96f628584fa05b1b7771a6f83310141107d2665b8e4a6f4c571d3fd66ee2787e

Resubmissions

06/08/2026, 20:19

260806-y4apxattat6

06/08/2026, 19:57

260806-ypn9razcmc7

06/08/2026, 19:42

260806-yeq1lazapf5

Sharing

Copy URL Twitter E-mail

General

Target
System32 exe.zip
Size 251.1MB
Sample260806-ypn9razcmc
SHA256 96f628584fa05b1b7771a6f83310141107d2665b8e4a6f4c571d3fd66ee2787e
MD5 bd201e040a8bb67655a9084e83cb332a
SHA1 3765510bbb0d37d852e10c5fc9d847205f8661ae
SHA512 b51070b068bc234aa47cc646216e19ebc32c6b3d33adb3f2f90e6766b6363b7623aafe4d5a8455d04c06a8f4a7b6a73fcfc3e808a57827cd95ba1668dc68dfc2
SSDEEP 6291456:vGOd5c7NwA5wasBJbkB3kk55RY/gV2m4E6Ojk+t31qJXz5i:OOdS7WA5wTBJbkBtn2csOMXli
TLSH
T1D5C833ADC2E7C58EEE1B57374A81B8D4E4D35AF8B96625335B604B9110D03B84B6ECC3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  CredentialEnrollmentManager.exe
- Size 505KB
- SHA256 417d8d06ed8f72d2bb6ce5e26ecfeacb305374b3acfa127f0ebc534c04c8a824
- MD5 2528d4f89e99a45efc09e507b28b2d66
- SHA1 a98763d54f265ff3bc282a749dd226f05727f68c
- SHA512 ac7eb45642ab53a4b41c4f982a2f759a4bfbbb72ac6b48d572d9333c00df556b3991900345e95573e8f9286801e25d87a4f76ea9ea9d06eea3fb12b3332e02aa
- SSDEEP 6144:/1XZ1g4lOvoPobr6mM5iMeHBwQpu4mDoZg+cOTeloXCUpn9KMQ:lZy4IQQbr6mM46Q0DoZg+XTeloX37KMQ
- TLSH
  T162B44C6E26AC24E5E17AE13CC583860BF772746143229ACF0154C27E4F67EE49D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  CredentialUIBroker.exe
- Size 203KB
- SHA256 a0bb1c561428f620f94f817a9513a659cbb2137d6be774f527579919546e67c6
- MD5 7d37447a7bb0e2905876202f3a815d8c
- SHA1 49164c17eb3143340b3b3caea5988f17cfbf1319
- SHA512 9c36286f2a6606a1691870e1075088677f2fd109aee3a499bcfa3eafcaeaaf585845f9a4b3744da65d9a359c3b2ec3fc8208d9687fdc3ae09f46e3e2d94698b3
- SSDEEP 6144:QwmHD4PHY6F1nSgGmM4jIX0+QZ45SKVFo:QPEPHXF1SgGT4k0+QOQmo
- TLSH
  T199144C6E369510E9E17BD17CC6534A0BF6B2706017251ADF06A442BA0F6BFE4BC3D790
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  CustomInstallExec.exe
- Size 160KB
- SHA256 f350d97e3e9201ddfe60c8b834dfe1015087fe4317afca50410d431f5f218981
- MD5 00e538d10f923ffabcd693658e538242
- SHA1 3f287d90b15d29b8a923fb1aa4a28d11e7edb227
- SHA512 5fc86f1889eeb15c2ba58354f84918ba2b1f9438810bfb7076b190889cdfe7fadee44486b7599adec46330b6ecbb0528cd056775ba532aa9892e392d06a75955
- SSDEEP 3072:ddhCAwaYJeFE4r/BNkds+Of6J74v0ODR/:gAwaYIq4rOJ7H
- TLSH
  T106F36B256BA544F9D439407CCAA3811AE372787343224BEF69D641EE0FA7AC05D3DBD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  DFDWiz.exe
- Size 76KB
- SHA256 211c577f2902087ad252982e90ac0f00c6712bd536fc99328e3572ae76263805
- MD5 5b264cec1d25fc6db61dd469eefacd52
- SHA1 e1e9da41b8f84a7ff3f1d4cf71bdb7c8fbc8d328
- SHA512 506e6662a02ec7478db92b897167fdba32979150e59fddfe558f6d5f405c1267e58eb296d1f16124e9ed6f560444501611970697b48cb10c750fc6ce82c19a73
- SSDEEP 768:0dPCcSBOoIBiRbxJLn8qy61HRO4uX18WYoLJuZUTopCj1MPWGNUbPGS:0dqJLh1xfkVspNS
