b02019a4358f5b292bfc0fa54d644e0f6dc57f345db31ca88223e1aee7545e57

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft.WindowsAppRuntime.2_2.2.0.0_x86__8wekyb3d8bbwe.Msix
Size 20.9MB
Sample260730-alv15avgrg
SHA256 b02019a4358f5b292bfc0fa54d644e0f6dc57f345db31ca88223e1aee7545e57
MD5 4328743e9a89a7522d86ef9ee94cd81d
SHA1 499a7671f11db7229f339ee4a8c28dcc4d3fb3e6
SHA512 e1665ebafb4e314553221b83da717cfe335bcf38c65d6d5098584d58539c85d6b0bb7940a25d1ce46d6c351115dbf3be21c50354c0d1797ca19cdd4833552100
SSDEEP 393216:GslQllyABBTvGxIPIQ4tSdwmiQ/uzs73d+yFjGDHIL77+cLVLHwe7W8bmtzigY+R:GlQmhGiPym/Gs3wKjf3rtQeSamt53
TLSH
T1AF2733A4E43778D4DAD8817624A2C4D0B959F1E38CF4DF2041CAAD1F96F09718B5A8EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Targets

- Target
  Microsoft.WindowsAppRuntime.2_2.2.0.0_x86__8wekyb3d8bbwe.Msix
- Size 20.9MB
- SHA256 b02019a4358f5b292bfc0fa54d644e0f6dc57f345db31ca88223e1aee7545e57
- MD5 4328743e9a89a7522d86ef9ee94cd81d
- SHA1 499a7671f11db7229f339ee4a8c28dcc4d3fb3e6
- SHA512 e1665ebafb4e314553221b83da717cfe335bcf38c65d6d5098584d58539c85d6b0bb7940a25d1ce46d6c351115dbf3be21c50354c0d1797ca19cdd4833552100
- SSDEEP 393216:GslQllyABBTvGxIPIQ4tSdwmiQ/uzs73d+yFjGDHIL77+cLVLHwe7W8bmtzigY+R:GlQmhGiPym/Gs3wKjf3rtQeSamt53
- TLSH
  T1AF2733A4E43778D4DAD8817624A2C4D0B959F1E38CF4DF2041CAAD1F96F09718B5A8EF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  CoreMessagingXP.dll
- Size 795KB
- SHA256 6d8584ed503616182675229f52814dc7e66d5e95c0afbf7654b05aab222df744
- MD5 7f02ee7134e2612ceb47eb3776172311
- SHA1 7b1cfc83e09b53ca6bdb7d2f41c89f671487895a
- SHA512 c777d1daf583aa4a3ec4bbe8f6e87ed2aec9f6d83ac58474b5a606b0141d4ee1afc9d9f6d8b73de9740d41ce295affec5bf7eac42d67dc7a3459ab124edf7e63
- SSDEEP 24576:Zh7Fim/1W4Pf+r/CuZaMW8NW8IsN77NAWPY4j0eAw4qqu:73aZaMW8N1Z6eX4qj
- TLSH
  T1EF055B337AD885BAC9AE2570545D367662FEE4600F7189CB1F5833EE5E786C01E3818B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  DWriteCore.dll
- Size 2.7MB
- SHA256 cf421241c6ef2c27016dae094646357e6215f38e5ec8549cc9bec8a3dabc6824
- MD5 f6f993b0b0c9f401e8d4b24414cef597
- SHA1 cf6dc2a6682da768912e86ad4fd203a5fc70c66f
- SHA512 69f4ace245344a7b11ce5362cdec77f95addfa0d806fa08c5ad5d3038ad679bd4e6849bc1f71e7df27b9986d39200faa49143a68eaf337e9b98f5ab3f069947c
- SSDEEP 49152:DR4paXCsPo0DhpTk9IaSntpVh89NkFNOkDf4DLHATYDaH/vAq:DUaXLA0DbTk9XSntpVe9NkSkDegn3b
- TLSH
  T1D2D58C12F959C5AAC6CF02308C1AE219A7687A31C77159C7FED89E9CFD613D30931E26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4 behavioral5
- Target
  DeploymentAgent.exe
- Size 78KB
- SHA256 5951cc4e27196e423db0e26b87e5dbb3c98dc97abafcd5820357bbe7b19ca396
- MD5 e957cfac5ea138ed86ae01d3db96b10a
- SHA1 461e2a2ff1d8456a70fd767676bc24b54e74cef7
- SHA512 ef1253c9367055650e8f738a6d3e40093309799085bb3fb555f26a454fa0f86bbdfdc7f390224d4b921eee76b6d03a669fcabd1e4a962f16172484c0c56e47df
- SSDEEP 1536:ler5As1ZK7WFwoIQpHiPI5eAkORUqjsbzO17kFpIwzO50H4Rzj:lM5ZGqfpCw5xYbzOGgwHWv
