4ba344b1fe6be392887486707b705fc845f6fe8e32c196f688431a03581584bc

Sharing

Copy URL Twitter E-mail

General

Target
4ba344b1fe6be392887486707b705fc845f6fe8e32c196f688431a03581584bc.bin
Size 18.9MB
Sample260812-b7nplsgp6t
SHA256 4ba344b1fe6be392887486707b705fc845f6fe8e32c196f688431a03581584bc
MD5 5f8fdd2ee6d5d58bbd38b68dc4a3d3a4
SHA1 60637d395f94f183ef172ad233d277b5ca486652
SHA512 695d0c0db8038ebd4c990e7e368cf37bb60cfe9c18719817899ec707f0fd8565790a96866cfebc6d38f3594b865bd2294f3cd544bd5dc16940a6304f5431eb79
SSDEEP 393216:PFFnL7yuMVgr3qYl3FXwUiF6EBxwpuENya6ecVJpIGyx8RDJ1N40:P7yuMw35FA4Amya6VjpyChJn40
TLSH
T1C41733BFF8382F91DF7FE0755280B8A5104FFC9A1D960E432E13A844E2A52E5AF415D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  SysFxUI.dll
- Size 404KB
- SHA256 cc1540bf367ba7da8cfed9893ce57aa4694edceb4325ac2239c207ba71aeaf2b
- MD5 fbb3e23ea71b0acb64bd1f4fdb3ba76b
- SHA1 7f8469f9e2e8d385e64342073c344c7196fc8a2c
- SHA512 11d95b5cbadf0b52f49c13093b2d6bf514deabf9adc111e7e104ca63640f9b8c0cfd9bcbff0225465ef7af59e2d3b8978d9afdc481f71b0b599df8ff7c514d42
- SSDEEP 3072:es/gZq7ftaUGFJgSKhCm1Uw08KbbaCXuBpyedxZ68kzykublsm6zUfa3xd5q:esIZqrwUkJg1MkUw08Kb+VW6hbf6zQc
- TLSH
  T11D943A5962F900A5E1B6D23885A34756E672BC216731A3DF03D0A27E5F33FD4AD34B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1
- Target
  SystemEventsBrokerClient.dll
- Size 60KB
- SHA256 e43b7a414c523d283460130a485f65410c264c603b994bbdf5b193251ae41d4f
- MD5 0779e4f140de1d35a9e0cf767283b8c3
- SHA1 3d0ca54b389851b4b94a6572a4ea4447077bc197
- SHA512 87872dcfa819ece2f785bcbe1c6bd0676f73d3416387d6849a5ee784c8b2b74e4e96e1de2a6b7e3e51936e088e6ccab4a3f370718f8d144757049556a3c8f978
- SSDEEP 768:yjE78819U7KTtP1ZYzBphZwUUQW7gqe5A0NE:yjE78819U7K3WazyA0NE
- TLSH
  T1CA533B2E766A1455D9B7C2BCC5A34E16D2F6F9A483124BCF07D0CA6E0E367C49138B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  SystemEventsBrokerServer.dll
- Size 260KB
- SHA256 8b31c62a063b3eb823f4d408fe9937dece40ae417695832ec91fbdd2eb4a17f5
- MD5 5bb2fdec8913dd68f833f684cef6ee65
- SHA1 f2c9338f0c95412f86a1f0b00d675020ce781fde
- SHA512 9348199f63b32d57213fcb435a2c9136405a7e70ad0092b6972fa3e2c26c4fc6836bbdb37ce34c4d390dc15ca857ab1b9b82d481f6cb41f08c455cb4cc80ebcc
- SSDEEP 6144:UJ4aoraYBOAy35LGUaclW4fFNbzLsDNxIJ7vGiOG:i4XAKiW4fFv7
- TLSH
  T130443A1EB2ED0DA1E873C17DC5938B56D9727C652721C6CF0660827A5F27FE89A38B10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  SystemSettings.DataModel.dll
- Size 1.3MB
- SHA256 0588b40e1830b9896897582a8bc8ffa1f125b4a186b7a2b35579862d17f0ec52
- MD5 7cb9ae04730573b5f1c20c5e6c0282b9
