00bf2151443ad9031e8e69a7a99162fc5af39cb32969f0eea452f40b8307755b

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft.M365Companions_x64.msix
Size 35.8MB
Sample260802-fxdh4sdl8s
SHA256 00bf2151443ad9031e8e69a7a99162fc5af39cb32969f0eea452f40b8307755b
MD5 6c5d6656017fea3fe6cfc6d42f588e2b
SHA1 d98d40a413f8b38818b0dd5a8360d1b84435aa77
SHA512 156ebb3f796541210f094229811a977e2d12b84ae7f0c544b02fee79a9b2a7836a665c661361ab688dbb0a5ac1afb2d985a8ba806137e5e6efe3998e7e91915e
SSDEEP 786432:wFoPJkCLzuEvgamvK8LzMRZsuicLzRyZoAVoAAGnzr/P+xArOP:wILzxvgaQLzMbLzUZoqAGz7Nu
TLSH
T1DC8733996D0CBCA6FA85617290CFCEE223A646B31404E7547976BB041B84E540B4FFFB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Microsoft.M365Companions_x64.msix
- Size 35.8MB
- SHA256 00bf2151443ad9031e8e69a7a99162fc5af39cb32969f0eea452f40b8307755b
- MD5 6c5d6656017fea3fe6cfc6d42f588e2b
- SHA1 d98d40a413f8b38818b0dd5a8360d1b84435aa77
- SHA512 156ebb3f796541210f094229811a977e2d12b84ae7f0c544b02fee79a9b2a7836a665c661361ab688dbb0a5ac1afb2d985a8ba806137e5e6efe3998e7e91915e
- SSDEEP 786432:wFoPJkCLzuEvgamvK8LzMRZsuicLzRyZoAVoAAGnzr/P+xArOP:wILzxvgaQLzMbLzUZoqAGz7Nu
- TLSH
  T1DC8733996D0CBCA6FA85617290CFCEE223A646B31404E7547976BB041B84E540B4FFFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Calendar/BackgroundTask.dll
- Size 262KB
- SHA256 fb588a4aa24607979f65f6028227fe3593c2578be9435e34eeaa51485ed732a6
- MD5 254001f82a176a7676ed205e6c53ae08
- SHA1 763fe3a4ff603b314dab454e0fe2bb0cc62f5877
- SHA512 5534162eac31ad51f0152624a5d609dfcdc950ab0fe59861b5b6077f7436674a51ad13db11ee09fa55472dee2f99c0b9c1f794c13a7e051c4320419e49c1be1a
- SSDEEP 3072:Jap4+l1QUI7OfVkp1DdPB02NTxph0LR/hSMXlk4ZqKFya5XB67TjOSVn6tKIh3bl:IK+0bp1D9ph0lhSMXlBXBWfwKI5V
- TLSH
  T1CF44BE12B7D9DCAEF51D8578889A4A49FB337C858380D3CF17648A954FB37C25E3A602
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Calendar/Calendar.exe
- Size 8.1MB
- SHA256 3e9aae6c518f63a63bb1dfcbfc7251ecd7504590cded1d9c9bd00009c0e2c7df
- MD5 0679430ae17aef2a786b9d178aae71a2
- SHA1 99eb71c3f5b443b3a4c10214ccb02fb9b7d7d3bc
- SHA512 2de3059c6b20b8a96e9b7fa06098f899019ca749df94b5841019b12469460987db4fd9b41893e67a73ed7898b45fb85115eee66bd39f8314d658502aa6af8805
- SSDEEP 98304:EdGV2wVdXe4nBu8K1tKuOrhvecdTsUxMbNhBHH:Edg2wzM83uOr8cdTsUxMbND
- TLSH
  T14B869E22E34846D5D1F6C2BE9A078913F7B1B8670732ABDB09E54255CF676E44F3E202
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion trojan discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  Calendar/CalendarLauncher.exe
- Size 47KB
- SHA256 c96d0f0b36c977b5278e063f638712ee5a023ffc9a5c68ec56708946c1a89c5a
- MD5 8189c20377d515e683d550c39dc57102
