eec395b26c2a0d679abf9840636c8dcfd48c7c465f858b0b39b10accb9f66ac8

Sharing

Copy URL Twitter E-mail

General

Target
eec395b26c2a0d679abf9840636c8dcfd48c7c465f858b0b39b10accb9f66ac8.bin
Size 17.6MB
Sample260812-a474easwcx
SHA256 eec395b26c2a0d679abf9840636c8dcfd48c7c465f858b0b39b10accb9f66ac8
MD5 ae65d0fff564a0cae1a04502d17b043d
SHA1 514f5d095cd01909183437fe5809ec510e8d1ddb
SHA512 4d761c247bbbbde2b4be45e2fcfe9cae3ed64cb955835d16fe204ad2d16a4a06653586f3189aa0f8a98966cff7a2686e19e903722a64747a5d8d028e49bfb05b
SSDEEP 393216:WNpIrytONtQbROjR5fUsAk/xJH6mnZyaNa4vc3psZXL2iRtIa9n/49XVRU/t:WNpIrXmbRk7Us9WIkr4EpsZXzjw9g/t
TLSH
T194073306FAC225CBEDBB11372F66454A329BD915096BBD2352A297C30C6EFCD4B24CC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  KdsCli.dll
- Size 156KB
- SHA256 ad56998fe0338cabac36d9f3d5f1094a9e3a7439eb346aa9bfe46eb5c33b82a6
- MD5 b9c596db58be136166ba20f8114dd7de
- SHA1 30e97f062227c67ac7f615ce2649592131673425
- SHA512 5f06d98c017e197ff8e8a5b675b9429de5db133fdfab08edf8c5861dd68b686dcd09a5db222aa2678f080c795389f3c41bd53557b200606f3af4ba3e5e810efb
- SSDEEP 3072:5Ah3X9ZCZ4zNZqm6iCNTTQ6FxUhn7b7B/6A1ih:ShdA2qHiCNTHYdB/6Q
- TLSH
  T125F3182D73ED20AAE4BA8239C5564619F3B6B426232127EF0390C17D6F16FD4B939F41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  KerbClientShared.dll
- Size 271KB
- SHA256 af46028ede6b383bab8df5cf62dcb865889a98682474946a5c8bc4c3786d1b70
- MD5 762693d2c103c7806bf15d01493def79
- SHA1 1980db5a9afd9f559d15ea8e214d8c3d5bd3774e
- SHA512 046f415634f538c98d1263389f2c43d5bb97051caf0c646c251754390dcd877b263c9dc0cb67a430543fe222eead3cd02513b37113cd7ceede19b880d0575c92
- SSDEEP 6144:S5wgImTxvwWrnoYZgauxkD1t05h09PSCxX:S5wgI8LnoYZgauQQQX
- TLSH
  T1F244C43C21A92CF8ECA18078A443D706D6A2757A335182EF05E1C37D5A0BEE9B67DF45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  KernelBase.dll
- Size 4.0MB
- SHA256 c5b6068974e0d1f63e9330948970479014ad7b162f61e20cf47e57bc8c6d4743
- MD5 a84460463070580547d1736b870781ad
- SHA1 3a966182a5fb51ded143d4e8bba400d17388cde6
- SHA512 02898c8c7563bbe0ed01535bdac27ddce0eadbd0d143a472e74bfddce9cdc4bbd730ccf43591979d7e0570e3c396be27ed19993206c545bd457adda14a4c2ed7
- SSDEEP 49152:duK39/1P1pLOeLQpH1r43KsC0idrRcxW6Vgu0sww14AhWuNxGQG3:d9dTSzRCNxc
- TLSH
  T168161B0EAD5544E0C35EF53487FF070D99B23CA5632892DB7AE368A69E0B3D1523E319
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  KeyCredMgr.dll
- Size 100KB
- SHA256 a5db09a9a87e4eac9294e137d6fe2a15643c75a2250cd69152ad594e22b70b73
- MD5 ed3088b9b477257b44593f1dd7e4bb80
- SHA1 986811c82ca7dd262ad76d2b3ccffa25449536f7