- SHA1 7ed2460bca305888d104e564985703b150d3eeed
- SHA512 95c866c13ac9a43950278903394da96182d6a7c017ae042b3c5153b6bedf5b144b5cf6832f1b62d0b964ebfe907c73bcc2c7e31bc54729919745a68f95bad8e3
- SSDEEP 24576:zzjlZPFwwkDGpfjpkMpG32WKgsLC/st7FKzMp87eTsK:nrhj9K2LLuEBqeTsK
- TLSH
  T16055292E66EC0165E1F6827DDA63450BD1B23C156B32D1FF0582126E1D3BFE8853AF26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  SystemSettings.DeviceEncryptionHandlers.dll
- Size 228KB
- SHA256 98b4914b519eaafe7a3f596fa32a10241b325f6fd09ef9d8f8096918d3b0ac30
- MD5 e023d6156d7f050e5b53682ddebd8165
- SHA1 3f3d7707247c912ed4d98fec9c40e147a309e727
- SHA512 7377b4985610cc58ca5c4cda9c749dc98f4bb76712664a3cc320f1c39c588b30264e6621544302dbeadb17270c0f88c310aee46a29dc34fef72faba0b960abf6
- SSDEEP 6144:Fce/g9qur2KEcJD8MVodZJhvvZiI5iqRb:Fce/gYurjN8NZPvBiEPb
- TLSH
  T1AD344A0D26E80CE9F5B3953CC5534E06E5B2B8655312A3DF02A081BD5E2BFEC653DB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  SystemSettings.Handlers.dll
- Size 997KB
- SHA256 8c2590979d6a60d07fef06d45236944747eda2aadc19d104043128575e30f66b
- MD5 5545a5080dbcad2a7cf75e2cdae78c64
- SHA1 a22b2aec4d0edff6d7a95b86eeaa7c709ede66f4
- SHA512 06c15f14446e6c38a056d44c6b0f7bc3f9424e84cef569e06de2dc08fada74e2b12efb6774d08f6704711e5a0d38d0d017a62c5ebc989488955b71679fec3558
- SSDEEP 24576:qC8fj3jEo1bexqZfXqHc8FEehiyp8Hm8:qnzYLSi88qsiw5
- TLSH
  T18C253D7B5A9C01C2EA79A1BD8D678706FBB1349403519ACF0660465E6F7BBF85C3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  SystemSettings.SettingsExtensibility.dll
- Size 165KB
- SHA256 1c3de4379b961f1038046742652b543f57087d0a9d08057b4f35b72fda53dee1
- MD5 555a64bed06dc44059411a59acd9d4bb
- SHA1 7820420c75e70a2ac14405a38ee98e99590c97fe
- SHA512 2fbf8a49a585cc96a1c153b4f4d6e8c46718e4221b12719a0b7ce3dcc348b97ad8787f413ff8efd8ef43c7e9bf8ca2a86c407385c6f2e04705a168f268bcb3dc
- SSDEEP 3072:4UzthhUOFSSxpvGJxWjNJusPQVluw48Eh+bCzxBsVpNzRWfZffjSP1hg/YC0:48HhUO4SxpOJxWJ8Kf8Eh+2zxBa1Wf1K
- TLSH
  T1D2F3296E36AC00A7E675E13CC9D34E0AF372B495172267CF125042BD4E27BE89D39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  SystemSettings.UserAccountsHandlers.dll
- Size 576KB
- SHA256 2f59d1706defe7b6ec188d4abd7c7fa3cf00cb06e5adf23e48476a6e9b4059d2
- MD5 a8e9893b1ba355d1fc79633c14037b4c
- SHA1 465f722656eb08f4995a3a0cd26f3d1b8f8dbe75
- SHA512 76f96281a7afd06785c64a9005a8cc4069e797a1b06faef990b371ea0780d7f87f9db433a754968a1ef030840840898160f744b7ee04e14bf721a9cfb7b148d7
- SSDEEP 6144:7MXA6k+ZLr7JQIPk5X/m49DLzELOZI8/VDTwHa/C/At2A9DGaGpdjxl/j0:kAx+ZLrVQZ/r0ijVPEZAt2AQaG9
- TLSH
