4ff6f898f11e8ea6f600227add4bb657bb3b10456b0fd636cf25933ae77d5c34

Sharing

Copy URL Twitter E-mail

General

Target
4ff6f898f11e8ea6f600227add4bb657bb3b10456b0fd636cf25933ae77d5c34.bin
Size 14.1MB
Sample260812-a4v4vaswby
SHA256 4ff6f898f11e8ea6f600227add4bb657bb3b10456b0fd636cf25933ae77d5c34
MD5 ab46ae98b74f67f0a307d67020356f2a
SHA1 6662d598e161947334f0645aa249de2c5a92bcd4
SHA512 421c1a87a39e605727a1645529a8809fcb15681c74b2bdaebb16e6e22904460f1d1d03e89da00e90981e6860424c14fed34e901b26db9b481bd0ab29e770c421
SSDEEP 393216:YSiRvarNOJcDpYEtE86vcgdnGA3/KiIXy5BOb6wKxH1TZWELXNPJfT9Baon:Y1RSEfE76ZGA3S5IhXTHdPN9xn
TLSH
T1F4E633B5CB42D0C1F637733256D652FDE99E86A22A1EB42D0897458ED03B70CCD399B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  MMDevAPI.dll
- Size 671KB
- SHA256 16d42e132ec651ef2fc54d27dc736c76fa65776ae5b437ee33b0fdb79b12be62
- MD5 ca20b1408d1c90ac346b182a98dd2dea
- SHA1 d6c1c9190febfd6afe0d126ef33d28b6c176a524
- SHA512 25937117756eaaca3c6d68e9d220fa0efd872e30815a1138649f392aa090a5813e38296c06940374c56ccc638d5133ee9e02f8ae6df752b1520e32b25ffce48c
- SSDEEP 12288:1HOjFJid/k5GYXmepUModRPaZ1hX3ZISiFy695RUjdW8LxWdHxd:1HgKEGGpUDdRP2sr
- TLSH
  T16AE45A5E16E805D5D279D27CC647431AF7B2342523219BCB02618279AF2FFE85F39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  MP3DMOD.DLL
- Size 166KB
- SHA256 168282a7a04332e3d12f1eb440229c85c6685cb9af1d0f748fd4fc175f1cae99
- MD5 402795dcc28959cc89602fa6b13a229b
- SHA1 4ee4cf1fd1e9fc0c922219e6645543e10892d6de
- SHA512 cb7102350e505132aa656302a66c379c644ac2e10b1c6e3e1dd0a56b86bc4acda7e3cca5f92721cfbecd08f442477c522b7a9967b99b75895254dd74cd7b377a
- SSDEEP 3072:ejbf3E1OyTuMy3rdzHA4MS0ryPJprR0PfHqICXVmM/vcF:ejmO3My3rdzg4MS0ryPJpriXKICXkF
- TLSH
  T161F36B89B2A515E2D1BD607CC497872BF372B4505B104BDF13E883792E637E45E3A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral2
- Target
  MP43DECD.DLL
- Size 287KB
- SHA256 e10aecb1df866371333ebfcd89860b1b57ac3bb25ce661155e718a378330dc4d
- MD5 96b1f192dd6b127d624b1fcd26872007
- SHA1 4edfd2c6c2b0dc1b2dff61fa9ecbc13abf48ccf7
- SHA512 3ac312ef0cf916dc2d951115794d415d253880af0750a4313879dda1888150c9c9f2cd51cabf90b434a17403f17ce5394c6f02855d480ccaac009706526c892d
- SSDEEP 6144:zBY63188o57MJmDi+OPiZ8DGym2YA2KEWESN5MI9RWClnMot4:zBJ31y2YA2KEWESjMQnMou
- TLSH
  T1FC54E647A26301E5D16F423B8C7647269271BB48BB2306CF57DCD2247A53BE3663738A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3
- Target
  MP4SDECD.DLL
- Size 425KB
