9b770338a0ee621648ec69fcd611883496cef5af729ae69e0c5632942a724a96

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft.WindowsAppRuntime.1.8_8000.879.2017.0_x86__8wekyb3d8bbwe.Msix
Size 20.7MB
Sample260620-al6smact7r
SHA256 9b770338a0ee621648ec69fcd611883496cef5af729ae69e0c5632942a724a96
MD5 03b9a5469859b041d3f911da9d645a20
SHA1 d028f3b45fd49ccf1c627371e132efb8453b3328
SHA512 99783b88e6c3a95d523a9d0ca9e186b092379c7079b6a9c7b6667ca19df19b4a685ccb2ec671cb8da01b59c2c9a27891a28e3a42f1a17fac0bebefac9df0f5a3
SSDEEP 393216:vSylT9fPjYaILeTI5opOaZic6Nmd4KSBvsvpcPVHGku9LkIlJ/JclIxXGN0:qwP9ICkbEQUvp6VaeIlNJcIxXI0
TLSH
T13527338C45C578AED3B37879D55140F8390543E2AC4EFA000E98DBE7B13A5C2AB699F7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Microsoft.WindowsAppRuntime.1.8_8000.879.2017.0_x86__8wekyb3d8bbwe.Msix
- Size 20.7MB
- SHA256 9b770338a0ee621648ec69fcd611883496cef5af729ae69e0c5632942a724a96
- MD5 03b9a5469859b041d3f911da9d645a20
- SHA1 d028f3b45fd49ccf1c627371e132efb8453b3328
- SHA512 99783b88e6c3a95d523a9d0ca9e186b092379c7079b6a9c7b6667ca19df19b4a685ccb2ec671cb8da01b59c2c9a27891a28e3a42f1a17fac0bebefac9df0f5a3
- SSDEEP 393216:vSylT9fPjYaILeTI5opOaZic6Nmd4KSBvsvpcPVHGku9LkIlJ/JclIxXGN0:qwP9ICkbEQUvp6VaeIlNJcIxXI0
- TLSH
  T13527338C45C578AED3B37879D55140F8390543E2AC4EFA000E98DBE7B13A5C2AB699F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CoreMessagingXP.dll
- Size 795KB
- SHA256 aa00de415963c1611b13d4b5d17108d0204bfd4dabb2b290c7255016ee4a8f5c
- MD5 e1988585bfd9b7f1c557b5c16a89fdc6
- SHA1 9cc3a1a5a8d63f03cfebc98d8d320b08df1d06eb
- SHA512 4f2fc38d293f40e8504c7ce691b957012a5b08c6214953623c629d65f3a9932bcaa958b54dfafdee77c42dc57fd8ebcb882fb251f4b7b638bdea54f4cb80bc36
- SSDEEP 24576:th7Fim/1W4Pf+r/CuZaMW8NW8IsN77NAWPY4j0eA4AqqM:f3aZaMW8N1Z6eXAq9
- TLSH
  T1E4055B337AD885BAC9AE2570545D367662FEE4600F7189CB1F5833EE5E786C01E3818B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  DWriteCore.dll
- Size 2.6MB
- SHA256 a2cc7fd9162204381967c6c082f1de16b9d0f1e8a749dfdb020f52db0fd27c12
- MD5 1b3157fc581ecf8b852ab2c3490f4386
- SHA1 f1a26d01a45abdc16550d92a084e4c72fc0261c7
- SHA512 6a505df5378f2b399c455e5176efe45dd811384643e08ec42f44186a03344aab239ba0aa59d20531eaf2efcdd392df58d31b8ceeec8b37cfb67bc8cf1c63cf16
- SSDEEP 49152:ONFwsZ770LcTkaXL6EMqlKjB/bmg5yhnWl3OcVb5DQTFmHX4jn:iFlZ70gTkab6EMqlukznhczQtjn
- TLSH
  T10FC57C13F962C9BED38F0230C81A931A93396635872149EBBEE05D6CED617D35931E1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4 behavioral5
- Target
  DeploymentAgent.exe
- Size 78KB
- SHA256 549fa4fe61f5255e5e0ce4fae1662514ea61a70fc1af61a87ebc1199be734551
- MD5 b4a5628d5b2d83879d166ef4155d97e8
- SHA1 eb2546c810adee1f889f85803a1dfa93613e4817
- SHA512 36fed60e57c77f1635cd5d4b5b96de18601201b643e599213b651d5804c18d245db7344acb494d9938d19ea564d33e8a88611cbdbf4972a15c118738315eac6e
- SSDEEP 1536:59FSE4H8Xoos9pHWUsAxOpSgxLO6Bls24LrKVTgzO50quk7ZsPz4:59QP9p28xOpSgxa6c24LrKgquwZsPc
