Overview
overview
7Static
static
3v6.15.8_in...4_.zip
windows7-x64
1v6.15.8_in...4_.zip
windows10-2004-x64
1Repository...im.dll
windows10-2004-x64
1Repository...er.dll
windows10-2004-x64
1Repository/dsprov.dll
windows10-2004-x64
7SR/spsrx.dll
windows10-2004-x64
1SR/srloc.dll
windows10-2004-x64
1SpeechUX/S...PS.dll
windows10-2004-x64
7SpeechUX/sapi.dll
windows10-2004-x64
1SpeechUX/s...pl.dll
windows10-2004-x64
7TTS/MSTTSLoc.dll
windows10-2004-x64
1UMDF/EhStorPwdDrv.dll
windows10-2004-x64
1UMDF/HidTelephony.dll
windows10-2004-x64
1UMDF/IddCx.dll
windows10-2004-x64
1UMDF/Micro...tt.dll
windows10-2004-x64
1UMDF/NfcCx.dll
windows10-2004-x64
1app__v6.15.8_t.msi
windows7-x64
6app__v6.15.8_t.msi
windows10-2004-x64
6Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
v6.15.8_installer_x64_.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
v6.15.8_installer_x64_.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Repository/dnsclientcim.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
Repository/dnsclientpsprovider.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
Repository/dsprov.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
SR/spsrx.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
SR/srloc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
SpeechUX/SpeechUXPS.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
SpeechUX/sapi.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
SpeechUX/speechuxcpl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
TTS/MSTTSLoc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
UMDF/EhStorPwdDrv.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
UMDF/HidTelephony.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
UMDF/IddCx.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
UMDF/Microsoft.Bluetooth.Profiles.HidOverGatt.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
UMDF/NfcCx.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
app__v6.15.8_t.msi
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
app__v6.15.8_t.msi
Resource
win10v2004-20240802-en
General
-
Target
UMDF/EhStorPwdDrv.dll
-
Size
85KB
-
MD5
271fdbcf747e8cc90ab30856a4dc8270
-
SHA1
8745ddaf89a68bbad0f93382adecf077cc5c9da2
-
SHA256
586da86bd50099a725e747983af982389a5fb98afc7b3015a016093dafbef26d
-
SHA512
b91d37995624c6599ac03ffd83cf1d548fb415be912823511cea9e8ed89fc219813e02ee20cfd4afd766630aa0707e64f66a36b7752c536687b4c7a0bfd084ac
-
SSDEEP
1536:fiJqqTHEry1pHb4Z7c8AmRRvgCUKUl4/t4FOsXbVmfdPOM0q3z:faNp5mTIpsrj
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\UMDF\EhStorPwdDrv.dll,#11⤵PID:4100
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4292,i,1729213506309163284,12809566808978835441,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:81⤵PID:2608