c603da7b4938df42e73b43b9a870c968f2c53fafb2914fb70dfd9cd24959f6db

Sharing

Copy URL Twitter E-mail

General

Target
c603da7b4938df42e73b43b9a870c968f2c53fafb2914fb70dfd9cd24959f6db.bin
Size 12.4MB
Sample260812-a35xnahf88
SHA256 c603da7b4938df42e73b43b9a870c968f2c53fafb2914fb70dfd9cd24959f6db
MD5 0cf7185d6950135d22418434c39fec8e
SHA1 89c015ed59b463f9d8d31387c3933769e492feb9
SHA512 2e030236c000388c8759f0d122e4f8e1c89d553de1a5cc2ea1cd57891cee34f1a866f5134063ecd394c0df1956584518eb1e1c972cb858a9ac80299ec67ba65b
SSDEEP 393216:pPJUmzfrVSwKm8rFoUwLXG/SIHgpyMdfga:pFrwbSLW/UZoa
TLSH
T1FDD633B74861455FDC2FE573DE8FCF24968BE12C8D2068120970BE673A1D9716ACB24E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  POSyncServices.dll
- Size 92KB
- SHA256 04629c3a93ff40e00cf2445d102f64c0cf628dd369a566de9c71635485cde6f2
- MD5 a44982147677932285fd2c2700947f5d
- SHA1 39296d09b2c0f65365a97a7c829c980077f3fc1a
- SHA512 ff64c904ed1dfc5c4ce972f11dee17ddb349ce9531af8c660071f2e6f2588ecb23c37909bf7dd2bc4a61aaba11281ce37f3da176b920063a4dcd92bcdd251dda
- SSDEEP 1536:3E8a2nv9zf2l3GtFoaUH2LvtAo6Hmvq4GlV5bE8Y:08agv9zexGiqDgLY
- TLSH
  T11C93C40626E545E9E665227D80834D2CF678F209275367DF0326022E5F7BFE09EF9392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  PSHED.DLL
- Size 121KB
- SHA256 9d28a344a681a46f87dd8b2cf8880e3cdf59f01484111ef885bbf6add2445c46
- MD5 db89f9b2c76d2498fac992041facaad9
- SHA1 57bd2610f3db282e862bce8a842d497f1dac22f7
- SHA512 9f535cc5d60fe10d9c089404ecde9454860a6804a5002c89992fbb41712ac2ee77e5780c012eef97ef2df4c17736e5a07b42b9caa26bb8f729abed3b836a3a5d
- SSDEEP 1536:SX27MNYeW3vh4mRI7JcWG6qssXKukPQ+psIVLIyMP2Wozx:+27Qj8NRyTjqssXKukPQ+psIVLIyMbod
- TLSH
  T187C3170257EC5409F4B75630863AC166A935BC656B31C6EF2290E27C6DB3FE08E36727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  PSModuleDiscoveryProvider.dll
- Size 72KB
- SHA256 08bafbb4dc8cdc8f6f1875841ab5b6bf5868078e4ddf1db6e120d6cc9358dea0
- MD5 347f08408507f4b9f038a186059ece48
- SHA1 db4dc46e8681753e2a41e7bd66bd642208609e24
- SHA512 2c972243886267d3f894e364c7ceccf54a58410178ec30a25f0eac4c06c98de068153728696d7fd04ea0674fec6eb40f701d9879689b0be619e9ec9242398e4c
- SSDEEP 768:Buoxr2fjplJfkU7+0c9Ba8KdIr2Ezl06c6hGotnzZlZ3dAUn:BcbLJfhx4BK3K++7tnzZlZtj
- TLSH
  T1FE73190AAAD81461F4B5853C89B30D2AE672F474571397EF12F0807D2E537D2A674F92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  PortableDeviceClassExtension.dll
- Size 148KB
- SHA256 4ac7aaaf0458c50a15b2d01a2baccd19f3d2656c9b5b8cd233bea2833ce5cbb7
- MD5 c69f1d9d6ca687a22196b2d05f916856
- SHA1 7d5bc7c5e43c5b1009305a437856c10e3cb329f3
- SHA512 46fc800ebeb9d1cf80829b3f68b18986abf5690df93e914dc5b802c0a1c289701adcdae080bd6022bc24ab2099eeb98bb744bd41700dbd87e2cfd6f887f8a1e4