  T1ADC4091F6AF80683E675A13CC1974A0AE7B278611763A7CF0255426DCE2FFD45D3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  SystemSettingsProxyClientDVCPlugin.dll
- Size 229KB
- SHA256 dc8c378a99b17ba7faf845a7eb846d6206a66a2f65f5a4387e304705d33e166b
- MD5 9be058796aba12650b6dd14f0be20ebe
- SHA1 e35c456c2468a3559db2fb50bc50aa0befebec32
- SHA512 c7d2a863030ccdff8d458d7760959983ad69a0a001bd2ee4f0c314e768388bfa7199739c0f6f069c8e02ec1aa65642394d220686f92cd59da32630b62ec48800
- SSDEEP 3072:6hbZdbThsrQeDynkUtu3ZjDfSKQ3RJuw7/UOJOaH0s+zgXN9yu:AVVNk9jDfvQ3R0I0s+zgCu
- TLSH
  T1C334195963E804A5F9B79778DDB68906E9727C510722C6CF0350822A5F33FE8AD38F61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  SystemSettingsThresholdAdminFlowUI.dll
- Size 3.4MB
- SHA256 76ba3fda09549730a9a7355718f9e8a4b45201300f89b6526ae93602db8a9536
- MD5 cd8543b98fd7da1ad4092dea61454a3c
- SHA1 d70be7fb78e50ecf7bd557bf03380001eeed10d3
- SHA512 f42c5db77e374adf781aefa1a49b6285152fc30e5b63a5dd4b307e3fa0b3dab1c02d1410e8dbd67973d4a0e3f9375c67f910b136e60c189397d5023293e94c1d
- SSDEEP 49152:JxMQPBy8NwyeKlf0FMulnvJG0dNPyvooT0rRHckDhyoxWJhxss:JK2YIeP007yv4Hphyo
- TLSH
  T109F50766169D00C5EAB8A17C8E1B8A0BFA713825071097CF15A4025E9F7FFF89D7E760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  SystemSupportInfo.dll
- Size 80KB
- SHA256 84f13c95f7fec932531dde35c7af2da2b2413f6b6f21ac7ce7a56ad6ff442bb7
- MD5 2485a620fed0acd7c69f791930dbdc37
- SHA1 1ab03ce7428c9835140db0ed4224397a934d31bc
- SHA512 60b9ad5c399051fd2e562c1a666f9c7684ed065447faccd3978e98f44b07d2d73ddcd2133ffe80119c50c8cd2820c8e088e4cf2f0a55bf814f4ecb68d5ef1b80
- SSDEEP 1536:1QQVkuhKI3IQ8w/g0Be3EN9HByPIY+65V:SmAIvw0N9HkPIYZ5V
- TLSH
  T1BE833A5E76AC109AE575A03D80938E19E2B2F851571397EF039082AE1F33FE46D3DB91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  TDLMigration.dll
- Size 280KB
- SHA256 a8677323d310c37fac0f08f588971b41c0d79b8b1f8effe6cd9c6d00b986e385
- MD5 be48ba2ce891b0bb8ef519ce2c37cefd
- SHA1 d6df5517648177fc49305fff3a6e2ed8a4d24093
- SHA512 f12a31ee8eacfdf5cd729dcdff6ee381b8319cc4c773a158921b688ec7abcfcd8489ebe2bfbcf7b24af2338e1443c5b23998983774ee8548471a50211a0e29d8
- SSDEEP 3072:4sJBEPhGxmhGwWNkU8oNCqszK6HptVVjJdh82jWdeRqf7b8:jJBEPhGxjr8oNlszBJtVzd2/eQ
- TLSH
  T112544C6E6A6D0CA5E4BBD13DC5874A0AE2B278510311E2DF06E0817F5F17FF8A53AB50
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  TEEManagement64.dll
- Size 316KB
- SHA256 ef1b3e7a9d4bd08d36e66ac629d136a223343b6aa7e30bf72bf715651949228a
- MD5 1813b4da286a66ef561c7d846efbd805
- SHA1 46411ab2f9a9eca1632b316f2f4a689b2cba0f50