- TLSH
  T12F73E86D92F830A9D4B68334857223659A31B4393F129AEF01F0C5396F16AF09F39F56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  DWWIN.EXE
- Size 256KB
- SHA256 95204ad59a90920b65256de26189fd3146676772d24305c400bd292788e6078f
- MD5 c209e1401442124ea2fd904c117f9724
- SHA1 fef41ed2c79688e49d154509e944ad5a6ea260f0
- SHA512 1e70f1af68436de39bc5503df6bb1fcf4021daf971c1fb44f64ad8978b14fc684b8a7ad6009f7589e10e807b2347df9747fae983ff79d6580255a52496f6c25b
- SSDEEP 6144:YEZQazAQcY5Hg+yMKZsePUqe8yQzmzYzo:YETAQDg+yMSsecqezc
- TLSH
  T1C4443B2CA3E418F5E877C23CC591531ADA72742D2722CADF01E085792F13AF5AA39F56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  DataExchangeHost.exe
- Size 277KB
- SHA256 782ae0f090a7bb120b5f9a6c806939d5952d40191ade510c42d8bec88977310c
- MD5 3ddd9b79cf83fb4bc90f63e47bfc4dc7
- SHA1 c9ed11b17afa455ef84771db6ed4f18c1a6de90a
- SHA512 20f35e6fda51c12d7e87f508dc16d7f4583e993931b0856998f409697409894d7dfb239030863d5bdd2a24225bc6534d17307564fb29201130d9bcfc0193aacf
- SSDEEP 6144:Jh5d77HmifcmvzoXlP+CIQ6c5UI13zVT8e9:jT77GifcmvzoXpf5DBt
- TLSH
  T1DB544D6E36E80CE5E976D27CC582860AE2B1B8615322D7CF02D1427B4F17EE86D3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  DataStoreCacheDumpTool.exe
- Size 196KB
- SHA256 c84afe97d12b9044ded215f7ca83762467c4480457c2f404253ca14b9647e1af
- MD5 67d2d6b3e0020e9fd0fbf75c9a466d68
- SHA1 e7b0b0858a0759f94214a017e61c7d5e61ea12d2
- SHA512 e926a6e276e02e8e61121d8b48b482248f736cb7bffd7f0fe524a9e31d92485aa3ee64e8c0286d9a5034a2b0efb546f2ab8f67eebcfbc06c583946c0e00761b1
- SSDEEP 3072:Yztp+7BXAjpA7M3vaNjUfY0eE2o9FG5c+2ug5P5mKLpFkuxmMpFfjcQ0N4U:YztoAjpA7CCNjTEy5d2x5QGm8IQa4
- TLSH
  T104142B2F77E900E4F176A17C99620606E6B37466033192DF0398827E1F77EE86D39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Defrag.exe
- Size 264KB
- SHA256 45d4e7ea61dc51528916155088dc2f3fc892d2f31469adb4f137eb2b8f29557e
- MD5 fedc5d11398ebaefaf6fdd37a7c16ff9
- SHA1 6187ebdf4bfbce0094eefbe31a4b2a0c76e8db3b
- SHA512 a041082f31d93d56272e024a30ef641c735036660e369f59e4d00e57756e2af46d634bb3372cffb658684770f0f4e67f9dd59b85de7ef6631f0957220a8cab06
- SSDEEP 6144:DNJ3fdAlMbBGz0UF19wsH813lRGOUZGKc4YFnwjCpW:D73fdAdE3lRkRc4YFwjsW
- TLSH
  T17444AE1932A512E4D271967CC1A26A18D773B820173613EF0BDC85BF1F67AF1AC39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  DeviceCensus.exe
- Size 145KB
- SHA256 b1017773b54ab1d0a7ffb3d08a201876fca5a9d2e60be34b9c6e56da5a0e4554
- MD5 95b31194fee26a658eb97f67c6d18f8d
- SHA1 a528e2ea7fa332fb343d9715a5e1716f18da8e31
- SHA512 ba4aea577d47f8292d5ee75d0f9949f27b501f1c2a5f0ecf0a200b8abf187ac2a98faffd3e09603600e5ac6565f25297e2ada71510044679ba68fca3840db332
- SSDEEP 3072:UHqlPu2+H42POk/ICnO+UDh7Ou+mQ6j1K/9Y:eQPunH42P8uP6jp
- TLSH
  T141E36A1AB7A535FAE5628239D8B05422DB72B835071193EF01E4C13D5E2BBE46E3CF85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

