26783f1e8adddeba9ca489e9686a7b1b5f2cd5b134efbaa96fb935a81863174e

Sharing

Copy URL Twitter E-mail

General

Target
wlanmsm.zip
Size 28.2MB
Sample260812-gn2d9azeld
SHA256 26783f1e8adddeba9ca489e9686a7b1b5f2cd5b134efbaa96fb935a81863174e
MD5 110ee766ab8d7ddb8ddd8ab5a3fb127e
SHA1 0e24af41626695b4570669565a6d1da706cd9626
SHA512 79f463fa2e9e6666d8d927e52a893cdc4c5e008ced91adc64dde9d7062c908ebd7d4d6c3423ff82ea9a3ea4bcf4183c0381ace913c912446be3fde142afd5948
SSDEEP 786432:DVZGQjDbJ9txhVaeg2WTTleEQ7Qm0pAOVNKLD:DV/btDvSMEQ8RpQ3
TLSH
T1045733B290C42887644F83706EFF7B5164BF21DEE9C6249ACE4693B37556701E62E30D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  WINSRPC.DLL
- Size 52KB
- SHA256 fd5073cbe1588ceeb399c0bce3a3a31e07c97e69e24bc541d031ad1b58189d21
- MD5 8ca0d13af0def2903ac2435d1acfac7a
- SHA1 0fd80db69b0dbe7732b9958365b936933c40be33
- SHA512 743816fb651d823524a5ec19581861e572373aa6b629dc31dec9e02d111bb43d709efbc33ca87ef20f8a9238e848d31bea58c142869b5f58e3f54e28e37a877c
- SSDEEP 384:yrrLpIaR/xCR2B4fOdad4JHTsDAMmdQG1kUWDLWo:gGaR42BIcadOHT/rdHkRr
- TLSH
  T16933D60DE31464EEF4BA867CC52B0E267626F465030257DF05A0822DBE337D86B76E93
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  WinHvEmulation.dll
- Size 160KB
- SHA256 5ab75822abe149416534555c28c6bd449b9e29821a1a6b7119bac482124132e5
- MD5 b2f080d32919590f3e402d3213ff7a0e
- SHA1 443c893e1d7780c0a527982449993a8f1f862c9e
- SHA512 2245a6531132f194f2d8e67681e10ebaf3d90bfb725a8f48fcc76876ace02e0c6f92f6ed94f1e733099b6e056571ebcfd48476afad7b7dc22cea8f1136e4ac4d
- SSDEEP 3072:E7U9CWbjwsgZlkW8GqZ90dTE0rMWwE31I:XCWbjwsElXqs/MWwE
- TLSH
  T147F3091972BA00B7D4BB923D8A834A1AF6F2BC54575157DB029062BD1F33BF8693C315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  WinHvPlatform.dll
- Size 384KB
- SHA256 2648baafc6c6c24cd5401efd59a5ea21fdbd5255f0fd4f7f96c2a4a116b121cc
- MD5 8b54f94c60d053eab6c78dd5b9aa78d4
- SHA1 09c176feefa6a213decb35d7ebc1d44eb2a46487
- SHA512 89a7fa78cedec234c9f5553e3ca40cfa21e83fc0159ece31d20725566f1747a663cbb0f77e7023320be19fa50bd8d7bad2e427e98be397439579e4fc6a00911c
- SSDEEP 6144:RWA85l2F/ivIZKm/tIIhh/GUTKlkgXMzhnEgUhTHKhbg:d8kivIViIh5/KBWhnQhM
- TLSH
  T153844C2EF66C10F8E07AD078CD678916E6B23869037166CF21E0816D6B37FE8653DB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  WinMsoIrmProtector.dll
- Size 112KB
- SHA256 e113140539edf514ac15c18042d47693e9183937966a097de6b73305a753c0df
- MD5 3d93ba7c661f459eccad128f189bfa50
- SHA1 ef20b760c51b675f0225e509464e9d9f25394e1d
- SHA512 49f14fa2e760551d8c49729fdd0ea9b78198f4840d4204d50ca9467070540d8e71a4ccc56274ce0c7d48010657c9bf38c993393e549c67dc94397ceb4e6b3cd6
- SSDEEP 1536:OAkzdmqHQ+CfIIBT9U+QlvYktdm+fOzBUOHnhD6EhVH/HRAuG:OAyQ+CgIk+Qly+fOfHhDthh/H
