1ae96c22808ae2d62581e58f233572f429a689af629a6f5ac806284a791c9297

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft Store.zip
Size 70.5MB
Sample260625-xpbszsew2t
SHA256 1ae96c22808ae2d62581e58f233572f429a689af629a6f5ac806284a791c9297
MD5 b5fa5a65d85db1c6533b5abc4231cade
SHA1 ac0b01fb45aa5a8bf8670383283fa3c178b1cf62
SHA512 f5eb3b3e6d0aca0d0560c9b31915dfbcfecc8a1cb6abc5faa3da67022445f0b27dbc1f87e16253ebadf08e1baba462e12e14a0a108997c9272856f0e959e0621
SSDEEP 1572864:WuJ4KsMSSsghZ2CB7bS/lbDS6xJ8XmcF5n4x06z:Wg4KvsghZdhwlnS6xDcF5n4x06z
TLSH
T17EF733905011AE40C1C660C9CDF5D1B41142ABE36FAD8C26BB54EDFDADB2EE17E6E243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Microsoft Store.zip
- Size 70.5MB
- SHA256 1ae96c22808ae2d62581e58f233572f429a689af629a6f5ac806284a791c9297
- MD5 b5fa5a65d85db1c6533b5abc4231cade
- SHA1 ac0b01fb45aa5a8bf8670383283fa3c178b1cf62
- SHA512 f5eb3b3e6d0aca0d0560c9b31915dfbcfecc8a1cb6abc5faa3da67022445f0b27dbc1f87e16253ebadf08e1baba462e12e14a0a108997c9272856f0e959e0621
- SSDEEP 1572864:WuJ4KsMSSsghZ2CB7bS/lbDS6xJ8XmcF5n4x06z:Wg4KvsghZdhwlnS6xDcF5n4x06z
- TLSH
  T17EF733905011AE40C1C660C9CDF5D1B41142ABE36FAD8C26BB54EDFDADB2EE17E6E243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  LTSC-Add-MicrosoftStore-2019/Add-Store.cmd
- Size 5KB
- SHA256 b62fceb293c6404ed08725abb944ddd824a0bb56f0e468c387875f763a49c188
- MD5 774d50f20409deb3953e6948b3db446c
- SHA1 4308a5fdf2790727017a5440962b97e9952bf87e
- SHA512 2068d90652eab85f8e30b78e76a8839e4b4296004c22824da7b7e0d7d77b828a4febf4facb523a68aa2d515a6844ca8b838e379fa0ca2b27d5f5f6267d13877e
- SSDEEP 96:10TmOmwmZA2E9sNADrokgxz5tK58EJJREMfuy:10T9F4A2E9iOVjXj
- TLSH
  T18EB103CA38C1602091740BD7AE70419CF28D65C726065CD974E64169E29FF753BF9B8B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Executes dropped EXE
- Loads dropped DLL
behavioral3 behavioral4
- Target
  LTSC-Add-MicrosoftStore-2019/Microsoft.DesktopAppInstaller_1.6.29000.1000_neutral_~_8wekyb3d8bbwe.AppxBundle
- Size 1.6MB
- SHA256 aadd2c42f2d4e199843756948604df702723f3691b319c58b9dae85c9178cf30
- MD5 8513453fe4a7c03f580dd15ee8025998
- SHA1 7bba5c82db207ade28c6d46a3e9d3a98b708e531
- SHA512 a01986f1674838810daafb4b1c477e782c83f54bbc6516f70487dd29bf6927ec212ff69e65f25b9bacdf0521aed66eee6b3c8790998e346734f6015fdd33b542
- SSDEEP 49152:IiQ+gL/gWYmFpzHmj/XsqJynEAqMZl8dQ:Ii+tYgzHsJ8EAqMZl8O
- TLSH
  T1627512E2A59538BFCA30967BC1070C7830A1841849D2EBA52764BB7DD8DADB41271FDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  AppxInstaller_language-am.appx