- SSDEEP 3072:WTjNSWxvrAUOBaqhto0f8ofwJvD09vA1ZYyEay:WTjcWxzAUKaqkIfIL0dCJE
- TLSH
  T103E3F64AF7D8D4E6D02D91398C9B839AEB31B0016F1257EB3394436E5E737D42D36A82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral4
- Target
  PortableDeviceConnectApi.dll
- Size 88KB
- SHA256 af6bd4f06ee34c63dc7ce26dabad53132edcb62f6ae99983b557e474dac39279
- MD5 731649a65c86fb0b674a8fc6fc107a83
- SHA1 3f1caa9bee5a30d4de27649a43e8dbd44b864b32
- SHA512 79abd23dcdc6c977ddf4d63c1473ca0e57fe57ce171585bdc45e97c434d88dc24b6b376a56120d09f2ff16f3afe884e44d07a963032dcc5b56b64593da86f62e
- SSDEEP 1536:OB33eY1FERydoyspGsKdwCCtvNzaErG46gDB:k3Ouo6zspGnd6vNza4vzD
- TLSH
  T1D693291AB7E820A9D665927CC4934719E2B1FC152B1247DF03A063BE2F37FD16A34B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  PortableDeviceStatus.dll
- Size 96KB
- SHA256 fa0643c309f1e84f2e199817c4df2264f44951a887f7a9ece77c65f1dd7a4a60
- MD5 5b0a04d4d58cd499c00edbf67a990ac9
- SHA1 5337f7b432096334c47b78699c51ebce6b05acc0
- SHA512 0b0a8a5ec40860eb216206fd3eef23dbf4ee0dc0204008be0b355cc236fda4359ae1ab6b31be562c07917938fdca63135e281faf9d02a92a8cf367d0a9efb367
- SSDEEP 1536:kCQr0t+blVTpgztPCOoRMISBkx9WSHocMQAXcyDXIIAnNwR:VQc+blNpmJyOoWSVWXnDdAnNwR
- TLSH
  T15AA3195A26EC24F9D7A9A27DC4235659E73070252B2213EF07A181398F73FE09E39F45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  PortableDeviceSyncProvider.dll
- Size 216KB
- SHA256 afa577bff0d185c35975d1aeb8b3afdb3d904a561e5d5e4830f12f528299fb16
- MD5 ea94b87fb3d7106933b27bb77a93373d
- SHA1 145b53ce52eb9ed97c134177da6fffa25716877c
- SHA512 a11eaa9afc2a75b3085812109aab247fdf498369d3a40f99a5088cf8861b6a9bb057523aecdb5eb11d3289575641d1d5430c2def4d696b632a6216c41e9bfffa
- SSDEEP 3072:73yDUImt9vG3me72MyF0dACe6+P8dLKM5m0mERk6MSE:bOUPt9+3me72BF+ACe6gGLK2Vk6MS
- TLSH
  T1F524392972D590B6E577827C84834B65F6B2B4142F1206CF02B1833D5FBBBE4AE39B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  PortableDeviceTypes.dll
- Size 204KB
- SHA256 b73b7d74635e765c21a0c00e0a91cc12bde50d67fe468989b5bfebb84ec44a52
- MD5 81c975b93756498ba9aa2ec5af9a43ff
- SHA1 6b83c1c493f57ad2e21c8f41f487f2a4d9dfaddb
- SHA512 7cd106dada424d398c8fe72ef33ab3afa64ecdf16afa6c41f90b8cab5706ede14bb23237bca9061c0fc5759c8293669fae15f21a6a180d12423098383f1eafad
- SSDEEP 3072:At10xSFipu+JE4dlEVM0d5ToQB4hNNqF4SVFNKFwMbX6m:q1l8pu+JE+ES0d5K3NqFvUnb
- TLSH
  T12114071BF78984A3C06EA138884B4B69E771B4115F1247D733A8837EAF737D86E36641
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral8
- Target
  PortableDeviceWiaCompat.dll
- Size 188KB
- SHA256 511e58775c5bdb5c41e162740283581c23ccb48d51372408bfa15bb2bad181a0