- SHA512 a90d1647aff44797b0f836c5054c00ead5efe62faa71922ea042f8066481f3f1dd383edce49b3c4aa706b8bfa7b00f0f3aa7aab33294ebc347b7c17bc0cdd832
- SSDEEP 6144:17ce5m1HP/irRQVJLR/EPJECRprohbwY064bVNX:17ce5mhPq+V/sJ9oRmVx
- TLSH
  T14C647C59B7A810B5E573813CC8579906E7F2781607B1D6EF03A0866A7F337E05A3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  TabSvc.dll
- Size 308KB
- SHA256 583b74053f8dc487c0b5527eab02cc7835e389336dc496f20cbf824b84c40ab2
- MD5 eef8b9dfdb60c8d4d1565685b18105e6
- SHA1 9632c2c1ae210ad47303ec95378d0d31c0581889
- SHA512 85a618de6e46b5232249a865bc73aef9b16123ef9d260f7211f03f14b9a7f109ed096782179233692b12f43baf989576e1f6e7b22da91164a02887712dd5704a
- SSDEEP 6144:ZbLO62st6eewnfR5HsYKv6fEPNx3jJyUIEUKxKs:ZbLZ9eAOYKvDPNx9j6Kx
- TLSH
  T13A646C2D73E814E5E1B6C17CC5934616EAF17028532266EF06A0C1BD2F27FE8663DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Tabbtn.dll
- Size 184KB
- SHA256 df03d674eac95626026cd43b7ac1d5c74dfadaeff3d328a4f2e000920ca3fd3f
- MD5 8d254c51492f3eb7932fda1fc6f5e6b6
- SHA1 45fda0c353b19cb554dbe4306cb05bec3e60b7af
- SHA512 df08bbae5d1292f1cebfc8c91ce8286c808b3712756fade414f4e7c719b56bd664ae28124192c71f3e90df1ad24df97824a73f80829192cf8bbe687e161eec14
- SSDEEP 3072:fSq7OGGG16530kbzhKye5hMHjlevkOeO/7lrP:ftp165E+hO5h2jwR/
- TLSH
  T17E044BA922B410B6C56BF1388943471AFDB130351312BBEB039659B52E637D4AA3DF0F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  TabbtnEx.dll
- Size 88KB
- SHA256 16c50cdc3eda9a4ad0e0c8929956bd010d22e3be06055e444103431a2bf6d2c5
- MD5 d9c2ae1e0817520cbfdf4fb519f1857d
- SHA1 cebd15abb9af036ea1ad47a7eb3984f6e67abcaa
- SHA512 de3c4b874249ec2b3f3b71f10bad944a79804d7790170883d267e4b92902a471c99eccd38c21dc7bcda89d5b91cfc523e62e30e70c135465313a94ce3782b222
- SSDEEP 768:GfLgA28xT35+/QsUJavNW8o0yzxp7evb8I5moVt7/5wcoSLc3IjrOE2OfNCbAfzC:IpxdQNW8on7YlRbVwclLZjrOE22NC8e
- TLSH
  T1A8933A5A77E920A6C136C17D86834B19E6B1FC101B2257DF27A4B3AE5F37BD0A934B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  TapiMigPlugin.dll
- Size 89KB
- SHA256 3576b7a2ab8c019dbfd19184058ca018f0dd4edc6d58f7e8cb72116ffbfcaa88
- MD5 8a468096a8b74d3a017761de1f5d8653
- SHA1 fddab510aabd3b02586b18b60560e351b4c7de9a
- SHA512 81e2a3579169397039d601f9c662ae97b332d78c2e6f55e1d671a97654655edbdae00e38b7e9617b1543fcec79a50eadfad49f8edf2a572c9ae1815f69d0f1f8
- SSDEEP 1536:jgyuZaaW+orCi9wYkaGFO3h6NzDIl4UaraPJzc:jHuF4rCi9w+6PIl4jrahw
- TLSH
  T1FB933C5D26EC20EAE17AA13982674A0AFA76F165131117EF03E1827D0F33BD1E938F55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral18
- Target
  TapiSysprep.dll
- Size 40KB