- Size 14KB
- SHA256 6d4d32c167ab99c56ac09c094dd4b5feb859c9d271cf0e521e1f4d5960a2889c
- MD5 15982771e8d68e1d5ec1114a300098be
- SHA1 fbd6605e3ea05dd8753e4e110ba12961b47ce94b
- SHA512 ddc4e3cd7a567b4ca0c908c8312b72c925c00fd9a37fe8167efbc26dd080d0e4148226bf94f96594a246fd0ca50992a3fd7222cfcf0b7babfc9888b350493b20
- SSDEEP 384:ZC5hTalylIYK0ONGtJ3j1bhb8KYs8aifPFdzZXpAMArFvEha:ZpIZn13Rbhb8aajtXpVAZ
- TLSH
  T1DD62D11D42B2CEA6D17518B6888D3C983C66DB8400072FE961ACB767D22CDD8A9B0938
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  AppxInstaller_language-ar.appx
- Size 14KB
- SHA256 1578a82bbd3c01a340b4d0bc11182d49e05429df6c1daedec8d45bd5c9b38204
- MD5 8b0f83b58b4e065b9654d86104fc26a7
- SHA1 cb2ded41e41d63c103a1600dbadfe624bcf3e718
- SHA512 7d98b6a22ddc1191187e0bcaf68cf9be407d9adb3ee95d84a9d173f2d07f35f5516364e83733bd698fb8546c8950854e8b1186f1fb30905bc55afe188d00feac
- SSDEEP 384:7IZNyoL5DZVks0oZUHVAYafdzgtZ74qwtK6:7IZNZLh0RVAYaFzg3cj
- TLSH
  T11A62C0C9601A343DD452A6FBA4C4C6879510A21C0A81B7D9D0A13BEDF970E6DFEE1F53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  AppxInstaller_language-az-latn.appx
- Size 14KB
- SHA256 5377a038d02b0cbfb54cffa4ecdcd13235f92f4d08362c601bf38011756ba28c
- MD5 039b236b6a0759090b0ff1334574d75b
- SHA1 7be0dcc5c168b56c781fadaf9566064b0beab407
- SHA512 0586e55a5dd5d68447a2951dc9ec6c2d99305063cbedf05ff6be8b32a068233866467b37df1ad23c861a3fbfcbd30e0da3e4cb00434888dc92b7634bbdeb72ea
- SSDEEP 384:fMZqefcFXQ/Xvct+LUEGN0ndLEFIW/xRqbXg3A/Yp2abk:fMag/Ut+gEGqdl6gbg3AAp2Gk
- TLSH
  T1E162D056287EB439CB60383DEA5A44BE9043958CC9C0F3E5D9743D4D11B35F822B4E78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  AppxInstaller_language-be.appx
- Size 15KB
- SHA256 1ce929227bd08847f7c640db1be99ce5b97b1ce1e9c071c1f02b71f10523e705
- MD5 7373a478250e8ac2e456f8706b2e0219
- SHA1 274980b327f099c732e45632caa48ad019b58bc5
- SHA512 31e7651cbbfff75fc3bb980e15a19434b6b882e4714bec43046ac7c622b93fd2c2c2bb2ff9c55743f6f5c1331ab5da0f7cd6b24ae2f2a868f1ca786141e8bf56
- SSDEEP 384:4eCJUOrMrv1VNV1PEqFy85vO7vkc8McOR:4JMrvhV1p5G7vIo
- TLSH
  T12A62BF9E747FA42CDB4A12BB42B34136BAB7A52A074C79D02014682F90D5B384FD6B4F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  AppxInstaller_language-bg.appx
- Size 15KB
- SHA256 09db16385d4e1977de7ae53895cf12378bf1d0ecaf2a3ca19f349b398b501759
- MD5 df20fbfe9740d32b25311f008fb8c0f1
- SHA1 e038cecd8fec4144732eb54a44cb581491e2d9ae