persistence
- Checks for any installed AV software in registry
behavioral9
- Target
  DeviceCredentialDeployment.exe
- Size 120KB
- SHA256 da677907df4388fde51aac859caacc31e70d0658df420c82e0d4e84f5b04fc23
- MD5 9d168bad624a24c59eb062179adf05f2
- SHA1 83aaebf4b9d6e20552cf7f63d5c706fba630bdfd
- SHA512 038d6d10dadce424f9db6d618a9d4f8d6a22f49cc3d42464c6792afd5e77051bf4f5d9bc800f4fbdf2e75e82ae8d949ef27a24e119e790d3730478e984a3337a
- SSDEEP 3072:BZBAOqkVftU8wmlj2Si4rHBYSiXTqX0LdnUK3U:NAOqkVftZwmlj2Si4rHBYSiX0UUK3
- TLSH
  T1F8C3F82E61F410E4F679B53C88531A28E771746213229BEF03A1907E1F6BBE46D3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  DeviceEject.exe
- Size 48KB
- SHA256 5bc9a9c1153a37f239b8443fd264753a28093bd92455dbfb6deef4bdb17c393f
- MD5 9eb2fbc2d7f299c7e0acad945ad9620a
- SHA1 be3aa9784b22229db3e2fa55784f749955a446f5
- SHA512 58efd5c03975bb89bddcb1021152e4e73bafc0226fdeb367fd28edd3bce53c3ee6d4bf2baec16fae7afa7d1a5d99692216e38d4fd713a2f725f4317e52996be1
- SSDEEP 384:KdRx/uBpN9XmQ1nxMTIWywW5JY0ehA/9gnl0:KdeLNr1xMsbJYQ/9gnl0
- TLSH
  T144234A41A3A685D5F13202794473466016BCFD314BA20BEF35A4B52F1F32EC16A3BBD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  DeviceEnroller.exe
- Size 552KB
- SHA256 85cf2701302d7bd737a441a115b9a11283cf8e8a71572e9cbd078d979160383d
- MD5 95859edbb37429cbbd6c2d8d98383f9f
- SHA1 a3c6d2639c41c3a8a4e004cf7b7f9211809b280a
- SHA512 9239b261b5eb07b423518bdb3a7b125f9be863c8948b9bb01c32774c1b6923d5864275e8b1ae741e21abfed7527ff6a3c781948b4b81c9deb4b49d86b7b853ee
- SSDEEP 12288:cAyvOqGoEtUAH9tsiwVYyS48sfIjrxB03:cgd+VYif0xe3
- TLSH
  T196C4191E53F902D4F276E27889674505F972386213329AEF1290817D4F7BEE4AD36F22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  DevicePairingWizard.exe
- Size 120KB
- SHA256 50e9b116163f7dd084b1050a3a0b6c4c9ca965112595b128f3c8adcf1153940f
- MD5 d6a780e9788cf19fd77916d4306ca717
- SHA1 cc9c3c2eb5d7f727ae4e54a8ee22ee02c60835a4
- SHA512 0f016aa26298af209cbee511b29438f639adf5a445d20bf265b8c929ec2d550886ce4492ac99df85623fd981c68d4e629e5a774f8a70ceee0ee5a2eb4e347432
- SSDEEP 1536:BHdpOtzGLPhXk9TcubcUE4XqABCVSPZAN0yuUqZ3qOTT:Vdcy+TcMcUpqABCoPiNFu4oT
- TLSH
  T12BC3E7D9B65804DBDDF4C3BCD17D8B14AB70B85103157ADB6E9043AA4AA6BCC7838F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  DeviceProperties.exe