- SHA1 a52e70281a895a5f56ff312b9f9dd740ffc1987d
- SHA512 d310f9a6467a96424b6994f56e2cad831960c6d9d2bbbc1c816a1a54e9d996f81c8e47053350e6d300975eaecde2cec311ae7c1ffe300f09273c76404dba8be7
- SSDEEP 768:ONOUTRwGQwA/VK44lKi+FWOOKihrhfjZ4U9zTt:TYA/V2lKzFW/hrhfjZ48zTt
- TLSH
  T16223E716CC2AA05BD35D8C74C1079C0AED72BCE79BD1B6CBB7505CD509A2FE4AB3A205
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral7 behavioral8
- Target
  Calendar/WebView2Loader.dll
- Size 155KB
- SHA256 5d2d470dbf8a508455ce8517ff560400a6fccfd3a24f15180a7550aa98279902
- MD5 3a3f9ae6b81a1a235db850195a930c03
- SHA1 d0201929470f7eac05c6e01da63224ab881a4d7d
- SHA512 cf60218ed5270b10f75a78ec3dd3da38444dd231f8058244e9b2e66c15dc10bf2f68ac1f3028152823f4d3ffa30a86b14f62bf563b1c65b56adf75b7c0f5f947
- SSDEEP 3072:NF1MwEX3tInKje5qX3HNuD9KPyBTJzNQG/BTeu3mEtJcKOx+4IsoA:NBA3mi6kuD9KPyBtnmEtJ1bBI
- TLSH
  T1FEF34B57B3E80077E16AC278C9634A46E777B8151750AAEF0364437A1F237D0AE3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Calendar/bz2.dll
- Size 84KB
- SHA256 cfa4175307622dcdd1f87c85aaf681ad9a54cad83c122d4aa31c4d6b94a3a25f
- MD5 0647eac3bad09b2157feb3e3b7482f63
- SHA1 ff1d7159eaafa0d287b549cddd37dc844475d113
- SHA512 cd9bbf0fb61aafaba0fc4575bb0175751574e32af4f4b1e23e7467dab0b0ec365cc946fb7534ea91e40863615f767ac429e56382c5518316388d412974679760
- SSDEEP 1536:MaVwBGeOrCAsWe2CTWqIOrUD/JhvEnnTy16hUKi8QzIl:ZrARcKOAhUKVQu
- TLSH
  T139835C4176A2BBBDDD5BC0395663074BFB35BE780B1027BB3660D27A2B22BD10D3451A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  Calendar/concrt140.dll
- Size 306KB
- SHA256 204ae0f16c0888ffc69fe0763efc8608da6d131e1e46fd0759da8c7bb768d7ff
- MD5 cef8d91889d73bda901985f391e093b2
- SHA1 e49617967373f2ec362ef9969887992d47b6c84f
- SHA512 555612061cbdcf084f0b97ab8281a5c268c81d08cfeedf832b82bee1c682192b41a1a64d1203149e03c691ce2bec987e7272f7e720580d303758c4f29883ae5a
- SSDEEP 6144:cfjSd54rw5k9cZW1Cbfpri5/ww8VRj7nWzg/p8/:WOP4rwK9c0ILqzt
- TLSH
  T13E64288A76540CE6F96BE039C553851AE6F2BC416352D3CB0264839F6F637D1E83A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  Calendar/minizip.dll
- Size 57KB
- SHA256 53968db3b83edda16075b5ceba73c0c66a1d80e61599ee15be01fd6cc54a4127
- MD5 8a89afef271a928634045594371de2f5
- SHA1 e36aecceabef09205b8f3887b4bd1175c699f34f
- SHA512 39739b854a595cf4ed60e820854187b30d38cf963957ccb20760031350a7662dc3c527a5b5dcb42f442d4eef4fe3633b3b56d9db33fb126ca9bde5e28c78e658
- SSDEEP 768:ubMiMsVVdsjCCjYsbyEybd5/TLQQdRVEtjK6J+qY69uihr7Nx90Ewd09z8:ubpa+CjYsbvud5/HQQdRVi+M9x7qXcz8
- TLSH
  T10A438C92E7A44094D9A3C078C25AE22BEA797159231557DFA3D1CB0A0F237F6BA37314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  Calendar/msvcp140.dll