- SHA512 a664f1a22d9c387331e9eee4fc72d577c249e1ac2e4cd303a7dd1330f519faac9f5e6c483d7327a545247776998e3b87e2e3f4c8dc5edbdb6318850d148e0080
- SSDEEP 192:0xp5c3kRC7XysxgkvkB7GjYDUhUgmpl+4MhFCqNMrBm0OU79du18vSXCP62kCLz7:oRCnfIUUgmpoFZNWm0OU7euEr2LLH
- TLSH
  T11862D12DED993AF2D6A013B6D74CB21BE185C89F764086242F065B2E313041C97B15F6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  AppxInstaller_language-bn.appx
- Size 15KB
- SHA256 51dd9bfc1c2d91d39b0a02daf133c01774203e64f96ccaf097842f88ea091ebe
- MD5 5a25bb995070a2b7b547b5f7348fdfde
- SHA1 24d596f05122358e024068ac4c63878db4961ecf
- SHA512 f6f6abd999afa4428720e02ffd047d15cf51ae0e74fd1b3ad607dbb7c904134b72c229fcfc62f98c235b72240acbe203501f591b7f668d17993347b6c5368e6d
- SSDEEP 384:hx4v0qP/E4JJNBLw160/TTDY9N+/dFfiMkB5Bthhrape:hxRqk4lwQETTDV/b6JB5v328
- TLSH
  T10762CFC59304A67AC8767033747F6E9CB3524B8C220516D23A28274D01FAF911ACF89B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  AppxInstaller_language-ca.appx
- Size 14KB
- SHA256 f28c71f7b226c3706b19ed86a3a75ddc3ec04878d125a7db4f8adf5af1a8e46f
- MD5 0b13aa4071577943ffc0468fd3459285
- SHA1 0dbc92a52dbcb777fdf018b6722637207c6dd43b
- SHA512 aaa54065974f202f3d5623f9d2701252f28e35b8f52b811a87c980bd305d9ecb2088a9b16cdb53179334e96a8511724d33af0a1f55c73f7700ce92ad623cae02
- SSDEEP 192:BmZ1qpZOH2IdZkA4KQ2lOOKZNcCGQgmeQkmoTD4ALGJC0WmKO7QILU/9UMsvDmKX:B0qpZdV32wQb3mUSk0bKOqXsBzDsk
- TLSH
  T12C62BFE98211F112C40028B9799D0DC4B4F4BC0B49A21B1791E9EB7FAC4FCB16DB7987
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  AppxInstaller_language-cs.appx
- Size 14KB
- SHA256 ce823a1537f5fad097a1cd445208247561ca9b54f29ee65fe27e9d18d940a8c3
- MD5 8b8a835a91e4115a3b99f2e67987c4eb
- SHA1 0c3c0403615d80faaa6a5a237f42804a155afa61
- SHA512 0fef22b8b69226defa4a7748814ca3f128b4c1fd99fa6c4bef2551fdfc1980b6efa60f41f36f6afafe40f0e273601a069f711269fd7cc475ef3d41ec3238b674
- SSDEEP 384:7wR9ptq8ZKydD7pUYLUqfwcUGibJzfVy8QC/:7w9/KydD7pUsJ3iXt
- TLSH
  T18962D052F63A79EBF731F0FA60966FCD143C20B55645035068267F8E80E3C6C5A1C98B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  AppxInstaller_language-da.appx
- Size 14KB
- SHA256 766e236069b93060611cbd49f628a013632de6fb9acaff340739a5b6f7654a7c
- MD5 416e0d638fecaca3b4ef7a1b8af70f03
- SHA1 676fb1e0cd04ea17bf237d38fbcebd4900c70d2b
- SHA512 93169a8fdbdd5d99b584af5c07729cb8555231cbbb205df471dac28e3cd06d1e68570a8ed3c5cafea983ec0b31cf625ceb7060408a89b32bd6dbd6c47f581ac1
- SSDEEP 384:rSN6zJas2pl8in8puBeuppVJKohQTgGnk:262lC2pnjQTgn