- Size 92KB
- SHA256 59c4bd37da9c5f1a52814e92adb22c5aeb3dc842a6fba683fb3abfab3485fc4a
- MD5 fd14bd910cd70fa00e0e16748bc14257
- SHA1 d798a1a9123bd9ba47cd76d652d67e2bbb30a513
- SHA512 40fad6f520a578ceb1468daf32961278fccce888cf726c18a6d93c2ae84be0d0fb12724a4496e0e162371b67fce11c23037c1f5d4b62d276c96a1b3cc0adcdae
- SSDEEP 768:59fswWkt3jWzV/0vM3EDs73D8hayJpVsQnhGc0bnH1CJv7VLjQAAAAAAe:51sM3jRM3EDs73YayJdnGbnH1Ch7
- TLSH
  T14A938D91B24485A6D8E8C7FDD4BE87058B246931435439E33D38E35A39BBBCC7936887
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  DiskSnapshot.exe
- Size 96KB
- SHA256 e3efc11f128f6e10eae8e15c9aa100201aa89631377b8c9e4db1314dd46659f0
- MD5 ab82d082274cb2c9f85fb96439229a15
- SHA1 46363807f9f1b1fb808391cbb2394e1b45b301c3
- SHA512 9eb11056274fe24a4bdc47d9f88cb7499b7ba7210840675e93d6d74c538b8eb75eb2310f22cf556d81708738f4449a5da95d0848fc499808c7051411217014f8
- SSDEEP 768:rGcI5oYFUm9UGUq18SSPgzzbfTcBa6zPNAVJskC93x/rNPO5ZDW1LKrHaHpHB77O:rm5orJIDwBa6zPWPchIL+0sHrwZ+iYe
- TLSH
  T1D4A33B3A76E811F5D1B691B88DE45A06FB72F4251B3047DF00D185A91F2AFE1DC3AB82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Dism.exe
- Size 325KB
- SHA256 118bbc6fbe845761fcb5230de9dcbfb7949130c5eb14134842ac53bd53ecb8f9
- MD5 81247255eafdd9022bdab39145b1857b
- SHA1 9033ff1d3eaedb1e9ec197efc6dd590f0ae8ac8b
- SHA512 7174016aca7fceb1057024b05e114950c835c61468f162a84a9f5b955de3792aecfa97b8d8aded877db908ba598c82cee8d410577b1959dcff24aca4f794be24
- SSDEEP 3072:DihlUqV8+5VFYIhK5UAAZPSIMNDOituB8hc0JQwUc+dD76WQqoo1Y1N9km/YhDwg:u7Uq8IVLoNDO6htec4+W/HhDQajMro
- TLSH
  T14164D71977FC0894F6B3B23589718645DAB2B8615B32C3CF5290823E1E77AE99D34F12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  DisplaySwitch.exe
- Size 1.8MB
- SHA256 775296b6dd6bfbb3684d272a70606f40c2311a5c144f1328b37117e3b3ff074c
- MD5 69c62cf38dd646c8bcd9a2b4f1633c38
- SHA1 92e1893dfce02b1173d516eec3b3df92f3467342
- SHA512 75222d8d820ba64ec75e54fc91abd35d08bf5d6ed452c2a58743269aac9f46cae87ed6e1b199ff5640c11270ecc0d54bae0b4158949cbd0b1e2524fdc2c38223
- SSDEEP 3072:FhP4YFPSTgNz4gvl1Oy/iIZvk0G15Kr7SEtbIQ:F+YFPS8NzFt1Oy/iue55mV
- TLSH
  T16995A5557653EC94E242583C0A6FD2E54D9B3CA06B7802E336BBB77E8C7CF857524282
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