- SHA256 9a9beff0ea0aa410a52be9f32dde434aac3081300bcb6968b0a92532b6779540
- MD5 4a9848743c4791326021b4761bd77a53
- SHA1 c4a60735b106c6eba001e2f965732eef9439064d
- SHA512 4721fdbd4b9293dea2251852a93880823ab565f1190c5d87b400c8bd7fcc213737a0d662bd558ad7dee2af8606b37a9ed9e2456e64e169c8e197a7e7655fcc43
- SSDEEP 384:B24d7GXga/ojL1oYQaNlh0sSOGg8ZNFXWOkbW:84d7S/o/1oYQOlVvgQ
- TLSH
  T1E303F969B7AD2AD9F4F64B3DC5B30A0EB139B9144B122BDF4790046C0C22BD4A935F96
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  TaskApis.dll
- Size 404KB
- SHA256 f6ba9245987a8e7462955726a5d554df5f6f2c85a5ed85133718d5de1e33b7a6
- MD5 34c599f40a3060ad07c5541f094d9c7b
- SHA1 abf61412568f40bc07c28694d354dbfa72f8ec90
- SHA512 e17077c2f65046bc08e42a3a67c3376d3789179869d34c1dbb2bf9889249f948f6a259612eed0cad8f8979a331c482b2d89a97017d2822e96e201336a582b222
- SSDEEP 6144:cTvt7ebY9XvIixJlTf4Af8b9mLP8kdQHE0jjxjVNWv:c57ebsvIS4Y09mLXsfwv
- TLSH
  T11094191FBBA905A6E17A657CC4534E0DE3F1F454072393DF027402AE9E27BE4A93A760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  TaskFlowDataEngine.dll
- Size 1.1MB
- SHA256 24af5a3aaa09fd296c6d207296f8dc0194dd80269c20201168da87d932a90f91
- MD5 fc2213caff2bcca5ee6acddbffd24550
- SHA1 f698b17e37e12e5b2358eb89faa74abcc384bdf0
- SHA512 d2a53983a5775f816d85327a794dabf5625e72cf9084a0c3d7e99303a09c4372fdc4993db329169cd4d09eb8374ef618b61f9d0d68a001a10d11c21a4baa8552
- SSDEEP 12288:E4vqTZ5J3RQ0RBWDtXriQHdre4FExyiZkq53wU4O7kjmcS:TKjUtXpHdCDP7k
- TLSH
  T178353A2FAAAC0197E5BAD13DC267460AE3727C51837297CF0550625D4E7BFE44E3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  TaskManagerDataLayer.dll
- Size 1.2MB
- SHA256 fa8632db8bf6ab24717e20154a90c217f20f2dd9537019705964981abe8241c2
- MD5 8018460fe07b11bc070aa5cd3f128c01
- SHA1 14e3068d20c781e1723f4c4887724eb4f71ad924
- SHA512 00e5f2e8ee6906649c0951fc068d44f41ac92ae56368874a801acbd8a2a9809cf6056ba9a383de64a3ce0e0253a59bb592a1105355e2749807359aa07f252f3f
- SSDEEP 24576:Lb6zgk/2NeJxYh51tZnaBBh0lhSMXlgFBfdG/ycHd:Lb6WeMnquQBG/pd
- TLSH
  T1AE4529D5675C5780DCBFA37A9E83C14A9A3264A383A0C2D72159432E6D27FF53BF6204
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  TaskSchdPS.dll
- Size 72KB
- SHA256 6c6cc01b1cbdf47a3d897ed493a1a6595f839cc27ae91360d3624375a8db25d6
- MD5 d6328b9e5164979a94499056dac7996e
- SHA1 6646141700760adcf9109410f25847ae9fe5515c
- SHA512 6c812d77763bcea60de90bc9888635c862e596c640918b4568d22dba16a4cb140751b86f602193b9cd17ea7e41625a84233516a7594795f9e2b8c7834b0a6284
- SSDEEP 1536:LCbafraOlwCutqEBATHJvJaJfxkSU2S7Mh+n:LGafraOlwCujATHJhKfxkSa7Mh+
- TLSH
