ce96141cc40914152a543152875743f1559b7a3e90c7d9b7c2079492dac6d68e

Sharing

Copy URL Twitter E-mail

General

Target
ce96141cc40914152a543152875743f1559b7a3e90c7d9b7c2079492dac6d68e.bin
Size 40.6MB
Sample260812-a44e8aswcv
SHA256 ce96141cc40914152a543152875743f1559b7a3e90c7d9b7c2079492dac6d68e
MD5 a466927e59f0ade3f2452b398126abba
SHA1 7625df0a0e6186f727c93031956c0ff13e095744
SHA512 7206a105b6560000f59e5089a05495dba8a1f8875f2b3923ac63f70df19e286662e8589730d0d0427902df938145e2600f8aea7a488db083e39ca0b47cd9d6ca
SSDEEP 786432:BjNp4N/gtcicZ4k3MoAbqAeZIvFU3GCs739YJVRoh93BlJxJdmg:BR6N/gGZT3PpAhFUtUNYHyf3BfHdmg
TLSH
T15C9733A0D234BAAECC4BD6B2C753F0B9B09E65250DF4C802E93046113CD56D7DBDAAD6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  MBMediaManager.dll
- Size 564KB
- SHA256 efe41b82c501cc4c3d7cc4e51bb4c5d28fa9280df18f06ab976e6c0c986efc97
- MD5 751df8ae5e7c5b94a03472095ca2e630
- SHA1 81a5bb9ab0b7302700de71466db34e8f34eb4d45
- SHA512 75369025b2d4a0e86b23eb28a8ff994159153fb8d4982729e7a595d07cee8cee211dfa0956fd1d5fc9939d52f7e9a0ac1aa793930172850acbb411ffafe042d9
- SSDEEP 6144:ppyX2Q+eOqyeiuPGUd2+OXZV14Atmox73Olh2Wf/QCQT6v+UW5aWD8A+7MZ6M:UceOqmgGZt6Ap73O/2WHLQTJfsgZL
- TLSH
  T1DFC45B2FA7BC0399D97AD13CC593860DE6B134A153629ACF0250836E9E7FBE8553E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  MCCSEngineShared.dll
- Size 212KB
- SHA256 a2e35b20d97a271172d282fe38f4c783b476ba6b7d316ca678fe4c27b7e30a02
- MD5 dcd38ad3d323b3d1d95324cbcb1bfa27
- SHA1 bc1797f630438900125833971e75d14d6603b9c8
- SHA512 49c3680506754361b41ea9cdd4d08bd4abd3483cabbaafc28020cb16d665087b7eecbbe1ee57f8bf3f90c05fea9c27d83ce23621ca89be7e6b9e84c844202690
- SSDEEP 3072:K24UlCXArgRfVGm4sJ33WZwkgyObImZ+kdPdjokFb4qj8pZVYUB:KkoXzRfVrdVGZwkU5Z+kd54qjKZV
- TLSH
  T16C24291A33D415E6E6AE92384483852DFBB5781163226ADF0690857D1F7BFF47EB8B00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  MCCSPal.dll
- Size 60KB
- SHA256 1370babc38c4f579b55e5bc626dabf7a58faabf930137b21dd7fde7675330f5a
- MD5 46f68b57ea1d56716a230e6ed7997b2f
- SHA1 8a5099bb0cdb6de9411c9afd022428264265138b
- SHA512 48bd99e21123bc054d356560b1357476c73ee85a598ada6b980143d87dc1f149fa08200a3d51dbe344f1451c96680b832b1906b2908900ef37344bf6647fb301
- SSDEEP 384:lO8CtY01NzpFW6hT0lFqcyHnxuxSbUKBgcFPAellLl2R/WHX6nNhEbm2ZD92V2Hi:K1/swksI5ePzLl0w2ym5sMyRX1yrh
- TLSH
  T1CF53174EB7690459F0B2417D85270D2AD671FA6043A393CF81B0C26E1FB77D16B74AC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  MCRecvSrc.dll
- Size 1024KB
- SHA256 68e0cce971309c3877a74ae4bc59fb7267a33016e5a05e821b263ef78b6fd990
- MD5 779325ccebbba0ea18998f6a885f41f1
- SHA1 2e3194ff64247a84cb81cdffe7f7bcb9a603c92d
