a4a6d8ac1b295492ac87314285ef485267205a669943dabb214bdb5bd6fb3cd0

Sharing

Copy URL Twitter E-mail

General

Target
MDEClientAnalyzerPreview.zip
Size 13.4MB
Sample260714-h2c49aaz8w
SHA256 a4a6d8ac1b295492ac87314285ef485267205a669943dabb214bdb5bd6fb3cd0
MD5 9212f666be768e1ea04d5e84948890f3
SHA1 e1afce57545a70db2825c635e3e0cdc29356c6de
SHA512 cfeb2cf4461021200ae106ffacb7954bec36fe908020dcc8b12e9b48fe18392246140254b42f44b1b5a3c875e86eed2cbea431c12106abf694010fc9308006fa
SSDEEP 393216:Ets2G0EVsraL95aE65WpoXXEqyHn6vr9BxBPQS5:EtscxmLmErtqyH6vr3xBPQs
TLSH
T12DE633B01C7F8D70DDFEE9F91AC46FC8E2F0D8F691B85040A597403256CAD509F6A62A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MDEClientAnalyzer.cmd
- Size 3KB
- SHA256 d4feae545773372ac09b168a77a1e849d17001ec6a5ef17515bdea38c6c0d5be
- MD5 bfc5e55bc48842601a8ff7f1a11d4368
- SHA1 92bc49f0c18008261161ca52dc1afc73527b0954
- SHA512 2ebe7186b45a80695396abf73babc5ab4ff4cc3b7aa412009359369678823c19c304e30ce793196896cb0287a8012f826ab4cfd1f4546fe5266cee8e9c823c05
- TLSH
  T1D1617306F649223988E00A129DB853F2B61E625733729D17B1E7253053C0988F9BE3AE
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution exploit
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Possible privilege escalation attempt
  exploit
- Executes dropped EXE
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  MDEClientAnalyzer.ps1
- Size 269KB
- SHA256 ff987129c619e0672cfab01ef63e130db80937cc17cbbd2e9d12b94dd9ce20d6
- MD5 7a625f756a09318ea1e894f0d740ae35
- SHA1 e4722af975fa56e6a9b1f152066d9bd73fbed175
- SHA512 d73b8e3451f3abe7ed593201ab425b1e68a22ae043d4ad07769c420cf6b320c0112e434f47783d39abe12b885f076562eb0f5f54a4d360a62a674bd2e34d6d3c
- SSDEEP 3072:CsV5jmk0juRA8tDQVEIsZk2CYRRzmvrKSrr5b9g:Xjmk0juuVEBBLKvuy5hg
- TLSH
  T10C442B11BB0C6077D3D327658A71DD46AF3C81BB2F170528B4ED4858A761A6CC36B2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  RemoteMDEClientAnalyzer.cmd
- Size 3KB
- SHA256 c837280c577a8c954429264f396aec3fd184620331cb2240c8d54f9da7695de5
- MD5 ff3b07c324a1f0e14954ec10b7901f70
- SHA1 1a9fa41096756596ee8d59d237b4a2db81dc415b
- SHA512 c9546b68c6a0d8e7e91c4cc79aecc0cd477c82fca8bc23cde86d322bc1e5c2bbdc4af860979e76e8b8c14a2d71071077dc649e31603490e46fba393ddfc93fd6
- TLSH
  T1D6615225B75E39A7E8604B12EC34E2B0B72DA08713568E45E1AF18791B494C6BBFC488
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Tools/AgentConfigManagerLib.dll
- Size 18KB
- SHA256 7055f5e0fb7913db20ab7ca87f4ae64d7928bd29370cb13505de461fbdf9e0a2
- MD5 9785026a93c92899d84c6206518a30bf
- SHA1 b28ec4f18e079584794ae725d618ce53d1a49f39
- SHA512 1f17b78661242ae8344bdfa1386bbbb4ce55cb3ba1b95a96f957488a0640401d6f59104f1cc4ba1291b76b3534e69b83d156fa4eff3d22df14596fdd32ce0640
- SSDEEP 384:XED4fVzE5anfLWpuWQ77+P8O/lN6CbdlKR9zz5K9:XW+FE5iWpuh7+kZCZs9zs9
- TLSH
  T16E824AD3F72CE65ADCDB5B715292CAF32D35D7831651992B424CF61A0E23B858F22238
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Tools/DLPDiagnose.ps1