- TLSH
  T102736D537884C5B1CC6630B2069DF62A127FD6A14B6087D3378993EE9D257C29E312DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6 behavioral7
- Target
  DwmSceneI.dll
- Size 1.7MB
- SHA256 0a8da497fca1dca517d9b5db1aa860036f5acb5fa58b09f72fa4744dabdf9280
- MD5 560fca8fa5e5b577a814487453b6cb5c
- SHA1 d279f037bdda5f62eec88160e777494d0fa52b0c
- SHA512 7d03176604c716414e4784d33b5279d5d954594bcc5ee4bdc9d58320f38e2d0e9788e8cc33150ad83908e3dff9af2295558907fd7c470c1ba7d6e65d2cb7cf65
- SSDEEP 49152:kdrCl3xHkxx7e3GKoQUojw82Jf9jWFIna/sMbWLJ1:s2hHkxx7e3GKoQUojuZWi
- TLSH
  T1478518136784A67BD95E537988DB3B20B339E4B00FF243C30B9861A99CB63C45D725A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral8
- Target
  MRM.dll
- Size 236KB
- SHA256 739052461d73ef2530a0e017f3e517ecfdc5844edd7b2531ad87640ec2c1d3ba
- MD5 1f1b7a69b7aae6057b42e22cfcf56eb0
- SHA1 496db02ae50bf175554d54262b6b703fd6ae3ddc
- SHA512 196c3a40df1c2b867611fafdc5c0daea83548a897d1440ac6870cc068c9f293fe7b31a0fa072b52fe80b3f8ace4566e2cf3392426ab2936af646da838b97e2a7
- SSDEEP 6144:Ib7tWo5xhoMrbhqrpPR7hX7jpkKztBypy3GlzV9h7Fzbu366QhXKoPRWvpeuTNTT:IntXPhfpy3GlUQhXNzkLruO
- TLSH
  T16F342AE078C806B5F8A73DB552DC3538D1ADD25007F099CF4A9486EEEBA52D27E341CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  MSIX/Main.msix
- Size 75KB
- SHA256 f8c355ecb8350d8e10aed1e4472053d9547b6ca151986cbc70958b3eaf6f0f57
- MD5 19f0cc328bcf262f70e9a314d8cae9ad
- SHA1 acd5994f9ac2a6456e3c77fa809cd6ccfedc8099
- SHA512 c6dff84430fab0c2249fb8cafa52c39a93d927fbd8bd696273ac09b25ec5d623223f803e4bfe212ff40d75354b449db28a31954e5b4600fa6ef9d29113ca252c
- SSDEEP 1536:6uInwnKAiyJ2yLZFwC7Sf9Iv7gGr0XZ/+zrrllHrJ2vj9:6uIqKTSv9Sf9Iv7gGr0XZ6rkj9
- TLSH
  T1B173025B7C7A3404C87483B2C81FB3ABA6477ACF0268E52511A139F8727C29DD651F70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  DynamicDependency.DataStore.ProxyStub.dll
- Size 33KB
- SHA256 07b0fc4d8be1565facaf00da050ce0e24bd61a1c766d0651e652063e8f22290b
- MD5 84bcb0f4d547aef924c32c4e0e11b86b
- SHA1 3f3a1f93be8d220da67febaee0033dc0cb48f3c8
- SHA512 338dba6bf2d9feaa63a9051e8f95ff481f906bcbcf644fb9530fb8cf7894f82d5e66530eabb7edfe21bbfcdbe460d47fc9016ef670fb7f51663895dce936371c
- SSDEEP 384:5eAK9Mk4XK4zsdT+1jTpMVliWodG6TnGHQofrEaZ3WC6lN29fPOxFR9zZpJE:YMk8+xyHgliWodGCnGXI+1PO59zfJE
- TLSH
  T114E208C2BAED0691ED5F05F4E9F6B71A183CF9410FE22BE316D4944A98A2FC453B025D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  DynamicDependency.DataStore.exe
- Size 72KB
- SHA256 23886f4cd780727b7a4a9707fdb509bd59aca4647d21dd61614ce5fd5caa65a9
- MD5 5d620871c892cbde475508ef5e3f4e9c
- SHA1 959843004ca0a7f18416b1f04bc3f2638091f9a2
- SHA512 f2e9ba73545bd576bb4f88b7e18fedc7a806a3ac922f6a6f937ea328c49f58cc8bc1959546b6b56641787dd9319d9ebe724db9e30fbcdb8f6fb25eadbb39d7da
- SSDEEP 1536:rgMcpHElzJ5O/dRYVmkkQJ2m5hnzdbTIJKvJ187tkzx2:+pkBJs/d3g7tpbU+8BkV2
- TLSH