- SHA512 dabac88f1d36020d4592b70561c1eb927a265cc2e9b45accb92acdee734538f07d2dd82a631f795ef7e79bd48aadea404c03af657818302b030b7164872942af
- SSDEEP 12288:zDj39SBVScXrkc05CWAHId5cniS8FQo/QiZShGg0ZoGihci3bZgfBP6pLnE:zDjkAcIC5A5cniwo/ZZoG7o1G6
- TLSH
  T189252A2D27F402A8EDB79079CA43851AF53530546FA2FEC7061583786F93AE43D3AE16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  MFCaptureEngine.dll
- Size 739KB
- SHA256 54d039d615aa0fc2c700961956ce61e505621fe9f3e2f05eb7f60fcdc911e75f
- MD5 2db0426c0d703c6ad0f7eeeaccfca047
- SHA1 1f640979bf5600f5fac3a9be0b37e708be81c6db
- SHA512 ea632d33d0864bff9d98e160eab596f5c56d1a1b717f78e42d4b28c67a332748518210b62ecf79be3cd8b417bae6d5e36bda98575582a13228c265c64783b8cc
- SSDEEP 12288:pwLa2ayxSWL/Xvb/j9q1026JoACRv65SbCnc30qFWCJUnPTp0GDT7oLn:pKa21xPL//Th2DDrCC0RCuPTp3DT7W
- TLSH
  T125F43A6E77FC009CC6BA807CC6574A26FA7134143B366ADB169081385FABFC55E3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  MFDshowReverseBridge.dll
- Size 288KB
- SHA256 bc9f6ca3700d4066f0d9b96722f9c4d8aba26eea7565a1295f6f0c9a47a42450
- MD5 1959c0b3c1780e6a57631d3bfcbe425e
- SHA1 1f80bfc177791af0e78e3c86b43bba58f5cbb786
- SHA512 d8cf45e6afcb0099b9583f12b308b8c72ed1fb5ed5f3459680d76e6001de83e8b0c7ba26b28269f84d527fc7107edd26d3db9ad944233c5607f7f5e9aacb3d4e
- SSDEEP 6144:tSUIHhQiihojoGI7PWk7n6zpC2zfCGUm9t56jx:tSUKhQiiCsGaPvc5CGUj
- TLSH
  T16354191F22A808D5EF6291BC954B4F0AFA71B016171296CB9664413E1F7BFEC9D3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  MFMediaEngine.dll
- Size 4.2MB
- SHA256 6908313493bb31406f4b7fc00f9f5b745598ba6c9e39199ac620e5d2574e7845
- MD5 9995f88438e65262c9590b7cc4399398
- SHA1 2d5bf60c703bc56f64ce2429a0c67d6ae607d97b
- SHA512 df37b9b60573faf5f2bfb224a794050d9bd93cefac5fb9478ba5fb56fc2cff41f0b218476c1bc8a751604dc1c4339a33191f7a33444351340857ed4826fbc31b
- SSDEEP 49152:Jvs5Bgzz3sJlvIfyEDPff9p0XU5xtcpYXsuXy8Cf3E9zL3WLM6v0wQS+yJ4d9hr5:b36FEpLEfrLQx2wZO
- TLSH
  T114162B2D63E801A8ED7B923AC9534219F93535186F72B7DB061583392F93EE4293FD12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  MFPlay.dll
- Size 554KB
- SHA256 403cb5c1978d9cad522bf7ee2f7483e291000ecd9a96f3d85dbb336647c80a7f
- MD5 84c6bfc8cd652afadb5473b346e85e8f
- SHA1 dd2eb70d52a78902c3c47d0e4023f69229160fdf
- SHA512 c4b652bea88a7c2ddb492778710177b99ba0107950282b4a5ea465386030762ec64a916056508eb29a64ebf5e3496cf72529063108dd49e609711216bb9af861
- SSDEEP 6144:6ruPkA5uODo/Vbfu/Hp31OlAD4xLo3IgQjeVlJq7MeQtQKzolqRFKd:tD5Rs5mxFOiEZHz6q7MDLzrvKd
- TLSH
  T1A1C4192D67F80168F9BBD17AC9638619F53135541F62EACB0250827C9FE36D86E3BE01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  MFWMAAEC.DLL
- Size 272KB
- SHA256 a99d1c9cecde310d5c87e0213e5ba0356463258fba47da6099841fd250b2ac1f