- SHA512 09f9286625470e4d376bc30022994b8e507cc8294e8e6a6e4473b406003f7435e05501e8ecf426d9815ec19226ddca76d06c0ffa33aa4c32e8e94bc6e64d2e60
- SSDEEP 3072:L8n3jpm+O3aC6GmtNTZXFVl1FVqwdAJ2ekOF:k3VrO3aC6G4uNJjk
- TLSH
  T1BFA3296E26B810A5E176C03CC9924A09E3B2B466631267FF4390C1BD5F27BE85D3DF61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  KeywordDetectorMsftSidAdapter.dll
- Size 148KB
- SHA256 657c83456c771b1b7b61a52c71359652aa022d65d8bc4bcf2825e1a758b16478
- MD5 8f65ede8e415760a994011b0e8f01e04
- SHA1 0a0dec32b6c05569c0c14363ee5cfdc95aca6db7
- SHA512 b7b4d04d30a8fed0d262f830f2750d81770bbd409df758d5af3a4cb20da43cfcfc079e1d9e6c62ae1629da41db6040457cbc7637451ee60f8c2850389f19b8df
- SSDEEP 3072:BO5Aa9EbJsQ7nEckMS+snuKSfpo85X5pnHv3ZE:2iFsQzEckHRu9xPXfP3
- TLSH
  T135E37E69776400F6E87A813DC1B6992BF7B1B41223204BCF43D0817A6F636E4ED7A725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  KnobsCore.dll
- Size 256KB
- SHA256 676bde27fb92da69761fe1985adc769d98819c1f556ebd83ee1ed9ec4a4182dc
- MD5 afea945c411cb1bad2325f1b0dead19d
- SHA1 15f5e28d00de2ab211e7d0186e28ce5658cd005d
- SHA512 80eafce389d01562f360033c66e91008101c22d39b78ec7048925a9c2e5c079a5163265a7fb517cb3603de208879f539b2a7aa47a1108c6767d5ba7c23cfe134
- SSDEEP 6144:Pr0nrYmcl4Pq8VYJor70y4tmkCEW4sfiTj37GCrrl21eelsoQ3XtzOl4d:vmYWVjrIAkCEW4sfifdl21/soQ39k4
- TLSH
  T137443C1F62A80CA5F6B6E07D85479909EA7174220311D7DF13A1C27E1F2BFE8AE39711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  KnobsCsp.dll
- Size 144KB
- SHA256 0694ca1eaf96b89ba82d77d460eec797d32c274d7bed840b347fef93a06a44c7
- MD5 2a90b5e0e97fc2613af97d9bf2a91ec0
- SHA1 5dbca7bd4f41fcd62c513c16aab3399c80ad982a
- SHA512 5d8ac6e236b821489c104fc81e440de610a60066a61507579c74ee39f25bf205b2c7e68b7ad174b3c5248bf14e33344aa7859e98e11d318a06fcf36e5e6dc955
- SSDEEP 3072:ZVoGIBXk1FnHWFpm5LqlcX73JUhMWaXcLqr+ShGSOIPw8urs:npIBUzn2Fpm8lcX75RWoBrHh0I/ur
- TLSH
  T198E34C2F726D00A6E176A17D86438E4EE7B27025132157DF43A0837E5F2BBD8AD39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  LAPRXY.DLL
- Size 40KB
- SHA256 1e7c6e672e0538d93699ef53997d2a1f26d22711fcbb861da8514f3a63084107
- MD5 63bac682d18e5223ab9236cd5da6a1e6
- SHA1 78910660bd02e2c5bd28e57b431546411c17ed70
- SHA512 9410c7da6063e2acae3e81e436b757fb685fcb75d0537b198a40571ea55c8827253addd409a85875c2afbc38c0f2c2fa01d0d4a7b915b847f6380df28b49d9ae
- SSDEEP 192:V3oYeSiFxPfPPPmk1tJrPJH5JeoBAKdIIgZphy/qaW33WM:V/efX3PPPVzSohdIfmW33WM
- TLSH
  T12203C599FE9559A9E43AD338C4535F2AD276F8201B2243DB03A1056D1C36BD0AA3CFD3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral8
- Target
