b92cc476061283450cd8118167238c5b5a7591bd022c3d26f8570d50d0459d3e

Sharing

Copy URL Twitter E-mail

General

Target
wsdchngr.zip
Size 25.8MB
Sample260812-gn21sazele
SHA256 b92cc476061283450cd8118167238c5b5a7591bd022c3d26f8570d50d0459d3e
MD5 c80432d1b6ab77abd00b66498194d27d
SHA1 76f0cd171a2a0a913f328444dc7f5b09444af7f3
SHA512 57b81201b221cd2efc0aea5af0b4124c016bc86e94ade503962f29846d2ede108bfce1e0bc4a91eb26e68045fe80b388c31aba7a77b324c3ddc54b366658dfd3
SSDEEP 393216:fNdcLV7nbWff9385Cbi77k/LbNtaV+LL+uAx+r77V/q5juZ4a/8aEiJdq:8LBiX9380TbnKur/Apubnve
TLSH
T1195733F7C2E69B54F63FC0F1A2987608FD92EFF246243A424EB43259398A34476B5354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  WMADMOD.DLL
- Size 994KB
- SHA256 eb46d990a576660eca4ef7186c5de687d8814e20994f68088f2f3da24429a1db
- MD5 ed88f1f2f0f8267774521590840b34e7
- SHA1 c2d132af09d7c56fdcd3d1b0dafb38530e691b26
- SHA512 fbaef5d27e85655eeaab8fbd6e84f79ad39980a9f4dad37adb65bd5cbf19e3d3bbe8cc48b4f3f13ad1686ef4fb24e72b3a231b418932e44b3cc59da52a90eecf
- SSDEEP 12288:4B+bdC+r8RKRVWFNBKsvUUJBJ+etGDgWuXPpfeJHcdgu0Sq+YjiNMNZt4eQbAoIo:zGN13xkHcQJjiNMNhQ0oINWaZ+2DS
- TLSH
  T18425BF43B6A559D8C5AB4138C2579727E770382663204ADBD2A0E72C1F7B7E0673A3F1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1
- Target
  WMADMOE.DLL
- Size 808KB
- SHA256 feb0015ca77a708017baeabf6ad4cfa4ce18a021fc063865cfbc48db8c2d62f4
- MD5 cff6c4b3b62694db665d6404607356e7
- SHA1 8263b0fc22c8c98564f3d8b7b979340732a77e5f
- SHA512 bd033198b811b65279f1d820b8637031545ac4628a4b7709a84fdc972254678ab3d5ceef71152b32cd1da8a6791ed531ecb685043edc441895c33c9030420733
- SSDEEP 12288:+5nzbUcyBRcn6eX+k6DZ5bigCLrvOupSKjvldW46T7/G:+eBB+n7VG7orvOuIyljw7/G
- TLSH
  T107059D52F2E949F5D5B780398297531BEBB1B04917804FD743E0C2292FA7BE0697A339
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral2
- Target
  WMALFXGFXDSP.dll
- Size 1.8MB
- SHA256 431dd5f7279fa296e31959ac24fbabe42693370ec3298f089902ab35dc2586b1
- MD5 d6e9549d0e686ebcd25919cab90cb869
- SHA1 e43146d1915da663ff2707618aa10e02205ccc05
- SHA512 cd9cf1e03037c161876716ff873a45fd0abc1ddcabfd12d58330eac72ec0eb2a3cac8971f12b19a92ed8c6436d3a38d0fb5a8533127f6b6e5a1d5fe41c73dda8
- SSDEEP 49152:PJPkNKc5Lz3AAyb4J4N7vTLzk7vXAAyKM9Q:BcNKIzlyb4J4N7/zk7dyKMW
- TLSH
  T15D85E016A6AE44CBE136803852E9B51BFE32742797404AD322F155AC9EFE7C04F7A317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral3
- Target
  WMASF.DLL
- Size 320KB
- SHA256 e6585d0268dd33591b8f363f4bfac65cedcdcfaccad8216660c648f9fc65cf21
- MD5 37eb36917ab5c8202463f3b45a048b21
- SHA1 929d451dc8771e204692311bb549aba9daa7f9d9
- SHA512 f344056cd9ebb78e557c484fca69f5d7cc7953a74987e1efb8c1a724073d144910212941fee904dc2062de3925f24988540d65ea9c03a293a387198fc8af2c04