- MD5 4b7c7771f08f16a35affa8071844f5f1
- SHA1 27efb4e7d1e81bd4b2728d9c3a154be9ba6a7136
- SHA512 5919b789885aeecfa12743e8860d9796a85a08ff19b0c5aeeb785aedc7bceb951252559ddf06f0da4a57f0bd0a08d99abbc2d250259b4ff376c78f9fb9fc5cc6
- SSDEEP 3072:2FqXQBODFfGeXecQzi8uLhrRs3YOBKBV+25ls0wsWzyU6tU:hXQBEFfGeXXbLIYkYihyU
- TLSH
  T1D2140829B2A838B6C127C178A5BA2615EA357D14271187CF2AA1F1B91FF36C47D31F1C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  PowerGridForecastTask.dll
- Size 324KB
- SHA256 543ad5a65783aa46c20f7048e0ed1386eb91bd791cd5d171ead25c00e93b6130
- MD5 beb83719df8fc1b3ba298a5b205710eb
- SHA1 978de4fcd5bf5c0633d481bd734a092bfa03cbae
- SHA512 a7122fa79a79baf5caf88450238b8cfa6deab38dfa12206584e77eef072359c7f098ef8aa75c9a25573c953a24a02b2963e0754980a186697c8c3c1c35c907b4
- SSDEEP 6144:HOTyrF1gEMPKkEf41sMB02/tF3gyYwGVYogd0ANjGpe:HrF1gEMPKkEfDMB02/D3LZGyd0ANj4
- TLSH
  T1E0644A2DA29891E8E567E178448B0546F7F13056673256CB07B046BE3F3BBF0AE3D261
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  PresentationHostProxy.dll
- Size 100KB
- SHA256 b0dfe1a9de451989610f1b03b3c1120a64159171ceee1ae87431701cf2bb703e
- MD5 40316e9995a47a1ac5eb9b39a6256d56
- SHA1 3843aba3e8ce4214502af25dac6a4de8fdb47607
- SHA512 cb8e6cf45b249ee8601187f37d198370792fda47aa2296f9023358b663404604da7a516007f9ff00541a05ab4b687bdfe1a83b38dfdbeb7a2dc37e5b2016b99b
- SSDEEP 3072:hZj6sz+IdEiXxI0uclZorpM1yUZSdrI9+l92+AaNSOM+X1i:jj6sz5dEiXHwvAaN
- TLSH
  T122A3185E66AC14AAE535917D89534E28E7B1F020535363EF13A082BE4F77BD09F39B80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Print.PrintSupport.Source.dll
- Size 424KB
- SHA256 b9fdd265ef72d24674b801f8d290bd8181156395a10bdefdaf453b853d8334eb
- MD5 e38d8bd2803908b6fef3dbb0250dfe23
- SHA1 7ffbd5fc1de89b5d7eaecb9ddd0918d4ab660e1a
- SHA512 d20a03e130b3caae26203d633427fefb0b09eb0d2f72ce3f7631672cedabe83216bd64ed3da9b0546f5827acf40a6f73449d59498dfa7c3b89a8cad97be92d87
- SSDEEP 6144:dn02MMaYBb6kboPV2vl8QyV8+Wiv5X/F4HLujqx:dEMaCb7boPVJ205qHK
- TLSH
  T170945C5EEAAC05B5E1B6C13DC5D3460BD2B23499837287CF02E5469D0E27FE8A43DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Print.Workflow.Source.dll
- Size 124KB
- SHA256 22c54dee6a7d193ab1d7076f47da9d0f44575a0e653d13601d05fdf4f15ff7db
- MD5 7900ecb079ef6d4d503341209cf9ca2e
- SHA1 7caf66f7080dc32c800d3187cdc92aab86b7187c
- SHA512 1f2cc474ae73b6c13b42a12c783d531141af292ac84a1c9658c2f72ef69c1f5e780c6bd77b6a667e1433b471ba57b2e2fdc17e8f420bf52161f326d187c21dff
- SSDEEP 3072:hEcQgrTgzErM8qTGaNfATNchyjqxf/akphnl:OgHgQrM8qSaNHh/JpR
- TLSH
  T138C3282E72E810B4E676E17C94920A19D3B1B46223626BFF03D0C07E5F67BE46D39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  PrintDeviceConfigurationService.dll