  LampArray.dll
- Size 200KB
- SHA256 0be70ecda163c121866be2cc913e25ba40676b21e992aa1001a4377817487ccb
- MD5 2ed4cb57d060e8e226e99238db91e29b
- SHA1 123337c1b954723482186657481a9678c947fb01
- SHA512 f435c70cd7494e042a7396d1568b76b7315cc22d79ee51d9664162cee1e2dd4327c7f59791f31cc157c638617fa04ff0387d657a3d8fe19b6c186c396f523eae
- SSDEEP 3072:ffLsGl07AYytV3VbBAk5cSwGKFQtx2SJPor8Eg5Evx714UatJufJRMYTkpge:fjVlSAN3JukNPSrhg5mT4UOaMY4pg
- TLSH
  T1BB143B2E31A910A6E5BB917CC9974A0AF3B27421531226DF02E0837E5F17BE87D3DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  LangCleanupSysprepAction.dll
- Size 40KB
- SHA256 6e209aeb2fd5a1bad85bc9a3e523a7e5b94bdbd08d5ff21c9361539882ff62fb
- MD5 37eba1521871ea125be020411ad45308
- SHA1 23b5367340a622243532d78263b1e1c74bf2ab24
- SHA512 067cfc0867b41a45abbf22db0c0d0b0b8fba703a0a7c2e697175a4d12ee15fb2934e49bb9a600525c3f3247d112d84535c71e866f81b93ee333ef23fe73e7147
- SSDEEP 384:Eps2bF3/70KKvdtEuOsqQpvgGtZMm6egWvNW:gbFultEuOs3VRtZd66
- TLSH
  T12803FA5AB7FD20ACF6F745B894B60516953438209752BEFF06E0427D0E227C06E35FA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  LanguageComponentsInstaller.dll
- Size 240KB
- SHA256 47fa4577bf5719f1d71e5ea9b2743fda016220dd83fe6699cf633e4359ad9430
- MD5 3dd66693940888ebfdaca538d1362c04
- SHA1 0e8ef38a3ec541cd68e39310a4294eb64f87742f
- SHA512 a9b5cdb0a9feb15f6c22c71f07617c4b021e840c68d1c795991df2e8e6f6afabf0c3ddec0545aaf43eeff05ae11246f6d2a2ba040572e443d3ddbb37d5d26e5a
- SSDEEP 6144:EETrxrQnynJSQe2u7ENJwhyWVmiTvpDRA/ac4Zh/x:RrxQnyJSnYfFWV3vpGCc4
- TLSH
  T1D5344C6D26A908E4FD77C17D89834A0AE6B378120321D5DF02E1827D4F57FE8AA3DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  LanguageOverlayServer.dll
- Size 624KB
- SHA256 c6c297f2012024809e6a17d029ca2d1fba59005ca4d67b0c59b70d3eebb3fea9
- MD5 665148a0925de19b00308440103a0ef6
- SHA1 83aac1438df664d40b3f4247f4b21bd5ed506984
- SHA512 091bd1f40ea281d88104640f293a123207ec4d5fde0d235ed347fe5e758c9dee89be0a9408e7ffe3dc1e7d912dd9f475668575b663d1197e68f54015ab8196eb
- SSDEEP 12288:TWj88J6qSgikfXnnuF85jRxhuRzYrO1X3NyCpgWku+D7GQDpY:IJwkfXnuF85jRxhuRzYrSyCpgWuXGQDp
- TLSH
  T13FD43B2E91E800E5E579E17D9A43491AFA72385203269ADF0251827D1F5FFF85F3EB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  LanguageOverlayUtil.dll
- Size 279KB
- SHA256 9dc1baaff0c6e072d88e4f281ed07f9640207fe417ce29195977da003cb0b803
- MD5 4696c2f6d432442ff2854a7173f92ff7
- SHA1 69aba4cac797ab6b86292a646eb3438e90213486
- SHA512 00726ff86e0a5a2ffb529627b8f6191ff2ba70abed2474e7591b1d0122fddb10cca26f8c7c0f682109f3abe7095b5943561f894e9b2d652ddda7e863694f7f89