- Size 534KB
- SHA256 1d04ea9ea73d16d69e21a4a2761048cd39f6ea35f0b1d91a17c9975d754af583
- MD5 e929a4ac3fca51e6db0b1405e8c819db
- SHA1 2e268fd1228305ec98447d4d18e24ac6d58d043a
- SHA512 c6c74f1ddad8ac8b0187e7e86a23340b8dcb5197936f27ac09512fb1dd8a1b58c5ab5ae578d5c57aea1971ee31f59abaeaeb50a53ba4c93d1ffdeb027e10b7b5
- SSDEEP 12288:fdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa66:fdnGoU/7m/V5WZ8dQEKZm+jWodEER76
- TLSH
  T1C1C41A27F74A06B0E195E3B8A1838702D7F1BC498322E3C752EB955D2F573D0A67B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  Calendar/msvcp140_1.dll
- Size 24KB
- SHA256 b73abd19a8cd553c07e77ec50db545cdc7587f310ad01b094dc7a04e8f0c93a8
- MD5 b9939580882fbb6a38f8f157cd6edecd
- SHA1 32cd5de02f4787dcbeda81a865d6518647e55a46
- SHA512 8b73ea7cd88f56375c30a2da7da272a5768f393313060045f8377c2b650a89277a80d5a65895ee2ae20eb6b15566579498df88cc2aa07f69ee302c85fbb0bbcf
- SSDEEP 384:3jW2J9VQH+qNy09dmFWcS5gW74lN/xrriSR9zKEHoR:i8QH+qNy0PmgMprr9zToR
- TLSH
  T1FAB25CC6FB28C841F85A4830C599DD86B939F7C14F51A3CB5395A21D0CA77C1FA35B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  Calendar/msvcp140_2.dll
- Size 263KB
- SHA256 4d0a66dccde956c7cc7aacfbf85c3b86b12b848a96228c0e1b494917899887bc
- MD5 64729945ae55d9c09be8be56ee97361d
- SHA1 ca705ed22541cd010ab13172570643ce6793f821
- SHA512 835a1c173b197ff5aabb3b5d5b8edfc0b59642a994c59c52beec740d0a3639754f9e65ab9f98a26a5a5ae7ed69525ec7bc4c9680d26f835afacfb8b1d47b3654
- SSDEEP 3072:DJ51P7emwi1j+XZi7b1dbqtH0h6XV3Q0JPQo07ICl3Sg2xmygdCg2LMeDh5FD79R:DJbjwvnQo/iy5L/XxTWrm
- TLSH
  T115442912B51A2EBFC5D6E8B04939B416FC233A418775C4865BC31C8D9E2BA533FE3529
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Calendar/msvcp140_atomic_wait.dll
- Size 38KB
- SHA256 ca603320ba99d591c0f276632ae4a857233a66413a61b46d8c91ed5b8453bcb7
- MD5 f91b5db3029a53a8c3d413b97126dd33
- SHA1 0d81dc9b3feca35906258d36943f2f96d5d5795a
- SHA512 712515bbf1bde4dfcee28212db39815657619821ccfb370609b61436c5f23a2b1e0a4cbe6e70fa7275004aab0585015a6fa6b6e919f637b5e872226b29c4be9f
- SSDEEP 384:eWqKvfMs5ynSgDHxh8f/ujGZNkhE7tNhyMoUN0sDSnHz+PcKh8o/6BVRbYAFzDXO:+yMsqh8UGchsJr3KbYA5XeDmZd2s9ze
- TLSH
  T11B035D8AA7684093F1678738C061A517F776B6A14B10D7DF8362E08A0F63BD4BE35F16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  Calendar/msvcp140_codecvt_ids.dll
- Size 20KB
- SHA256 3bafe23fa408793bbfe5173e42d106fb031ef91cf871064ff0929c7816f302db
- MD5 cb91f490e126ca2bc740af592f4ad96d
- SHA1 5d3d449e18dd76917e7d1fd85a3c52a4ea31a4b1
- SHA512 3618534faa8aabe3a05dc5298ced6c6511e2ba544170f85030f4fb0d11c4b6cabb1b3ffa0cad0b092502bc348d0d092e19165eedd3f64bee5315963e8ccfeb7c