- SSDEEP 6144:mMswdq9fTp/nrKuayJmsyQxS9Xukzy2TOpF22f7DFZSBavsTojbKQd+E9H/2m/Tq:mMsw49fT5rKuayJMuUXukzy2TOpF22fu
- TLSH
  T1B5644A4E12A465B5E6B5F13CC64B8D0BE3F1B0115362ABDB02A5025DDF5BBE0AC3D362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  WMNetMgr.dll
- Size 1.2MB
- SHA256 6978d2adacea30e0d7b220142f8fc02be50baf5d744db0ecc9d99e4f79ecc0fb
- MD5 b68218e0b1d079e05043c7e963e31bd6
- SHA1 290d2fd3e3ef148ad79ccf52262c7dde2944e5fc
- SHA512 547a2eabfd7ae18d7f32f6b59e756322ad1b08d4022d38a9fd056bdca3579242a28232a4ac619662def5d85c46d880298d4878b517bb8147b5b29cc1ced3e8b2
- SSDEEP 12288:hbQ6EfFmq8yeNYffwbiVygJkw4WFZ9vAa4FgSCnFOkLQfo+KLfrZtaav/2euxvBI:CMoegyYkvWxvAzGSWoy/qBxm
- TLSH
  T13B555B4A32E801E6D67AA17CC557820EE7F1B060136186CF1660877E9F27FE56E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  WMPhoto.dll
- Size 428KB
- SHA256 deb4a1a9ff3c3a63bd9b242c99334232525c8c9e8ad8d9b9dd10c4f8692efd6e
- MD5 8a7c21557b4df7d6e44721ff7cd554b8
- SHA1 46d238d5c7e2f628425f8f5827a55a8268afe181
- SHA512 0025852fe3484e35f87ed18f4e1afb8f71b4091fd06e228e56b983562359787f7b359b88d349a17e030a9568d97670aa952cf5dd9c2c3df1c60c9b430cb31dec
- SSDEEP 6144:lE/kAGTK0gAkoHhEpxUzmI5HLhtdefP1i39R703G7h0mFc:W/kACWoWxUKI5rhA2HSM0mF
- TLSH
  T188948D8BF6E505E8C5A7D07885A78367FAB27C4D27018BDF0384962A2F377D09A34725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  WMSPDMOD.DLL
- Size 1.2MB
- SHA256 462f598ec7e46e20b81a224d5a562f32a12631f7dcd1fab4eb8046a9b8aaf651
- MD5 719ea33487fa30fe93bbaf8b7c041244
- SHA1 f6259cf8e3118b0ac5b92f1a41f65be9fcbc89c9
- SHA512 327e6517fe76c41b47bf259ad3b659802fed36f46d877d3504b5ad0ce7e1425e3797d5d1337a17120750b71b05442cbe8eca14ccd79820e3b81f131d6a34efae
- SSDEEP 12288:feQ0pyOmy01jARKRVI12GmMQb8eYoh3taV81MujPUoIq2y00GE+H+0OMXO1dJnSE:fe7whSmMOWoh3tQ81zjcoIU/+STxmG/
- TLSH
  T1B645AE05A16D48EAC427803482EA741BFE717A1353545AC7A3E0A6AC1F7F7E05F3E366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7
- Target
  WMSPDMOE.DLL
- Size 1.1MB
- SHA256 b2ba07e8b959135b221fbe9ec3d37fc9f4ce35a92a2edfbddc40206182940f38
- MD5 ae7c9ae178189c9b10d352425e08a941
- SHA1 c8bff9c8efa0ff1438f692530bd7c002a4f15e22
- SHA512 bd0a01d6bb2dd55ea164f65151e91f00e9d8e516d55c4f20deb826be519a37879e4abb661c3f2f9a286acd8ccc864959e760ef20f1044f6fbd1667e5fc7edb03
- SSDEEP 24576:6/CjftKOYLcg+kb87CHX+vM8IVLknNbchQV:MOngTbwCHqtGhA
- TLSH
  T153358C42A2F45EE4C4AA403982DB721BFF71770A53547BD743D0D6242F63AD06A7A339
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral8
- Target
  WMVCORE.DLL
- Size 2.1MB
- SHA256 419e934cf86ae92e6ce8a8885c6bb94523d9cb332234021f8e1241f22c76c1a3
- MD5 38ac1b0b2fccd40134b4c07e91b3e4ac
