797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468

Sharing

Copy URL Twitter E-mail

General

Target
797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468
Size 920KB
Sample260801-eyr78ade98
SHA256 797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468
MD5 55f88031582b5b2f5d0a69bcd6c9f8a4
SHA1 77571d278e7e65baa224ddca089f0adcbb8a5e5e
SHA512 1edae9274609d2813bab4fe585b59ce209114bbedeee4121274d1c463c816ecc06942d9111d90dc4e0d1160627c4579337a1ccb6d1179ac015fc30b5cc1352ab
SSDEEP 24576:uyWZ8IpsDk6+pZSl8/vqBSqKiOOMdCz/oQ43Fh9:t6tLpZABSqK+yjzVh9
TLSH
T1741523A0E794C85FE1F3997513370323E975E16E05A02B1787812A497FAB1C3A63E7E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468
- Size 920KB
- SHA256 797469145a98ccd35e8650be57c115f69b356a838010d99c3d509e3fef404468
- MD5 55f88031582b5b2f5d0a69bcd6c9f8a4
- SHA1 77571d278e7e65baa224ddca089f0adcbb8a5e5e
- SHA512 1edae9274609d2813bab4fe585b59ce209114bbedeee4121274d1c463c816ecc06942d9111d90dc4e0d1160627c4579337a1ccb6d1179ac015fc30b5cc1352ab
- SSDEEP 24576:uyWZ8IpsDk6+pZSl8/vqBSqKiOOMdCz/oQ43Fh9:t6tLpZABSqK+yjzVh9
- TLSH
  T1741523A0E794C85FE1F3997513370323E975E16E05A02B1787812A497FAB1C3A63E7E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH
  T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
- MD5 cf0351a2ab9128838be6b54cea8238d3
- SHA1 c3b1abb890d92a6058de7c3ac2b2185b2f4fd03c
- SHA512 f1a68557d3825ca879f66c1b6828342528e41b8c746d137c51b85e8f8341dcf69bffc5bab76a498113cb53de3f4502644de8a26adaa27c22fa005ee7186f7785
- SSDEEP 96:oXEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3Y8NqkzfFc:oXEvCu5e81785qHFcU0PuAw0uyWIFc
- TLSH
  T16012F892E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  Snipkap.exe
- Size 1.3MB
- SHA256 df074c77699353812981935e511a4f220ac80129d6a3102dc33c1d9e067001c8
- MD5 974801403ed5c535e34aeeb64971cbb4
- SHA1 7df488296bbd421a1628e39eeaba9dd5036725f9
- SHA512 374ab9d2feaa0dabb06d85c149cdebdef209d26357730a8046a8dffbaa9418148aba5429121fa4cf18de726db10ecd801a70ec289c69d300d99f0f99c63a9f43
- SSDEEP 24576:Wbl3k2A2QZlkqVkX2NhUUSDUeGCKkjVkno17dv/Yd+MkFeVTq:H2yfkkkmvLSD/GCKkjVkuQzTq
- TLSH
  T12665CF3773A015F9E5B7C2B68C775602EA7A78093214D4EBD7F840A32F264A7213B725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Loads dropped DLL

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8