- TLSH
  T1D5B33A4A77E8A0D5E16A923C89574E59E772F4212B2153EF2360936E0F73BC06F35B81
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  WinOpcIrmProtector.dll
- Size 104KB
- SHA256 907df0d3cb32faec8620e656156b8c6b17a72dd7cef39300303b7b55d27b76cf
- MD5 e104ce526e7d49c5cba35de5d1c2a1d5
- SHA1 64c6ebac01f8db8687cc9ec7358322ad03de7c2d
- SHA512 82b5c02ee9ba80c5736365b00da2b8f26033d9e54ca3e16b5c89bfdc695105e23fb7d36ff6cebe119280519a86b899acc0e0484ad666443faedb9704de570b12
- SSDEEP 1536:s1BqwHVpCz+iEi5hjPolgH4EY+6O+a1fghS6Cd9yaAuG:sTqwHHCOi5hjP0v+6OvdghSbq
- TLSH
  T18AA33A4A76D890D9E176923849578E45EB72F8213B1147EF2390937E0F73BC06E39B82
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  WinREAgent.dll
- Size 817KB
- SHA256 fc815cbf95bb930ce09348ed339653d802a13d10a71f2b6909bc1059d739c4a1
- MD5 deb2070f2346b6d25e91f327419cc318
- SHA1 39cb2d8bbd22793baf3046980ccbbccc279a5048
- SHA512 524822fd68d8e23d95d6732952f89f3cf9fc36f1eb1850fa3bfae9ff849e692d023e2daa783093abbdc63a3360dee92200d3e3ddc6c854c2b7170c14cc1411ac
- SSDEEP 12288:57EQMej5MbrUEjc4ODNYoH68yuBoHUVKHSYBqphyntXngPNWpIO0r4F7JKddN:vM+5McEQ4ODKoH68yH+KHVwphqWNNOEN
- TLSH
  T17905F85927FC02A4F5F797389D734606F9B27C659770E9CF069140AE8E23BE09439B12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  WinRtTracing.dll
- Size 208KB
- SHA256 d943603fe713c7c6572a18d954c811bbf48e034ddcc9d51ae30bb525233f763a
- MD5 0ff8d9ef2900312d168614b8ca0a7ff8
- SHA1 4618078f5000cb5025ee6d4ed333eda85f35a767
- SHA512 c33f81b04efcb60af02f269f0d40e170a181287eb4fe25ca1f2bd9bed61aaec0aa3846c3b1a100f12d5cc6382658dab8c2a1714e3c18ffe270a1144ee706c5b9
- SSDEEP 3072:HxGIQNqhRwyBX8CwQzunjmsmyONF/z9ZMwlQHj+0U5ZWac1Bml/ag:HAI6QyyBX8Azujmsmb90jRU5Tc1IZa
- TLSH
  T1C624F8276A6900A3E8799178C95B4B0AE372BC14079153CB0254537DDE3FBE8AF3B761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  WinSATAPI.dll
- Size 408KB
- SHA256 5e31b06ab8cf2a01b131370560086233b07c63162b3608d863c4e4a023d344e0
- MD5 52bb6e69ec7534459605caede3269b71
- SHA1 e260f642f81f952de9d121a013317b9772844e9b
- SHA512 5a257b5c3ae28d6b93dbe0fd6152f7e9777d3c1f0d02375183c13bce4fa982e11efb8cfd491da7219c10580e69d24bec93caab55899f25c366a7a55e7e903c67
- SSDEEP 6144:S2MRg07v96wYgMVq12241Rov7nR9cT8vn5nYBbc4g29p7:S2fO16FLVq1b2Rov88Cth
- TLSH
  T1EC94E61EA7A847B6D066913C8577F205E2B278105B21D2CB229C427D2E37BD46E3DBF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral8
- Target
  WinSCard.dll
- Size 316KB
- SHA256 17c6112948db66c9a6137e217b1b04e7c10d1e7ce5cae2caaa2e324bcd13c5d5
- MD5 142b9dbfa5cd2f3d3ce4dab29362eaf9
- SHA1 fe6737299a7e2392b364bef75cb3a04340704875