  T17B734209BF8188B3C5740679492B0E20E76ACE121B8647DB715C625F6FB3BC35BB3589
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral23
- Target
  Taskbar.dll
- Size 3.0MB
- SHA256 d14e0cf61704f474c923f2815ab1900c9ff0bc1bccb886d905cdd48588698f44
- MD5 a8132739ead48202d0127ca3dab88d7d
- SHA1 37cee75ab0c5d44a27a695284cb04d6ac0d4ad1e
- SHA512 deaa038779e338b4ff090e620e995ea3b9c0c4cf44a26baada2675c37cc81e663902dc848488abcdf98409b2b67d4917e02facffcdf9c7d35ecb0e9d7b72fc5c
- SSDEEP 49152:09Nre9xasWK3X/ZPA7Zp3Ug1BfqpTQelko9k8gBOeXv39Un5yXe4oJBNj:mRe9IxeTQenOXvt05Lj
- TLSH
  T1D7E538593AA941E5D1BAD17CCA4B8E0AE6B1BC114B3247CB1169335E1F37BE8853F321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  TelephonyInteractiveUser.dll
- Size 176KB
- SHA256 0e77605f3c5b4b106567c9a20be78a148eacc7584c69e34440ca6b4373ab870c
- MD5 0f68cb327b9d211e0167062a1d218c4f
- SHA1 9908a547ddd66f38334165e8619eab35219e8443
- SHA512 1dadf2f40c882b16a023c3de0a070630232e2466d52a5d0692f3d70aa8925a1f24d0c15ed8ed04dc0be683fc7d179bd7d17f78373f7686cc32dd46c20eec0fa9
- SSDEEP 3072:fHnBYfeVV1ehLUzyMCqWT0YjddLvvK6c/JC2BgY+:faGHMoORjddLoR9B
- TLSH
  T18E04086A27E911E5E579A27C84534F19F6B1F821171253DF03A0817C4F67FE8AC3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  TelephonyInteractiveUserRes.dll
- Size 12KB
- SHA256 8701f9f8b0ecf7f50c57603fdebc013ee15c776418b68a5636d0553faeaf228c
- MD5 5c4fe89226ee86205599c4e8eb5894dc
- SHA1 3727df251b24f2021db08cbb3d79f7557905f5f6
- SHA512 1c1748cfb042e780b78d7ca37eccf1f95bcca42d275251a074035a1687cf0857a67459403159d1e02be1e6112a5c018d3ed600f04036788944a372376be3f9fb
- SSDEEP 24:e9GSHQXxFyUYwOClWy5IZW0dowqPGpPcN4DnCeWMlCeS35WWdPfPNs8s:KHQhFRfVlVIZWurY4D9lu5Ww1Xs
- TLSH
  T11442BB4AA7F80629F0FA4BB499BF071665397C288975D72E0A90011D2C74910EC75F32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  TempSignedLicenseExchangeTask.dll
- Size 96KB
- SHA256 9193d03b5bb38c307a0ab03a85a5dfdd7838d13c0a1b00e1716fd3382aba2da1
- MD5 c6cf2a5f9a7d5b36ae20a614646f2fd7
- SHA1 6711ff0bf21216dc6ae9f137e38cd4f081758d12
- SHA512 a6d33bf4e47a2d2c1da7e3c2d4b814ac12a8f6b72da618c16659b510794c029bef885b5c965b3eeeedebc97f1168cab0e6fc32258bedcc0b05555f3f7b92eb9d
- SSDEEP 1536:/z3KHTnMEUjNJgRj36gzaHVxetoh588M5nWeHJ5189KJjbk9Wo7RQ:L3KHTMdNa55aHVxh5RM5nhdxvkU0RQ
- TLSH
  T120A3490D63A964A4D1B6083889360B1BE6B8B025236267FF17E1C1BC1F0ABE49D7DF55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  TetheringIeProvider.dll
- Size 40KB
- SHA256 7c1bdebbc20ba380382b682686675ce429ea15d8c682339e0fe7793b8c839490
- MD5 00dd3ff11c5fe6dacde87ed7d8453d07