- SHA1 942a7fd7e69e6d963d97c2f9bce02ec186480309
- SHA512 c0249ae8bdcd5ddb298c4f12bda30b2238fae07dc2949c7cc6109758c00ee9eee22ed1917140155185909f1cd9176818d186eef6f7092c2e349398dd2df4c53f
- SSDEEP 49152:bdbBe4Iqr7p8YIL0D5QrBU0BmRmGfwlE1m:hWNVOm
- TLSH
  T12BA5191712ED0054E5B6A13CC6A7421FDBF3B806273586CF01AC4B6D5FA3BE15939BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  WMVDECOD.DLL
- Size 2.6MB
- SHA256 298a1bebc58256840ac557cde7d806f931d06d99c7763bb17edefc522b0b0c10
- MD5 fc9c71119f2cb082cca3931bb9a559cd
- SHA1 a44153681a9784eacc0c5c63c8227efc2a03e277
- SHA512 74cb2a9bf407c9f5663b0069cbf3aebf71ab8889b0aa1fe659c214295976b63f1e6bdc9ba9129c998511867c7d8c17f4e010ac7815c5514f4f35e3991520d366
- SSDEEP 49152:uqZzwFxxQuz08Nbwuf39OBF5CVD9fQqII8Sbwy8lJ52b:u4a8VDaDvB8lH2b
- TLSH
  T1E3D58C4AF76B41ECC473903989A6921BEBB87C48031446CFB6D0DB555F23BE1663B389
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10
- Target
  WMVENCOD.DLL
- Size 2.0MB
- SHA256 fcb9738aab82e15473c4c065502eae342d048eca5aaaa91809fb9c5bae2a8fac
- MD5 9d6f3c8c37ffe5a3e5278e427d507a12
- SHA1 cda2e48ec8987b794b5a0cdb590ca4ad1d2088d4
- SHA512 359ef8c1de6ba2ef609ef7e1852f2810b63cddb19f220093b8db8a3d988e2a34a1201c3ed1cc463e92bc011f4010d5604e7d614f8531f7d76ca38eabdfcc2e0d
- SSDEEP 24576:7EM+BVFYJEWxNEXnJ4VqbHE42tyEMUXiqjosBIOa5vnv5HKtG7wiGvIh9OmxAwmg:QrQq4VXtyEvXQBHmG7fVvdLqRTC
- TLSH
  T1C8954B02E2E381F5C0BB9474D99B5257EB30380C03941AEBAFD4C5613B67AE0A57B75E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  WMVSDECD.DLL
- Size 360KB
- SHA256 5332c56ea46f1688620159bb249afeb1e26997af8bf8dc0b1acadb8473310ef1
- MD5 1ac1ab7845e5bf5dd7625dc392d2bd0e
- SHA1 b12fc9d664de0a6670778b4d36ad1567d9eafa12
- SHA512 4bfb65b6f5426f328ef975148d4a6402353163e8de15e9bb2635f677f66bdaffe2b0ff4fb1d529a7ef7427a947a65927f0d21dfb90985af909e1e144c594d75e
- SSDEEP 6144:DlAJ+M8yX++7EzM9KUxtFxa0cXK5PLIyH5tBLYMKnWCrXN/+:DlAJ+M8ydEI9K4LvHqMWX9
- TLSH
  T1E1746C4EF3A515E5CAB7803CCDAF820AE7B07898235157DF0384C264AF677D4563AB98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral12
- Target
  WMVSENCD.DLL
- Size 436KB
- SHA256 01e8f6404b7e3d27d4a37fb832de87d39a9718a177cf6c420b3765d3ad0d5e01
- MD5 be0ca707a17f9f43852b804bfbb4ae19
- SHA1 00f176584bf8c66c42141c833c86cd51d85135ca
- SHA512 748f4dc9b7ba714777e09e7ffbd46b9706c39b83734f6bef64cd678b9d0352291729f944cc608b3923f3d872a32e12c9b754deac1af2b34e4ef39ab2f01c2510
- SSDEEP 12288:+tgyp7YLyvgWktSYo1QiEgLdIQE7NypTh:+R7YQfASYjyMy
- TLSH
  T193948D49F6AA15E2D5B7E03C85AB8317E770786D1304ABCF17A082785F637E0693A335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  WMVXENCD.DLL
- Size 620KB