- SHA512 e8522167f21bacd657819580222864ccafb1063c3eab9ec2b6ee3182189a225908e5cd1419424f3c3aa7a2615c91d536f073ba503d8d40a5b4faaf092a06d0d1
- SSDEEP 6144:79C8dZUj9u19KcJrQQ+Cj5H1kyQApJCGkkvR9dceGGiFj0oIGG:Q8dZUm9FJrQQZ5H1+ApM/kSIf
- TLSH
  T19A643C1EE2A91895E4B7C2BDC5478616FBB27865831183CB0AA0C53D6F17FE87A34F41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  WinSync.dll
- Size 736KB
- SHA256 3382aa3729c58c561806bf430a6b702c6fbe49dc6a9c70d94959adf3397cebdd
- MD5 1141187bb5149a3b6bf53336b096bdf6
- SHA1 bf6cf23a81ac89f207113c334025202525c0b593
- SHA512 62c41df4308e991d3e2e800848b99c40a449d6bf113ce89145a333a55d078cbe4c94cd95fab5a112941a9edd0134b18c8736411c625c4058ac8f253ea205c740
- SSDEEP 12288:MrAofIoulX41Mv6alYHN7gfIQ96DG6P40S5o73AXgQj:qhQNlXzv6d7gP9666g0S5FB
- TLSH
  T139F44A75E5E406D6D6E5E2398113062BEB70744DEB3181DB02B48179BB9FEE4CA7E308
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  WinSyncMetastore.dll
- Size 244KB
- SHA256 e5dccac51ad6900f49ad6ffe0fe61460ad64b1d12a5b8447c5c516a4373ba17d
- MD5 0ddb96cbe5a38da3df2946fd09fcc0f8
- SHA1 245b3d077c6338b9fb183df4ba4702de363318c4
- SHA512 db94a9a5524e6e7284aa326f3c0ac17dbacf0b2f21ba33efc2cec69226ae99c8bdcf6e6cc95fd96d88d348ff01561aa2242f90aa76b8f2f8d4e72d141c74db56
- SSDEEP 3072:zDdgW8fEtdeIxpwWF3ckgpOSgej20aXorQmsYInqY14gqQ:F+f0dTpd3ckgFgmIqY1
- TLSH
  T1C0342B65E1D429E4E9F25774866241B6EF72700D673041FF26FC08652B2BAF1EA78B0C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  WinSyncProviders.dll
- Size 156KB
- SHA256 bb27d176e88dba3825da21862f7990df1ee028de37834e0e751a9c45bdc86fec
- MD5 256178df83c3480d809119b542cb72f0
- SHA1 3247c8e2d4337a1e50b6f3df5641c447d7450d11
- SHA512 284dc1fe06e5e317fcfb37e0086f92956b742efd0cc651b47005f4b21f1d1ae0e4d2456ac0e4f02fa051f64f0cdda5a2140363add1c0638d280120c59cb739a0
- SSDEEP 3072:leAQNT0ihOPTigBZQ32rX0bZu6LhGW4/:lIYDigBiSXWZu6Lhv4
- TLSH
  T116F349B666F805F1C7A5633D9993054AFB70300523A252CF075842AE9F7FAE4AE3D712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral12
- Target
  WinTypes.dll
- Size 1.4MB
- SHA256 3ad9f2c233dbe2e491de364025a726f95c21aaecde42820680b52a3cef3b4473
- MD5 4ac4ea13122c932b0ff90c8f6092b4dd
- SHA1 5e6e0d324cf673a565c2593c006760d881163fbf
- SHA512 a132810d1263f370004494e0a9e12c2eb4509dc6203f45769bd32a799403c60e08224cc288603b9d3df6e2dd9b336b60cfdf27268bd6c32f0a17031b3b246329
- SSDEEP 12288:HxPfPj52EqljXwJv8PB3Zz0+dbH8WUDiID6QndM0A/w93ZELRp:RPfPjU/XR108nryDTVZYP
- TLSH
  T13865E84BAA690156D27CB236C2AB0B0CE3B16C155755D3CB26A4723ECF3BBC45B3A750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  WinUICohabitation.dll
- Size 132KB
- SHA256 f5acaf696abffdce3a0492291b3d3dd4fadbbc084745f7e8edab6d6ccc700d71