- Size 180KB
- SHA256 4ae6f8b2c0d6d990d1ab7648773e07b99dee095be23590e8676247f4b3e29221
- MD5 effda0fa2d5b35337515905b57df71ce
- SHA1 3a1a95881913afa2ae8c112814a711b61de4b47b
- SHA512 76ba051b9ee1fcc6c4d425aabfacf746d2f5654e716b41158eab2f9c3ca5e13cf463e412eb075d57a61e64136721b3809d9ec2b07f7b68df3b8c3ab4a670c58a
- SSDEEP 3072:90Ub5YRg2v5NH2Q1Vzi3BhBjBwnghWWNd9HqE4ly5:jFYRg2vPH2Q1EBanghWWNdNqE4l
- TLSH
  T143040859A7FD00B9F0B7A279C8E20606E9727C615731A2DF0660427D0F37FE86539B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  PrintIsolationProxy.dll
- Size 128KB
- SHA256 f915ab4e9df9333a924dc781daa873cd996c7e904bdd7c0e5efa47570991ac5c
- MD5 c9e8326536eb6859244e91812795945c
- SHA1 3d253964024ffe4a33bff5e372686c9019165d66
- SHA512 52cf893d932f2457ff6a6db620a6c14f9ab8ce1377816cba394c834c9260e31f19e52b2c9ae136308f449c18b849ffd1845b66517573c90d2be25a7d5f2f7abf
- SSDEEP 1536:46OtzoXvkIgouw85hKj+T0UfC4yJ5YhFs0sbuK7uN28t435I4iAOT:bOtzoXvkIpYy4qnbuK7uLt4pI4BO
- TLSH
  T170D33B5B679410A7E27E827CC5930A0AD3B2B861537253EF026082BD5F37BD85D3DBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral15
- Target
  PrintNotification.dll
- Size 76KB
- SHA256 9e11a177a1883d7b76fc419fb17f302ad81eff65c5420a098af8d905efd9c4f3
- MD5 5aadf32eda68bedf13c3ab836be7fe1c
- SHA1 313bf5d9571052e3e0122281a4a047d6cfca7413
- SHA512 a429e9f96e629dc25612ff52bb7c98a588cc3f792b8442eff0cbba943da0aa3093e1212623c06e8d4e72cbef5918f8075a7df3a41fd45a1289fe7a8439f5abf8
- SSDEEP 1536:cvHa9hB/hXbI06wutAavnHbw7vHtDaPPEHK0CKX6+G:cvHKhRONtAavoa3EHK0CKX6p
- TLSH
  T1BC734B2E66A810E5E575C13CC5534B09F1B2B065132257EF479082BE2FA3FF4A93DBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  PrintPlatformConfig.dll
- Size 88KB
- SHA256 f7dbb920a3391aed08810ca6c715765a5e498ed13070fccf6d45cb40321319d1
- MD5 f0b8af2ca94eb4e04060536938d86059
- SHA1 7666ccea4b359f6d67abd3582390783934536575
- SHA512 8164cd63dbb74ca2a5bb1f8bcda8ec41448b26d1f489e38de19abfab9e0337679650138760b2f329d23be21849eb368252af0e2d2e7e64643b330d2e8567cce6
- SSDEEP 1536:5CMqBbJqpHhXJD9Y+IdMqndFgoJURjKNbZ86T:5CMBqBoONd86T
- TLSH
  T171935C6D66A410EAE439C17CC5A30E0AE771B45513229BFF469081FD1FA7BE06C3DBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  PrintRenderAPIHost.DLL
- Size 624KB
- SHA256 32d5b16578646f2e45fae9122700f9b28e345e174ae31d95ef8cbddfaabb590b
- MD5 4dc47c0f30405460643680c0cceb324e
- SHA1 b4dee74e3c26a47f42e11868364378a10518d43b
- SHA512 6fd00eca73d4bac5303b1d3116ca50ce355b5fe026b151490a5c41c5d85965030f18edd5a190d4cb75f2690b1a3b957cd5da7330b1fe374af098aade0a6df332
- SSDEEP 12288:Gej3Kg/EzBU9Fpn2eFwT1t0Qi+lZbE1qCGSOa:bOBBU7pOqQ/lZAqZ
- TLSH