persistence privilege_escalation
behavioral17
- Target
  DmNotificationBroker.exe
- Size 52KB
- SHA256 712d1e37910db9fb3f97edd21aedd77ca7bd3abccffa1520ac5b26911c29401c
- MD5 e505efdaf170879c1592a6e774fae652
- SHA1 b7ff5272dff08fdd2bca7b7dd007220806b0967a
- SHA512 373e7e05c88c3dd8b197cc045d15e72adf3c5591adca9abc568d6064ebf458d03f072689df19eb033222e99bd1b5a7508c9d9ce78bce0ee7214d3f26bf5c78f9
- SSDEEP 768:v0QUWSbYb4DqLsqI/JT4WU7IE8l0/y3utjVm+nMud:cSvb45qI/JT4WU7ID+/yetjVz
- TLSH
  T195333959636904D9F7A6427D91370A45D0B6F030876317EF61B0C2BA0F37BE1AE79AC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  DmOmaCpMo.exe
- Size 60KB
- SHA256 e6c0114c5041056072c7c1c1bd6553267dd83175c9ebdef636c1202f011713f1
- MD5 fa6e11624c94d1b83d807d712419c486
- SHA1 1d7f3efad890b38e465fb22a3326277aee3bda47
- SHA512 64e08c5d2261a8b0d0e0f34683db944526b6d4aff3c17fbb5174a38f31b7ead4ae67439fd7fdc8fd1f634efbae89f287d71340ed6ba68649916aa1492ba5e363
- SSDEEP 768:AhmXJgs/kDnw88yIthj1vRpoL7mN6hUZolgOfY3Zsf80DzUpq17KEFF/F:Y6Jgvf8lhZn2Yno4J0z17KIF
- TLSH
  T1F2534C0EB7A520E9E57A823D8552491AE1B1B03167521BFF0364C1BE1F23BF4A93DF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  DpiScaling.exe
- Size 100KB
- SHA256 58012ed021e4e99afd7c5efb2fdbf433fafe2c8c51ef0676e1ab72b59e709eaa
- MD5 d0fdcdb82be3f5f5bc5bca35a9002aab
- SHA1 d58efe6adf2a1e956c0ae248655d6e0b11107b7d
- SHA512 4e4c22b7493c3ceb987bcc868db1236903a1c7e3a1146d9553f1c7bf33679cf8109ae2ecb6a90c7634c8dd3c64e4137b06d30d669f44e645b3cb040c8f0aad24
- SSDEEP 1536:/p0ZXM91OwxgwYfPSqlGv+BNXNvuZS36EDtAZ7jz6dTdMQiMtYwJjM:R+iOwNMSqoKXNvuZAFDqXzlzQw
- TLSH
  T14CA3C002728410D9D4384232D8B78AB539B5AC300B6206EF7668E65F5F317D6BA736FD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral20
- Target
  DsmUserTask.exe
- Size 56KB
- SHA256 4ca522be6a9e4a4bc93ff4a6f78045a52dd0fb3fa7f72f9271be6fccd31d6c2d
- MD5 43187f609baebaad3cda845206526536
- SHA1 69adb2f518bc141e2a240c8310d6d6b2d380a758
- SHA512 a50bd76ea236139701fc34451842778dfd9f370bd5759522df1e34fc7471ffe4fe45eb827c191b64833c6241435915500c40146fa8813080c3508010e6cac37e
- SSDEEP 768:ZVSP1dPqPS+SipvEcxvndBxh8N0CRD9LpnbZjK1p:X+b+SipvXBn9hXy/ZjKv
- TLSH
  T144435B09A3E810E5E479427D8E73550EE172B524A32162EF63A4C17E1FB3FF0A439B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Dxpserver.exe
- Size 304KB
- SHA256 fcd4b305fa11b1fe5e5090624f64b0717491421529fa7e1ea259e4ff10544a4c
- MD5 4832d57fd21ad4001c3425649727ef59
- SHA1 f2b341e91dbe1c19d3375eff5d36d3ee0f552d0d
- SHA512 8d73c11488a54a48a4112a594bb522818458e4026c5a64eb8b6b399bef9d073a3aec95b576260fa2b23163d2a0a07490f4c1b991ea77bd2ccd9c2baa0ac3bd0f
- SSDEEP 6144:6AH4V+F5CiiB+K4/+szuSr4WeH+zRaqq:VH4V+F5CiiB+K4tjrvt
- TLSH
  T14064291D27E81CE4E9BBA23CC5628249D77278756711D6CF02A0817E9F33AD4AD39F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral22
- Target
  EASPolicyManagerBrokerHost.exe
- Size 92KB