- SSDEEP 6144:eI+1gwB8qJnxmez6mmiuoAv7dl3NCz7JvqQaWtIZcT9TiSsA:v+1gwB8qJnsPoY7Ny1t2chTpX
- TLSH
  T132544C6E66A90CB5E977D13C8993890AE7B278520322D6CF03D1817D4F57FE4AA3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  LanguagePackDiskCleanup.dll
- Size 108KB
- SHA256 eb7cc8fb3decfc434c4a2946ad62fd49461b6996c6bec511a44754a3b2aaa4e4
- MD5 930186b1e96a386c7511134f48e74f28
- SHA1 a69f0e8b5b29731130d3205ab10b1caa9de45186
- SHA512 7b3a5ed21bdc09dfb17f06cf158e153ace5035a04a5ffcb2064576c92ba38e6c87a4032c9a6723f2f4daa5149863c4ebe6a64a9c6e1f1127f0d32d95727b8218
- SSDEEP 1536:7z3la83WO0A6TqhilzatIElNweU+2sBlY6z4n8Vnx9CzoAVE/yFjyQVNkuWZX:f3E8vJ53QuwPVEKFWukN
- TLSH
  T195B35B3D76A810F6E579D13CC5928A0AE372B455071257EF469081AD0FA7FE0AC3EFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  LanguagePackManagementCSP.dll
- Size 148KB
- SHA256 be7d17e1341262ebd0d379fcef60bdbd6350fc7b54d889bf84878549f1990741
- MD5 195e398de82b7dc3aee9e52040ba2a4b
- SHA1 d2153a5650159c50774e7094a95783411510ab83
- SHA512 b3bfdd6b655894a4f3dfbccbee1c9ad4e2138aaa271cb1a0f9e5b7291c4d25a319acf86cd2d8fca60d5a2357465973c81cbc44ad58d0600ebca6f59cdd80c839
- SSDEEP 3072:SRVXReEmk8nKo4Di+jyQavTCfhUUroixra:k3eNnR4DjyQaufrroil
- TLSH
  T107E34C2E35A910F6E03A917CDA924A1AE3B27495032653EF06D041BE1F97FE47C3DB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  LdaCx2.dll
- Size 2.4MB
- SHA256 6d656fab2eede5ceeac56430c79c3bfa28b7e7f322f9c9387910729ad3b8ecf6
- MD5 c46f6ec007ae4032c6a5110f449ca557
- SHA1 5fcdf6d3c95240d421c76e46964a8d92d84722f4
- SHA512 7e3a91e8a31ef956ed2aa793768ad7d5116759b93011cb46ffca1ee55a7ac344a08ded114ecfdc6508a84d8add3def0e04b57e6e779f7c8d6b6daeff4dd9d1db
- SSDEEP 49152:M0zvrY6OgBuA1nWj+0d1vRFmFT+ESfBKnDSKz99nhwlGTeG3:ibnJVKz9VhwlG
- TLSH
  T18AB56B6737F840A7D8A6D135C52B9A4BE7F2B4911A30C35F50A607AE1F733624E5E322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  LegacyNetUX.dll
- Size 96KB
- SHA256 eb6592fd230900014d62d3d02aa2685fb201762e9a7cf60e8ee343f8a8a0f5d1
- MD5 0dec686889f2b1988fbd5fb1068f19ac
- SHA1 b74a00905e0aaa88ad5c571cbac39cca6bd5a3ea
- SHA512 dcb21985c3ae1e08bdcc46407205eee912614720931b34f84fd547a152d1d3de4e7bcd41954a8934a4a7abc68b7d917cbf4e7eab0d4875b93d8284e7a5ee50ee
- SSDEEP 1536:2h0MBXEPuGt5vTsc34dJYTOBMs+TQ8mbY7IPXH8jyNADd:Q0MBJK5wc34dz+E8mbwIPXcHd
- TLSH
  T17FA33A5AB7A9A098E062903C8AA34E05E772F470672257EF16E0837D4F37BD05E35F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  LegacySystemSettings.dll
- Size 108KB
- SHA256 b1b1d11e16b31c4b43e507cbfc889ec718bba585d47b00a314a8e56f31fc95f8
- MD5 a8825235694b9f725f617057544df144