- MD5 05d12f298d0c2e76e396158ad6a11a0d
- SHA1 aa2bb7c6e53b9b5c6f2e62b1425b253a9567ea4a
- SHA512 3fed8bf1c3549fe45990406980afc3430b9a4e9a0d827abda8652c5ba1107daf2fb35511bca9af2fc4595ccf5303ac1e47efff7630a29b1108b21a8c5269405c
- SSDEEP 3072:m+IfQHVBuUOAz+IGQvc8c+zFg8jaX3XVkmEUS1OM2TFLfKYIyJILFRDmV883aoF:mo1BuQ+IGEOXVklUS4VuyJIBhma
- TLSH
  T128449D4E72F504F6E5B6803C9657960FE672B029136087CB03A086BE2F67FD4797A361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral9
- Target
  MapConfiguration.dll
- Size 532KB
- SHA256 6948f840f8169a00b695353e41da4275db8e8acb6be75e37774ec857ea6c94ce
- MD5 eefaca33200f3ed126be75b71011331a
- SHA1 d292b0bd6a2138724ac3eb90bb572306c8aaf7b6
- SHA512 b1f04abc1539c2e0f750357248ac29c1a188f6d675fac74f54983418eb226c705c1ae91b4a42e808a5d17220536f414ec7f1c840404145420289bcbb0bc2f4e0
- SSDEEP 12288:VMN1R4VLlEKB/SHKKt/yVwf78aiw+jPXt:qN4VCKB/LKt/yVwf78zw+jf
- TLSH
  T14DC4C32862D803A1F1B7A27CDE978507D2B3788697318BDF11914A1F0E17FD89972F26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  MapControlCore.dll
- Size 232KB
- SHA256 1a9f4187365e73b0272e718d0a62a5128e453269ba21459188104ed240f126d6
- MD5 12aa540cd08c40bbd9409ff25a658df4
- SHA1 9afbae7f36574ee0946238e08f9a0b2461fbadae
- SHA512 3845aec8a3d833f86f173c0fc67ec555294a6c411409d97479ea75f30b6f2a8870179cc22079d3983e0872a6b24263825abf5650a2b793d9fd43fd6bbbe5b232
- SSDEEP 6144:ig3WJFi+3c1KekxWd0XrSF0tdlBKIvqPen90vKLIW4:iBFifMrSOdmNiIW4
- TLSH
  T10334072FB25A10EADCA3923DC5C64A0AE1B37865434397DF09E1827E5E177CC6939F81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  MapControlStringsRes.dll
- Size 12KB
- SHA256 f5340caae0523b2bb8d38c67fe21d4402246e1f0903162b894a4311ae56b194a
- MD5 93857a7c4d1cb7d3eaa1572083a6a0c4
- SHA1 ce35abb6b50a6396b6eb75c802508bcdb6438155
- SHA512 cb4c305a002e5e48535f8f6cf689cffcf7c6ad23c0b7cae8a15fcaa3f32925f7f0c338d81205ee7accfa48af2daa8ee72137f553654fee395c9ca78a60fc764f
- SSDEEP 24:e9GSHQzwEYu79RCcDT5IZW0oP7NwycN4t51NK5L35WWdPfPNs3/ys:KHQkEzGmVIZWbTG4t5HK5T5Ww1yqs
- TLSH
  T1E5427A0563F80A25F4FA0BB0A9BF4B1A517ABD249D75872E0A94005D2C75A11ED71F37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  MapGeocoder.dll
- Size 2.2MB
- SHA256 b66a73a65f79aaf619b218dafe5a3059b7a14a523530e8031518b658acb0b45a
- MD5 7f4902e39cf8b0844a521414f98fdc13
- SHA1 5c0e617e52db5b8cfe65f5686b125aac6cc2d43a
- SHA512 ea3d449050206b2b4ac62cd32267a4d04aa398e1008b79aab6e75e1d8e93b0972026db22da4c022a9a5f06c3476528dfbd66bd3d3efee02d41b2ef9c4994b831
- SSDEEP 49152:EDPnwPHsyl9efzgtA+xTTXFd72Ri9jlhIwWqwhT5opBPc3EYuo2DYwDxha1if:pHZ5e
- TLSH
  T187B54A2A23EC02E5E1B7D27CCA87850BD2B2780553719BDF25A6079E0E17FE44577B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  MapRouter.dll