- SHA256 7642c9749bdcee5ae0eae643e9d083b5ffca6598317f43330516e41b20480dce
- MD5 f75002ca7cc7d426dd66a25f3ef81dee
- SHA1 c5b5dbb13399d4371750c07f32803b0e727d2145
- SHA512 409a3cbbdcfb9eaaa1f9e18f427f15272d1c1dbd855104dec51a61e9229fffa9fe2157c2ee5abcbc338b5b93968a8c9bf3103d0bb4afcb79b19dd7d848ee2431
- SSDEEP 12288:eRrAV35BlQYT2+g4+SuKdj8EpEhdlDjZOd:eFAfBlQYT2dvKoEpEhdzOd
- TLSH
  T1AC942945E38B01D4E52F417B4C66871AC2B0BE09A31396DF47CD75682A33BD39A3B35A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral4
- Target
  MPG4DECD.DLL
- Size 287KB
- SHA256 620dcca0a50238936f03d2e36f5291bd23b49dcbd1b6911dbdea129684b10a66
- MD5 134e1a11c9163ccc72ef355f789c63d4
- SHA1 5c7876d1b64a2b55fae360ea71a4224ddfd55908
- SHA512 f2ca33b76f9480252eec75cf1a817ddb0b0ffa3cffa98824d51110fd9582dffc4830a18065bbb813325bb1f982cee1b67f7e9273602f72a301d731db40bb7795
- SSDEEP 6144:j/PxfKYOGi7MJmDi+OPiZ8DGyGTYA2/EWEpWRRWClEMobS:rP9KYOTYA2/EWE8FEMobS
- TLSH
  T11A54C547A26701E5D16F423B8C7647269271BB08BB2316CF57DCD2243A53BE3663738A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5
- Target
  MPSSVC.dll
- Size 1.3MB
- SHA256 7c1be89f33000f3fef08b5cac07aaff603ec601ea7e4e776cae4cc91fa6d3177
- MD5 0f98bbc466a359fe58e4c58c6fbf4b51
- SHA1 0e873889d1876707611d68772869c0ddc5583e0f
- SHA512 4af8e7c0e61202b13e6df3f72328c7b833389c1c326b37bd0112738043bf14bd6f4645b1c7e89299789b9971e8c77036611ba1a0e897d00546f93009428026ee
- SSDEEP 24576:UpUX0B2hOBTNMa3kJR5xxXGZdiuDtvBqo3tR:9X9hOBTNMOMxXsdiuDtv8odR
- TLSH
  T167652B2EA7EC4069D47AC274C5674725EB71B4396B208ACF20A4823C6F27BE54F39F45
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Microsoft-Windows-AppModelExecEvents.dll
- Size 216KB
- SHA256 10c8c602f34ef4c8cadbf46f40267d60254a0e8b38ec5dab1da19a1559585fca
- MD5 0688dfdb676c58c0f6eaca5f74f0798c
- SHA1 4f297725192482417688cc6059d675035466eae2
- SHA512 e7560d3a3b161c04543ee6c3927a2db0f0c04ef644be9aa9a760f1e8dfd8f336a2dcafd7290ec2e2f0ed84f478b7ebf537417e1e23f59db9790d3cc004df85e2
- SSDEEP 1536:L+bXHT1d7TzPJRT7K2/kPUVnrf2nx6S08pyFxnL30e6BreeKYPczbEdmKTHXWW6:LcXaeEBreeKYPczwdXd6
- TLSH
  T1F0247B436AECDC19F4F78B70AD7A896573327DAD9B21E52F3085136C6C32B409EA1316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Microsoft-Windows-Internal-Shell-NearShareExperience.dll
- Size 228KB
- SHA256 6d800a4f8264dc029b45ded6a4858a34ccdc42ea759a04869370abb8e582a22f
- MD5 b859ec4d91d4edcabcc328ff191188cf
- SHA1 b3ba7284a7e4f17f897cbe716582477dbbe7b917
- SHA512 413ff33f30572127768914bb18debb2d9af1cce0c2670682c4d335262f7dfd19ab8c7aa4ec32985d0acea5ad4481dc8c8628409ead94c5cf00e627dbe93a80f5