- MD5 d5385fb21538491327242b21008410c0
- SHA1 cb5367c9229d9bb8c72629bd7955bf8dee813ad8
- SHA512 70c506b1fc7c0ca0fbd49909608db68348289c3985bfde183c6db66f3bc0f2091c823b6db737b0b1950400ddb12ade30ad9c339f8c2896c5c59ade0c69b41639
- SSDEEP 3072:vkEmmG4rlZiTshaYkWiVKJshvIWO4nBEDX5Wo/D4U3k:syiT4aYqHcWo/D4U0
- TLSH
  T1C7D32A6E31B811E5E5A6C03DC8924A19E7B2B465531253DF03A0C1BE5F93BF86D3EB60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Windows.UI.Logon.dll
- Size 4.1MB
- SHA256 51b3aa2b50944111f039c0de035f9c8951a3fd7a65eda7380ad30ece5c2565bf
- MD5 d35ad1c7d460d5b29f36cb838b976a02
- SHA1 b105fe550e1f7e4cd283bca166a92b07da2d2702
- SHA512 e34344da71317128ac77aa977aef07719db7b622069b0d26a573a3c20ca5590f57f050c50a82334fffb1ec609b65d9a71680bcdaffc0acd7446bb0baf062e08b
- SSDEEP 49152:09OSBVJoyynhr+7AgOsqO0COWdVicLmqrkgy1DyTEL1C1ryzyQrx3UQ12obpi:Nktm8dyguvrX/p
- TLSH
  T1D116F769091C42D1D779A6B9881BAD0BE9B1744C077006CB08500BD95FBFBFAADBF271
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Windows.UI.NetworkUXController.dll
- Size 92KB
- SHA256 94ef95cbafb2f93f051a356299be955ad5a3a080e19f3175cb7a6cc7758a9c60
- MD5 bd6d219d2670d04a25844371585d5084
- SHA1 6baf51646f278f2c6c8f5b291fa89e3f129b9ad4
- SHA512 e52082453e1e9b560d9f81e618dba5ed4aedc4e0d96ce0f0d914dc884b8516b86c1d086a63af18f611a6eb514e0a6e851f1463842386329981d6115dc9dc430b
- SSDEEP 768:ZnprS9VNVq35/wfA/dDlwRBhXmfX06coK94Am9aFdE9Idmt523SqTKRYx/2hQ7VZ:Zi+35/bNaBhXmf2OOKRXkwcRbL8EShe
- TLSH
  T10693185E26E404E9EA75A13C89A34E1DE370F05557035BEF43A041AE1F23FE49D3ABA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Windows.UI.PicturePassword.dll
- Size 436KB
- SHA256 a195b21e6f7fae84c313b5411142faac3cf982d3c2f1c9235aea3a29912797a5
- MD5 09f50af8ec3675e1412581a0ff2ea103
- SHA1 193c83299a1127e002c2a95b3f37d021f375525d
- SHA512 d7b53685dd2caecfbe5804b2b26acc2b8c7e05dcaf62a0c643867d5d9449b7cd7a21820da2675d955de54aed7181650d7970e48726c3df5c3cc3e3715312f8a8
- SSDEEP 6144:njZcqG2vB7QAo5Upyv//nJ5axe4yu5KtAQgotWDucUAOLr0U6zmh3dT:njSqGEB7QjnJ5a3UqDYWD9OLv6qF
- TLSH
  T19E94AE5D33A60065D5BA923885674F09F572BC10732642FF02AB727CCE77BD8A93AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Windows.UI.Search.dll
- Size 748KB
- SHA256 2bff9d7a710f19b6cd54cecfdcb9bd8ae8febd2626ef001c3c9cd2c0d2b7cd56
- MD5 78cc0591dd9a59b75b2e9347c7c4cec7
- SHA1 b8bf78beb0b0ba889cc843b0d4d53185a67e2aa4
- SHA512 92c660f3269e9245e3918b86e47395b6120d40f3018c06f7e2b228bae9b2da3cffa7af20c1edb7c4474636b539a5d1fda8644eaacf74ea43774669e2486991f4
- SSDEEP 12288:snzVQJyjHpEEdT+8KgVwFYwpLVkoytpa5lsSMSvLuP6FhQPJZKkr:szWoSEd68iFXUpa5TvupR
- TLSH