- Size 2.7MB
- SHA256 89ae463aab0246329235fead3b455d5de6362c6ebc2c966d4a48336e04ade5d5
- MD5 087d47e545a25cd4b2534dda7d408f1b
- SHA1 93cc5fb21e7a09a900ab5a52920e4e03de871a6c
- SHA512 d8b72c8b0fa1fe44b9b7309f5574a4e9a864bac62bd2ff7425039de499b245e1ef5b24c0edfd2779bc3d24cfe34ba4607cb7e58f00cd354b7e5a8343014680e1
- SSDEEP 49152:NWRCd8ZBccMS7xtSwyiGPIYvGwXMKT8XGfQBwC8+heynluIzHtocz:yxDJhe
- TLSH
  T1FAD55D2A63E841A6E5B6E27DCAC7890BD2B379474372D7CF1865024E1F17BD9413EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  MapsBtSvc.dll
- Size 140KB
- SHA256 0251264a878db16563870d5347fd55e4bfe7d707095a5054aaa0299eb2c4c458
- MD5 224660b64a34417f192d9db8cd971eb6
- SHA1 b33ccc40bcde17e110c2e1e41d0ac5a0d5d73fa7
- SHA512 96f97b767f68574d01fc73255399b0211c7071f9817c1520de7ab7bea70da267e14252206fdd0f94703e120aaab6c126b41698cf2414acb47c6dece07a3fc937
- SSDEEP 3072:ya9mpNM/kAt0yaPv5gYwzbC9A1smEpztKn9rg:vQM/kAza35g9zG9A+zztKn9r
- TLSH
  T1AFE33A6E7A9810B9E576D17DCAC2491BE3F1B821972253DF029181FE0F13BD86D39B41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  MapsBtSvcProxy.dll
- Size 40KB
- SHA256 a94fdfed0e3cb0aaaa9a727d150157fd0179ffcbe03adec5fdcd3e186c1a457f
- MD5 ae54de5d281d6cabf82cf88bc0e5011f
- SHA1 2b27d48630a1b9e7a82ae32459c18f337eb5c50e
- SHA512 cbc541b4f40d8e3ba452f35b31cafedb492be6981f425b333d8ae397e01247cba0ada80c6313b99a00f6e4307ff889944d6e4190e953f832fe0218227c4db24a
- SSDEEP 192:G2obK6DtPHd5Qk1tRSmmmDVwaQ9jdg7QA/eQ9cQ7p97vE1VzkdHWR6Wk:Gjbfd5jzIa37rehQn7WVzsHWR6Wk
- TLSH
  T14203E669BFA40592F43A6B3D84A30E5F5079FD00573247DF4762199E0C3ABE55A38BC2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral16
- Target
  MapsCSP.dll
- Size 120KB
- SHA256 a8361c034f5865dae1521c5bf378fb02aae224cec95695c0e22f3c133dc4fd59
- MD5 ea3649daf14c71b927052cfb06bf7817
- SHA1 305b09f7fd254bcdca47e4cbf71269e6d160349e
- SHA512 b61a5d0f0c018d52a8c9c692edb2894d9befa639d0b047305a3cf5de6afe489c2afbc262c0319612abc1179a8b68c19c5217f33115a4eed574ad6e05a0cf7b84
- SSDEEP 1536:Ud84ZhE/juRTq9/MmHvaqP+2CnbODYBz4assOdclRqH4jr7QZTaVDR1qOF07WWgD:Ud8E5VXM+2EbODYcdcl1JrqOy7vgZh
- TLSH
  T1BCC34B3E6DD41077D577C178C5E20A8AFB60B49233021FDF029682A91E53BE66CBAD1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  MapsStore.dll
- Size 1.0MB
- SHA256 caa8db82983e21ded29b2f68cd2c745535d7b4fae2e3c07fbecb414418691d3c
- MD5 c83f7429b650ac573cdd99f29d82d7b2
- SHA1 11b1da34eb628dd0776b8f54492d06bb144883e9
- SHA512 869b385ba24d6095ce087efbffa3662a7a921911eceb8050420eff172a923b79e4f45e02fe48514c11d3abe6e26f48670ca2017ef0320f45619a64a0e528a95e
- SSDEEP 24576:9Ef65XkhXo5jv5JezhBg/h0pXEf2/frDpmeg8+X15SpM/q/D4:9ES5XkhXo5jhwzLwyXb/frDpmeg8+X1d
- TLSH