- TLSH
  T102737EA3BC94C571CCA238B2055EF62A127FE6A10B2086D32749D3DE9D257C29E311DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6 behavioral7
- Target
  DwmSceneI.dll
- Size 1.7MB
- SHA256 86a102949059827ddef7b00c1046d881ce7a6cceb31e3dc8d07fa88be8ff396f
- MD5 9dad72a7fc51134503af619667c87951
- SHA1 383794cfe6764561a73de0ab8053c10bb602afee
- SHA512 e3de13d86ca0fa3a0b837dcbe342704669df380f70e89ade2fea40157e180851f5293d6407deccad261dc7f638bbee708c2db0f6f6a2e26e4e7f599423c7f79d
- SSDEEP 49152:wdrCl3xHkxx7e3GKoQUojw82Jf9jWFIna1sEbWLJH:A2hHkxx7e3GKoQUojuZWO
- TLSH
  T10D8518136784A67BD95E537988DB3B20B339E4B00FF243C30B9861A99CB63C45D725A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  MRM.dll
- Size 236KB
- SHA256 9135a997d00f12f01eea611dc15da641d6f0f44d9a99e44168af9761a141db29
- MD5 3a6b23de01fd1ac1cc6662ce0a4018b0
- SHA1 f96446dc8b7dc951a03c3bf67c1c9b5df571ac91
- SHA512 995b01b6a6e9be891cf82b6e44434de88fa222123fd1e4a8d0d88bb57597ca4161c0bab8cf74c6c5856145e303ba5f3de3af709f147fcc8a4dd53b0f5d0880ed
- SSDEEP 6144:kpfqrQL+WQLbxb75/BrxnrT5V3LHaNgcuH9rNRrVjXMdYdcWbU3yo/BbPHe3Gjqb:ifw5H9HpU3sw4Wsv
- TLSH
  T17B344BF078C44275F8E73A79525C7538D1AED2A007F099E74AA482D6BB692C33E341DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  MSIX/Main.msix
- Size 76KB
- SHA256 99d6893c02a18b317117b630ac04e2384e7bb306bfd6003252667bd199f3a8b0
- MD5 2249f4542e0209a3aeab4809dda7dc05
- SHA1 bbadf397b6ff97ad985b366b1856f4bbe4ecd5e6
- SHA512 7fe4f714396ac4410363752165b318bae60917615732a40895b5b432b917af70321c91947e6a3adc63cce5baea1ef81122ed28d9bb0a8f8b4baea93fae8466d1
- SSDEEP 1536:861o4WIqEpTwuCOWytb1pY1E1cBfOO4Psm+D8EjNDQnlSW1jNVI1uz/33+:no4R3pTDCWZY1EGBmDTyNDQnwoBVI1ui
- TLSH
  T1D87301D5E3A87D5BCE734873852C2644BE53E86A01D95A7031A6740CE6C1C2F1FB2B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DynamicDependency.DataStore.ProxyStub.dll
- Size 33KB
- SHA256 64dd760603c13f8775daf8249d665c75fb0d3f968d0e2facc6afe4d945caa444
- MD5 56363f16589ea39a9ad7c0ed42e1693f
- SHA1 e87523cd978380e7b6e08caa11a174d2de80d2f9
- SHA512 16282a67e6bf62ef0b93dcad2320882053ad903fe6aece5c245dd4ddd067b7ab60cbca460539a4d8bd99b5f35e027cbffac147a883ac07dd7cbb7130ac7be2d5
- SSDEEP 384:VtG4530BJ85ZeWT+NTT8sbliWodG6TnGHorNaZPWvZ9gclNoQjR9zYk:VmOC3lliWodGCnGI5rZ9uK9zX
- TLSH
  T1C7F209C2AAE90691DD5F05F4E8F6B719183CF9400FF26BE316C1548A98A3FD4A3B125D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  DynamicDependency.DataStore.exe
- Size 73KB
- SHA256 b92abfb5da45adf6dafbe3c80960dbc942cf0dad3f86c3d6fee8b99b356db65f
- MD5 bc9254e86340c3ab8099ce29ffbb8271
- SHA1 1f334013167012cda693b9154ee6676076fe1557
- SHA512 653850c0a7733f5f952bc2b0b05a8497927ade2aa562f8cb9f60f275d0a21baece0ac50965788f47d90afe3a729b45becb1e956d7769d2ea677dac1b0dd92f0f
- SSDEEP 1536:nCjypHV4gGW5r+UOks/ToE9yhMHNCeOO63Pm+ea6pl9H3TB6fJVF3C0yozc:Hp14JW5Cj/ToBreOO63Pm+ea6pnDGF3g
- TLSH