- SHA256 fddcc6a930aa564f854b83b01c65fbe97d70821a1db1ccae79a02f632f2cb2b4
- MD5 ac8a36c412f13dedb18b0e7d351f93fa
- SHA1 439dd4b67e23567d7d6aed0ea268cbc9ca9b3a0e
- SHA512 c0044d7a62646c97e4e1aeab28e85ec28182a237a1b0384b529cc7f891400dd229b284e3c61df41390e15ccd41f8e5e1d7f2b1f672a6313a5ec4d7a89e10da78
- SSDEEP 1536:5utIvsQlvvhn4/uMZQJGHrwwiThER6aTG99K2Ev5:5YKamUcwuaWKlB
- TLSH
  T165934B5D67A420F6E57E813C44A24219E7B0B82053126BFF4690C1BE6F63BE4BD3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  EDPCleanup.exe
- Size 164KB
- SHA256 fd9613b6aa3014d80f45ee0e86c50bb925dce46a0e2946379a8d6eee23a9b0e6
- MD5 de205a3e91a3792a00c92c03dbcbc2d9
- SHA1 d15bac8fb6821ea5f9caea8f7f716e87a9a4f8e3
- SHA512 f9e0f4ea88784317d8bc4c0988cb318e604d94f234dce868836fde56b0e3d9baac552e67c35727859788c682d52b0eb06a7ffafdd0aaa34c379da0377c998bd0
- SSDEEP 1536:K/dW6rqcoKI3gdhrxgSwcX+DSI4NRDA1KH+1vfbUN5LE3fyOABGYrVraAcB6NLro:K/kY37rZrbA1lyJBGsmAd6fucCNk
- TLSH
  T1F5F3196E73EA10F5E17AD17CC9D2050AF6B27461532293DF029181BE0E27FE8AD35B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Eap3Host.exe
- Size 40KB
- SHA256 cfc615831505a161fc78c2e52e049ba420e2b4b53bed79388508bcf24a192791
- MD5 cbdafb444c5377e941144509db05f9a4
- SHA1 2849c19c9e8fdba25f9c52687abe8ce3da8d571e
- SHA512 a81b4bf1a4d427e04b94b3036134065051a6cc92d0236e88e8d2f67d8bbd2eba6bbaff076a2ff03779cc0d2592c323da5590026349979fece3f3a2efef8812c8
- SSDEEP 384:XN2svBS016FJ9byhMObF/SFe5nmO8fJJQa6WwaW:XN2YwqhMO/SDO8fJJQa8
- TLSH
  T185030889A79459CAF536A53D48A3521ED0B2F6015B2296CF27D2035F0E37FE0AC34BD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  EaseOfAccessDialog.exe
- Size 312KB
- SHA256 bf5168bd49aac49d9be860fd5d8707ca3b301c47573597b29f355a5e380ada11
- MD5 24f5b8bdbfedf8ab50ed8195931e0f0e
- SHA1 8578b582ea162bbe4183db46347a8ddaa4baa5e2
- SHA512 f3c2c6e7d748493162aa71252f975edd5d5a74291c4f564d0c071e025dbf52933b7e55f2b805ac6f5012d22cbc23e5d5f58419d17651845b6bf191bfcf27add4
- SSDEEP 3072:7BWVBt0mQ4u6LYP18oE3OnCDF9o32X7/9Gc/0ODR5F+nce5v7EUZI++nee5v7EUB:7Bg0mQ76Q03ACA32X7Ff0oI8GjyZ8mH
- TLSH
  T1F764F609A3EE01E9F1F6A23CA9B30506D9737C164735D1DF02AC066E2F63ED49935B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  csrss.exe
- Size 37KB
- SHA256 a958083fd4982697973d1f4a05a8f51b1f5d551a558cfa0097cfb6867fdce3ba
- MD5 e77e433573b7f629cfa089ffc8626292
- SHA1 17397f105f7d51112261ecc501fe99b8fcf4de67
- SHA512 efa4780e125e0802edb618ffed1f1f55a116cfc83e3544a1f80abde58acc18549128223a7cd331bd13831162b348cb0ab1e2d0b24b4f8fe9f1737a4a2481ace0
- SSDEEP 192:gBo8n4PUVV09BgmPW5cnWhynTyttBpEhDBQABJYowcLK+X01k9z3A+bmy:sn4PR9BFPW5cnWhiOtWhDBRJY6R9zZbv
- TLSH
  T131037DC1E76C00C6F9A656700269C34B7D3D7392072042EB7698F5250FAB7C8AF3566E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27
- Target
  poqexec.exe
- Size 640KB
- SHA256 18ccc68f64bcd3e3d5ac86e959f49126aa2fb16378c2cb6aa922c725c897318e