- Size 105KB
- SHA256 c95b628da90e99ba544553f1ca875e910e397d8676bcfd47ad69a40c6e774f3f
- MD5 03ef37a7673998853400de740e2f2f09
- SHA1 fb9103f319dbbb697ca762f612ac56a2df860d5d
- SHA512 d819c49ad197a55f5926267c8e56c55ada8c77b20cfee050c678e4bfb7494b5e3c35c0eaccabd874fb19532a10a7717adcfabfae6fc5e0ceac42fa3e48d44144
- SSDEEP 1536:BSDeaMDpivtCkY7OmROjE1pMeWQKwUX1USzXMZNfQMzIwrrXbnu9O9:UCwEPSqXrDbu9S
- TLSH
  T1EAB33105AD02571203F3D73E8E52A985E797927FFC9B2D20364CAA401FB850DC96D9AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  Tools/DefenderDiag.psm1
- Size 24KB
- SHA256 4afe306fa7b7de73b0b855136ea7769f65c2a9af9200c70c2101446692dbbd1a
- MD5 3e86524fad0d8f1504230ca00bf0da1d
- SHA1 d8d01b0e935cf3b960fd9f2d1d3934ca9140e462
- SHA512 b7beac086da7ccbb250bd77d782dc318e0ae108b401e6f561190c78bc8c018bfd41d7fdd5453eb00932c953933260e46ff617deaed5c68a54a4a0ca557195ca9
- SSDEEP 768:9JzbJ8c3ne43KDK+brrPmjb22J5bkfX7yC4GlGrPx1BP:9JzbJ86FwrrCb2Vf7c19
- TLSH
  T1FEB25BA02E15300949736E34EFADE59DEA1496171AB92238BC9C6E441F35A30D1F0FDF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  Tools/DisplayExtendedAttribute.exe
- Size 225KB
- SHA256 d0d3d6d60abc665c234e26240e66b372649f527ab6e34e73ceb35e3e8e62a54d
- MD5 8c4e021113ad15493fd80b1c5d188256
- SHA1 c7cc63e18cb10b8d6bee1047b370ca987726e226
- SHA512 5c3eb48e02fbe0aeb5693e9e3e8d76cc3fe4c1b01bee2a545608d08bc626ffdeeee51ad1921a18ce76aa897d17fdd13c7360e962d9798efaa3fcf72887b2572f
- SSDEEP 3072:RVQbdIjbxApA3RsMJ8oi8G4mpZdFbMrrA+GKfRY3OgReBFXbWs:TXxAq3RsQ818XmbdFbMrIKfRYHCb
- TLSH
  T1E2345A2BBB5840F5D5BBC1388A82954AF3B2B451472197CB5791933E0F33BE4AD3A790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Tools/EULA.ps1
- Size 27KB
- SHA256 52008ddc402c465745485fe2227cd902898433b14e05dde7782e549c3de9db77
- MD5 4bfa00bba72c619e8ff70cfecc041aac
- SHA1 6ffe968c9688bab3e37bf9adf169cff0063e8477
- SHA512 a822a213cc11bf4a047414fb1c284def1215c14c28cd1c34505070cd3e0ce30b3daee3fa3dba90377e5dab5295ea6af12c44a5a038131ef0f08492c6888d39d9
- SSDEEP 768:ZHA0cXfBzUq8Jeg5e43KDK+brrPm6brM8RJ5ObkfX7yC46U/PF2Ppt:5RSzUq+egzwrrPbg8sAf7I+t
- TLSH
  T182D27DB27304A295CABB0660CA5BFC80E83D703B19E95A84744CF0059F77E7993F69E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral14 behavioral15
- Target
  Tools/GetAadUser.exe
- Size 19KB
- SHA256 b9700acf9db815bf0acc57734cf314f1cda2cec2e41339788b71df189a2918cd
- MD5 383324c06a3b95496cc9699a1aad0c2c
- SHA1 e8dbb17a59390d1679a2c5caeb24620d83296965
- SHA512 29cf5e0c0f5858650922e9e74ca0b780c875d4f85daf0a13a54ad8a0fbc39f90532a55ecefebee7623353cf754ead1cd03a81cce6d02c218706139666ebf46f0
- SSDEEP 384:uwcHUS3aigY/4uMGnuDRXHaWdl+lVSTrbIgHRN7/MW9R9zn/:uNHUfiHtVSPbIM/z/9z/
- TLSH
  T194924BC6DAE84107ED6F0E7495FAD6932E39B7D31804D92E1AC5F5C90C93380DA2167E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16 behavioral17
- Target
  Tools/LoadedModuleFinderARM64.exe
- Size 336KB