- SHA1 9424386c1d466566f973b83ff34ddd6ef0f61c53
- SHA512 0698fa44e3a12d2a9275fbcc3af1b25becba1cff4c3c24a9d45845e546e9ec41a5e780c8963356e9b317cb5ca59b7a994eba8df92f817ec7a5315861529314a6
- SSDEEP 1536:LNCLZhs7BRO+98iTmq0JtUXKGYgm4ELt7qM5iY+/ze5u6cN:LaWBU+tj0PUX0gm4Q55iY0BN
- TLSH
  T10EB33A5A66A812F9E236913DC5C34E09D371F471572357DF03A042AE0F23BE86D39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  LicenseManager.dll
- Size 1.0MB
- SHA256 ac0b8c935f5fcbdab4383899145e166c56ccf6c650b15414ab05003dc319d79e
- MD5 e336fe90b36d80b5775d389e693db9fa
- SHA1 99ea760bb396ff64005afe84f2c8e2c4071bfe6a
- SHA512 a48bcaf3e553e2d0fe4a58d71a78a32beda6fd992769e1c0d85962a89cd2e4af861245b2771ea7c60b716aa9f0f589081e9aaf3ee1254006581a541acca5ab2e
- SSDEEP 24576:T5+3wMXLnG122z3dxaQAAY3K3q9c3sCmNoQD:I3wMXgzd0Q3cc3zm+QD
- TLSH
  T1CB355C1E57EC02D8E5B6D17DCA53850AE6B17856133196CF0290827E1F37FE89A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  LicenseManagerApi.dll
- Size 132KB
- SHA256 950fd5f6645edd478a14c5df42f430d8bd32c18323be6a3fd72f672448efe465
- MD5 6937b9f6833581de39a4a3f065d9ac0c
- SHA1 221d246a02ee97d17cc220afa55a65facb55b562
- SHA512 c027a22b052ca70fd914417d7f1bcd64ffd6c0f8db1e33f95c8c6bbd02b0b998b4bb4ac8324f6986eaa6fb94a4c42688234ce785509a0d942f861f38ad150f4a
- SSDEEP 1536:S0cimxxzlKhXqZ3JzjijrwOKYSMsvOg1ZNyZuwsW00yHSXBaJoPNbU2ZJpx:SiAZtKsDLOgVfFbBJKbU2fpx
- TLSH
  T1BAD3381EB2AE21A5D1769578C8624A16EB71B831631163FF10E0C1BC9F13AE87D3DF91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  LicenseManagerSvc.dll
- Size 164KB
- SHA256 16a7951ac5a3f1850a3188b406d9e1a188651821069c4ffdada40fb41aa61cae
- MD5 52762a15f563394ed4dbe3201b10135a
- SHA1 7fe69d27eec1557b14f2c4e84014162583f0b795
- SHA512 fa324dc00966f0e660351fd0265aa0a4bf3d51b6b3b3e155a83477fe2d6063ee5e3d7a3d2a1380052a2e8e5006627e80005fff724a12f1d145a8d08c39c83875
- SSDEEP 3072:JkjOVSiuSggRu6V5GSfPL6AJHPMtAy14TuhLbPwjvk9ebsstX:J/SiuSg3E5GkeAdPMtAy14ChL24st
- TLSH
  T1C0F35E5D62D914F9E276417CC9970707E6B27025232263EF02E0827C6F27BECA93DB56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  LicensingCSP.dll
- Size 188KB
- SHA256 dad1ae5ee7ef1a1524d5231bf9aaad4107dc92715c6fa1bb166306d5d66ec7d8
- MD5 168f02eb1ce069dbd2e356c125e88cfe
- SHA1 c7494a8fc5a523791eca203c2cfe4adfac77db9c
- SHA512 0c16ee765a570af0e3a8b3b69a4ac6bb25552724261b32df7b9e8071a6747aee23077a76d95d8722a9b7bc8ea454278407c89595d4d8bfd03dc0f58634bc8bb6
- SSDEEP 3072:PtP/LYxTQSz69bF/3Lgzc/REWhpC5wlQTe6d3pa89PAo7KIWCYL3tRN1kFNPOw2i:B/LYJu9bt3LgApEWh85gQS6a36SL9HJh
- TLSH
