aeb670eef59c050f52e889f00e5f2f2de420b707b559a8d90098aa3447149268

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft.WidgetsPlatformRuntime_1.6.19.0_neutral__8wekyb3d8bbwe.Msixbundle
Size 2.4MB
Sample260625-pmkdcab14l
SHA256 aeb670eef59c050f52e889f00e5f2f2de420b707b559a8d90098aa3447149268
MD5 117234ac97eff8b0409549244a4c05e2
SHA1 a3f03add5cbe11126d493dc347039dc698527209
SHA512 b0c32187fb7debbdc8e4ef792e5245bc86b20093009d5c3c289661433035da30a8504abecab275fa72cce25f7d7bdb2556e85a18539d4b045e6d590512b19638
SSDEEP 49152:7+elpvNPu8MLk8f/QN6QQNT9T7iD11uZzSyLNTPqeS33/Xap9jhRvA0sTEJtjlbs:6eldNPu8Uk8HQN6QcRSnqzSAPS33PaPK
TLSH
T147C533B4BFD46081E32CD0B425EB552B789105C37DE99921AFC9D83E9EAD3A001537EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  WidgetsPlatformRuntime-ARM64.msix
- Size 862KB
- SHA256 bd2cf6f4d51b525c73640e7e8f0307eff25833bfc648cc1776ff8f3d876081c1
- MD5 5f2d759fcdbb0c96b810cc5b69c303a0
- SHA1 e07bddce222c867e91e2635094059b4e96fe91f7
- SHA512 08f46cef32e2a8d4752635e51f095340727bbb43d34912dc75a2e05174fb3fb6706da6e032c2c90bfb2d409383af69b54b77caaf4d0c21bc38d224580bdbf772
- SSDEEP 12288:NKc2W0ne8J3Kp8EFGpPVIDbm0dSuTgKgsMUZCh5qjMLoaLVgdPmBd/vV6nxXlxk6:Nn+e8oCgZdNPXeqjMLkFmf/MJrR6QQjG
- TLSH
  T1B01533F5EB40C5C1DB5C40B9116E65357D0104C36DDEEE296F8CA8779EEC3A20263BAA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Microsoft.Windows.Widgets.Internal.winmd
- Size 14KB
- SHA256 e922916f9263c770fbf812ace09cecfb41e7b7d1c37720f3d5e84ad483835bb6
- MD5 3346bc4fcb2794d69d7484e4861b6338
- SHA1 9e26704280aa2507e11f7af8d43b489b5c168b43
- SHA512 fca7dacc62d6dc8045ed75d7caafe03bce131da691da203eef0758c6d6e957f6d906e4d05e37e707506c9e6140d2ba0020ec6d37fa031a6816e0e9da63f2ce3f
- SSDEEP 384:RvZB5OpfS5ro2O6vYz+dnqWS+KZ2qOimDc:9f5OpSMzQnqWS+G2qOimg
- TLSH
  T1E852846725AE8C27C61FA47FECA00F115632C95BB803EB281B4D06F5DCD71E916267E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Microsoft.Windows.Widgets.winmd
- Size 56KB
- SHA256 e1c7a767d65b78f8d804d702edc2f756abc442340411de272093348794025e10
- MD5 4f530338bc5017398cb2642a8fcf649b
- SHA1 cc47881c2cfc380f4cfcbd2500a113c2dbb6b956
- SHA512 df7be65a53b6c901ea5f9bc20cf01180254afa040c60c456f11409726a97d94ad3d6c33898a2ba39c725e7f59731ee31f17683edf495a5b8b898e3a773e1bb58
- SSDEEP 768:4puTJ5i85vuNuR3+Lcak5aheYvLq2LqhtRYY9YihM/IhtRYY9YihMN2djVv0v5ET:N085P3+LbiYsDdj+5s1KYsXvm4yiG
- TLSH
  T18A43B44674AA8FB2CEDD157A2C665B51333BD6A7D6029B270F1C4C609CC3BC57A09BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  WidgetService/Microsoft.Windows.Widgets.Internal.winmd