  T1DE735C73B8858D72DA9234B806EDFB26A13DE6A10B7055D3135943DEA9287C1CE312DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  MSIX/Singleton.msix
- Size 139KB
- SHA256 cd92ba85cee6118c77313b9ac969d72a3f915f065b8508f0309778495bad7e93
- MD5 7efb5b15ebf1af8eb10822422c512fc6
- SHA1 abc8c557707792a7a16aa9aad51dad51fb719f99
- SHA512 a6f2f150fcc288c2f292ae3f8a43483646bb44181fb05bea0748b700d0100a20732f8b664464500613f5264f16a9245b211e2691ad9b046d23d11ac75c353727
- SSDEEP 3072:DQ6NHfBb/1Ify3wXGle9/WICbwOTbEXVoKkws9niTa:DQ6hB2fyAXGlee3ZTdpw4nP
- TLSH
  T1F6D312EDB1AD0102E7B66078DB0A9B7B1634579ECD60E606D7604FDAA26F0B50181FCF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  PushNotificationsLongRunningTask.ProxyStub.dll
- Size 34KB
- SHA256 59440a111baed4fb3d6124191553bf0d1afe23a4b7a570637c065a725a6bb61b
- MD5 7f20eeb265d01f7e90976f950cefd477
- SHA1 58407842715fe06e897c1d273e6f3933075c7669
- SHA512 31134652817270d2783e1f84a086a5d70e79984080a49afee0cb92b0b5a0804e0d1ae5ef2ae76be2b2ca179b83c484da8160f1913d00ebae740b5ebefc0491c3
- SSDEEP 384:GEoEMJbBkau7T+tNTIsrliWodG6TnGHyWr9rNaZayW4py8T9gclNPFR9zTsn:xPChRliWodGCnGSU95PcpRT9VX9zwn
- TLSH
  T1E2F208C2BBE90292DD5E05B4E8F6B7191C3CF9400FE16AE31685548E98A3FC5A37139D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  PushNotificationsLongRunningTask.StartupTask.exe
- Size 55KB
- SHA256 bdf53980fce60c2cbb2cfd37a86d721101fe53a05e34df9827b9f39bb2d5dc76
- MD5 34533ede0851a84dc5cd46c72c7f4d41
- SHA1 9d17547e0c0379fe47e46ba6d9a6c2a97c7c9ef0
- SHA512 e48ef7fdd3e656ce1535a49c7c731cf75dfc68f90c76bc630bf0f59952fe6fc4c35d0e565e68e9925ced76ee5d5c71b405c24eecaa05259020194a7ca29b638c
- SSDEEP 768:7eX+CkB0pH07ZT6dyyWUQPkzPhF1GAa7JZaoHDR96QT03TDkfB/95S609zud:7RCkB0pH+6yyhZ65TR9VwTDkJ7Xczud
- TLSH
  T161435BA7BE848072CA9134F006AEF666567EF6B04F6556D32B5897ED58353C08F300DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  PushNotificationsLongRunningTask.exe
- Size 146KB
- SHA256 90cf1113be20359f404acc6cc0d6d76ba685031da7b984639132cf298d0f553e
- MD5 bd09850cd84c4200ad7b17be571a3be3
- SHA1 c4d5fae765058c90e533aa9dcc5f9de2b6dcfad1
- SHA512 d4aa143b83279d4d6bc511d4587394abe6a3cb4cc49534e77e26d2dfa6e3ff5392396380cb828348ac6c4431a2c02d26aca587bc614dede5c6515d7692c9b132
- SSDEEP 3072:VdypySlu2NgPs8gh02kjBYwUW3JjuMPR5QlDUIq8vO:VdyLpgPs8gOHjdUW3JjuMeD5O
- TLSH
  T183E34B72399CC5B0CDA738F00A5CB6AA522EE6B4073206E3531957EEDC683D25B355CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Microsoft.DirectManipulation.dll
- Size 474KB
- SHA256 a340e172d44bc9414e87bf6b6982d3b9f542317aa8cb6cf5ddf5c8bba6cf3cbe
- MD5 7ddfc7f0ae6667ab106d6bc67c45ad09
- SHA1 f5a79be547b93d9f678ae7f4d6dd05ad4bc19427
- SHA512 696c2a91cab13b832ed07b575d3dbd0bfdf1f8c49929b648d3be62b36d1f70828b40be306a5faf365619051ad1fbfecc78a072647c404e5baafcb20538fb2df9
- SSDEEP 6144:fadpsauKCIxHVyhaHZQUb6dsKU6PFy80RhH3mW+xpRcoLJFNpqtRD7MmuBkcTsDe:fdau/IJcIQv/k8yWBJ8tRfHuBkc2Fvaf
- TLSH