  T1AF735C63B8C8C971CA9224B405ACF957653EF7E24B6445E3275447EEAC243C1AF322DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  MSIX/Singleton.msix
- Size 139KB
- SHA256 40e25081e8fe9d21c5f8cdd7855a6fe6da870c0f6a1f6d5db36dabfd7c47ed0a
- MD5 349ae0de257b1f90d9ad590ab24a94b3
- SHA1 84a7e30422d6e89241af30a7b5934c2770c51b9d
- SHA512 10f78ad94f6c577fbeafa5250eb6bd627ab8bb2ebbc15f953800630457b87d6195fcc85dec3977484e09173a242d7f5794d36da5c895e3913534ea33718c8620
- SSDEEP 3072:z8oCis2ExjOdp8ZQbHt4hUt4n3jcun3PI/iWYe7hr0J8p9BCJ:zTns2E9Y2oHU3Qun3uCup/CJ
- TLSH
  T17BD312E01D7C7E30F0B19F76444FC42A599FC8D85BA0A5C8DBEC277AE0112E57999E0A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  PushNotificationsLongRunningTask.ProxyStub.dll
- Size 34KB
- SHA256 432efc42118f40c15277bd533cd24ef20b0ca55efd0a8e3011529b04ef205966
- MD5 9366514d397963cace4dc731d6fea795
- SHA1 3c6748262e21bb66d1e967233460e250da452c96
- SHA512 ddafaa17272dddb42b1655a55c71f32b8a974dc0ef346f9dbc37b204aeb75b8956c72cb6b408b5fd1e593004d0aa2a533742f1d8ad67992f1269732d22b9361c
- SSDEEP 768:SMkqUhIqLsAHliWodGCnGWI/VdSrr9z6BnJ:jkqQ7kBGCGWgVoBz6J
- TLSH
  T1D9F229C2BAF90292D95F05B4E8F6BB19083CF9410FE16AE316D1644E98A3FC4A37175D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  PushNotificationsLongRunningTask.StartupTask.exe
- Size 55KB
- SHA256 278dfff91171e126f9774e502782e638eff8b110fe3c6ff721ef42184f3153d3
- MD5 14c3551e5ff0522637fa0d44a987a1a1
- SHA1 c648b9686feebc47bee7e3675f5ced8ad110d8d4
- SHA512 446fb67f06ba740f19bc41918a83cd2bd48d44ab407dde09afc0fe8787adef0712b4accff023132b2074db6143744716fe582396dae2d3875777c3facc9f4d20
- SSDEEP 1536:K04UF2pHshLuvuRiikqV6jPR9LGIbNnh1zE:rapMcWRi0A79bNh1w
- TLSH
  T113437D63BD848072DA9234F41AAEF567127EE6A10F5492D3275853EEA8357C0CF301EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  PushNotificationsLongRunningTask.exe
- Size 148KB
- SHA256 1d4373ea98b9789d3e1581e9da8e9789a4951199ff431094f4527c9bdeca9337
- MD5 89851092dc2d0fc673fe1b81d49e6dfc
- SHA1 ee99c64d161c601d5f674c9c5377a793672e89ce
- SHA512 6f0d2cc1a276a16800ee3ea73423f5311b2307cd4d2357c4edecfd5b930aed065f1df7526b7a1450a08d61faf097db4b8a36b674a1fd1448de704e559783b41a
- SSDEEP 3072:/dqplLgvsuNnJz2p3z3ccRiTJ+BgUUiRgn:/dqn09Ntk3z3ccRBg+M
- TLSH
  T11EE33B72399885B1D9A739B0098CB77A523ED5B00B7112E3570913EEED69BC22F750CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24
- Target
  Microsoft.DirectManipulation.dll
- Size 474KB
- SHA256 6cc7b07e1a6a27b7fc5744f81d2a53d293b4920a05c02afdd8ed5e3d8011ae70
- MD5 28642a7c51351eb08ccba8d8d5094f67
- SHA1 7280b6dcfc30042ee652bd2bdf2d4b20747234c0
- SHA512 3df307dca3c684a0a52b3407021b1ba7a9533f5090b652dcb15dd6fd764c500fbacf781807bf98ff20947b2d1ae3bf0a853810d39345995557458e9232d2d036
- SSDEEP 12288:7yau/IJcIQv/k8yWBJ8tRfHuBkcmFuawR:3uQJchv/k0TrmFWR
- TLSH
  T1C7A44B2168FD4130CEE631B460DDB1EB917DAC540B268AE77360A2DDE5F46C09EB319B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25
