245b59e45e6e62cc7d4dd018e77a682611195eb70028afc16e906ff89d715ae8

Sharing

Copy URL Twitter E-mail

General

Target
ztrace_maps.zip
Size 12.0MB
Sample260812-gn3mbazelf
SHA256 245b59e45e6e62cc7d4dd018e77a682611195eb70028afc16e906ff89d715ae8
MD5 fda1bc2805a24f39aff1ce3392583146
SHA1 cf29a9f5316897e9d5aa0db36cd50558393621ac
SHA512 32459b6052bf3e9a9907bd4ac131f467d5c11b85669ddd6933cdf61d54900ca2a4e93abb89ae2217bc3745124ee4929c62e06babaa65372769541606df417eec
SSDEEP 393216:QGHfSsfXKEeQ5yEG0DPiGhyxXmY0FMmVdi:QGK88syEG0D1sxXmY0FMmS
TLSH
T152D63360F5D80918FC99F3398518F802D1E11A1A8FAC50D975B32C607EB9E618F6BF5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  WSDPrintProxy.DLL
- Size 116KB
- SHA256 d1fa0353bfa1c2d9c0cea01826f39d4792eb7e040ff2415ce738dc8b44859be7
- MD5 9ee023605b3b70445bb300b5efc489dc
- SHA1 9a0d97711e472d659c3c2d5e18cd92b86f5a075e
- SHA512 73187393056bcd59658c97d4ec67bfa4077788aa83f8e941c13326551a1e8099ff02a75569c881eaca7c0f97ed4ae1d30c973126a58269516e0efa8d76acff3f
- SSDEEP 3072:8WXihYQYM08qRNAokbgpS2FQjbb4yCrFjrr4l:ehYQYM08qFrFXr
- TLSH
  T1B7C3DD4BAAE8154BE1BA9BB855778D698775BC299F91C2EF0260014D4D73BC08D38F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  WSDScanProxy.dll
- Size 88KB
- SHA256 2f6a60a68c73f8f7631b092f0d3b063b80796ac53368023c91cb0eab7527e497
- MD5 b3ec63a162712a347a325e6efc74c181
- SHA1 19e7fc21c261d989601c0963880839c8d1297176
- SHA512 e31d4b94363589f459b7b9916d67ea1f395fbc18a07854a4f64332e3f8b83ff87b7d007784c8dc02b8ee620ec10cba92a43d9fba7dd08bc2fe109d35a9564d2b
- SSDEEP 768:7xNGsPdG+TAHKwYAJYLW6IwrtRIEqz2juHxQOuaHfQ26DpExkwoedXOdgC0dFRyL:9PdG+TAHKwYAKLNIw6d+dZ0pHXxdw
- TLSH
  T1329330A66BFC2911E4BA5B3C58774D15E535FE691F51C6EF02A0020DAE62BC08E30F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  WSHTCPIP.DLL
- Size 32KB
- SHA256 16ac1aed18660dc229644e5c11e2d5190c61a7b6cf250f2d09d7118bcd76ba83
- MD5 7c327a38dab841744d1f4ba1753f9048
- SHA1 eed580f8fa24a45b8f7305dda7e044120564c6cb
- SHA512 d6cbd9ce6caa83c0a0ccc93f9d65c70a492e5e266b09fcd65d2f17acef8528b33396f6e7dd53626a635297dee2620312eacda9635f4026d51bba30de905cfcfc
- SSDEEP 192:WX39nsrhOkV9Mdtpme9Hhxp62tlWEDWSn:Wd8OU9Kpzm0lWEDWSn
- TLSH
  T17EE2D84573D9257AF578C33C84A70B1AB979701087734BEF5AE4827A1D21BD0B930F95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  WSManMigrationPlugin.dll
- Size 108KB
- SHA256 710f94996c3f1382b488a5b063bbc5fc935c6883289606bb4dd64285a9857fca