- SHA256 56729abb839b7c5f0a01216458060c72a4a7d49ddcd298f32f8cf768458b6937
- MD5 23a5a5ea4a0cd2192b304e8fb8b1c2de
- SHA1 f140e55a095e55621731b5b5501729c55f47ddea
- SHA512 229930258f38c0c6e06f6ec14b99c40605923c85ab720f81be08e5a5d34a7c52f4969bef934dba8c390f62481a95e43a12b9b438d98bbc92209013b9c4c87a54
- SSDEEP 6144:FPbISnW8FTuVcAjt0iMtc3vdZrJvvUEkB7zc4ed:Jd2cAjuiMK/vU5U
- TLSH
  T1CB742A90EB8D6CD6E6C6D73CCC658A50603BFD788530C98B7153021EEE6EAC4DEA1563
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  Tools/LoadedModuleFinderX64.exe
- Size 318KB
- SHA256 14e52085cb09eea751fe907754da898ef3a219789a88ade2c455f3519b7e4ace
- MD5 d2b6ff59842d5153565358e50f87e67e
- SHA1 db3462ab0c2f7ff9301854cd0c197c8fa17a55b6
- SHA512 624af290fd157446f802d7f062b0d0a3f8816047251d5f3909a3298e43927c8fdef22bbd21e74fa683b3055c54c1c0909c052b97bd59e51b3f2ac3ff273dec77
- SSDEEP 3072:AifPfZsTBtvdph6wc4yF4YtJ8+9x8j/IH/FL4jg/1r/JDFtV8EfYiIpzNdE4Ov/R:eTBtvdD6wcn4ISWx6twlFwRd634uzX5
- TLSH
  T17C647C65B79804F9E977923CCD82850AE7B2B8110761D7CF03A0525E7F27AE48D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Tools/LoadedModuleFinderX64_win7.exe
- Size 366KB
- SHA256 e0944df3423a5865e89a41d2b2e30997046a3876cf415172e2c344908249cdd7
- MD5 57d4c97da45be8c368d1d9d4d95186f5
- SHA1 a2dc6c1c484602b39c55d71d974446da44df8767
- SHA512 5027c075b839b13020606dfbc2169c35fbae11702f64606fc836ac0840ebdef1278c1c79f11689a301c1f877e5fe3df49aa2e117cf721b1c301fe5114e76633d
- SSDEEP 6144:RUWBeAAltb3BdESKMGQq5M1BmTskRuczf45:RUWBeAJLQq5Aqsk
- TLSH
  T1AD848D59F6A514F6E177C138C9428506EBB2BC164760ABCF23A04A963F377E09E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Tools/LoadedModuleFinderX86.exe
- Size 249KB
- SHA256 7d76ba086dbba15952279d8dfbabc0ece59685e1af1a1cd4b09ce6b61a40d8b5
- MD5 5bd72bc2a13b74bd92467f8f3a7d854d
- SHA1 279c49f35ecb2db79e10a09d3df2ae1b060e5b72
- SHA512 f7499b37377ccdec68b169a3570babab20d12ca8f988597ee787d7081cb74e81ff98f423482d234f8525644f36218c326e3b37879820648ebc1e6548ac21ca44
- SSDEEP 6144:GGMxw8AAqkS5QHMQ0hCRcTSx/OfiwRM2nEKorPIY1:GGMxrS5r0Rcm0fiwuXKorwC
- TLSH
  T166448C637995C931CDA621B919FCFB35463FE8A10F2196C7538427EEC9207C09F31A9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Tools/LoadedModuleFinderX86_win7.exe
- Size 299KB
- SHA256 652b864b86b82303785f474e6b01c88381ae0768a37c774fc8be4be5089cca81
- MD5 167e613d7bcdc27b55024866dd6f9c4d
- SHA1 d6c9e6a71de9989254f78e064251913ec7714f07
- SHA512 d6848372765949b4b153f9b44cbfd7ad628bf853425ab605705927812ce109f082f275f3bc1917f2c44a428d20cb228f44aa9038c5916effce3bc89af66e9f24
- SSDEEP 6144:AbtZQ8q6fAAVUW28XNX+RUURsrAOTsAYOo:aZnq6fArMURenYp
- TLSH
  T127549E01FAD2D037C96609314A75DB668D3EB8610F60A9D757E41ABECE307C0CB36B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Tools/MDE.psm1
- Size 19KB
- SHA256 a774d8c8cb9af3aca703dd43eeeeb6545c56b2120def873ba20653295ca1cc58
- MD5 f572a638d8cb8631900c584dc4e33a01
- SHA1 e59af3a605fa35d99cd0007bffe224b31356a475
