaAccessUtility.exe
- Filename
- RemovableMediaAccessUtility.exe
- Size
- 4MiB (4195885 bytes)
- Type
- peexe executable
- Description
- PE32 executable (GUI) Intel 80386, for MS Windows
- Architecture
- WINDOWS
- SHA256
- 117bb209c3b0973dc076faa323599d77852eaa455c491ca73159090fd2aa1111
- MD5
- fbdefe7aa6f68dbaeafa5fda1c755556
- SHA1
- 22fc6c93027862763d70563d6a5efed7d7d15da2
- ssdeep
-
98304:SSnTq2fliaeFbOyYhNoVd6NfWjradiVK+Okq5EprCaRb:rtiv9ouK+Okq4rP
- imphash
-
a562279c4e2dcf4d8367d48fc67ced36
- authentihash
-
ce5bb2c0a5f4f232caf93c7e19f5f1c06a0f8b5cae28fc91c3e94d7a0b89672d
- Compiler/Packer
- VC8 -> Microsoft Corporation
- PDB Pathway
Version Info
- LegalCopyright
- Copyright (C) 2016 Symantec Corporation. All rights reserved.
- InternalName
- Symantec Removable Media Access Utility
- FileVersion
- 11.1.1 (Build 1200)
- CompanyName
- Symantec Corporation
- Build Number
- 1200
- LegalTrademarks
- Symantec ,Pretty Good Privacy ,PGP ,the PGP
- ProductName
- Client for Symantec Endpoint Encryption
- ProductVersion
- 11.1.1 (Build 1200)
- FileDescription
- Symantec Removable Media Access Utility
- OriginalFilename
- AccessUtility.exe
- Translation
- 0x0409 0x04b0
Classification (TrID)
- 93.1% (.OCX) Windows ActiveX control
- 3.6% (.EXE) Win32 Executable (generic)
- 1.6% (.EXE) Generic Win/DOS Executable
- 1.5% (.EXE) DOS Executable Generic
- 0.0% (.CEL) Autodesk FLIC Image File (extensions: flc, fli, cel)
File Sections
| Details | ||||||
|---|---|---|---|---|---|---|
File Resources
| Details | ||||
|---|---|---|---|---|
File Imports
File Certificates
Download Certificate File (78KiB)| Owner | Issuer | Validity | Hashes (MD5, SHA1) |
|---|---|---|---|
| CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US | CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA Serial: 7e93ebfb7cc64e59ea4b9a77d406fc3b |
12/21/2012 01:00:00 12/31/2020 00:59:59 |
7B:A3:69:EE:9A:BD:81:E0:FC:76:74:E9:70:9E:15:1D 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1 |
| CN=Symantec Time Stamping Services Signer - G4, O=Symantec Corporation, C=US | CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US Serial: ecff438c8febf356e04d86a981b1a50 |
10/18/2012 01:00:00 12/30/2020 00:59:59 |
08:32:B6:5C:C3:E3:A4:9B:C3:81:BA:95:E1:B5:87:37 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4 |
| CN=Symantec Corporation, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=Symantec Corporation, L=Mountain View, ST=California, C=US | CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US Serial: 20b44682a0de2a8026a1c3d781e63fc0 |
08/08/2013 01:00:00 11/07/2016 00:59:59 |
C7:CE:70:4A:DB:71:24:C3:1C:AC:EF:81:84:ED:66:98 CC:85:2D:B4:BF:71:63:9D:E8:C5:AA:43:45:9D:FB:98:32:3A:71:16 |
| CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US | CN=Microsoft Code Verification Root, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US Serial: 611993e400000000001c |
02/22/2011 20:25:17 02/22/2021 20:35:17 |
8D:91:3B:CB:70:53:0B:AF:CB:EC:15:BB:74:CF:73:D4 57:53:4C:CC:33:91:4C:41:F7:0E:2C:BB:21:03:A1:DB:18:81:7D:8B |
| CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US | CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US Serial: 5200e5aa2556fc1a86ed96c9d44b33c7 |
02/08/2010 01:00:00 02/08/2020 00:59:59 |
4D:F6:E0:FC:40:0C:AE:9C:05:2F:AE:98:C6:6D:37:9F 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F |
Screenshots
Loading content, please wait...
Hybrid Analysis
Tip: Click an analysed process below to view more details.
Analysed 1 process in total.
-
Input Sample
(PID: 2236)
Network Analysis
DNS Requests
No relevant DNS requests were made.
Contacted Hosts
No relevant hosts were contacted.
HTTP Traffic
No relevant HTTP requests were made.
Extracted Strings
Extracted Files
No significant files were extracted.
Notifications
-
Runtime
- Added comment to Virus Total report
- Not all IP/URL string resources were checked online
- Not all sources for signature ID "api-55" are available in the report
- Not all strings are visible in the report, because the maximum number of strings was reached (5000)