- MD5 5ebc3c32f5e1fc73f9f3eb9e8d5607e9
- SHA1 a34f297c1ec7fc57b241c324cc1cfc6322fbab16
- SHA512 866bfe13607d62eeddd83564543a3a34001430eb3c3ced5ed5e9edff73c58239f692d29fe93fb0ddcc7d2624fafb1bc79dce46a0de96514a2fa528d7c57ad4af
- SSDEEP 1536:1UxoYxUhIsepOBMtkCgKPK5qPxulpGX+aQxQUd6VSxRLBd:1Uxo9IseqMtkesqPxe2+7QUdmS/b
- TLSH
  T13BB3186FA6AD109BE1A9913C85570A06D732F034131267EF53A4C27E5F2BBE05E39F60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  WUDFCoinstaller.dll
- Size 104KB
- SHA256 5888c3c9f4832ceaa1239a4b0a4230b30fd71d09d20a7eab43343caecaa5d0ff
- MD5 66743e749bfcbb736ad639f49fdfe178
- SHA1 695b1e4f567b233b38e81599c7d2b498a1639ae8
- SHA512 79e4b34418c886648b6c353d87150a72fb2e5b959155780badfd3fc603af01393d3c905abdbd09e0d1899f86fa9ef714fee05be9b1cb61ee0f465f8529bb0fd4
- SSDEEP 1536:ZTKXvae3TJ5NpR3JK0wI1h4r91mqbsm0RM4En4GKAm1M:ZSvjJpCI1h4rzmqbmK4E4VAm1M
- TLSH
  T194A3A34813FD20A8F4B7AB78897945159AB2BC656B3193EF0390C47D1F72BC09D79B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  WUDFPlatform.dll
- Size 267KB
- SHA256 33c9bd25ee89af181dea1c5288236dee623b95071759f6f6a56a4284c0307701
- MD5 07143cc35df05f6ce204cf77253a1560
- SHA1 f41fe8c586e8df4dc856cc59dee4f2469f5a6933
- SHA512 c48480a88fc65cb584506a7723445003c80703a91558ac304f0854337b518abf2bfd9c95eb3c32dca81ec20ce7b11041d8fa9aaa0e604f18d2c2503a59dff80f
- SSDEEP 3072:67a5TaHeAuvzDOAplCfjN9qrM0nz9zJuzufL1CqJL4uxhhVv8j5kW5aDfWPLgpUs:GHyvmUlCf3qrM0z5MzA5JLR3vTWqSs
- TLSH
  T16F44F71A63F91489F1B76A3899B64611A6727C606B34D6CF02A0863C2F73FD4ED35723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  WUDFx.dll
- Size 676KB
- SHA256 781fb2d7b0add0bdf2c0623fdf31d87736032953fc55a521c9419686f25922ac
- MD5 835a96dc5d7c79f8d68c4b6f6d25b2d8
- SHA1 e1bb5989be7b5a59fd6b4bde1c3348e8fec194a4
- SHA512 a4cc7457138eca9c87f5ce8b5a9312223532f652713a8d7ebc573e036a01f67a22da13fe7c2321e3d58830e53499482db8da06f6c1203651aed4c014d501be19
- SSDEEP 6144:r7IrpkFwT51dRtTK+C8O0ZVoc6ZkYpnP5zHqGaAeecReUHG8L4iyz9l6N7pK77Z1:r7IrpkCBTvC8O0ZuFHzHqGaA5UUi10
- TLSH
  T185E4390EA7F824D5D6BFC07A86474607EB7474642752B7CB0960C279AF3BBE4283A711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  WUDFx02000.dll
- Size 820KB
- SHA256 6404c811cdda1288c5e96bbd5936e22e2109910e3798c5519410cf9ef05ec72a
- MD5 6e1b652ea8e981832edef65174b447b2
- SHA1 eaa58f60efa0c0978abb9da81e548c5e05e657ee
- SHA512 daea9b2f832e694e0b36bb47801550862e5f4fe4dab00666ab34a96228e011eb4f8a4c3a9d22cc54c506c71b3d9edab940aa0bd68db0cd672f0936ec7745acac