- SSDEEP 3072:OqkHxWVkYXO5Tamhx0misvSNrf2sUCcIodRQsApMFvDT0DeKgf:ZkRukCO5n9PxxP0iKg
- TLSH
  T15A343A6E26A904F6E5B7E13CD9C34A0AE2727465573292CF0294027E0F17FE8AD3D761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Microsoft-Windows-MapControls.dll
- Size 24KB
- SHA256 b755809b0906e9931ae0af2f32b2bd932db1e53b7afcf23aa31be4be566af438
- MD5 bca2c45159ed628d8bcf79a28d3f3ddf
- SHA1 73c92f6901554573f2dc81f7a769e0e2438cb982
- SHA512 89623e30b5c58f6bec4407b653796e0ca9ce7b32c3806095cc46ab04f6985d596eca9b0f08ecde303818a2628447b6dd351129fee5894daa8b14c3a196c88df6
- SSDEEP 384:zWEHVwWg80Jtvlvs5fqlSaVMaTfOS4ecN9dbeYbP1sNsNaN5:LE8mtvlvsdqlSFMOqkvbeYbP1sNsNaN
- TLSH
  T155B2BB0B73ECA519F0F75770E97E81662137BD6AAE21C42F7090275D29B1B018EA1B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Microsoft-Windows-MosHost.dll
- Size 16KB
- SHA256 2b978270bc30ba0739e59647f8d4b845d273e0a12ddb1d4068dd9916fe7405aa
- MD5 6b81581ce06104184759fa3dac05fb20
- SHA1 459b01a8ae4a11e5dce891856753e08807c95a7a
- SHA512 27cfbd254ae935cf16670e57d4d608498d9af1763b06a5e7a441f00303350dabfc7c3610b6ca686a6d8b53927ecf1d09d95df067660fde250cadd168aeab4bbf
- SSDEEP 96:YcvEWz4VJWwFwSKR+rEDLULpa1EuythWSySlZSzflYCjc5k:eWz4VJWArLpa1EjtDySlZSL3c5
- TLSH
  T19D72470717FC5A48F0B74FB5997787252731BC646A26D61E36A0122C2CB6F40BE22B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Microsoft-WindowsPhone-SEManagementProvider.dll
- Size 12KB
- SHA256 4addc972c99c21aed28051ef1960310c82c4196eaeec732f390c44f240ac060d
- MD5 a00c674191e7495a1d3c5879bcbdcd67
- SHA1 997c557b3ea8a0a57c9c1a43c3f4d135dd02154c
- SHA512 904b3da533bcd83902b0bf250404e57b05daa8f08a0de3e1bbc27efbf9d793692f9860a21d3145fe8ba79c4d5ce950220cc0853bf07f021f4ab51e25a28f2545
- SSDEEP 24:e9GS0zo/5mNNR5LIZW0THDOVocNOTMOVOcCOVa35WWdPfPNC:KIkudLIZWwHm5Ovv5A5Ww1
- TLSH
  T1BF425B4583F80639F4FB8BB558F75A2B203A7D189A65D79D0A54111D2936E10EC71F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  Microsoft.Bluetooth.Service.dll
- Size 3.6MB
- SHA256 6a1e0b0d86b2681bf68efb610706e2ddb1bf09e57992aa687ab13de8dce91c1e
- MD5 d0a80de18469858b3c7133c47c0e31cd
- SHA1 a7e6bec0b66727b6cf053392aa3622e2ef368777
- SHA512 1a64238cffc9e13326b3818c2e5efdf5f6bc94337fd6e0a9dac6cb40bdf6fed5e011913b1cc7541d496d8ffb82ef4e4754bc35b202f11fed6125d394e5cce639
- SSDEEP 49152:vbpAajlhY/rEl3esWB6Uzy9/zLX0B0K+zBZKQMAkfkyiq5LOJwjMMvTqfsa0PNvc:vNWo0p1Pjh3lSZmtVinB
- TLSH