- SHA256 e6a3ab8717bbb42377329a9836e0c8a8c81714adac73e4aec34fa15ff75719ff
- MD5 793741d974247c97197a115d54b23fe4
- SHA1 a3134d6b838e5856aaa4e4bfc343a6282e0c80d8
- SHA512 c00da61f8ae1af61a73f69cc9e81968210444f1c750c1f4dc475ca10349fc6c7a2f4258bd42541ba8b34c56fc4b341d94ea0fb92f4f76d1bed92c3a2ec5103a1
- SSDEEP 12288:UrLeZifgpslauQZ29VsoLsGZP/DhlctLBvA82YS2P/EoEcAb4OkO2vC:UrCZ4d8DU9VsozPYtNYzYS2P/EoEc/OF
- TLSH
  T1EFD44B46F2A502ADDC7F6038C59B463BEF60BC09170426DB6680D1E56B237E06F367E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  WPDShServiceObj.dll
- Size 88KB
- SHA256 310ae96433ad22d3dffa3f249614cc95fbb9b6a3a284fe03f9dbfb9c59dd2683
- MD5 fee3dec7a5ea8499ce35d62cc9ddfab7
- SHA1 60d28b236552df1134e8250da62a3b9b5e012308
- SHA512 7a15d6c0af7ad489174a4d7ee04c3906ba47bcd261494a47d774f7fde94e4e353a7420b41ce6a469ebf73a89a10b6a1beb87133c024d3f6c1e485c8306c76846
- SSDEEP 1536:rfQUBx44xRtdZ2FrjuMksqqwBBDBrays2l2C0W6fcGSsUQ:dNZ2rzqqwBB142lH0W6fcGzU
- TLSH
  T12493082EA7EC20A9E535A278C4A34725E372F024271257EF03A4817E2F27BD45E35F65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

persistence
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
behavioral15
- Target
  WPDSp.dll
- Size 384KB
- SHA256 09da8c0e05c36ef7fe081dff27bf194e0b7916885db0eef985c3c3e12880237d
- MD5 ef2081be00d90eed80087ad2edbea578
- SHA1 d4113fe54e76819f4244a0f815a4484e5add7b85
- SHA512 8787ff76e34edfb67d16a308091453a990e4a9713c1a69c9f847c5420b9a8b6af38ff5f6de7130c428a1583ab82d895b99894bbf316fcf776d7355093a07eb01
- SSDEEP 6144:FlO9OJotvOBkh2hWUZOJnWJ73wsbeY7t0gdeh9F0ne9kRjbUxX:FsOJotvSWUZmWJcsbx7tjdeh9
- TLSH
  T1B9844B29E7E810F9D67AE23CC5935716EB71741C2B124ACB16B48A793F13BE01E35B48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  WPTaskScheduler.dll
- Size 224KB
- SHA256 5c93e022b15ffb96801f0eab72ca4141c2375e39eab9f9ef4d06838ae185d379
- MD5 4f8c3aeff0dff8da3d96474ea5ce80e0
- SHA1 9799d43e5af1c6be2a9a264458113771d238d86b
- SHA512 db6c7c2377cfa12f27dec11e6af1d877ab3e9b792a44cb1cde10fb5cc4c439bc1253a3afbcfb4bf9dc7b5874027206656e47d126a15a1bd9d7b37710a2d6cc7a
- SSDEEP 3072:orf21JFXdvlsaqTfNZ20moal2WAoKsRq+S2YOYO6SOKMMBhmK3TfmG:oL2FdHSFZ20m1nAo3qJfrSOKMMlj
- TLSH
  T13E242A1E36A510E5E87BD13CC553861AE7B27434132163DF06E0C279AF2BBE92A39F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  WSAIFabricHost.dll
- Size 824KB
- SHA256 5e30e0198d9512643b5056939beaa8d082cf8629539146844bdf60b1ea8b53a6
- MD5 58a704f0ef3349cbca7619bc9f42a26c
- SHA1 760b43f673bdc10d1a1dfd833818af6375e5d54c
- SHA512 be4ad6c4bfb894ec736881f7d551d6b514879a3e1d7ce83baf30295c7d353968c6d5eaa752a20b12c02588acba46152cef9c2bfb00bb7e7fac0342ba8c254cb6
- SSDEEP 24576:wQti+Tw0xtT1Md8qJdfcEvaQ4wxJhuBDVj:wQtq0xtBa8qJdhd4QJGDVj