- SSDEEP 12288:5ewiIHna8lKSFdybxQr08++KknwV/tODkjWuY42:5jFlKEdyKQ/knAtQuYn
- TLSH
  T13C055B19A7B820D5D9BBD07DCA47921BFBB474242321B6CB096086799F37FE4163E318
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  WWanAPI.dll
- Size 546KB
- SHA256 ac2d07804622a8f1ed9c4c4b6cd59444c8758673b9b93fedd1df2eb4f050fccc
- MD5 6a875e65ffc2aed795b3879d2028332f
- SHA1 e9155e61563181fda4c73cb20bfec2aab48e92be
- SHA512 84a448100b5d44e47a8f601a16fa28f459e8ebcb66cd254b5ff4a8d597daacd33a2463b12ece295813357881a71f9d4259a0e0441ed55ebf2cd2d7a2cc2d6208
- SSDEEP 12288:IuJSTMqQwNwVrf88GHvRDcxZh4xOBeL/Uy:IuJiQwNwV/wYxExOs/Uy
- TLSH
  T1E7C45B5A7B9404A3D52A937C89934209F67174442753E3CF02AAC3BDBE27BF42E79B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  WsdProviderUtil.dll
- Size 52KB
- SHA256 6f4f41056a02a1694a2b535afe9d96b805fc3340763afa37d9b53da87d2e67e6
- MD5 94638f85f8092b84d27c5d10b83cca3e
- SHA1 5dd2063460d132d354e2ca34dc43dab8c85f05f5
- SHA512 1f702fdec114596a8d4056edaaf75d65e299f038a901f03f238c1be2bffa7a4f776af84311652aa808d6ca886674b4ea3e0f92d4bcce6e7a7da57db6c99e4c9c
- SSDEEP 384:dmRD6D3TAAmsLb5Ypj6udseqUh4YnOrFt23P/PW7byaLuabb04AGTZzt0rqWjMWO:uG5FYphiesYnOZcuf3LRbo4FTZzK
- TLSH
  T174332A092BD81DE9F17A427D88635A19E672F8226713C7DF43E0813E0F36BD09A35782
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  WsmAgent.dll
- Size 60KB
- SHA256 6a887086b431ade46c0b8c73155ad0721fa3e04758103d22e4e6e194a6e82a9f
- MD5 5ae13008e4c0d116a4b2527f67b5cd80
- SHA1 2ff133035453b32e69b3dc48abca5abf06f3aaee
- SHA512 e75b32b39a257ce058f1ad67724177e593288a29d6652ba5eac187cdbd46c29ec938444f64e17568728a726a38a71e49d0ede05e620fbcd55bd48f2b9f3fe9d2
- SSDEEP 384:KVx4cxXsW4i6THG2tyPEnvq6zCFxJkZJwodUDsMmbVxbSgIVr67yFnV0MZuAWPhP:54shKP8xzCnJkZuodUDsxc9FhZUP5
- TLSH
  T1B853084AE7F854A8EA72467CD8371E169372F9341B1293DF05B0822D2F677E09634F92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  WsmAuto.dll
- Size 192KB
- SHA256 bb50fbd030353142001f2840ad647f241a5b35c52b710fabd0fb921b0944c892
- MD5 8f105efc5bc8f0678e99ce7e2082d39c
- SHA1 ccd2690d10a63ab9d3b40a1e94d5dfb9a9c78322
- SHA512 42555a048f295d907d4811716b3b85284ab40e40512125baf6147d39ab6dc9597fb22f890acbb3076700bd5fe9c4d9cd50eb6d9bc2f73435f62bb2eaea7f7834
- SSDEEP 3072:9GWxBpA3sw4q+Z/by+7qaPanoUcsBpX3VEAPaxJ:9BxBpa4q+Z/byGtUcW3EHJ
- TLSH