  T191066B6F95AD40E6D5F9D2BDC24B4A1AE3B138560332ABCF092142991F17FF4993E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  Microsoft.Bluetooth.UserService.dll
- Size 572KB
- SHA256 daddca135446fb67192bff8b5e58edfd2bcb6945e0189b383e57a233c3531530
- MD5 1837d1eca7454595828b6534389b30ae
- SHA1 557f59e34a9ad795aebed130fdd9505504b2d940
- SHA512 d9ff3ff85c44f87ce80d9938db707ee9e59028bad892edbf669c9385a0bb6bb122966a38a2f80d50c91500c7f3fb936bb0a5782af6d97254e09aef1589b3817c
- SSDEEP 6144:R9sQKAa678iZntY9oIzF+m7oK663/ubYEPAlzU1Ha4TB6TTW5P:YQKAb8ytYCCFZubYEPuUk
- TLSH
  T1BEC45C6E92AC43F2E4BAD2BDC597461BF2B138651333DACF0560419C1E17FE8993A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Microsoft.Data.UsageAndQualityInsights.dll
- Size 1.6MB
- SHA256 725cdf72c1784c34f65d213083d26a0ea3fe4e449875c8c33a127b29a2843b7f
- MD5 07bc31a3a4c18dcc1575f4ec5b1d4f61
- SHA1 4353d2eca4184ebcdbb633fa7b54461c8696e52e
- SHA512 0f3e04591cb7fd7ea5365e89c282cfdb4dc1e1d86b09b9e5b3233cfa59b173c9dd50ecf61343e931b12cd07e4d9b5c26c7702f47a82bf50e5ee45b147365e36f
- SSDEEP 24576:QicV1X6YirkcoRzU3lv+WEhcASy7w9Vm9Jex0L16h0lhSMXlrqF4+o:mVVxuIzqgh04wbm9Jd2S+
- TLSH
  T16C858D6A62EC00A9E0BBC27CCE47960BD7B27416033153CB12A486AA5F67FF5563E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Microsoft.Graphics.Display.DisplayEnhancementService.dll
- Size 1.2MB
- SHA256 66735046a32d9224b49a876b3e4d11dd69615f548904c1431e2f855a657031a0
- MD5 f2c6c7edaa908cfce9953269d4c2ac9b
- SHA1 2ca7f4927526a79df12b6ec47bff4cb849092baa
- SHA512 9b2ddef7a4caf6474b1384ffe7fab82058b30a34b3cf2866f1209f6a7ed48e3ddf145185a06a5ec5740bcdc7a7d51de0936dbf6ee36323f0a561d61ff499ebd1
- SSDEEP 24576:01kMnwLZc3E09Pe0Re+MeR4h8P1otBUcVi9:xOwLZc3E0FQTA1otBFi
- TLSH
  T1B8554B6E96AC05E6D0F9D2BDC69B4A0BE6F138154337A7CF0561025D1E2BFE8463B720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Microsoft.Internal.FrameworkUdk.System.dll
- Size 632KB
- SHA256 7fcfcfd61636f53c5aefe5791ac727f7f04f27eca488d9c6829047c79a4e9185
- MD5 6fec908e1bca89e1cd47cf9f4acc5cc0
- SHA1 07ab03d9983b21bd28dc99d0ac7de8f6c28d2b5a
- SHA512 076fc842e3727157a775ec32919a38bbadcfdc7f9fe3b262157fb5fe26b367a3caa0516e475f1e00303fc6d001ac4828c7051cf9cec18b034a4043c7b8e1ce9a
- SSDEEP 6144:e01AktXQJMGZmklAh5vGaFK451hYTJCP+WX24L0:ekdmmsW5vGq5Mg+C
- TLSH
  T1DDD4645AE9B952E1C4BAD03C9183712FFC7134A6837457C3E6929A4B4722FE4A73E740
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Microsoft.Internal.WarpPal.dll
- Size 110KB
- SHA256 2198d61c2bd1b8a00fefc9349acc60cf4b4c00499245af4e77ff451eebff4ffd
