993ffa131a15f3a697a4c6a05fdbfd1ae196729bcb2a81ec1967fbe3ddd48045

Sharing

Copy URL Twitter E-mail

General

Target
9f71a7e1-ec5f-4c7c-8921-57b926ae2973
Size 12.9MB
Sample260706-g134lsay31
SHA256 993ffa131a15f3a697a4c6a05fdbfd1ae196729bcb2a81ec1967fbe3ddd48045
MD5 b29504f7ceab22ba5599a935bc3c5158
SHA1 cfb7e0b7b49aa2b7bc1dfc8f5570cdd9c2063a71
SHA512 bb683fb63549d58d7e3f5c271b4e6e108854e0cf535ca46ea9596642e596478f24862fc0ffa52861820280908a3a76cc1c88f5500caa8d0f2a6552f03e728ca9
SSDEEP 393216:eD7UfzxutpFYyp6945ICpMwg0HUMVVg3e2Zq:eDQfzupFA9LCKUUeVj2o
TLSH
T16CD6337BEB0DC887EAF76721CF6474974F9033B2DD11789A931E751C28DE2A126686C0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  AppxDeviceInventory.dll
- Size 993KB
- SHA256 fa22cb6947dd0cb5267ec96853e1553a0f2d48963d4bc62ae079844b8d393611
- MD5 40bcdc4b7daf36b084f628da3fe1cedf
- SHA1 4a6d7591b275d6988a2c573e58d6f15905bf58ea
- SHA512 156d59269126f0eea6718ad779fa5ce617a66454dd6f3b4fd2901bdd415042dbb59772d13b3949bf63f64b8ed69f8a5898ca30decfb50529f04a0f92d17fac82
- SSDEEP 24576:uBwSJzeRWq1VDJ+piuyCb51tlxL6tV5u2:uCSTq1VsN91tlxLcVH
- TLSH
  T1C6258E6667A801A9D8BB81BCC597860BE7F2B445237187CF05E0969E1F13FF1263E325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Microsoft.UALite.Plugin.MsixDeployment.dll
- Size 1.4MB
- SHA256 015e0437b4311ba100468071556e9beed415699e381b3404e7028e981ac4973d
- MD5 412425d5338483b8cc47c189ee235024
- SHA1 ba234f50c065fd7e3f68123a35a85d2a59a2d0cf
- SHA512 f6a6b3c3061b6f18837d21ada76d86a420152327a997adcefad44aa6e348feb8f55109318c08dc81534763d31bd4355a634c49abb6b4b63f3a6fbfbba9958d81
- SSDEEP 24576:uljYusanGSUatmIzNqzso4/s/V+DIuIHg1DoQqDmh0lhSMXlXTkhnSAgd73Fj2k3:ulXs+GSUathqzNos/V+DIHT/TkhnSAg/
- TLSH
  T1E0659E1272FC41B9D4BBD679C6574A07EBB27405233097CF02A54A9A2F67BF2663E301
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2 behavioral3
- Target
  UpdateAgent.dll
- Size 5.9MB
- SHA256 a71e2ce3921dd72e93cf32c878614637833dc6c2724086d72b1cd979f80e476b
- MD5 76d8291a64292a8e35db9baa380412fc
- SHA1 33db73e2e3285c66f607da5fb939e738531a5501
- SHA512 faaa05d9b5b69f7a624478583054dd7fe79213763e87d4f97ebe2fefe5c011dab1edf2382f73abb711532646b5117fa24e74aa949267d5497149cd6af6dba9d0
- SSDEEP 49152:82Moe86qYL9IM5exGFDY8sgZKwYar6y1UxGg3tkdaO9mS5+k7115eKe+nAvObCGv:8jFvb3/9dqPsa7vfqLP6Rd2x
- TLSH
  T18C5639027F9A586AC098C874C74B8BA30A2174CB0B36B5EF51D506292F6EBF55F3D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral4
- Target
  ualite.dll
- Size 5.9MB
- SHA256 a71e2ce3921dd72e93cf32c878614637833dc6c2724086d72b1cd979f80e476b