- SSDEEP 192:Gp7d3UVNesFv3ex+xSxMxosYcAaWioEWzWUwuIi9ycBWseaoWvTsX01k9z3A3Uw5:Q7GVNpd36sRWioEWb9gclN1oR9zyUwuK
- TLSH
  T18AA26E8AE738418AFD9A5970C668CE47B83EB7954B1163870361E11C1DB37C5E73538E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  Calendar/nh.dll
- Size 4.2MB
- SHA256 173b01506fe47270fad663c5d36f8c91069f0f1cc3a8167bd37917812d8e8306
- MD5 c58040f632d4fca948ef3e1ddeb3910f
- SHA1 45b20d09fcd3e3f4b0f06ca4b23a96fb01e6e636
- SHA512 5b1bf123bdd4d610da9cfee415654cba02eb384fd92edcfe944390a1c689492cb2043ba8da59946923e1f9f01b24a49851aa9899ac38f48dcbc676ee076ae9f3
- SSDEEP 49152:9rg9K3PpAD/Z7miNbFjluhZhQIgRh9kZ8V4eCejV8tp71AAWxVH9mQR0thhKkJHW:53ONjuVWdKRe10Y
- TLSH
  T123266C22A35E80A2D5F5E2FFC9634E46FB71749353229BDB159483491F23BE0573E222
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26 behavioral27
- Target
  Calendar/pugixml.dll
- Size 201KB
- SHA256 89c28d3f0c5b834aa4648308e6bf486ad7fb8c4635a8262cb77f23423b7ce086
- MD5 c203f0ba6941724b4ce499adbff2c386
- SHA1 27390d5f31bacf84eb92f3310c7d55b0091b54ea
- SHA512 085ede3c145c126fd89aebf8d95fbdd6e2c1712ba2b99b3ac4111d20da0c56a1b259c3b724b033981d8fd09fd6e28e9d4da302192409ec8ff31595ae360ec6e0
- SSDEEP 3072:leDpOtgYQexvoOfd2q2Gu7nRRMHOMefGiyQgGcf+IkbiVPB1b0xkC:rv52qL6QHvefGbLB1be
- TLSH
  T132143A16B79840E1ECB7D2788D6AC417D6F370D123919BCB0AE44776172BBD92A3F221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  Calendar/vcruntime140.dll
- Size 111KB
- SHA256 7185c9011546cd9b498baacdf797a970c1a13797df8c4213301620e97ec08af5
- MD5 144452b31575449072b014cb017bfa05
- SHA1 ee3fe542892f984967f227f9cbd377a666b53ced
- SHA512 0e507d26fd07218befebcc59120e04465f8f71fd5afdf00ff13d35fea3efaae5b0ebc1dd623b4c21223c4545a8cbeee8c2c2236983dc25fd5a4506feb5fdff13
- SSDEEP 1536:Qtk5+v3nc/vD0f6aB8IwklwfkHWBXCyGH6wIuecbfmDElozm:QtkenID0f6aifkHWBXjG/Iuecbfmgloq
- TLSH
  T104B36B42B2F402FBD16AD278C5A26E27F7B6B80547609BDF07A986640F17BE06C3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  Calendar/vcruntime140_1.dll
- Size 38KB
- SHA256 82436fdf3b81d7db7152f2486b8678391cb2c7ea1cfe98b24ea94e4669f9c8ca
- MD5 5f82879f6497f95e59708b791e9953c7
- SHA1 65248b64fcf461fc07d4deb17922559fc63ff44e
- SHA512 720923f34ce8b146fd197626c69208731d942f782abfcbeba68caac01608d38ac946d14426137eae843d6e77521a9a51a7b41cf3641000ff5082ba86a41991c9
- SSDEEP 384:pe5jr/AQa49/UtBWyABUdBlfzcxZ4Q8facuUaz+3EYfAKhdOw6U8fk6WrcKWRlN9:Q3oZYctpzcx0pdESASv83dOf9zpEtyA
- TLSH
  T157036BA1A7B81092E0AFE574C0E36E27BE78F6661710578F47A5C10C1E237D0AB3E316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Network Share Discovery

Checks computer location settings

Network Share Discovery

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32