  T107F4097B6FAC0692D275B17EC5534B0EE3B278550361D3CF0269026E5E2BFE8593A321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  Windows.UI.Shell.Internal.AdaptiveCards.dll
- Size 1.3MB
- SHA256 0f668bbbd73580e0e8d9baf3bf4703fdd10ad26fa39e18f2bf396fe6a1632d31
- MD5 b8b62dc450d750e7116657440be1d62e
- SHA1 cdda85aca8f32f2a733472156d78b1c210501c12
- SHA512 819e18fece2505db3cb40ad968c2d5cc12782de7a813061b57a797bccf80fe5f4055b28d5a720e89a045aa952a8866e937eb0530ce96801bad84d44d984b0362
- SSDEEP 24576:omSdu9m1bfFDvbBphpA8EF7ArLIlcgMdQ:omSdu9m1VcmMlcg
- TLSH
  T104551867699801E5EBB9E17C892B8A0AE7713802437197CF0355614DAF7FBD48F3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  Windows.UI.Shell.dll
- Size 72KB
- SHA256 c2ccbc455a17ab0af7621e1687fb24469d1802e53754691b7f1cd1a0136e05eb
- MD5 256256fed70fd5d6d004c07e394c264d
- SHA1 1e5712fd5f9b816e145cde2ffbb23922ade47eec
- SHA512 187ab8e8ed615f30b8c0d9d22dc2218d34a297808ef0b02cf9150d1d1113ddf941670e91129fc298ad0136618ab69b682381f6a49b9029453393750b55365005
- SSDEEP 1536:dJZlZ4DhtnimLtQGLN3zvL6CPKVkPQAO:dJO7iwBzvnPK6i
- TLSH
  T11B734B8E6AEA24D9F136D13DC5930A19E1B1F4215B5283EF43B042AF1F33BE85439B55
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  Windows.UI.Storage.dll
- Size 304KB
- SHA256 847cdda0ec4e195d6b787088a575279fc5eeef15b740a482c2c03e82aca7cf76
- MD5 731abb1fb56d65138e703d253e5654f6
- SHA1 1664a2240532687c236efa1bee5ca8547f87a738
- SHA512 e200fa3cddac3f22b9f4e34757db02029685237f841eae70f3d2e3cb1a4b1349fdec9d8fa4206afdd46cf5412e1b03b7ca7c7c9c072a52bce8121e987d2ebe5f
- SSDEEP 6144:SnYdsb28ZikLkltjSrzb2hmIXtCcxYttH:XsbfZikwnjSrzb2hBM
- TLSH
  T1D5644A2F76ED05A7F2B6D13DC9934B09E271B8115722D2CF02A1026D6E27FE4AC39761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  Windows.UI.Xaml.Controls.dll
- Size 3.1MB
- SHA256 b7bec60d0cbb92454a8ee218100b8f2c1f8b4fb25814dc99c841bb85082bc549
- MD5 17bf497cc1b8ef69681eb9de5571c3c8
- SHA1 528b3011fc209164ef325380c94c026c6be09d0b
- SHA512 2a3903c24af02e50b1b745f30270855b1dcc6fa3fa76b12abb25421f43ea79511f4b26eecdf900092922170af3bbf29e3df6d417ad8f0c0eaefad83b55ec8bb7
- SSDEEP 49152:BizXq7xgws1KIkOtSNOVHPRWvikJP7vCd81HPfJBLq2IHpfQVRzYnK4AkD2IvgVr:wVHPRWvikJP73Bq2IHxQVRIX0
- TLSH
  T173E5F65956A907E5E1FAE93CDAA7890FE5B13C25837387CF0175014A4F27FE8813E622
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Windows.UI.Xaml.InkControls.dll
- Size 816KB
- SHA256 db021cf7588929ae5a2356e1dfd3a7e0d6d2570ebf261be64a85e8b90202c330
- MD5 9a4ea19e6c63514fb3ef872c4f662a20
- SHA1 7e9708bdb45b0b1e90734a03177df561a7f04331
- SHA512 3ca7226d60f260abdcec61743f494adce1a4f7b2a949185a4d687ee09e90aa6b864508223f02745de9685be277fd453a121f16a033b64f2e4d75f0a377c4118e