  T1E2A44B2168FD4130CEE631B460DD71EB917DAC540B268AE77360A2DDE9F46C09EB319B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  Microsoft.Foundation.winmd
- Size 11KB
- SHA256 59fe134f379cf60b379156ee2ae420898e59e3fe4627543b4749e401cef43158
- MD5 6342051876ba19d4121ecbf5280724cc
- SHA1 a14db6c19b4e7451f4691cc7f5f9715406668645
- SHA512 7dd1ea8faa202485a2ef0446514316aec6a29c3d4998bcdad210fd597adb6f0a844ea50ea6a7604ab1b90cb5638a73870f3a7183d11ca56b81bd0c6df4001506
- SSDEEP 192:q5EsWO+qOWDI68n2JBWsea4Wa8RDXulc/9X01k9z3AtgDBZub:Kz+qxlNw8RDXuO9R9zcqBZw
- TLSH
  T1433229C3C92CA043DD9BAC7096A8EE933C7C97C70940696756D6F6681D933C5EB3492C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  Microsoft.Graphics.Display.dll
- Size 154KB
- SHA256 79eee7c2a3581e3eba2c3948b1c3c017138e3496c9e1f638daa5a7f56fc0a226
- MD5 3c919e4dcf979646c4d26692779aa51c
- SHA1 dd72106ec911b31091d9c7b9ab9341ed7b0b366d
- SHA512 9e7bf2cf52a205cabda9e115bdad1de52f02b205506582d30e39766d0063cda1a9ddf69017409f5dc0bd4f0ccb2a20e71a02ec4d051ce0da89f354c43304df53
- SSDEEP 3072:VdYAp597VIYCquxG8ibB3wwBOpHWJT5Rrh9ILdkwevnVLM:wAQlqcooFWJdR9eLd8S
- TLSH
  T11AF339727AD882B5CD9F31B558BEB36A637CE8D14FA119C3171817EEA8606C15F3018B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  Microsoft.Graphics.winmd
- Size 22KB
- SHA256 5200a073dd63441a18bb9b0bbeec62140041b4590910570a8d6b143ef1556375
- MD5 35f4eed2064976634ae83fce7459e900
- SHA1 970723cee04e55516bc56a552693df21e994b758
- SHA512 68323ece297cc91264b7abf949af6568106326593bc23df5c3275a0b72684bac5729391607e7f27b0a9c899b5825ff3d9b7b0d08c61f139f68489670f8b3844c
- SSDEEP 384:fyfbpDck7KElP/+5zoxPAgALYNfUt9orAz9gclNJjXuMgYR9zhV3w:CNAkKElFAgAcaKAz9XjXFgE9zY
- TLSH
  T19BA23BCFEA44BA41CD4994312BAAC563393883E7790286621E65EC4E3DD37D4531AFEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Microsoft.InputStateManager.dll
- Size 296KB
- SHA256 8d78440953d83bbe9c8a0747dd89ef2a60a5df279cdfa4d692594b2393b8c5de
- MD5 46c841e86cf1ea60d15f86c73e597e7c
- SHA1 a903f822445a181525c6dd9696c0552a404004bf
- SHA512 4ff2f6d8c41b0fa10dfaa110230bda1c6b49456e852382cc3546fbf82c878b2e93ce72ddab6cc7e9e233d56e72e03cf1c33936b4a86f4ce3232d86ef9b406d83
- SSDEEP 6144:+kXzIia7ggXwKtFbDmbtn2WNUohdeORqgNRUXGlywFVS2vuiO:+6asgwK7bShnhx6ORqa1lyCTmiO
- TLSH
  T1DD546C32A88884B5C89B31B4708C7776927CD9A40B5185C3C75C97EEEE696C16E363CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  Microsoft.Internal.FrameworkUdk.dll
- Size 672KB
- SHA256 160cf92a25fec4affb0791134a3f1367adc37091ca0ec5a7fd2a8d8fdaab5d16
- MD5 c38068c77a213d15a321d5d076425d01
- SHA1 abdfc768a05a57fb6f1afd21088ef9c126c78102
- SHA512 f095aceed1006436a55dd1e9ec524a65d4bcaceb6df83e50d64291d81862112de2418e08028e6991b45b5fe6983bcf42aed7368bb831f43d7dd590f1f2f412be
- SSDEEP 12288:FeyQBrsKwItm3EU+Z7qr3MlhXMwTKyXRjT81/hJxjmf6ExCAbm:HItoEUJCNmyXRjT8jaxCAa
- TLSH
  T17FE4D4219A026336CCFB20F55D7E706EA11DAAD1076028D763C85FFEDA666D03B3119B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32