- Size 14KB
- SHA256 e922916f9263c770fbf812ace09cecfb41e7b7d1c37720f3d5e84ad483835bb6
- MD5 3346bc4fcb2794d69d7484e4861b6338
- SHA1 9e26704280aa2507e11f7af8d43b489b5c168b43
- SHA512 fca7dacc62d6dc8045ed75d7caafe03bce131da691da203eef0758c6d6e957f6d906e4d05e37e707506c9e6140d2ba0020ec6d37fa031a6816e0e9da63f2ce3f
- SSDEEP 384:RvZB5OpfS5ro2O6vYz+dnqWS+KZ2qOimDc:9f5OpSMzQnqWS+G2qOimg
- TLSH
  T1E852846725AE8C27C61FA47FECA00F115632C95BB803EB281B4D06F5DCD71E916267E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  WidgetService/Microsoft.Windows.Widgets.dll
- Size 2.6MB
- SHA256 1b10221583bcfcc2ccb706962c61bbd479f74ddef4a05ee7baf5424e83dd84d9
- MD5 403ff8fb380a58c600ad77d6f3093edb
- SHA1 fbfe205406012380b0908794a274c7f08083b841
- SHA512 770fc1f3dd10620b92d90350792fd1d8c02d8a9dd8dba4332c4adf045066592ca33f092fe8f96ff25d38ab8759c145bc39dba99c1a4ee43c58601818bbc772a4
- SSDEEP 12288:ws6d7Kpj5q4kgHC5ngN4YMjrX5jAouECnTsxSFC/COOv7/DofCPPq4RCWiLE+gXQ:ws6dip1uP4hwf8h0lhSMXlpICjoLk
- TLSH
  T129C53D90BA6C9951E7EF63385C579FAC3533A9B49C208357744A032EDDE33C2C6E6291
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  WidgetService/Microsoft.Windows.Widgets.winmd
- Size 56KB
- SHA256 e1c7a767d65b78f8d804d702edc2f756abc442340411de272093348794025e10
- MD5 4f530338bc5017398cb2642a8fcf649b
- SHA1 cc47881c2cfc380f4cfcbd2500a113c2dbb6b956
- SHA512 df7be65a53b6c901ea5f9bc20cf01180254afa040c60c456f11409726a97d94ad3d6c33898a2ba39c725e7f59731ee31f17683edf495a5b8b898e3a773e1bb58
- SSDEEP 768:4puTJ5i85vuNuR3+Lcak5aheYvLq2LqhtRYY9YihM/IhtRYY9YihMN2djVv0v5ET:N085P3+LbiYsDdj+5s1KYsXvm4yiG
- TLSH
  T18A43B44674AA8FB2CEDD157A2C665B51333BD6A7D6029B270F1C4C609CC3BC57A09BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  WidgetService/WidgetService.exe
- Size 214KB
- SHA256 30e04930ce9d3a3b604f98ade387523b35e3175451221ef47187f04238629e67
- MD5 0c6cf8c3419810a2a49ff1cd4022af19
- SHA1 523b49648df7a729eab76e511cb8649d0583b4ed
- SHA512 cdf68e5a3e847b780c90cff3f6cbcf5f98d49b32f91e2f1b0bcf3fcfe5606a1191ae02219ad0893922565e87da1f06242c0fb964496637fa5b353eb7181ddf0f
- SSDEEP 3072:eAQu9PPDU9bqUXOxaDuMcmn0/5/nkw6BQEwpUP3n5S7ShRTorLzlcb/R:rQCPDU5/Ox2vn0/1kbP353MrLq/
- TLSH
  T1CB2408A16B8DA8D5E2C7A23C8D618764323BF5789B30C247B15B033FED9A5C6DED0152
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  WidgetsPlatformRuntime-x64.msix
- Size 839KB
- SHA256 4dd3a29a440a60a1e6a176a434b1b3829ddd034b7b6bbaa61d0e884341c6d7eb
- MD5 83254844306daaf403086030f785931b