- SHA1 21762da7693bb066e58c778f76d090dd732b74a5
- SHA512 39cdd9a63f615fcd23e81946b5b2a733c804e9364ccb0b2f63852c41b9f28beb61ba949cbb1622eca40cf211075a320ea655963c40e84862148e340e40175f22
- SSDEEP 384:tgnCpBkmR7Z739r6ZwfK48qi2n0MhrGIPWILWW:iCpBkK7kK90cGe
- TLSH
  T19203C65DBB6414A9F9B8863D84F31B1EA036F9144B6243DF47A111891E32BE06E35FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  TetheringMgr.dll
- Size 256KB
- SHA256 db5ddf2da2c934d57ed5fc2b4d84418a025b1843fe9cf8b2e8bca70ca8c36724
- MD5 d7315e3c92d9510be836cccd55835277
- SHA1 128874a17b42d2daa63feb2653c283c5f52707e3
- SHA512 87f3bad2c5490dcd9e2c9d274300a950cbed237f4181b32967f96f14ecfe847b4c6791f40b9d85586d327805e79350e9ce9f85c21e17bce3a8e568b3cae917fa
- SSDEEP 6144:Q1WtZCsUWzaHVmDbQIvyZOLgcCU8NC/SP:mWtZCsUWuUFyZUij
- TLSH
  T1E0445C2DA3E81CB4E9B6417888534B25EAB2B4390722D2DF12F0813D5F17BE49E78F55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  TetheringStation.dll
- Size 260KB
- SHA256 4fa308f1e5e886ad151ce60710dafacf7c6eeb9f90527d558cca73737f0d1f3e
- MD5 79f72e427af978c0b7fcae3dedd14bc3
- SHA1 7a2b84ea452bbfa71c8a9b0b49cade970f446414
- SHA512 608cfdce8edecf3d9b4f9ef98d52d57704b96b2c079043a637fe77aaf95db5fdacbfdfb7586a9b1c4403c9c2728fb37032d989a7029ca7f27a6ef0f800f1b605
- SSDEEP 6144:2B+WnF2/QzfHGyWnlmqoAjsbcjHRTGBGjOXEgzb:2B+WnFQGfglm2sgHpG9zn
- TLSH
  T155445C2DA3AC1CB5E5BA917D8983061AEAB278290732D6DF02F0406E4F17FE45E3D715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  TextInputFramework.dll
- Size 1.3MB
- SHA256 51c85128192ae0148bb4c1af6b5bea457d51b922ca2a73448065fa874d068d5a
- MD5 e85fe6b86f5fe1ba269a243826166a5e
- SHA1 3b93d476690bf695de4749f27e0ac803a59aae68
- SHA512 27f32091951ebb1862ea2e31ba6cccdfac5a140049d4d0787677845f6330938f85d8ad94ab8205d7db918a7521370104e1269b7ffa437152fc3af6bcf7f28b33
- SSDEEP 24576:CZRnYbaphSd9CmiigP2Ax9WIsCPS4+BZXXZUDSYy9NcWWIXnuzT:CZRYb0U8U3CJgBmeYcWqe
- TLSH
  T172556B2E27EC01D4D67AE17DC5434A1AEAB17050237166CB066C427EAF2BFE51A3E731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  TextInputMethodFormatter.dll
- Size 564KB
- SHA256 620cd033c8f29638d837a8621786a3efbf33ca39489c9aeb5451bf7de4bf602f
- MD5 c1db23f4fdc7511f5cd6daf7486fa220
- SHA1 f0a933f2f4e4eed5e284c05d5af21ab1eb990627
- SHA512 fd9214d8a04b37d8e661398eb1919da1cc8dcc9adc1738918a12937652ff46c3020656d013d71c3b7165dd9850a31893ccf7a6ac406b9995faf47bbdf0a8ea4a
- SSDEEP 12288:fUdWy34I2l48m2dlIxpQKE0IDVdfVfWQ3Ax:dg/8mMmbtE0kb8Q
- TLSH
  T12AC44B2E769803E1C539E1BD88574A0AF7B078111752E6CB0194607E8F7B7E49F3AB72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32