- SHA512 99b88836b59cc7f07c7950d1e82b9286c6dc05c3e4e5889ea2201be0f7c83b3da1763f59873ee02ca12c38dd615ee0c44d578a799882bba969f57839767ac3c0
- SSDEEP 384:M7gmSuNHe43KDvK+brrkjlgmM8a5vQrci4jjTqNqFA5WFQExxRnvtpb7PshZ:qSwHe43KDK+brrPmMb+rciCjQqJQOnvM
- TLSH
  T16D927DF27F08625A02B76E88DC7DE64ADB2CC47626F18168F49CB441D720B1963F72D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  Tools/MDEClientAnalyzer.exe
- Size 1.1MB
- SHA256 f7475d91ddd789961504c3cb1158330748e4582b6c6da5a2eb69163d2b9e41f4
- MD5 34c128f5cd1ed234888d988f9226afd2
- SHA1 f07fee3c4cb6e17a70269829dcc8a85ed5ac4bfd
- SHA512 2877a75570342cbe4858a4ef3623f6fa175a5c0e96e826672198f5ef736bfd9ab0a1604a9687e62289e8a62bf0667475a4857566ee7d19b92a2817723bb1be74
- SSDEEP 24576:OkaEromi6hjF/d6nEfUyGYatIhahpoYQ98r+hWlePgCHH7ZuuCvCvSOv/mMb:uEMm/jFknewdHQ98r+hWleDHbEu5Bv/5
- TLSH
  T11B357FA039868075CA8252B10E79D7AAC23CD9390F7344C757DCAE6E2B355C32B75B27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26 behavioral27
- Target
  Tools/MDEClientAnalyzerPreviousVersion.exe
- Size 20KB
- SHA256 5dd0835c7d26be42713dc72cacbf2a345d2b1e789f79011687553368a0d0e40c
- MD5 7107e21ad2ca0fd73ec96c4811e40edd
- SHA1 b3c6c3fcf980b08c0d956ffb1ce978274c5e8964
- SHA512 164f3923b2af743b9d4423fd8e4a07e099f0f234823f2dfa5d430b4337466ff46547f7649357619fd79b2df3d88a14e7ca62f18d1bce933b6ceaf2fc6f3997be
- SSDEEP 384:8a//Ce+HwoaMjfq0DYE7gR+P8O/lNJDEER9z1527yGiGCa:8a0kI7DfkR+k6Io9zWfiGCa
- TLSH
  T1FBA23C42A7E88215EBAF2E705BB1DA922F35B7C74D21E55E15C5E04A0D2F7808E31379
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  Tools/MDEHelperCFA.psm1
- Size 35KB
- SHA256 1543f8b7e3a6b160f4fac7cd1a36a620aa92592eda59244fbdf2786b7bba3c8f
- MD5 482135436c1cce2041185504128d87cc
- SHA1 ac62a3ac6f8be1793323e3cabb4ed1711c59b326
- SHA512 32fa7d61c0f70e4e17c74bc83750700d3551e66283f8560f4d6a1f091216b17c7d880c9d09f75f372cf687c5750909a60ed5812dcc3dbe99c18b161c61dfb14d
- SSDEEP 768:AjbspqM2qrVaBGufj6Lne43KDK+brrPmShbK6TWEKiM9E9Y0TDKXxc0WNv4IATf:A0VVaowrrphbd79VzCIA7
- TLSH
  T153F23B023F11360895F7A7F8EE52781AEA24419B16D327603C8CE4966F35076C2E6FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30 behavioral31
- Target
  Tools/MDELiveAnalyzer.ps1
- Size 20KB
- SHA256 03aff20d71413f98ed7d185c27ba62f37e298fa22f949274b16e327192eba30e
- MD5 2a71a530d1b82c0143ff4577a896be49
- SHA1 c4529c91637cc2b48ed779ac2e3653421fa8dcb9
- SHA512 1ce7f4f3007d119bb0b3a39e24f404551531bb72f9066073cb4ae9614cfe75b597af6581a25a27060ddc5b4b3e087859585ebc728e5300c97656402fbfb370d4
- SSDEEP 384:5Y7Ly957/j/jVbEWjpmXPEgWcj+qmBe43KDvK+brrkjlgme8alDXrJ5BnDkfX7yY:53fL9EaSMRgZmBe43KDK+brrPmeblD7a
- TLSH
  T1AEA26C627B24204A9A77AAF4C5BD7BAE382CC16701D16751789CF80EB73A635C3D20D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Possible privilege escalation attempt

Executes dropped EXE

Modifies file permissions

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32