- TLSH
  T17362C053C9B27016DE3255BFD60AAE8CF3624C8C1093E6F6401A1B1E84D5E8D44AFCEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  AppxInstaller_language-de.appx
- Size 14KB
- SHA256 99ef598a47e0985f05ecf72d21f2ae3d063fc2ee534fec8045f04d361193941a
- MD5 0a2c196694afef09b97e4a6bcb3eec04
- SHA1 432423d8e3dc2780b39f8841a24a149b52c4a493
- SHA512 b9c213607ac4002ab46ffddde7a264c5f0bc2aa418acc017fce3769bf65a7e3c7ef7abbd8385444b9c21b8a28fe4c206b4dc62db5c3e44caab59995ba2290d1e
- SSDEEP 192:dgrM+7VXC8ziWU623dO2YWXBypOAbrFcC3iIgp77q1SpYiTVXgbN0DzBSXcGSEl8:d6DxXFCO2pyscgp7m1SpdVgB0psZS5
- TLSH
  T1C662BFF2A8AA3CF2D1F970376A164B9BC276E814C1697A500A3DB43D608AC714634FB4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  AppxInstaller_language-el.appx
- Size 15KB
- SHA256 96e8071797885285a4928a44b7eddf60e26dd93f5d4ca928e56a518f6e511301
- MD5 99ab9874a9050677ad210afbd89d9662
- SHA1 f69fce72792a292bde62c2230e788c000f410cc7
- SHA512 e8b5fea52f8ee7302b381da4721ad183b76a19c4746a5e1ee1e45c755c497b2e31b7acdd4caffc7d07d96ce8ab6e2d290e72f0720a3537391c79666c388d4f9c
- SSDEEP 384:UB/vaCJOVxfVCuDMi4/TGfZSiBUXn15RDcxQUPAU4:UlvaCJ8fVCQ8TCF+n15RDc+uf4
- TLSH
  T1A562C090FF932846E6D03CB7D5083ABB726464848487E951FB982FBD89C9CD447B2D4B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  AppxInstaller_language-es.appx
- Size 16KB
- SHA256 471914adcf4453ebab5b6bf40b1f9021ce54795f261fa44ef6874ef0f2a398ee
- MD5 a88cd99bd936a77d123588b21d60d2b0
- SHA1 35e24abdea0b70cefb665d992c07b6a1ad91794f
- SHA512 8bafe49c90971c03619963ce064f0d6ccf2540df933d17fc8a2c297a4b386ae22b499e37b1feb0a7b73d5243a6bc540b4d25bb4bc1bbb15edeea27e205aead03
- SSDEEP 384:/mn/Emby0x4e39Y/hPP1dpp8gImxeR+E7XFBtNMfiCEF8aYR:g/EYlx4PP1zjVknLs/EAR
- TLSH
  T16572CF79AA59753EE1C278378C078444AE83C96ED486AB32D160C51D633DCE026337DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  AppxMetadata/AppxBundleManifest.xml
- Size 16KB
- SHA256 572612ecc9ab39bf50e519882376d17b265d69c3afd24d5dd2bd797da7d66758
- MD5 eccf9e8c5d8f63563bb5e422c06ed576
- SHA1 cefc840889a9e2a04b7b4cdf09cd60b5a55e75e9
- SHA512 b03df7a1554ca0d7c80447428a0b964ae0d30531cfc8cce51dcb4d57fd84d5e369ae8b686e69cf4983c2439e0d49693207568733265b058212335cbc41bdcac7
- SSDEEP 384:F7yLkZ7yLs7m7E707Y7W7h7j7oy7O7p7c7F7by7M7i7d7Y7M7Ty737P7V7b7P7iv:F7yLkZ7yLs7m7E707Y7W7h7j7oy7O7pt
- TLSH
  T1A5728E4330DC1E3CD1300A0FBB387D445A2EBF2DA635696CEABE253377E766506A2951
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32