  T13DD45B6D229843F5D2BAD17CC983851BE2B23815437656CF07D6039E0F27BE89B3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  PrintScanBrokerService.dll
- Size 436KB
- SHA256 29d453be6284229bda48df6af5631f585cc48ea7f0e4d087270fccac8ca641e2
- MD5 fc24fe6d4ef2b6ec12b111c8bd59f7e3
- SHA1 78a0a4c6aa193fca209e6bac944fecac362a1641
- SHA512 5d67f7f53713c3dc96c3550f607c7e3aea7aa3e24f21bed777dd06e03b958954035abc164de028688124fea4c944f3b70947d36cc053669cfee0ac9cc0d8f092
- SSDEEP 12288:CU82QF39gHsGY9gV5N2z7fdiUY9OS63c+2o8xsSVDKGv:XKqHsGY9gV5N2z7fdiUY9OSneSVDKW
- TLSH
  T18E944B5DE2AC06B5E1F7D27CC593490BD5B27816833292CF02A581AD0E27FE8E53EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  PrintWSDAHost.dll
- Size 156KB
- SHA256 c152ac1c79ccbee9bb4cc8bbeb1113008704a5819a1c554dcf81d8271cb4475c
- MD5 d349983fba54a2679f1ba96bb521dd6f
- SHA1 b918b1f35ee95cc23e56cbf0786d6c8fc5f9c40b
- SHA512 ffe8693beddaf66d93a1b78605039de6444816e2de79f8f390cc1110ba2406d198f375d991181fc7a53f7629c24e6c81ca1879538060a55db12019edb495480d
- SSDEEP 3072:Af5hHSmLna3s2v9OaFJaGLfOaBDJW/1ZAW1v/B2XbYwK+7a:OPHSmbuFYEJW/1qW18Nr7
- TLSH
  T1DAF3072F76A901B7E179A23CC5D34B09E772B4241B2257CF02A5427E0F27BE85D39729
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  PrintWorkflowService.dll
- Size 592KB
- SHA256 d86b74e9fccb288d2613983a8c5d1cb3ff18834800e83277adf57e63829b60ad
- MD5 0a7b9a16526f2dbb96d42eae4a1519b2
- SHA1 1f77fb10e83390cc91563239a4566ebba768bf40
- SHA512 0d5f0dc55fbcf09e5beb4fa0dcd8013aee6e412f8333b25344fe87278bd0433f288498d515edd97ebe477589a6498d475abef796497fa9cf99aa1ef293940de6
- SSDEEP 6144:IQBhOocTWGgtw/0B66RvjqyhUJz6/clQZlf5wi7vu5f34EARt2pEo:IcOocTWGyFTuyhUl6/eQZlufobz2
- TLSH
  T100D45C2EE6BD07A5E176C13CC5D3461BE6B27850637296CF016402AD0E2BFE8963F721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  PrinterAssociationCommon.dll
- Size 112KB
- SHA256 244c67a9d8ca9bf79f97ec86be80ab716e2f036b10b94695fd80f3bc080e0b1d
- MD5 8f6aeb536224d7ccd030a2e0a06f6e7b
- SHA1 e8b2d29af37a230e0632bba70de530a03f6d50de
- SHA512 fe85b8f22cb8bd78166a70016120162e8f490295b947f25cef2ddbf4c324a95aae193d8cdde61fe4db95da030216303834dc06939670f3718a1e32fdcbc1daff
- SSDEEP 1536:ccs3ZW3mTh+h3ArjoCe+C+cRbFxdnakZ+clW2BM6NjfZfUT++qEk:ccspunpRbFuiW8M6NjBfF+i
- TLSH
  T108B329AA66A810E1E1B6917D84434E1DE3B1F451076293EF039082BE5F77FE49C3DB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  PrinterAssociationCommonProxy.dll
- Size 40KB
- SHA256 d40f24c7b131d71168d18b68b4f732fdc6e6717050de25b9bd5ead518e36be09
- MD5 a84ef9a56b64fcf64c92ad35b2469ef4
- SHA1 ebdfbe864be52e07ea7ad7fcc3b780eb841fc5a9
- SHA512 3d9b5b2feaa3dc0906c7486db00a1514eabf1b85096bcb25ec15f14c1d3b4bd0dae2c7f01dfdf10c68b24b24fe085fb25fa8710bbcd40c287e6cba713ae166c5