  T172143B1A379A14ABE1AB933C8C431602D3B2B4644F038BEF15E5433E2EA77D95D35E60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  WsmRes.dll
- Size 68KB
- SHA256 2f20f2cc49ca8962ec57ab75c75c96a5b712b41c11f6ce65680a5979eff3bd0e
- MD5 89abb07bf080882e95146cfc2ef18518
- SHA1 a0146e06635d1500d08eed779cf221131e7d220b
- SHA512 085433c1af18dc408fca6eb0a9efb95ab2aad8b50d47791161cffadbbcbbaf6834956de14ecb236a02cd12b48f3f8a6fb1097d7446ed27db773cd8e9440124ea
- SSDEEP 768:QrUZi7bX8FohSjEzGZoadnkXV0/s62PEPKl/J:Q4i7bX8uhSjESZoalkXV0/sFPn
- TLSH
  T1F86348035FEC9806F0BB5731797A86693236F968DB51E42FB052275C9CB2F408EE1726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  WsmSvc.dll
- Size 2.6MB
- SHA256 f11966b5c7aef2923507c76c15f38a7644e06c5ca79f8d8a1fa906597edb735d
- MD5 b0fac2714613a44e7fa7ae4b9290fe53
- SHA1 ff9a757eb4c50785df28c3dd0d99ebeb3b7dfbaa
- SHA512 5fc332ebf1639db4850441abd4a856ae58afdc9d74e0d37adcdd90288969a56f274d5646ec0c1df3b8c79fbe90f6d1ac57982b47a0aa1b52fe7da627961b8f19
- SSDEEP 49152:Tn8IJk9xUKXMjjs/aRHPszMvF5Ttk4eWqRmiyYoSV4w3UunAua/T7kkajcgJ1AE:T7EDc0/efZkt6Nc
- TLSH
  T11AD55C5977E800EEEABBD77CC9530617DAB2B4151B23DADB006441297FA77E1093AF20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  WsmWmiPl.dll
- Size 328KB
- SHA256 0bad4e1351f0f9a7753d4fef30399d8cc19ab9ee27b0b4ae9bed6579e923322c
- MD5 84c012752944bef23f509c2d52061900
- SHA1 dbc7276ae40fd694f252484375c728ead1ad55e0
- SHA512 877a07d8cfac8aba76214e352def61629a3df6d05f2ae799164bde8046a379ddb94f1d7945c3f10691215bf43fa66751000509fe7c64a29357b44d59c1c2c057
- SSDEEP 6144:4gO6pDCOKWl3kwXd77sNQCbpIPG6152uNar1hTm7r:RjpDiWlU0svAG6152Sar1h6
- TLSH
  T16E64E61CA6BB2169E6B3C278C4435242D6B371315703AADF29E1C139BE57ED8BA74F01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  WudfSMCClassExt.dll
- Size 76KB
- SHA256 0917be7b1e9cddb1b08899f16ba69bf73093255a3c61325f66daa1e6a70cd0c7
- MD5 f5229b7ad6f0a31960f1dadd811a9e3a
- SHA1 31d9d283efe8110b929d077c6062004f1376a349
- SHA512 dcb43e4e6f096251929c1e674329f32e61867f6521ba11c29a7f8996d6dd96a37190053d10f81a61e6144d8a796d236191ef0b3c641b3b28bd0d0aeedb56a0b9
- SSDEEP 1536:H+p6qYAmObmvgDfvsJ3KldzvMYd0G2x4m:S6qdPgCdDM8wx4m
- TLSH
  T16D730916ABDD4469E4B792B4AE774A69F231B8265B01C1EF5220431C2F73FD08F71B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  WwaApi.dll
- Size 528KB
- SHA256 9e07088e6ca261f0f2c1cfca1efefb840af2f075543d53b0644dcfc583459d23
- MD5 622abeb326c10dec2304e5b24b3853f7
- SHA1 08e05d8254406551ee736e8a525f03f0569a2259