- SSDEEP 6144:VKaQZ9O7yW6Lnd9ypXkPITGXHSQtKcnzPexSNRDmUapav5Z1vm+O3+7oLlKSQtUK:VKaXmUynP2SNtmU/v5wKSQp+FT4H/
- TLSH
  T10E052B2E1AED01D2E9B0F13CD6574A1AF271B4516731D2CF0295029E8EAFBE4D53B721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Windows.UI.Xaml.Maps.dll
- Size 1.2MB
- SHA256 5f7bd9d1d2338147bd21b77ea5c3ffa1491de6a9b087534356355829fa829228
- MD5 9aa766c88b367b2dc90e508d67e476d6
- SHA1 08a6233dcbc0746a74a651d3172cb6299cb5e29d
- SHA512 6a61d3b16489a2ec9cdd18dfa429390b1150784d5775c65d9c2762c7b200451debbbb70de17be015b22adfda5ab80c467e0a08c719914ca43c5c252c6ce4599f
- SSDEEP 12288:9h08uIhx8CT2U6glJ6BLRuxSEILrzlYYB+buJ4ru+HWvtIjW6MWFj55a:9fh+0rIPzltB+6F+HWlIbMq2
- TLSH
  T15A55E71A1BF98342EAB5A23CC6A74559D77378066B71D2CF011C025E8F77BD1D83AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Windows.UI.Xaml.Phone.dll
- Size 1.2MB
- SHA256 b3379f090dd031c2435de7f0d25d14f952f105ec4a6b6467a7b031e0b378d878
- MD5 852f342cd8f7c7597ff73f3ab7c73252
- SHA1 c13bb1f2d6779a7e1c901aa0413bf3b1f3e22a81
- SHA512 cc8a3e89d1c45bbda8e52630a9534eb2c993cb5cacb12dc0aedb77a30635b490bff350848a578ca17f2ac8c9468fa14cbc1bf5606bd37627e5d2fdf95fba02c3
- SSDEEP 12288:qPnwC0UbBZd76Z4wp8x6xX0vG5F5yGsraXQIFsFANn2rqmwROqsM:IwtUbBz76Znp8z+5FIrdE2WmSM
- TLSH
  T18945A31B1AE805D0E7B5727C82174E1EFB717402376292CB1254456E8FBBFE29C7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  Windows.UI.Xaml.Resources.19h1.dll
- Size 696KB
- SHA256 4fcdfb207c0f62885a6ad20380af5e6beef4e093829e0e41575f58437b75463c
- MD5 945070325ab1de21d491775080847256
- SHA1 3a17c38aae92a1f972670798148e3a9e6627da01
- SHA512 55280ae4f4864265f7c66cffa51d2cb20ae5a54824e968a71ca349bb58bc9b888c84d7018e21eade600cc31d1b62fa61a127e954000acc88d87ca3cfe3bd4d26
- SSDEEP 6144:OY3WUYr4CDQfY1wGUouTuqGrA6mxro+q/hrI0mRMSi70aeGPhO6AdtUtt/tM1xvq:x3Wzpr5mRMS8/tSxvcDKBP
- TLSH
  T11DE4FD01A7FB1248F3F36FB06EFA492418B7BE526A31C17F4014164E1A71F85AAA5773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  Windows.UI.Xaml.Resources.21h1.dll
- Size 696KB
- SHA256 13636286b41b495d43481f60cd040919ed1da31408ce6ccffdb74ee09fba19ac
- MD5 3e464f05fde9e638318a3dc8f976cda6
- SHA1 f847abff16d66d1e6a9d33c6fba3a983ff9d0597
- SHA512 686d53125428591348f7b7b9856086d3ccd353a49f811183a264a7daef1d71777be30aac6c02274dfd45f9034fdd20d735876f34c919e2f62568138558774e22
- SSDEEP 6144:iY3WUYr4CDQfY1wGUouTuqGrA6mxro+q/hrI0mRMSzI0aeGPhO6AdtURemzTbPPz:t3Wzpr5mRMSDcvP1JyPDZG
- TLSH
  T159E4FF01A7FB1248F3F36FB06EFA492418B7BE526A31D17F4004164E1A71F86AA95773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  Windows.UI.Xaml.Resources.Common.dll
- Size 52KB
- SHA256 769a03d263032c205c3c0b1712cc2c843f3b9db1c47ef12af7ccb6f05f89197f
- MD5 18517040ea272c53e24a4557db708892