- SSDEEP 384:aiTPdtmfdm1zttLQycCkniYjkbScC8uAGVYWrHW:tPagzttLQdgY0RvGVN
- TLSH
  T16D03E859FFA50996E4769B3884A30F1E9079F914573253EB079005AE0C36BE0DA38BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral23
- Target
  PrinterCleanupTask.dll
- Size 164KB
- SHA256 abecba0f0e0daa57bf494dd3afd6ab45bfb9d5ac63598c74c42fbc31f27d22f5
- MD5 e0bcbce6a47fa4c7976de8a1152d8c71
- SHA1 266e8d0a15e6742a326d58aa6c738b1fe74ad5a0
- SHA512 472945fe417a6cea95e4d9f2a53bcb43534d46404f0d189f2fc7348ca4976256e784dd17952531a1821c3e0302a5b9edd74a62d91a13cb564f55a97b063a60f2
- SSDEEP 3072:LEk5CyY5/6yOcukl9OO3ujgreOAqrJ2tGUCjAzoA+oQ:gRyUDOcpOCQ8AzoY
- TLSH
  T1E5F32A5A76A900B5E1B6D13DC9C34A0AE6B37861573243DF026442BD0F27FE8AD3D7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  PrinterServicesAdapter.dll
- Size 132KB
- SHA256 777821b28d9b682bef346fbae43216ac64c188a8a228aa45b2d868174295bf27
- MD5 98b00bc32b4d3e0324356543811dca76
- SHA1 0dbf20181a35ae1814e96c23fb782e14a0238987
- SHA512 49b6472cdedc8e26c49b80cd04121ca100b257d6ecf653244bf6392a666873f3d357993d8cb191acaf31c5288859863ea8a5e48acb6fcec02ca644f8fcf3f4f5
- SSDEEP 3072:39bcV8/z1pSeLb7Ua/+pyc60kUaaNd79ri7Bu:LznSeH7UaWyc60IGu7Bu
- TLSH
  T1B9D33A5E716910B6D136D03DC893490AE3B27065632257EF03E1C27E9F67BE86C3AB52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  ProductEnumerator.dll
- Size 64KB
- SHA256 8fb81730bd1a9f86e5058d6d387e654b95a8ef74508b69144a4bcc3f0457e8ae
- MD5 f8566a968613b5131b8f129e49895b32
- SHA1 5319284948606074b777cec4822cf6bc9088d292
- SHA512 6033caff198b96cdcfc485d729803afec5d942aa9ae52995039b68ae8ea5de5ac7f3d6e192d13e3bcb5eb99eced63aab7f1c7e43b70cc589dc742c8b7253076c
- SSDEEP 768:FQHXoYsqAt5YRhlp7o1YMHECa19dGhpO/gI+XVbCTKc7jzQWKVVQtcY2:FYSqA6midNqoT7PjKVVQuJ
- TLSH
  T14F53174D229921B1E5BA467CC2D21706C2B2B4325B1352EF13F880BE0F637E1D639F96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  ProvPluginEng.dll
- Size 116KB
- SHA256 27753e4eb116c195a32d60062323eecb3cc3d6f17e5de4dd30641b3096c8067a
- MD5 8e6d5068a2cc4e71e8af797604662701
- SHA1 22fa7c7782b4477e2f81b18965e2187c02536281
- SHA512 6ccb09093c7bd434cd845b9211fffc06e20711cc41ae3dafbbe46c45f40fb20181f1e3efd7c9d0185897c547c1358c57a594e8b6a549ee3b83532981d593336d
- SSDEEP 3072:ZPoFmYbk2UxDPSZ54pb+O5bL+/nlYN6K:ZwFmYbk2WDPSv4pbX5b2nuN6
- TLSH
  T182C3292FB1AC10AAE175E07C89174E1AE371B0261312A7EF0790C17E5E7BBE46C39B51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  ProvSysprep.dll
- Size 88KB
- SHA256 22a07a017e940d23f69a1b70ff2a8acd7a96dd23e3784d4bbd63afdd7e11dcc2
- MD5 8b4e9654b61a5daf053ba9d9ff7460d0
- SHA1 5f3c1954fcb85900b5e0e495ba8a4811c490a90d