- TLSH
  T1E8056D2E62FC01A6E176D17DDA534A0BE67278150334A2CF029086BD5F2BFF4593EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  WSClient.dll
- Size 40KB
- SHA256 443e5091ddb32da5a5449adb9d3d3e4fdde37e4f38c2d5a3bdd797471c80746e
- MD5 0aaf847c0d1ee307d79490bb6a1e6af1
- SHA1 fccdab4fad1c832e7eeca77397570e0926ef2dd0
- SHA512 c07ec1bb32980355f772077f4a9c2711855efbbeac15a35b4a84b62b2d908bf6e16ceca08486efff740e9bdd8001a3520efdc74d1bb8c6a4dd644071c3f4b04f
- SSDEEP 192:dDNd7DUF3WVzlEzcQxXdL9aosDWPYozW:tDnUt8zQxXdL9ZSWPY0W
- TLSH
  T1E603F987B7B00DBEF4A5067CA867090B1536F814935242DB4330624D2E7ABD19E3DFE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  WSDApi.dll
- Size 776KB
- SHA256 8c99dd857e6b733dfa13168035ce2c511060e10930b4ed36293d29f99c6002dc
- MD5 640d31dcd63810c2fc16fa3fd9cbec9b
- SHA1 ba7fe676bd6f35c2d5ee41a809e22a14380c95ab
- SHA512 aa46afb57ece678afe5191df644a3c4d066ab0ed4ccac5d5bc708542c581b55c91677f231e31a3c035cceae707335224dc82df297917d759c765fd5b8ea9c06b
- SSDEEP 12288:HVKXflNpsQfLWnq+BaJuaRRY1T2Gp5Ewg9Jf6quOxXVUF7Dnb:HVANpsQfLhLlR6q4FwwOxlODnb
- TLSH
  T1C3F45B2DA6E81094D4BAD339C9570B5AE7B174192F2066CF01A0C278BF1FFE45B39B16
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  WlanRadioManager.dll
- Size 92KB
- SHA256 c6cce2dc0b59aa7d761993f6512a3c7aafc7e046a3ae1bdff4f10e078dcc2725
- MD5 d8c7d2eaa5f8fc09f680d6b60515a58c
- SHA1 cbfebe41d89373e5e8918e532ac60d7307c41edd
- SHA512 79d2e712b8e42bb0f5f7772d041685b5dfa1fbcc75cdf9c61d53acac967e61defdc7349f09b7004f7d2204d3b475b50da5acb3edb568d3d8c48b2155ea389d81
- SSDEEP 1536:tDye31KqYgTKXVtyGn9vu0SCQmVYYg42+UsBOyZD1DMS94H:bKqSVkGRLS1HcZD1DMI4H
- TLSH
  T1A0933B6EA6AC10B1E575917C84934B1AD771B02C2B525BDF02B0837D5F2BBE88F34B94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Wldap32.dll
- Size 452KB
- SHA256 d45b1fe8d7183034dd3dc0c470f0da0b4a35670bfdbecdc7c332d4a77695f828
- MD5 4e02b65aa2c437fe69e106ec8b1d0115
- SHA1 38e53ee76573cb77d13537ffb99235a895d315d6
- SHA512 577048ad7e1bcd52121b8f53d4bd1d961a7fc1601bc9615e8b5d189390a895815ede454bbda557ff3c7773ae71122460d733fffedb794aa13be3b201036d9489
- SSDEEP 6144:KdwK/zKs32dGJXMOG2CeT2b9ZaKMqNCz3S1MDAHBIivNgUimknlrxDd:e5J8+CeCJEKMqNQiSoBIiFty5
- TLSH
  T1AFA46C5D77A810F9C123823494879222E572703913612FDB73E9C53C6E67AD86E7AF0B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  WmpDui.dll
- Size 368KB
- SHA256 7a94867041054418f2b786ae369bf1e4ed647ffcb4e0623f30f5a782b77f69f7
- MD5 8592c626a40f37e3285a3bb4a2f8dcdf
- SHA1 a724f3aad1f63c543d61e3218e4c13f9d300ec7f
- SHA512 d80813a5da6262b46fcecf63edcb203463fe50414ef74341aed167d970808567a1177170ed0418cb0b260f05a3d6ad2d7079d9141484db403b8f5f1fac6e6ee9