- SHA1 4c4d9e2db58ce977a1713c11953d4af859de5dc2
- SHA512 c471003547c0a9c7890fc5f065a3aa38a5c044b4f93e08b06a48d0b49cd83af95a969f9ee958723d3a01e8dff758bb183d991326b2429fa5259df735bfc024e6
- SSDEEP 24576:NvQA9QA4SspZlGST1Ny6W9Zz1nI3tkv5537NTPnqes4h:1T9T7iD11uZzSyLNTPqe5
- TLSH
  T10D0533047ED57162D768D8B02BEB2ECB35C94BC27EF09455EEC5C82E892E8D49052BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Microsoft.Windows.Widgets.Internal.winmd
- Size 14KB
- SHA256 8c4bf1bbaaa804d3e418ca6c153213a82e918faa1a15cd9be1d445c2c2276f32
- MD5 d16f8ba343e01b3ba440272029250140
- SHA1 0101ece8657d1d5e9420450c9c0d6848d7a02bb1
- SHA512 7a33109d7c1c0fa98ee9030fc0f4afc83db7961ced2e756315ea3b06eaafc6b0e116aff18caaa55cefa62fca5f1b780e2ec6393e4baf92b5e1ced098d089425c
- SSDEEP 384:ivZB5OpfS5ro2O6vYz+OnqWS+KZ2qOimDc:if5OpSMzfnqWS+G2qOimg
- TLSH
  T13F52846725AE8C27C61FA47FECA00F215632C95BB803EB291B4D06F5DCC71E916267E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  Microsoft.Windows.Widgets.winmd
- Size 56KB
- SHA256 99b9e0a1fc8465f0c703ca1395ec9e24572f6bb62d814db834e9db8f100fa975
- MD5 4906ff46f2c556c879c366f1e57ca488
- SHA1 cc00061de22e5bdd6f834b7d82283a5433060781
- SHA512 ed4f61da127d58735dd3cc3e952d027951d893dc6452869bdc1a54e9291be877dec66d3390431aa6e6509c2294fb28018186e0215e966445e790c15ab1ff2493
- SSDEEP 768:zpuTJ5i85vuNuR3+Lcak5aheYvLq2LqhtRYY9YihM/IhtRYY9YihMN2djVv0v5El:0085P3+LbiYsDdj+5s1KYsXvU4yiG
- TLSH
  T1D043B44674AA8FB2CEDD157A2C665B51333BD6A7D6029B270F1C4C609CC3BC57A09BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  WidgetService/Microsoft.Windows.Widgets.Internal.winmd
- Size 14KB
- SHA256 8c4bf1bbaaa804d3e418ca6c153213a82e918faa1a15cd9be1d445c2c2276f32
- MD5 d16f8ba343e01b3ba440272029250140
- SHA1 0101ece8657d1d5e9420450c9c0d6848d7a02bb1
- SHA512 7a33109d7c1c0fa98ee9030fc0f4afc83db7961ced2e756315ea3b06eaafc6b0e116aff18caaa55cefa62fca5f1b780e2ec6393e4baf92b5e1ced098d089425c
- SSDEEP 384:ivZB5OpfS5ro2O6vYz+OnqWS+KZ2qOimDc:if5OpSMzfnqWS+G2qOimg
- TLSH
  T13F52846725AE8C27C61FA47FECA00F215632C95BB803EB291B4D06F5DCC71E916267E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  WidgetService/Microsoft.Windows.Widgets.dll
- Size 2.3MB
- SHA256 e35a53256360a890026064bfafa07710c413d259ae9e93b3441e0b9a361ff39e
- MD5 673364709579f127be4dd890d89ecdd3
- SHA1 bdd761ba354e6d9ddd321efb60721ada2fad76b4
- SHA512 80a1cb6dac7ecc9e21a4aeae8a565236ffb0b6df23def003d694b937e032160f4aa3fc61525fbd8bb82d6ae72a13a283e3ed023b77577b7277ee17e66577d9b2