  T1EE14291E62BE2595E17B8938C8464A96F571B035130661FF02E0C1BDEF02EE8BA7DF11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  LicensingDiagSpp.dll
- Size 484KB
- SHA256 05b6ef2400e38402155192dd1f9cbe7d4cfce00874e2e3b2e0357264eb69c921
- MD5 ea9b1798f39deabfebfc4e57514eab3f
- SHA1 2ee78bc14cc7358b544f9347f82ad0bc974f463c
- SHA512 e7b8ed8d1fc8e3b38094350779d41814d2eda5191f6013f80a7ed54261061862aa2594c9d3e9b6033407e7901f76bad09904fc0b95f9c9b22969a3aad0024a18
- SSDEEP 12288:r6QiPTtoiS0tRxSsYNndg5GPkXLNxCrFypqpKzE2VZwQdw7u2WyXMLoF6tV0YaTX:otoiS0tRxSDi5GPkXL/CrgpqpuE2VZJw
- TLSH
  T12EB47D1E33ED0594D2764978CD124B13EAB1B034233275EB22E1C57C9F4A9E8AABDF15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  LicensingWinRT.dll
- Size 809KB
- SHA256 e100672c4c35f70e56247b9f86e19d97de794831c9c97cff1a51efade402e4c0
- MD5 391e16393bd02692383a3dcf4421cc2b
- SHA1 28b0c0a6f1c0daf3423cc4da5256f4a8e832179f
- SHA512 e9a13f67e3abb272d7f80a4dbdf88d1466fcf1ac59c7c6da6eeda96bad261ed106e5253cc091bd597095626fb788c317d09d838e95d361f52cda89e313bddb4c
- SSDEEP 6144:IXRyCDSF77jsKZc69tP0pB92PWcJck5lzlCxHOKJYU2Uu8es50:KyCDSF7RZc69tP0/w9lRC1OKJ8UDe40
- TLSH
  T14C05EB3C6DE40236D472D775C1A36AD9A936A95277045FCF00E2434A4E27BE3AC71E2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  LocationApi.dll
- Size 408KB
- SHA256 0a3a5b9f7f857c7deeac10dd75ec718de82dda333a75655f51ee7e27fbd3338f
- MD5 741eb5cf9d79659a764e832566f7f19c
- SHA1 ba3d688cc9beec99278419facefc1e3b957910b2
- SHA512 156f4ada9111bf46a648583271ec8d7323d7753752235c188d5e84c0b4a645e07d5f2f4b22297322a5d70f716e734b29b8fbac2bc950cc8c0aa34f9c4b8e3b6a
- SSDEEP 12288:l56HdERF3AFe/UJVLpF7RGN4hun3zAKt:CHg8EgHF7ROzAKt
- TLSH
  T1E9943A5EF6A008A5D278433C88535399E77279180F6247CB32B5036E6F37BE45E39B4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral26
- Target
  LocationFramework.dll
- Size 2.1MB
- SHA256 c9103d2ea9026ea7ea51873965bc72679f08c3e31f98150a62a64e667b5a1315
- MD5 fde06ed7a3285e9a6b663f2b81709bb5
- SHA1 b168dde168fc4cdca686288dd99d7167afb317ca
- SHA512 6201f910e32f6a4919d3087209da22cae89c867ff4475404c4611b275cf1455baf9a87e5bb0c7bb69d1e4e993370fe38fb07f5b2fa355bdf0920ce47aea04d3d
- SSDEEP 49152:MroYpFvz4v/kaLU4/RWJr5Le6yVPKPGTN:476
- TLSH
  T14FA56C2B26EC01E8D6BEE27CC953450EF6B17825133296CF0265026D5F37BE44A3EB65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  LocationFrameworkInternalPS.dll
- Size 96KB
- SHA256 22878ba63aea8606c59e8a562c5c6964fe7a11281790abbd78f4d2b4de0282de
- MD5 7cd82a2ed702a74bdde0fdc3af2525ad
- SHA1 ec9a3b7459ee1c8e4326c93f1b93ab6b6021ee21
