General
- Target Maxon_App_2024.5.0_Win.exe
- Size 47.2MB
- Sample260719-evm44aes6x
- SHA256 ef7326d2d228bf2d54add314a9be8d40de86366d276447b1f57e322328db6452
- MD5 225420db7068db9f964a3695cc75358c
- SHA1 5e3fbac0721612d24809aa8c049821604f8e9efa
- SHA512 decf6d34a913fbf500b7312a7ad758a30506a0c992ca64b8743f74b570787e0d27b55c82898bd54aa803792cc6e5a75a81a7e1455b7144df38759f4b0cab58c9
- SSDEEP 786432:Am5CCP/tTWaoKptj3ZkJqtLjmX01q26slkvDRmtH+kkS2Bm6liWV5EE6w8G1SLKh:xLPVTWaoKptj3ZkctLE06IWDMtekNd6d
- TLSH T1B1B73317D2A240ECC53BC07487A7E672A971BC1911307EBF2664DB353F72EA0672E619
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Maxon_App_2024.5.0_Win.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Maxon_App_2024.5.0_Win.exe
Resource
win11ltsc2024-20260710-en
Malware Config
Targets
-
- Target Maxon_App_2024.5.0_Win.exe
- Size 47.2MB
- SHA256 ef7326d2d228bf2d54add314a9be8d40de86366d276447b1f57e322328db6452
- MD5 225420db7068db9f964a3695cc75358c
- SHA1 5e3fbac0721612d24809aa8c049821604f8e9efa
- SHA512 decf6d34a913fbf500b7312a7ad758a30506a0c992ca64b8743f74b570787e0d27b55c82898bd54aa803792cc6e5a75a81a7e1455b7144df38759f4b0cab58c9
- SSDEEP 786432:Am5CCP/tTWaoKptj3ZkJqtLjmX01q26slkvDRmtH+kkS2Bm6liWV5EE6w8G1SLKh:xLPVTWaoKptj3ZkctLE06IWDMtekNd6d
- TLSH T1B1B73317D2A240ECC53BC07487A7E672A971BC1911307EBF2664DB353F72EA0672E619
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Creates new service(s)
-
Modifies file permissions
-
Stops running service(s)
-
Adds Run key to start application
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
1Modify Registry
1