- SSDEEP 6144:DVrx26gabmMbTMwgj1Pkq2o0GDm31tUEpRWBcLJDoBvN:Df26PaMFqbPs1QOJD4
- TLSH
  T113842A1D72E494A5D6BB913CD9B3CA4ED2B178155B5182CF32E1036E6E33FD0993A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  WofTasks.dll
- Size 56KB
- SHA256 6631f4d95276a84ffe100ed29767568da6973dd468a7d709c9f4b824a4891b51
- MD5 7adef5e97275898f29acf31956189dd6
- SHA1 25cebcb383788448810b358bf85ec2fcc3f14878
- SHA512 03b0e95346eb2cef3c3ad6c8bafd4336c2b0bb9be19e7d87201a078beee15c3ce3fe3721a620fb7f59576dcc4693dd6915192b15c443b7f907ce55b53b11584e
- SSDEEP 384:oT5R3v+axDG+9FUWKWxcEB1t8MZsn21mo0Wz8cGFyskZKGeDsFusKglmjmuvoHW1:oNRRpG+DUWe262Fz8fy0DiKTjRt
- TLSH
  T18743F71D66B230A8E9B6827DC5570616E5B2743137122AFF43B0C2BD1F277C1AA36F52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  WofUtil.dll
- Size 60KB
- SHA256 9c17ddbeba5b21e2eb2bc6dd71fa01c2a94cdd709db0782c59cedce73a62606e
- MD5 e3f2e2d75ae768377323c1d1e0d633b6
- SHA1 60c3fe969653ebdf4fb38ab0a4b590a954f9b993
- SHA512 c73659acd08863c27bfdbf1a15bad3a7aeb1d7dc92eb57c5b6cd01213f38a9e1fa5bb2eee938c7d529129f36d7d7d0ace35f840014375f42ab5279436baf8b40
- SSDEEP 1536:5A3qEXSonCR7bMssaO5JQcTlpHpbbmQhV:+3qEConCRXMsI5JQcTlpHpbbmSV
- TLSH
  T1C8532A4E93F834A4F47B86B895610115EB737831372155FF02E4D2BE4A66BE1BA38F42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  WordBreakers.dll
- Size 92KB
- SHA256 ad3b8accea8a77fe653286a1aca4b18f4ca2184d0f1002c4d5329e05728fed89
- MD5 307df05f18f8ff9ee390e87e1ada4436
- SHA1 ef71dfa0481e891340b549f8d136fb98e6ccfffe
- SHA512 c050c43b2ba3d4ec5559d8495176a28b1e7e659fab5aab4529e7cb5a546e06185d6efcd8b93364183f24d6c3a94de577fef91d0a2a9c3de9265bfbfb1fe58a8b
- SSDEEP 1536:IKv16PYEhxRyhXKwgPnpmtd7oThOlfu+RAwAgynnddYZy:IKv1sYzIJP+dkThOQ+SwAgynnddAy
- TLSH
  T1B8932A6D72A820E5E476807C85534E06E7B1B065236267EF42E0C1FD6F57BE02E39FA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  WorkFoldersGPExt.dll
- Size 104KB
- SHA256 8e9e5608a1d70dba1e6fec51b3e5c5e49433b8ebb3419f3c6d582ce7ad9dfe73
- MD5 3f1b05b25b5c3a48ac0393f8083dc5c5
- SHA1 936366399731c75b08531185ce1d59bfb45cbb0c
- SHA512 4658a5e4e663ddbeb4e1ea66d92a6bf003f864398da2684763283667ebb4268f73e639a0685855c8178ea25e7f70c75d7c8525da9f8562fec556fa06c44b8da6
- SSDEEP 1536:7H79zao/bt0Rp3JNZ9BmP4R1VtsOl0A9WxIu2JoTU6e0LVdF7jAsK+2:XlaoR0Hfl1VqOldiTUYL/F7l
- TLSH
  T193A33B2C2AAC16F2F4B6C079C996461CD7723465531253EF8AA1827D4F26FEC6E34F02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  WorkFoldersRes.dll
- Size 68KB
- SHA256 188ffd87b5190ae04ee8b2bfe101c5665a646805b706f460e7047476dfb33e46
- MD5 7ddda616d9a46fffe9ab8014e7af04e7
- SHA1 cf634d6235678dc33b646f4407fb933b65e4827e