- MD5 758a0d3a62d27d46290fd01a4689825c
- SHA1 2107cb1b649ec26245f6c1d43e4625321ac84ff7
- SHA512 8acdb9dda1f58495b94a634c75548120ad66a7cf114e38011f6b60630cbd12f2b2a21838d3ae568e75cdc2c0ee336d35e5dfd2a79c80816f574fbb1d3ffa70c8
- SSDEEP 1536:vFV4gDRoRuUvC6Vo6Bl4IuXy1GvLXgP6724zC8:j/WRBDVo6BFKysvLXgJ4O8
- TLSH
  T109B3C55AA6B620E5C5B9C07C91C2712FFC7170B6432467C7A7529A5B0F22FE8AD3D780
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Microsoft.LocalUserImageProvider.dll
- Size 136KB
- SHA256 c9d58391fd2ff15c7b8e43aed07870e63c986a1b7fd2a6984cc4ee277045c0d2
- MD5 392e2883b3b5e5a609aef39ce89d4dc3
- SHA1 46dc2cc8b6b51bcf41e9cd7f596739451a0879ca
- SHA512 6680c736f70c9a193970d9035c9bef17404ecc88b45668145be3f65e09f53191ac34ef743c0f45484c06cbab81964413645788449a8403522959ad4f83a2fb93
- SSDEEP 1536:V4o09mxAKfrDE+Ozh9oQUc9kYnaMjTnZJIoghodf1b2b2kJJcN+G3L/xJjPQNCSE:21CAKXPKBvLa6FVC2ZL5Jb2vWRl/vP
- TLSH
  T1FAD33A2E76A910F6E136C07CC9934E0AD7B27465132253DF4290C2BD1F97BE4AD39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Microsoft.Management.Infrastructure.Native.Unmanaged.dll
- Size 40KB
- SHA256 def16d2337d3f3532d2fcc5d04ef7551e778a800c853d9e44d391da2e66f37b3
- MD5 dce679d763b767ec9af03734f7d278ad
- SHA1 ce327dc2d51f8053f250cac8dc052f4ebb0dc0aa
- SHA512 9ea3190bb609cb7dca2fb982619a64622b60c85276e7d694efb2560fa7c9309bcd270b048a6b7fdc74de3b97ba588d1548eff4e569cc7e7c9b511018d1b80d3d
- SSDEEP 384:9cWsyrr5i7TtilFPJr9qd5IemWH0eWtE:uwVivIw5Ij
- TLSH
  T1AD03F95AB33E11DAF972E27D80635A16A43674150B06A7EF0230C35E2B77FC01E35B66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Microsoft.Media.PlayReady.Appraiser.dll
- Size 430KB
- SHA256 17c9f43d65f213a3d819a613d08d59af9d0057c6f4540d5a1d43955b73bbcd42
- MD5 4430804db2971477cea7052ba3951e46
- SHA1 258a54e5b35d00afddd7393435b0747ad294bc83
- SHA512 5f6f22a53d4f5000a1425fb7f70f97e32946cdeb89af33fda956a9451716d768d2b387f911b9af2a4409d0b3278eead044b5534cfeb355fc226b1e74466948da
- SSDEEP 3072:dmqZASGfGM1dTA8TAxHC7HfDoM9jU1IuGyX4ccLPtjHlrhkDLlj83Kf8WjXOGYsq:dNnEtOxHmfD1ubGyXitjFr0lyOOfB
- TLSH
  T1A8947D96F7A055A9D97B923CC6974B1AFA70F04403208BCB01E5D5EA2F23BD5293E7C4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Microsoft.Windows.Storage.Core.dll
- Size 15KB
- SHA256 df86a3840ccb4b2c0dfb1ed6299736843fdaae7928d23e552fa1d2a358cff0d1
- MD5 5b4dfe1d0df802fc9e5022422ba6b57d
- SHA1 e0296e452191a61c650b8f152be3ff1ef08859d5
