Utilman.exe
- File Path:
C:\Windows\system32\Utilman.exe
- Description: Utility Manager
Hashes
| Type |
Hash |
| MD5 |
8ACBAAA99E9E5B9821CAA92D4BB16127 |
| SHA1 |
37FF7A89CE8E2375664EAA6BD5018B80D9A132F1 |
| SHA256 |
20F42DBD52A5ED36212E818FA6AEAD8BEB132E79BD8E24F3D8E3EB02E27A8DD2 |
| SHA384 |
3B7C9F3839CA70A2E1B4F88F266761B0C1CF36A16E053F53C6C10F4089F1B04C56D093A60B97E849B00D90DC3F832FBC |
| SHA512 |
4CC45C5760A41D2850824D4AA3AF5C782F759D29360D41173809CF797341AEB517DB747DA35D184CDBFC5B768DDA3A7E4DA08DB029B68DAA34D7509227F073E0 |
| SSDEEP |
1536:ERTXlx44D5yvRnrbGoknnS5w/xOoDbUZk7BHOiXfxfXvvpB1nw64dTZDRIwEaN0l:EREWIRnrIxaexfX+djOaN05+6 |
Runtime Data
Loaded Modules:
| Path |
| C:\Windows\System32\ADVAPI32.dll |
| C:\Windows\System32\GDI32.dll |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\System32\msvcrt.dll |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\System32\RPCRT4.dll |
| C:\Windows\System32\sechost.dll |
| C:\Windows\System32\USER32.dll |
| C:\Windows\system32\Utilman.exe |
| C:\Windows\System32\win32u.dll |
Signature
- Status: Signature verified.
- Serial:
330000026551AE1BBD005CBFBD000000000265
- Thumbprint:
E168609353F30FF2373157B4EB8CD519D07A2BFF
- Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Original Filename: utilman2.exe.mui
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.1 (WinBuild.160101.0800)
- Product Version: 10.0.19041.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
Possible Misuse
The following table contains possible examples of Utilman.exe being misused. While Utilman.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
| Source |
Source File |
Example |
License |
| sigma |
proc_creation_win_install_reg_debugger_backdoor.yml |
- 'utilman.exe' |
DRL 1.0 |
| sigma |
proc_creation_win_stickykey_like_backdoor.yml |
- 'utilman.exe' |
DRL 1.0 |
| sigma |
registry_event_stickykey_like_backdoor.yml |
- '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger' |
DRL 1.0 |
| atomic-red-team |
T1546.008.md |
Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. The sethc.exe program is often referred to as “sticky keys”, and has been used by adversaries for unauthenticated access through a remote desktop login screen. (Citation: FireEye Hikit Rootkit) |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1546.008.md |
For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (e.g., C:\Windows\System32\utilman.exe) may be replaced with “cmd.exe” (or another program that provides backdoor access). Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over Remote Desktop Protocol will cause the replaced file to be executed with SYSTEM privileges. (Citation: Tilbury 2014) |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1546.008.md |
| parent_list | Comma separated list of system binaries to which you want to attach each #{attached_process}. Default: “osk.exe” | String | osk.exe, sethc.exe, utilman.exe, magnify.exe, narrator.exe, DisplaySwitch.exe, atbroker.exe| |
MIT License. © 2018 Red Canary |
| atomic-red-team |
T1546.012.md |
Similar to Accessibility Features, on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures “cmd.exe,” or another program that provides backdoor access, as a “debugger” for an accessibility program (ex: utilman.exe). After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with Remote Desktop Protocol will cause the “debugger” program to be executed with SYSTEM privileges. (Citation: Tilbury 2014) |
MIT License. © 2018 Red Canary |
| signature-base |
thor_inverse_matches.yar |
description = “Abnormal utilman.exe - typical strings not found in file” |
CC BY-NC 4.0 |
| signature-base |
thor_inverse_matches.yar |
$win7 = “utilman.exe” wide fullword |
CC BY-NC 4.0 |
| signature-base |
thor_inverse_matches.yar |
( filename == “utilman.exe” or filename == “Utilman.exe” ) |
CC BY-NC 4.0 |
MIT License. Copyright (c) 2020-2021 Strontic.