- MD5 76d8291a64292a8e35db9baa380412fc
- SHA1 33db73e2e3285c66f607da5fb939e738531a5501
- SHA512 faaa05d9b5b69f7a624478583054dd7fe79213763e87d4f97ebe2fefe5c011dab1edf2382f73abb711532646b5117fa24e74aa949267d5497149cd6af6dba9d0
- SSDEEP 49152:82Moe86qYL9IM5exGFDY8sgZKwYar6y1UxGg3tkdaO9mS5+k7115eKe+nAvObCGv:8jFvb3/9dqPsa7vfqLP6Rd2x
- TLSH
  T18C5639027F9A586AC098C874C74B8BA30A2174CB0B36B5EF51D506292F6EBF55F3D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral5
- Target
  Mitigation.dll
- Size 685KB
- SHA256 05ed3f8286162794b857780ebeb6901f6132651e4251c9ca5b7afa2b787969b0
- MD5 a4cf512d5d0b8d2171ce8ebf576a149b
- SHA1 a226fe658745b487897bb14ed16fb8c1998838f1
- SHA512 b9c7644ee875cad2f8cacd1b6c80147e43ae155302235535b2faf5f76705272e0e686a87f7f28251a169303981db37e7340be7d10cde595cb485f47640f2fe94
- SSDEEP 12288:96tkCRwq/gxIt3ZS8NFYAlxBMli+cWIJbeNXLpc5zCPhAg:6Rwq/ggSeYAGTz2bqXPd
- TLSH
  T178E46C2E67E801A8E5B7827989678506EB72B4251731C7CF1290817E1F37FE49E3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  MsixPackageProvisioner.dll
- Size 809KB
- SHA256 d368ee9826047fc244ea9d2bae828667af6f42f546bcac7d5c5d135acafdb23d
- MD5 5ce89e84c0bcab570a374ae929ac5f66
- SHA1 ba2a4ddcff87e9b8b950c1f91e0822d500c0e404
- SHA512 7d0ff70ac3acf5e1159a3e046a6a8420f02c350a2ca69692139c0b0f5045adb9a75fce0a73c4619674fb5e2ba932f6302f74513709a24d5e721dba6f0658a26e
- SSDEEP 12288:ZhGev00eR/w0wh6fPDE7TlJzp5aAWFlmMwAulh/B2D:47Fw+LE73zElzwdlh/B2D
- TLSH
  T1E6054A2A6AE404D5D77AD2BC85674E42FE3070266322A5DF9190817D6F3BAF85F3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  ReserveManager.dll
- Size 341KB
- SHA256 f1a4d35414f966c2d9b6d3056d079bb9ca1348dbc05c3e6a1113eaeb5fe24112
- MD5 d6927246e444fe5b51d8b0fbd6fd8465
- SHA1 7725de123ba1650f87243fd68751f993f603c55e
- SHA512 82b62e50f9c394672e61f4014d204bfff8d20e262b41a684eee0d2c5a17ca1b8164ebd5c5937039f51764b8038d60a3db9f0f1648637d382f6668fe96cdb9f29
- SSDEEP 6144:7FaJN78nQNew4dwON3psprbosHamXW1rPD/s42E9J1zOOllgMVSiODv:ZaJN78+sdwON3pb/V36
- TLSH
  T1BC744B3EA6A114A9F53AC13C95628D02F6723420176166EF0AE0857C3F6BFE4B93DF41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  TurboStack.dll
- Size 2.2MB
- SHA256 84420b916c688848cedea7157d2bc87c008bdf2a9627867e44b53c0fb6e73cb0
- MD5 dfed6415d4cc6547531295f87c031789
- SHA1 5db9dea04dca071bc5d443c3fe453f7f53664050
- SHA512 5fe425de8d10a4b4aa7b4a7df76ce175005aa4ede766912479a6175199a144b6a3ea538c16aa47d57eb595c846397cf1634648633c8be9508f6c6a0181d05ec1
- SSDEEP 24576:HvyZ0q9QpBKgltkUKlQUUofsztQXCG1cZnsM7BrNQ3hqElU8hSvbzBx15qC97Uv2:HvyZ8pMQa/lszyb1g3r0RSvbZ5R7UvP+