- SSDEEP 24576:jHlcR309rNpiFhoPJ89Cih0lhSMXlP/CyEV3Vtg:jHA30tYhoPJJ/m3
- TLSH
  T1DAB51B81B6BC41A2D67E52348C575F49BA3178A94F3093E72852132E4F777C2CAFA790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  WidgetService/Microsoft.Windows.Widgets.winmd
- Size 56KB
- SHA256 99b9e0a1fc8465f0c703ca1395ec9e24572f6bb62d814db834e9db8f100fa975
- MD5 4906ff46f2c556c879c366f1e57ca488
- SHA1 cc00061de22e5bdd6f834b7d82283a5433060781
- SHA512 ed4f61da127d58735dd3cc3e952d027951d893dc6452869bdc1a54e9291be877dec66d3390431aa6e6509c2294fb28018186e0215e966445e790c15ab1ff2493
- SSDEEP 768:zpuTJ5i85vuNuR3+Lcak5aheYvLq2LqhtRYY9YihM/IhtRYY9YihMN2djVv0v5El:0085P3+LbiYsDdj+5s1KYsXvU4yiG
- TLSH
  T1D043B44674AA8FB2CEDD157A2C665B51333BD6A7D6029B270F1C4C609CC3BC57A09BB0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  WidgetService/WidgetService.exe
- Size 213KB
- SHA256 c9ef9e2982d1816954fbb4a184eb509034f82bcc958bdd443075d80e35af04ba
- MD5 89808dbf1c929d686a6a70e5c58145c7
- SHA1 34eff1d8ba97e27d57817e7adecace0811d09852
- SHA512 9b134641bb1b26f53de11c705184e893ddd4e2ced959c31a0badc147f43fc861d86d0a4a117d19c3226200c817ec1f6592b9d0facb2c65fd46063a0e9d222a6f
- SSDEEP 3072:igaEjdYDsgUGAJ4wpvGKhzd+0QDQFLhl/L/n/LBlT2w5ErBnb8kIKOCyg:EsFGAyQnabjO
- TLSH
  T187245A26BAA950E1E16F9138C8424A45FB32787587A0E7CB2761077B1F63BD0BE7D740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  WidgetsPlatformRuntime-x86.msix
- Size 766KB
- SHA256 e9da352bd791cefc8ac30f466518a9199080af7bd0196baeca00ff4645e237fa
- MD5 f3c83e67048895029c3882e7ffb6171e
- SHA1 c8fc1352510c2ec1e8fbd33326879f44e257e7e8
- SHA512 07782cbd3af4ed8f660bad6bd8063d526bd1fb8866f2b7deeee51ec01d5908869a71f6fab83502c9a92c77af0d52aeba56761cc1731413dd95295ad4af4c8a96
- SSDEEP 12288:UjdQqnP7QqnEmwlq2Xm/WW4ZgPV0T5BrvpgRgFjofTPODU96y0dOJsZiFXXaa9Eo:UxQCQ/mwLW/9GgPVwbvpg8jhA96y0AJH
- TLSH
  T151F423743FF15808F228E07E3192523FA4B101D17EB51AB19FCAEA394DA5371419B6AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Microsoft.Windows.Widgets.Internal.winmd
- Size 14KB
- SHA256 77da72149c974ed6ba947f5d30330a9e06bb7a829ffbffdce8ccc97d8cd7e68d
- MD5 418a7b3092ec00a21b03ef7e8c546973
- SHA1 61db3a919fc14cdb633598db6b0bd3b876541cc5
- SHA512 db39a57bd66cb73a2bd495fe71591052d091471a3b7e47f2b210aab00c18e0a08f1568f50c312292f8d469aaa5799faa87082a5285bd0437a98f293e618521b5
- SSDEEP 384:yvZB5OpfS5ro2O6vYz+9nqWS+KZ2qOimDc:yf5OpSMzInqWS+G2qOimg
- TLSH
  T17552836725AE8C27C61FA47FECA00F215632C95BB803EB281B4D06F5DCD71E916267E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32