- SHA512 5879036e5f236e11c7dd78296454ec0f01e8e39556dead3362674d7b94b550c4ef76f0dbac87a1a8f313c28f98c5862e0830d98977ee00dcda6bd8b8ddf0bcea
- SSDEEP 384:mVplRcldeSWtdrmYvZPkPe7pp2Jqk6OEa7PGd/YW/0W:mVplRcldedpvZ8G7psJqk6OY
- TLSH
  T10B62D84EB7D41326FBFF0BB855F3060423B5348398B5DE1E5485014A293EB484A66BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  Microsoft.Windows.Storage.StorageBusCache.dll
- Size 14KB
- SHA256 a82f30a8cabd9f31a0ab5a53d5908150c67e9e5bb3ac76ed075622a564d5203c
- MD5 18e8b4ea21b495dd1a7f2990d169212b
- SHA1 015b8ae284f65369fff657e987e2fba276f0a539
- SHA512 3cafa74184a38cdcd0cbbc4be9a9fbdd47e712ae0729c71e046183396c3a535c3ac9215610d9c05aa1a290f06803d4a89e0673b8b2ddf08c4b2f40461aed19e5
- SSDEEP 192:fkWwesTtNkiAN+fxymWXXXpkkaY8J6sFEGcqKzDFxLK0CF+2JtCyN0e0remWVGW:PC1Q0UHyNB6+KzDFxTC02JtuLWVGW
- TLSH
  T1D3620AD16378433EFBAD4E35A7635222037AB2966922D62F6950990E3F1F3091314FE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  MicrosoftAccount.TokenProvider.Core.dll
- Size 712KB
- SHA256 b11924ea9c0c6745d84136b4cc5bb988e6c9234653d4f7c1d2d179efe8f5f1c6
- MD5 668b0e5cd3e99498d87f5f195c697f6a
- SHA1 179638c11d73ddcf9c5bae752cefdb1fab347491
- SHA512 2ceb5bc72ad230d833769404652a846d993db5246dd4f6c3a66c989c343e1679399b8dc9df31dd5843cb6302b5c71be3d3e8b930227f5aa3aded5c218111828e
- SSDEEP 12288:2tTxXDPbT0dxV4YBDq2ZguN0PazHkCD2qW41cuJbpEFHj:qdzIdxzBDq2qDPazHkCD2qH8Hj
- TLSH
  T158F4296656EC06C5E7B9E2FA8A17891AFA713805031196CF0260425B6F7FFF49D3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  MicrosoftAccountCloudAP.dll
- Size 340KB
- SHA256 64da3f28751d9a411779aacfaff75872e081fb79742e219395b885e26322564d
- MD5 8829507d32d1a8232331f1d07f9b468b
- SHA1 ae1e994c7920efa71ff2aa374a50824fecded1f9
- SHA512 96aa4c5ada59a8a27c9521211c66d9c69f8b485b7f975207938ebd9e44058f9d3c1f0eae914db3e3a91392deb8a1fb0cd4ac71c7a4c2930b29ec2415042d22e0
- SSDEEP 6144:F25XR4sBxmkUqlvFzwquaiypkCTHKSXbmRMXUKDea/nzM8t0HWWRr6cE7tGo:o5XXmkUwVVuaVpkCTHKSLmR0DekabE
- TLSH
  T1E7743A2DA6D600E6E577D17C84A34A29FBF278611321D3CF0651827D2E27BD8BA39F41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  MicrosoftAccountExtension.dll
- Size 484KB
- SHA256 a11ecce4bdea3f89d09b58781e02e4eb2cff50f4326904e46345a8041e30c726
- MD5 6c2b8b560711839b0f3c31fd77edf9cc
- SHA1 3f66377d3969207c89ccf1f48cb20d6011b5b83b
- SHA512 4185843b9376dd9ab627015dd44bb225af70bcf4d3a51791b331f1bf82716620926ccbad9fffca565c1111a6cd12529654aa5cfdf926e860841c9f248a2af1f3
- SSDEEP 6144:r6S73Vfb9iJnDO+JkmLpmWEruNh8tqpUM5dAeXzM8EGOH0MmQZDky:z73VT9iJnDO+JkmLAWEruNNpL5aB0AZ