- MD5 81508a8c9760968d6ec2d9011fb630d4
- SHA1 38831871d2f89c060002f36370cec6e8dfa2f9ec
- SHA512 b9fd416e127ecacbd20bf1db0473f7217931c27b01b71e8faf3ce40084d98fefcf87cbec3a517b1d040abe0c8c2100e2ac0a13703c14ec45eb50e0f88d3c608f
- SSDEEP 6144:uCIW+CTYnaUuFPbucyOMaioL+S2FBpt3HGQzlVKJlHsoTFBZRq5aD1mUVWLEK5A1:1+L6bxX2FBrHVnKfHsoLRRdK5l
- TLSH
  T16FD45A3AA7A422E4D17EC17992774D02FE713425232176DF06E081B86F77AE8AE3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral28
- Target
  securekernel.exe
- Size 1.3MB
- SHA256 b647c5f2e3daa6728bbb9dfe87f7b76f6810974649ea04e8004ea967c6914c7f
- MD5 81dff0744f2282eed728fe2b3ce44caa
- SHA1 45e9a22a5dc29fe59208f24a9da16482ce81e148
- SHA512 43837ef4b3d254f0a35eaafd1616bb8fc0b55ae55dabddc9fcc48181766864b37f712fb71652821b75934ed8134588fedc255c9b7541c26d6c0477b7c7d272d1
- SSDEEP 24576:iIiEyLlcpCRoaz02AxLttttVSkTx8zSVQ:iIzUPRoG6LttttUkd82K
- TLSH
  T128556C52B3E755B4C467C2788AB68326E770B445232096CB22E497793F63AF12B3F351
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral29
- Target
  setupcl.exe
- Size 28KB
- SHA256 e1803da483c99cf84b5d2ec90cbe3ba4b319a997f3e68c04fdf2374bfb9ed8a3
- MD5 d172bc852f785acdd74f26f5254611e8
- SHA1 1bfda852e63cb62641951e86bf72e73f8b8c1472
- SHA512 3ed6c872e94ea611fc63426409ba37dbaacc721ea859ac17e4fe703cd79ff211b043f95491927114b86e58e09730ac3796927208c43c315b47d7f06c242884ff
- SSDEEP 96:kVeWpl1W1O6d26pgXchzTdhiv33ylE06/XrM8DJvmMDAAaEWjVWw:kEWL/e2EgXchz2ylE0QXo4msWjVW
- TLSH
  T176D2D849B2A52184F432C3B809335B5D717879325B2153FF65A0D23E4F2AED1BA32BA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral30
- Target
  smss.exe
- Size 223KB
- SHA256 684d896393abf390a5a01751fe4354eac77bfd4febe607cd02f47178b445dd12
- MD5 d997898238c9ffde81d6d3aeef879ee1
- SHA1 bd934d7c1805052331a1bccaed3c3576791ed932
- SHA512 f1c004c6f910960c3edcee515acb808108ca4223ae131cf6153571fe611ed7a6d5730d90150e1b032a089a525c6322919fe067ee6dd1717aa52832f9950970a7
- SSDEEP 3072:Dt3mfdZY6a8tA0Ly8ihbgN++zrQapZ6nG4+Mlip:Dt2DA8tA0Y1x+zrQaac
- TLSH
  T1BE24F60C32F61084E7B6D67889B18655F9737871172196EF16E0C17A4E32AE8FE35B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31
- Target
  srdelayed.exe
- Size 36KB
- SHA256 ac7acd21c7500e2bf5af86d4850e6384bf1ad46de565dd748d5f1b052c79a4c5
- MD5 4ef009625622a759e78b81f6424a43ef
- SHA1 dbca8f19678888c7f2a11917ec928ee1a0f0dcab
- SHA512 33ac8324da00107d736d59172c78a7b1e056b20649e1364017ad1745d092e87e5487aa25ea99299ded52732bb3d51aec9b94378bed9a8ccace2f9a1e9213bb8f
- SSDEEP 384:V712tnzu0OnV2klzdcjAj+MEZk22cV8YiOytxIW1doW:VJ2Ru0eVVuhMEZk22V9txB
- TLSH
  T16FF22B8A57E576E8FA36C67484638106A671793527318BFF69D480B90F33BD09B39F04
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Checks for any installed AV software in registry

Checks computer location settings

Checks installed software on the system

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32