  T1E1353A2962DC02A5F1B7E2BDCEC7850BD2B3B84257328BCF01A5065E1E17EE45536B36
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  MbaeApi.dll
- Size 624KB
- SHA256 b7f8f8e6f12346cf5646db1fe3205845431e5bc4f4a1d0328d16a422c159b235
- MD5 82eeb70cca4375316f1a987b9869965a
- SHA1 2b386535510aa268318c0cefcae78b24f2cedd02
- SHA512 bccf16dda08e738a61b299f89fb4d0bcfae644c2a86bb5921b2af431aff9f51fe381a89dc6ce936a2259c67b245a48c116bb7325db505702001996029b8143f0
- SSDEEP 12288:yKvVuThpA1TmkgqrQivUc4ylSrTDw5g9TsL91acb:ChiYMQiT/SrTDw5gK91acb
- TLSH
  T145D46C1E729807A5D1BF85748CA30607E3B17C5557328ADB22E0427E0F5BBE49E3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral19
- Target
  MbaeApiPublic.dll
- Size 1.3MB
- SHA256 bbe58cba9083cec7d879071ffb91c9e70985201672a00beeaed12142e35f1440
- MD5 452c3b94def2eebfd4761be412f73718
- SHA1 d54637f167e603f0414a26b2aee0d4c98e55d6ba
- SHA512 1959408115fa2b18d16303171b5360bc0a9585c802d61a203e5ff0597e47e21434bf5e6cc999fd5637b2fbf640d7589b580b6686bd6ca1c5a03b8aa20bb372e4
- SSDEEP 24576:C5iAGdNxtuKgrjj5zr/VqrgdUYxvSTwLjnBwOnTe4BKlfFR7:5rdNx4KgX1Ar1YxvSTwLjnBwOnTe4gd
- TLSH
  T10855181B5AA80656D979927DC5774308D3B17C509BA2D6CF011862AEEE3FBF04B39B30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  McpManagementProxy.dll
- Size 44KB
- SHA256 d394ede4f7bf86e0fdedd3d8f07b8c2ae7a201554f9f27c249ee915b1ead617c
- MD5 a8d6d0377313b639f54e8bb69f7124eb
- SHA1 864eef31fa584d850e692061d1466ab599f390d0
- SHA512 27db14e73ce7c76a94780abe2ae79f954c1c6098875a962723f809cda1ae632ba602c01701dc86436e6e8cf7259bdb4ba34063e306a57b909534a6576c25a802
- SSDEEP 384:hzLPtnF68B0UMGorXD0buMA2VP9dWK4W8:JbG5UarXobuV2VF
- TLSH
  T1EE13D9A9FB450DA5E436C73A48570E3B52B9FD20537283CB0AB1262D4D367D49B347C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral21
- Target
  McpManagementService.dll
- Size 280KB
- SHA256 1d711de18c16c37fb2a1603f851f5e4d21085eb27fb2ab09dc3ddcdb5c4944e5
- MD5 76b62d6b538053c12f9289ae2db6841a
- SHA1 52429c5abcaf501ced135869250484f1e05b9b75
- SHA512 d616af0774c1bd3536b443f51887b763d4db2c3f04d1044becf8608d8eb74161b58b38f13ea8c3aa3523ae99157656f6ca6fd4e4bb2892e58578514d6d8fe230
- SSDEEP 3072:V4N5fVZ/6dyvlQI+df+mOwX90ru34cMNHHilTO1ZsdIs7rL6NzWysiIfMiEMoIcO:VofVZ/6U9QDdf1X/MNHH07xEM
- TLSH
  T15954186A67E90CB4F5F7D23DC9A34506DA7278519772D2CF0290416E1D23FE8E938B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  MdmCommon.dll
- Size 212KB
- SHA256 abeeabbfb08fe323930fc5bacc5f502a51b90c8442f5c5f7b62f443705339368
- MD5 7a74b77ef454c0493498992079bda3e1
- SHA1 84a6359f2dcad495a496038bb70540fc0c120abf
- SHA512 dc9b0e8e566c8278b7ec6740de6368f441956c7981971a1c5cb62eeca07af4e26163710501e498ba0fcc632f942484315d1651303b93cb8ff90ea74efda6a6a9