- SHA512 7fc8f9987abc11e64415487212e93994192d69d4eb80976bfe9d4d4090b8009b46355061ad7b28f8b5b857b79558ef440192a32ed35e3e4878025d5f381d4c22
- SSDEEP 1536:fGCn0EnbrQOkhlDTHRPlp12Bm9BvJGleWESx3Me+4kbgzCru2i:fGCvoHHwm9BvJGl/ZMe+DEzyu2i
- TLSH
  T1AC93286E6BB860A9E072813DC5A24A05E3B1F4206B511BFF02D0C27E5F637E46D39F52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

defense_evasion persistence trojan
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral28
- Target
  ProvisioningHandlers.dll
- Size 280KB
- SHA256 3d1b66a1a2697dc250ecb6506fe1744b11c8a84bf7dd03670b64b51fe8929bdd
- MD5 90be7e64740a5573bb95971648f6358c
- SHA1 a7f2d23a1f78e7d34838cfc40dc1d55db7c088ff
- SHA512 924e0c9c94606e494abf93098f1a45b96a3d57d32f6fd9813050d3312a73c9efe3d8eae4c7be3cd67d947789663155c2aaa09c5c037cbddff8f9deac7853f028
- SSDEEP 6144:EonuwMkNENxPD1BNuPgrJwwleTBYcVta:EonuwMWENxPDvNuI1zledj
- TLSH
  T1DF543B1F26AD0C67F1B6D17CD583890AD37278615761D7CF0290426E4E2BBE8AD3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  ProximityCommon.dll
- Size 180KB
- SHA256 2191f49f6207043d4de8d80e4fcd12a4a5a6151eb5f38e19bacd4f6754288411
- MD5 19b0c67bab091268d382a234655b7666
- SHA1 61978e8afd6eabcc96d6627ebabb3d163006799d
- SHA512 f1ff1d2fbd7aa3dc61c647cca77477165d78fab3aef555936062f2661e1f512f6d20a139b3007d868c297294535098344a24dbbbdff19c7362bfba54e41fbdfa
- SSDEEP 3072:BbOZguv+LCq8WtmEc1m5ZscGe7W1/QNj:BbOZMV8W0Ec1m5DGenN
- TLSH
  T19204071FA6AA1032E8A99274C4871115A772BC28676153CB149CE139EF3F7D9EF34F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  ProximityCommonPal.dll
- Size 40KB
- SHA256 da2eb83e2d34626dfeb888ac513f37e52c2e2646ba24c0736477fc4cab74f2d7
- MD5 354b354e9bd56efa34aed35dce286acc
- SHA1 d57cada46fb97e6d060ca3d5fcd451b5d65855a0
- SHA512 99eade98ef3c73e78971de55aa29a0b23c3dab07d45301c874a487634ef8214364fd22f32dce1c8a1015e67950e5d80b17594ef2586d3f6c6b29ca2978f3316e
- SSDEEP 192:0TpZbUlii6Ab1PtZWFTlnmi9BTnY7C1ZR/0/cRBBN7OtodB2sEpVbqFkM6a4Wekr:0ni6Ab9aCgBZRB2OBibqFkfa4WJ8W
- TLSH
  T1EE03070AB76D00E4F17593BC89A36A0EE136B110171256EF867086AE0F77BD09D39FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  ProximityRtapiPal.dll
- Size 52KB
- SHA256 e787ba9c7d20357113f1f0a5247eafeb66c59d151b6dfa54f56a5dda6c294d32
- MD5 9d9f07174be37fa966067a9cc6542c32
- SHA1 d4ba52c4857f7e2f168861ee026ebf251334eaf2
- SHA512 51b6e21f6fb39088c702619820900682bdb6aad5a618a766c821620c994d66d83b2ed48edba8c25ded77d555ca101e1619132cd67d410a8e4d053a9acd3b0cab
- SSDEEP 768:nt2PL5X512I3XWuQLyhnaumR34Sdv1mXetYIZFKh:tUL5Xl3iyhnav94M1mXetYgKh
- TLSH
  T15C33284EE27520E8F072917DD256491AE1B0B02427115AFF0390C3BE3F27BD46939FA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32