- TLSH
  T11EB43A296BE904E5D57BD27CC6534E0AF6B278500732D7CF0150826E8E2FFD4A63AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  MicrosoftAccountTokenProvider.dll
- Size 324KB
- SHA256 fa0264a6dded32e7b6931bde0978ff5fed58b06e752aa47e10c2f412ef607714
- MD5 afec51199f8f11eea2e62e5ae828a1c5
- SHA1 044661f4327f2912b3437c013b37585800167de7
- SHA512 a2217bbe0ca0d02b254527d99942b35b49ffc1e5b7cc8b061947e628f4a50e0c9524c13c04071ca04449a02b7c337c8c48d9966bf7509dddd36246a0167dccd1
- SSDEEP 6144:iEQ4eQTfft8cbi11wa8UUEj9Mlt/t7CF5n1dTb6HzM8+C5A8+YyMWjJTj:iEQSDft8cW11wa8UUA9Mldt7w1dHTN3
- TLSH
  T1C9643A2EA29500B6E577D17CC493061AE7F2B8514722D2CF0691837D6E37BD8BA3AF41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  MicrosoftAccountWAMExtension.dll
- Size 660KB
- SHA256 c0fcd3b0a35d65014221e9945306f5e211ab3cdee9b69f5e0f88b990be7d0b49
- MD5 75827d9d702823f013adb55925e25f27
- SHA1 f792053229399a12dc99742b4d19d1614bb715cb
- SHA512 05fcdbe936fa46a29c07de3559dfa1681efbb668b52d60cc480c5a9d959a32e5111f5d7447ef10d41b46638ff2b214776eef53c7f3a59e68ea2b1516d64c46b0
- SSDEEP 12288:cPiHTDWlbHmSmGStbtgLuWRXz4Fye34fNgPCYlWDWCoIHWN/Zw97zklOfUMy:cYWlbHmSmGStBgLuWRz4Fye34fClW+Ia
- TLSH
  T1C0E44B2E66E800D5E1BAE17C8553061AF77238224332DADF0651827E4F7FFD45A3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Midi2.BS2UMPTransform.dll
- Size 96KB
- SHA256 7f5aa41af972dc124b9c27ea0d6bf14d6fe30d14d7fd6066f25af419329df09c
- MD5 e82de7e875e4317f1851946de71c17a7
- SHA1 a9d88361d3649cd0ad02f57c2325897a2e9081e5
- SHA512 c922b1eabf548f00f84f72a3ea70c292ff18745076ae4d2014722c9335735728c0d45769acb4f99a663751fe917301b387ade214b839f7fb04de1706f6649a0c
- SSDEEP 1536:FWEEzjbtiuUfa1uE1mNhoNs8uTdu9XMIb7/pU2zQGn4NC4ng2MoBkD4MVa:Ft6qaIEeGs8yeMI3pDaNCSgzSk/Va
- TLSH
  T171A34A6E76A820F6E57AC17D89934A08E772F025170253EF039081BE5F63BE46D39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral31
- Target
  Midi2.DiagnosticsTransport.dll
- Size 112KB
- SHA256 e92ea4c85fa66654a9fdbf661aef50cb561d6f9925f85005aabcc6f53af0c603
- MD5 74bc77770d6d43419d628a163e04e028
- SHA1 b434e3b2838a377b0476fc8516f7ecbf0ceee717
- SHA512 b14d2649fbbe25d6239fca5d00a2b96301f3e1c736591aadf7484d31099da6912afb8862dd3de349504f852ef456720bcd59cf326303ca2fe90652e0b01a565b
- SSDEEP 3072:UH7ZRilTRzqP2GMTPowsOZ8h8bSJ6pwJPi6:e2TRzqPVMUHOZG6uPi
- TLSH
  T1FCB33B6D76A820B5E57AD17D89930A09D772B035131257EF039082FE1F23BE46D3DBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32