- SSDEEP 3072:nCWZ1evvpnpWqC8L16a1eODAY8pJsYu32NVJWzvIceiRtGKTP0pY1LMO7MAfmaEx:3nAtpWG60eODAY8PFNVzOuaE6
- TLSH
  T189244B256AD400F1F6EBD27CC892A52AF171B854633097DB0A514A2D1F03EDEF93E399
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  MdmDiagnostics.dll
- Size 2.5MB
- SHA256 7f66bdc12670ceaae96cdaa4afeae4bc82cda1b9ae48fd545287fac8779fc34b
- MD5 0864f6bdba0b2f702ff9dbca37cc659f
- SHA1 a2683bddcd4451bc2ae6c9f1c661becb69e2f993
- SHA512 6d063604e321051490380902b001820b4dfbcedc7c2521a0f1d87956364aa71d22e0968aef595ddc7fb71bb7560dba3962f998439ac20198565584dcf453d859
- SSDEEP 24576:Bhxzts4EenR2EC2qCVklIQs3qy/mKnCXM9PI2fbl5Wimlc+lgzoB3mrWP:BhxzC4EewECuViXM9PVf2Bgb
- TLSH
  T13DC5094BA3E900DCE1BBE3B8D9678906D77734550B3186DF029C529E1FA7BE18939321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  MediaFoundation.DefaultPerceptionProvider.dll
- Size 192KB
- SHA256 8999d410205546624ee2502985b8c2f5f6d2e68c4a9a69f32066ef38d3b62327
- MD5 fa4da8258e4dc0859d64d48930315a1a
- SHA1 a6fcb7af294403399ab951e5105ee5a774676f4f
- SHA512 a7eb162d86458266f4e498ad944f87a4575e54a9156b5aeadde15e54b8c7b8f0061f6e3805f18ca059d48e88749b835f9b32358b06c0c885b779263441fd7ac0
- SSDEEP 3072:WCWNYsr1uy3YhuL4S73s3G6vA2S4AjLXGzSVQJrhL+kBWE6OxboS78:WCXsr1ZIuLr73s3G6vA2S4AjLXGzSVQX
- TLSH
  T11A14C52BB3E844D9E277E13848178A5AE376B4634B4143CF27A1833E4E277D85D36B64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  MediaFoundationAggregator.dll
- Size 156KB
- SHA256 616d3ac703e3ad6094d687833b40c0122a0217449a054562aa9c70c3d725f071
- MD5 0cc68ea88e44bd51ae7724e3d777243d
- SHA1 4cd3bc0678df91475bc6de904d088e5815e6bbde
- SHA512 f139bbacf2e32d8abc48a3df0af3358bafb5de7ffb03619c289fe6c2f865971968f9db5cda50ed3c512163ca42de8c52293186fb03256779d3b3edc113728711
- SSDEEP 3072:QNU66sHC6o+N2QeN53uQU88yUJXzFvN3jFFmDdxUBC+CEZzRe:QNU65Z9N2QE95/8yU1RvN3jX16EZzs
- TLSH
  T1DEF3073976E900F5D1BBD178DFA35803E2B278098332B6EF02D142761E67AE4B939751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  MemoryDiagnostic.dll
- Size 212KB
- SHA256 3eda593fc12e5fd99cc43870c26dd38fe46412d4cc430e9246e2687146b7432e
- MD5 5c256a86f55b972786c94b0e4e43b6d6
- SHA1 3cf582f6a9d1bac0a909d152fb56e6ffdc3806b9
- SHA512 a05043caf1ed279c430560c11aa78887d520be8c85c4c326f60c97ee137d27f7dbc05302e0cd73b8a6edf38528f9e543003cb23e75c746322e7ce0bc9f66be2e
- SSDEEP 3072:cX26m7eA6dOkl0lgAABcRDlvwKcK3yrAX5dHvYP2vp/XQIOUUdLr0Y6z6ZHzMwNR:q1xd9KlghS8JqbbJX00Y6z6ZHRExCs
- TLSH
  T17B243B2E62FA00B4F0BBD17889664615F5B2B466171192EF03D0817E5F23FE8B939F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  MessagingDataModel2.dll
- Size 1.0MB
- SHA256 449446a1ede870ab357c8211c650585cb7faae9536b5558da68019e0e07015f8