- TLSH
  T115B57B2966E840F4D1BEC07C99974613FEB07029173565EF15A0867C1F3BBE4A93EB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  UAOneSettings.dll
- Size 149KB
- SHA256 50911fdc2f0f0f027fdbd382fd322a7209fe9e1e5ebcdd816c0b4f3a5cd89a83
- MD5 918f4c9abd469b94eca86311decee8f4
- SHA1 4962beeea83beaeb6023fe38aed2d575d7eb10a1
- SHA512 50116c69c84c3acc5acacc366167acd9dae264004a2400bbfa401f005f36e8ee2cfb1427c42c7f684256d76b6c353341d80a8aa00592c637ec8bb9e4c4520836
- SSDEEP 3072:N+KPRlmXPQQ+ve2VnttYRVdXkjxQjRFfV6B9rKAMscWOk:nPTmoQ+veYnSVdXkjxuhGhK
- TLSH
  T1A5E3181D32E920A8E1B68138C5664516E7B2B4352B21A7FF02E0C0BE5F57BD4BD79F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  UpdateAgent.dll
- Size 4.2MB
- SHA256 8b7bea69ce1cb530dbf43b20dfe571b00749955a7ed7bc61c54b722523601477
- MD5 f785b47b53063eb8d2005e6802d5dcb9
- SHA1 75ac582d5a0f2c3372b8d58f6750a893e2201014
- SHA512 4b7ac66c7042c15634dc554e573636d9a9c129b3d3496138dc834398849c8f21bf3a93bc9af15d46cbacd5334415c348710d8ec5b889b732777306702fa3a3e9
- SSDEEP 49152:mF89VaSQd+ywafSUkTjFoWLLj4sye/gvVS6MrynQ1SILLv9GUeFsbUzfHQCvT4UV:vn4pR3P/
- TLSH
  T13716493A66E410E4E5BAD178DAA74A03FE7074291B34A6DF016085791F3FBE0AD3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  UpdateCompression.dll
- Size 601KB
- SHA256 c6b832f3914ca1b7473b39bc82c9b93be93a8aa8157a9f58f1e1b574c295f8a4
- MD5 3175541c212222af24b2e49871fa3431
- SHA1 9e990fe3c88970bc47d0b8094e0a1e876825555a
- SHA512 cd6b6b36afdf3f77eabd3bc8e13d2cca1c7678053b5a65ccc2eb2ac2367c2ee1891e0594a317b853bdea4ec938c96596d3837516083c179fcc6ed3472174d634
- SSDEEP 12288:rDJhOGcjchU0j7rJjKd788Z4ybp0Y2sz8vBsiCC1oEIzOvW:rDM0PrJjW88ey2YF8vBsiC+ur
- TLSH
  T110D46D56A5D88095D06AC17A8E6BC626F6713C410B208AD713D0F72F6E37EE49F3B760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  WinREAgent.dll
- Size 817KB
- SHA256 ac13a5b58b2a8a2f197a2f6809d4f48784b94b26646fa2435877478a4c1cac15
- MD5 fc7b67da504c3503b784d91cbcc2aeec
- SHA1 32cc3e77483339bf40fe9864cc32cb650b335bba
- SHA512 70d597fd56538f5b74f36a8a72f595af1b9106b927f2eb44bd4fe78431ba8fa394648aaebd10a4aeb9337dd3c5ba786e0cea17db314451917fead0e73beea0f4
- SSDEEP 24576:k1SenI5Ln9ZXahoacE8+suMTxMVTkk1m8TX:jenI5LnbX4oacE8tuMTxMDmW
- TLSH
  T15F05081927FC02A4F5F797389D734616F9B27C259770E9CF068140AE8E23BE09439B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  dpx.dll
- Size 1.0MB
- SHA256 651dba1fd9b3c331444d3cc5516028ec2981df09a4344d177f4c041a74c356dc
- MD5 97dbc016bcb079c05eb5577e7ed67e3a
- SHA1 d7a0dd0aa78fbf635e81eb9669eb6534fa0c3264