- SHA512 cd25d6a6492544b6ad4f30abe9ee179ed8bc7c92ccb5da115adde4db8981e2e79949dbbb6595770c8662c5d28edeb57adc5c38566a8adf19f1abd288ae9c5226
- SSDEEP 768:KTImoescevzigxw/BJtKIXsFNUnvvLHxrT0IA4dahVhKZH888888888888ko:KTIm1wisw/8cxEa
- TLSH
  T171631932B1D067A0E4546F32DA17E5AA8B667DF8D646EBC132C87E2F147D462C50EE03
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  WorkFoldersShell.dll
- Size 228KB
- SHA256 d2736c9fb67a84fe6c9c73cb4f3c59f95cf8eab559fe5e4543816af5d468481f
- MD5 b525760ed5a9e52dd47c2b68fa479ae9
- SHA1 292ba8198a8d7fa7c6952e3174a5c8369a18662d
- SHA512 125002ca904a726f8d76492a493960371d0ff9229c943b1d6cce17ef8fa11d4ba42f332e9ee1cbd18fc55e74115a8715252676f8f0a323907fa02b0b6dad2d28
- SSDEEP 3072:KB7ru1QjSkBxIiMiMJZsu93xOpNLoznr3wo78POpGFK:IrmQjSkBxIi6Zs2iUDr3wo76oP
- TLSH
  T19334F61AB38598E2D07D91398C9B9289F7B2B0015F1253EB3398433E5F737D86D36A42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  WorkfoldersControl.dll
- Size 828KB
- SHA256 986ad81f4c1d43934e7aaff65b155484c0979cad81815f27b9a09231c3b84d62
- MD5 534a8f9d892acf76e9bcf1e5aaa05baa
- SHA1 477c37ea8d5e04c2a393e217e52a68b8b963304b
- SHA512 9fed6425eb09b250aae11ea32481e80ad66cd64fe4cafee7e78564e5b8c26e29eb91167752778bfb3fadcda27fd8e19ab0e559765317e62ad56cc515834e2156
- SSDEEP 12288:U+uskfVLUxj9wgtEQsL5TEvpu+GCgMLKIQd4+LGG1icMNMt:5WLAwg0L5Yo+GCgMLKIQd4+KG8
- TLSH
  T1CD058E0872E90B95D17BD138D2439F19F171BC61831202D762B2A27E9F3BFD56AB9B01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  WpPortingLibrary.dll
- Size 40KB
- SHA256 dddbb60b90c57eea97fee6757fe1997b6d1da00eb487ec43481ebabbacfe0dab
- MD5 8ffb434db809aac73f375004282679c1
- SHA1 1d86d8423b5bed5c5fce323cb704e04ffa5cae28
- SHA512 9034d6e95c14ec1885fd46bca9591963862447c5ccbaa7541a1530a7b4749b380a0a4aa0c1c55423562877c28e358f3b83ac7b1b2a190876a0af5638f53c2fea
- SSDEEP 192:/Tt3w1BYst+TkK1PNjCqmMftPN2CeTEe4IoQWIgW:J3w4cVK+qbPcCZIoQWIgW
- TLSH
  T169030A6AF33912ECF57A85FC84A31A16A62A7004173144FF43A18F592D75BC4EE35FA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Wpc.dll
- Size 1.4MB
- SHA256 6ea91c9c682d65754282d6cf8d9c176c60f045f6d40f9d5f38aa83c7dc69d25a
- MD5 93d59a76c705264708887a21acbe2e68
- SHA1 128d4c0476d66ebb74dc5b2f149a358f423db659
- SHA512 2357d4871631abcab69b06caeed26b1de17a4b2ff5e86cd16f2101400900711bc26ecfc5a8a4930b67e8cb15164e684f6bff02829213f939b42f600ba4f08998
- SSDEEP 12288:9AL+1nS1S1n1u8wgsc1uyBemBzJh/81LTdsrmoVp9z12VnJ/:9wJi1uJbc1uyh+1LXoVh2b/
- TLSH
  T110654B5B775D41D2C0BAE2BC898B860EE3B1B8724B2193CF2491635D2F677C8593BB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Adds autorun key to be loaded by Explorer.exe on startup

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32