- MD5 cef72ff57950fc3f193af14a7f1eb6e9
- SHA1 90f259e6e76725c3698db41f7f5eda3e5f8b9ac1
- SHA512 fc9a56a871424eb97f3955db3f79056383e5aba44ff571e8520784a07fa5873544c1b776dc79cb15b51a92db7f28ba430e7409486a21e4cc7e23bac59701f339
- SSDEEP 12288:/KiqVpfMyAxq6OFms27tzZoSJDn4WDJfKl5vMaI/9uXffundSTPZddUqkgp/KWJ/:ybVNPAxq/ms4tzuSJDjJ7f/V0jkHWJ/
- TLSH
  T105354B1A3BE901E9D53EA23CC587055DFAB8BA5033726ACF0266416D4F23FE0597E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  MessagingService.dll
- Size 92KB
- SHA256 cf075c7cad76d1f73f5ae6fe245364cd0eee4e1c2c2ea17904588b4da05a7c9a
- MD5 8013c5d3f627322ffc74445f50fa05fd
- SHA1 58758de60373011e3aeb3da4787454b8c47c6961
- SHA512 5545ae730523c8c5ab2b6752984ceb1c67a5d333a723c7829f4ae7a9f3c07f120b1ea6b4d05be60c2325f246ce84366418a6a82eb66942b62eebfa47483dd11c
- SSDEEP 1536:ecneKn3FIBvpwNTX+Ha/YVsifUGr+K1M:ecmBRwxX+HagVNfJr+KC
- TLSH
  T1FA93192F62A510E4E66A617C84670D1EF770B425172363EF43A0427E0F7BBE49E39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Microsoft.Bluetooth.Audio.dll
- Size 3.0MB
- SHA256 931d23d0b5dd463a17f3bcbc7fb710cae7cd609445fd807ff74fee70e0c00c02
- MD5 925026e4b61545fe82e37751329dbf65
- SHA1 44dfaf22b1a857cf0a6f5661cb6bb248e7b1c0f0
- SHA512 3498d98f6ec94ffbfd362db8993cc15fbb0c0e1a8a48717bcc074f8f6c06924f5e7d4d57901c68cffc7b82223eff22820dd0ab453d4b49e3bb77468032c94d1f
- SSDEEP 49152:u7wheMN6gc6U8Kw/rs9VsnA5KdQ7LWIfhdjcExy/0JdtTKR1VKToh:82y8DIvQ2vZk1kV
- TLSH
  T1ADE55A7E91D941F2D4BCD1BDCA5B5A1AF6B0345907336BDB0A6402981E27FF88A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Microsoft.Bluetooth.Proxy.dll
- Size 300KB
- SHA256 befed28eba3cc2796d2476457bb1faf85f986190773347c03dcfe4a389a42255
- MD5 06fa203782910679ae37a9e246d107fb
- SHA1 e5ed3f9afe8a55127793dc458ac75a25e76e4e2a
- SHA512 0d2c0a50e46765db9a88c84b1131c4ef39e64cae972d65d749f973c0f86b25f3e5139c6bb184564a448da2996a7fd34e0f7651185958f6e3a821e5f9a331829e
- SSDEEP 6144:4yUczqGNZusBg5p4gyXRxAZJKxUGFAeRPYbZctbhg4n:4yUczqGNZusB4F
- TLSH
  T1A564704BF28109B7C979963D84AB4614F3F1AC109B92C7CB10A4722DAD3BBD09F36794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  mapi32.dll
- Size 192KB
- SHA256 e26d5e1a6c02ffe1e81c361e23a93619e936d6ef0287913ed55d03104246c98b
- MD5 923d6141a336fa4ed9e9c231c236e695
- SHA1 583e63dae0e9a45a74bdea4439e2c91b199f994f
- SHA512 e6aafc378c1dd3773c6fa65982ef6a9fec5d277e8b6f8724a4fdce88014b32cf46f1ff31648b279bcbcd85e1afbb0756bdad603d2c61a0206e1d33f22ef4c21e
- SSDEEP 3072:VEhla3P/YTq8RzLmmFPwHECcWtoiAtfEjzvEbQ/AnKOIpvlWn:++P/YT/RzLmGwftAtfEjcnKOIpvl
- TLSH
  T10514E61D36562056C46E0278C5A28669EB727C70A34453FF01F2E6BDAF73BD8A936F40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32