- Target
  Microsoft.Foundation.winmd
- Size 11KB
- SHA256 63253295e79d49168fb5e881527b7ee637af21f4486d9cea56add2b804a0cc04
- MD5 d7ed7d15299f83223c9a8bbea7401cfe
- SHA1 c32cfdfab4c3068d5b89d2ae6f22bbcd05b01b27
- SHA512 86157039a34f8309d38c703163e741b437a524816252f1177ae9c09fcdc22a6a7001bb7220a7f09dd8603d292865a443a8c961983c5ed2e1f9cba1e3d2dcbb4d
- SSDEEP 192:tEsWO+qSWUwuIi9ycBWsea8WLN6U34DcX01k9z3APYIXxpYj:tz+qk9gclNVQcDR9zgYIBw
- TLSH
  T17E324AD7CA2C9043DE8ABCB093A8DD833C3C9BD71D40586212D9F6A42DD37C6A72916D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  Microsoft.Graphics.Display.dll
- Size 147KB
- SHA256 bd99ddbe51ed09d822e1fd957d6e33d7687c28c5b2fa513ee24d9e6bad2b4bd5
- MD5 7a143b250bbf5a4efdc3cfc9a3ee1221
- SHA1 55e574382601f8ad40db4a03770e38655dee4a7f
- SHA512 830af16e5fb53d5987dc24a27e05bd286364eff6a04f7ec7852d734b3f4e2bbb58914987b10e832bee7faa78e348d73592cb5bdff4b6e2bcc75e46439cd128c6
- SSDEEP 3072:o78ptdUhwtREH9bemaeC7fONWgM/5zKeSsxQhGKLKfxkf:88ttRu9PaRKQgMhzKeSsxQ8Kig
- TLSH
  T156E32A717A9882B1CE9F31B958AEB76F527CE4814BB109C3275817EED8657C11F3028B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral28
- Target
  Microsoft.Graphics.winmd
- Size 20KB
- SHA256 2bd759054854c1d291cadfbc1e4f6c3aaacc942b17bb0ebe7b05daaff4e4a325
- MD5 4d00a7970a8562d54638655658ebd210
- SHA1 c6cdad0b604c513bb349ab2b36e65a93fbea6804
- SHA512 38fb59e140fa6766c36b5ff7621127dd6f6fb2f15372c9b76d7007453235c79e67381faa60896ecb8692ed6d280150670eeb10314d78f6c246379ae37ed3fd93
- SSDEEP 384:h20GKBw0DKErH+5zoxPAgALYNfUteb6A2lNusdlKR9zxAt:bBBwQKEr1AgAcaZAss9zat
- TLSH
  T1ECA21ACEE9487A42CC5ED4725BAAC693393883E725024A635E74E85E39C37C45319FEC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Microsoft.InputStateManager.dll
- Size 299KB
- SHA256 41bc98a42b3c250fe516f80386a96209188ddb3162227d10e2ccadf882cda4a2
- MD5 c1b31c165d1948a948848a874f943684
- SHA1 0fb0f00d6849ac47101cdc38d7ac662c6a83bb57
- SHA512 e89e47acc351083d55d64790f50c4a5277af8ff81b99abb2b5a82211f8585919eda1bfd444771b5a92cbd5e0d41511449c5f09cc1dfee9a115b9afc51c80b000
- SSDEEP 6144:uU/N49pFHd8U+U/1xPk8hI/lpfm0RPmDq9nOPCeTLQ7y2bs2je61kEnz:x4zFCU+U/1xPkII/nO6Cq9n7eQ77g2jX
- TLSH
  T1E8646B32A8488575C9EB31B8704E7776A17CD6A00B5185C3C75897EEEE6A6C06F3438F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31
- Target
  Microsoft.Internal.FrameworkUdk.dll
- Size 675KB
- SHA256 28a404a0ad513a1c2d57a2e08022c0f9e6c0030bdf6c7a6b28430926127b9335
- MD5 7a706b808d1b0e75c3bf4233be93e86b
- SHA1 caeffd58e797abe5f151d29244831468807846ff
- SHA512 312666ebfac7e1b68eae335ad55f29a685c370243e41cabd5d6c039d217da676ab432b5d5266bedc520fd069bd2899464a372e6373b8600ac9628a69e78efd03
- SSDEEP 12288:s4/3/SforqI2OIdA3CaYR6tyKBoUxdAG+59mGzuvpW1F1vSkyOG5MDt:sEj2OIK3Cn6ocKkGyvpW4T2
- TLSH
  T1FFE4D4219602A33ACCFB20F55D7D306EA11DAAD1176018D763C86FFEDA626D03B3159B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32