- SHA1 c715b8542da59b160dc4220345ac49d143ae58ea
- SHA512 de460646b39c714f26a0f9b417f954f01cf2ab69bad6b69e3c58842b522ef01cf6a4ad8c5c12c8e0f47e94ad527783000d02b553f28cac6b95e45ccde5b147e4
- SSDEEP 768:w5enEEdKuC0eJ1MH5+1FMoy0CkrSaDWKFxGd1pUBsQOTk1P:qenEEcuVQiHaeHrG9BsQOTk9
- TLSH
  T1C833FD5067F95208F6F73F74AEB95A640E7ABCAAAD79C21D1210904E5972F40CDB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Windows.UI.Xaml.Resources.rs1.dll
- Size 452KB
- SHA256 d6c353d75c944e3d168adbff5d40a5fdc753de48d625779a19f41f5d515f6c82
- MD5 09098dc13070dd4b690dc53681044860
- SHA1 f9cce4f915adf3abf4a7f800da25b5dfcda19dd7
- SHA512 a2d545bbd94afbfb9f9e8b78e75037deddd00bb7674a31e01372ffb044425abcab3502b0bf578e79d44c5ad70bc61f04a9d62ba974bf92134000cfe2cb25279a
- SSDEEP 6144:av36FBQBEGm90aeGPhzGDFd9ichdcX+QAKc0:C36EzBca1Qb
- TLSH
  T1BBA4EC05E7FA1148F3F76BB06EFE492418B3BE536A31D07F40041A4E1A72F859AA5763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Windows.UI.Xaml.Resources.rs2.dll
- Size 504KB
- SHA256 aefa8021a895e50c1e8b92a5686189c6eef6d8ff494bcefcd72b767c6433cba3
- MD5 09f52e7c96ad3f355e9cedb6c18688d9
- SHA1 6c51a68edfe6e4d2817a74d40c0122ee7dcd9ba2
- SHA512 355ad51b8b5ed9a32d01587f11ad6f030190a035334f06bf933524115f90c29cfe7c2da2a8708dad79c758dbde88c45525396ed63e2fe8b16116b9a572d439b9
- SSDEEP 6144:av36YjdvKZdDQB2awnipULG9YaFA0N0aeGPh1JIq4FiVChjc3L:S36LQB2awnipULG9YUAYoEI
- TLSH
  T105B4EE05B7FB1248F3F76AB06EFE492418B3BE536A31D07F40041A5E0A71F869A95763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Windows.UI.Xaml.Resources.rs3.dll
- Size 612KB
- SHA256 eb61d0f407bcabd10f423d5481d6f45bbbcd9e0169254d372f4b1fc84eb029df
- MD5 ad4f46496696c88569c399106d46074f
- SHA1 52ee1a3d65cb9191ce7c7437819ecbb97ff13f3d
- SHA512 48a48b7a45cfa670ba873cb99e3ba693cbd720e6e23d1a9eaa640be552916d5b89e0416aa25fd1e6cf375a2d0daba572c7a323bbed94352d8a768b1b4ac13ba6
- SSDEEP 6144:3L36ljd44CDboY1wGUouT6qGrA6mxroFeMqsePalw0aeGPh56AdtUeoq4y0QShuK:b36NNiUIJtw
- TLSH
  T1C4D4FF05E7FB1648F3F36AB06EFE492418B3BE526931C17F40041A5E0A71F869AA5773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  Windows.UI.Xaml.Resources.rs4.dll
- Size 636KB
- SHA256 70e0383fcb0670c456cae3a5e115e302ec12a685d1856e4a9409c7293b4b747e
- MD5 21e1d4b8002d9086cae7068c48f387d4
- SHA1 72402547085f182a5c1143d62820a6aff6c96d09
- SHA512 51eae93d2534ae1cafcebbaa8a22c1825a2dccaac5d51592cff1dedce38835a9c872b66b2df95c09da550673ca2e53b6d5d3c9738243b9f85d0535909787ef5f
- SSDEEP 12288:o36GFa/YpRljYVURj0RTcYwEPawEPxwEPwwEPswEPWwEPrP/wEPqYPdj/R/JJ:r/R/
- TLSH
  T1A8D40F01E7FB1248F3F36EB06EFE496518B7BE526A31C1BF4004165E0A31F859AA5763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32