- SHA512 a1c9426a9df71d34877b0bafc39ee20e40364837f261fe8452286468d58735ac934c62bb979188492d231b5c2d89ff6460b835185591b0a1e27c66e3035be744
- SSDEEP 24576:mGb9iuAjHIy1ehb5jLLmlg8I2USsWBlco7VCDrGdOM:mGl8HqjLLmLI2USXIGd5
- TLSH
  T1A1357D2AABEC42A5D077C17CCADB864BE6F17C1117318ACB0565626D0F37EE44A3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  featurestaging.dll
- Size 89KB
- SHA256 d5202f519d29a374aa697f2c659f3e63b9f86f29a421b76f5679c7cff29d4034
- MD5 b81131f80e87b631101003b5a191fdd6
- SHA1 dd9a004e71b0a4a3ac47ed1cf1e7e48da3b6bc3e
- SHA512 825385836f7f880c3519f8c1dcb1c9e7328efc5950aa2cdb22effeee086dee16a28ef9afc33bb4fe3226e1c8d9e5239361caf066ccd075de58a848ee08d855ad
- SSDEEP 1536:LdD+Tl6l8ihlQYEPNs5kCnb0NLPfv1HvaPfcSzl72cgPOz9:LdDkwvE1s5/61HvafcSzl5gG5
- TLSH
  T1AA936C6E6BA824AAE036903DC5968519E7F2B061271117FF03E0D1BD1F23BE45D39FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  turbocontainer.dll
- Size 1.2MB
- SHA256 aff78e556bf67612118db68948106828a1ed633a4191bcb33a97bfdf2d770c7a
- MD5 41df7aa729946edf1ff9434a2c2357e1
- SHA1 b9c3cfb208955bc4bd7404b7982907d95f07ef21
- SHA512 b8ae94d013c446aba3b65f61882c16a21c2eeab2d5ddb6d272e65a00e207fe6457f67f9ceb8cf4ed1a1acca1b95f11f2a705ac5adce355a03a8adc2aed122ce8
- SSDEEP 24576:DC4Av4c5qa5WLchyzA2MLobhdQt9Jd1Vc8o/UHJUwDPzfHu1Xrl5jCKuthnNbXI:G4Av3WLchyzA2BhdQt7Vc8o/UpUwDPzw
- TLSH
  T136557C2D66A842B9E466C038DB728622EAF07810232476DF129CD97D6F37ED05D3DF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  updatedeploy.dll
- Size 681KB
- SHA256 5a84e9c975e913dc4af17b4a601425804ac0d92a0139a4106a88a16ab1bd2065
- MD5 1c66c56aef626374944fa79fc34ed149
- SHA1 3c6788de6a174b75211aafb8c85bc9fefa08bb34
- SHA512 f7415c812c7ea917eb584833b614857073d86c3f81628466fac66a3f6c5b0d63aaac16d76477177db0ddd5122833a748699b8120d81e9d8ae59fcae34c03646b
- SSDEEP 12288:FA9ztOuMlr9FeqWx8CO1YeHtDTX0F5Pms76n4SvQ7a:mMlr7eqWx8CO1pDTX4bO4SvV
- TLSH
  T1D3E4391577E910A9F177923D8AE75226FA76B42623319AEF0150821B1F23FD09D7A332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral17
- Target
  wcp.dll
- Size 4.3MB
- SHA256 ee1458e6fbcee48e75dbb3c8d71463c446553142d80ba7b8a7a195e7af10af2f
- MD5 f65acd81654fa7a85bb7c2cb5d5a208a
- SHA1 d3d731dee61836f3022195efc1708ba8d48ed93a
- SHA512 85d539252e1f5c528f65992ad338ab851b78b45dda9fa4844767916d6cfe84b7b14525339e216811dbcaf070da499f3c6920d069a567e6a702414c3ef4d222dd
- SSDEEP 49152:WHgMKStqiEbLjDPfnv9v3yc3CCbmxeBjfOhZduID/RTPkSztHQavImQYlPwWRuuv:4Z6FACyDZz0M
- TLSH
  T181268C2132E492D4D2BED1388A678E46FEB13C15233172DB21A553B96F37BE45A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18