- SHA512 7cdfef6699fb4083edb341822d2ce131d922a12ef04cd3a3fec6c6f9f632613bdb0a1ba9db31fd0ad2803f4c0f508b3f15ac49cdfe78e32d130405e12b72614c
- SSDEEP 384:oY8Rn9bNKQ3AtM1sDbd2tVUOXiunIjSflFfwGOYtRVJjcOQGUl1+UDk9cF9kYMPp:oH9bkusXmJkpy0G9UVKP16VBzKemWe
- TLSH
  T1FBA32D9AF60014B6C03D5232849B0E24A37ADE4597D787DB00A5327D9EB7BC5AF36BC1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral28
- Target
  LocationFrameworkPS.dll
- Size 61KB
- SHA256 5e17a771d4bc4110c4c8cefe5c18441954ef4289917175439a4182d5a7bf97ef
- MD5 bac2f5ad296adab7836df7e5bc1fa4a1
- SHA1 56365cc43f7b93b953c5e3b14f31556406d730dc
- SHA512 c942f73237fc71f29c884821a89690570e47ca44d4edce22d328b83e2a213736d54736766be728ded6733cc74b408147a59a73e53dfdf0bdc10312aee8c6b03c
- SSDEEP 384:6orOBGFwmmTpssDs10fY9cqDa2LHqIVBKWVzWuNi/vDBRJNhF9fPOxFR9zFon0:tOBGqpz5OHtVBZ7wv1PTbPO59zCn0
- TLSH
  T16053F888F7584866C4398231C88B9E25BA3DEA49679243D711E0A23E1D777D0BF327DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral29
- Target
  LocationWinPalMisc.dll
- Size 152KB
- SHA256 9d0da3a12ecc04fa0963d0776de95258a87e8d1a49ee1133a6c49ad886917aae
- MD5 51e9c0cb094c8db3e9489fdf96d70f65
- SHA1 14b7dfef7fbed08cc607f96de7de880a0e76085c
- SHA512 1ea7dac94a223bc33df2ce289a4c93d2cb28276d74ac187a1ffb097b1b4331b1ba7f6f24c82c7fe3bc6f1d291c558135be542ab6bae3b7a702c267b5f7217279
- SSDEEP 3072:Kv7kTBCD6+6layLZubPcmlPxegweeKzAr+1O/:s7klCD6+6l3GJlPweeKzAr+
- TLSH
  T142E33B2E72A910F9E575927DC5930609D3B2B424172267CF06F082BE1F27BE8AE39751
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  LockAppBroker.dll
- Size 412KB
- SHA256 caf2898cf8bf109f51556cf2794d8330258a10a0b1cfe2e3634865eb433d6a74
- MD5 970bc0bdf502fa9dc3513a889fab016e
- SHA1 b761be431aaa4626f1d669f64f063dfb36e346ae
- SHA512 8a7c1886ad437f208067a590eb8027604a1a205788c271498acf1bd257268409c20f12692184f0bbad709f93df975d2ed0236e120fb5920537e300b1bb4b3a78
- SSDEEP 6144:nUq9OB/WxRXVIOL8nr0//n4hTezomSZEQYc3/SirnjZjUAnu:ZOBexRljgnA//mlm6EQYa1
- TLSH
  T1BF947D6EE7F804D6E57BD13C81534A0AF6B234A513629ACF0294817ECF1BFE4A539B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  LockController.dll
- Size 680KB
- SHA256 015758a8a784b17669ae0da092b01b08f8c9e9236902e18c8fb9d9953de7fc3b
- MD5 25ee514cc349e7a469a78525a48e1bf3
- SHA1 ccd00d2cd9afb3fcd5f432ee60aee06d67345618
- SHA512 cbc14937aa9d81cf4bbc9e7fb68b0b3e4f6e2b8452d6d539703b63ed82b26fae2a6dec8f08adda1fed72a99c0271df0689445262f653bb453bb81762db982862
- SSDEEP 12288:qwA9Ooi/iat+AjNLbdEwWyc5fWGi7U9mji:qkFbGtWogji
- TLSH
  T1E1E45B3D66B811DAE17EC23DD1134A0AF57234914325BACF4690827D4FAFFE4A53AB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32