- SHA512 0ca0b9cdd88e936953856af27a43d66c7d2f8c81cf474330432de6462e281a6f37222db7193a483c5e54a2a5ed5ed5dff70856bf3367182f454a660c548481df
- SSDEEP 6144:litozzAHFkSd207MI5hCcs3lSzpJa2NuQPJune/g01DpVLbV4z:0tozsSSd207MInCcJz7pV3ez
- TLSH
  T13BB4E7AA2B6C0652D476B13CC5279A09E7F17C915792E7CB02E402AFEE3FFD45835620
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral17
- Target
  WwaExt.dll
- Size 64KB
- SHA256 b546a6fb7da15741791fe4415f7b73ab8400d353ef970c6e7e9ef9b932cffa16
- MD5 d0ba100af6859a1ddc980eb75507661e
- SHA1 9f5b3e515928f03454f365748a9d0c6caab60a41
- SHA512 80353023599b13bc066f987c6f6b442748ff59f15f73006e903983f342b387f6633bd0f317004d452d819b7e1dc66d99ea404ac5c1031df7c54e6e65d0d64b1c
- SSDEEP 768:/4cQQrG4dcqcqiqKu+oBcnKeJOUKdfRtL8motYdWfSTlHR08ObLzp:bdcqcqi5ceJY/y1tYYOlx7ObLl
- TLSH
  T116534D0AA7B810A9F57A917CCA830A1DD370B434532166DF636482AE1F73FE4753DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  WwanPrfl.dll
- Size 144KB
- SHA256 4288693f7bb0ee80b6610d98c8632ee835627717d0a6cb89267f710201e9e02f
- MD5 b2430da65924b261f3f7a36e55dea2ce
- SHA1 105ab32f444fc230819c9e9b4e269739eb9a8303
- SHA512 4e3531e5c7596bb3fc6ebf6513a9e9018e6527b24f5b2f583116e618decd33630e19ac26c40462b46e61e7ff37349ad14efdaca9073bd3db463dd36d23b0c25e
- SSDEEP 3072:5CzYAZmeKIP4PzHZP/ke4uTInqElXfVLm5mK25nELh+:5uY4meKxPrZP94uTjunEL
- TLSH
  T1B3E3D71A33F50095F9B2927899760929F673B831531057EF4390416F0F77EE8AE7AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  WwanRadioManager.dll
- Size 116KB
- SHA256 4e0701290561e217ce5bf7bfb1b7cd52f3a1aae6011bce6dd8aec27782266e05
- MD5 e894e56f8b26f2ab03c23b5fb4d13ff5
- SHA1 83c72f0f28abfea93db3686aa574df3d3f9e3edc
- SHA512 64c8d6f0218f133385862ee5152c0f7558d436cff9b18ed95e807abfa58788d83dda8f383ba5ace008732cb363842e95391e52b8bb3bcc8d212f2a7583309fd7
- SSDEEP 1536:Wf7j7FAsH77Xamwm6hXO/4gK09GCMx73fv4Ip248k4d0I3Cq+rzYMNE:Wfe0qzY/4FkMbE4pQ3C7r1NE
- TLSH
  T105C3286EB6A810A6E276907CC5830B19D371B02D271257DF03B0827E5F27FE85E39B95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  XAudio2_8.dll
- Size 12KB
- SHA256 34aae77da39898479dcff029f59a9f69788b52f7cab2f75929531b1273799f69
- MD5 57d363f6f8579c7db1ea03152ec1bbd0
- SHA1 4700877e2c3a927815e629adce2a9899673d022a
- SHA512 b7d344af251bb2dd022502ac3ba749a7ec4ff9b6c36c357205d085f05d1ef5202d243fb96ad14325134a9dd7584bd7c7979f2087e8f3ed07aea1de91db159bac
- SSDEEP 24:eFGSTSYHCbC2+giEOrtqCLDKqBwGDsmIZW0rlAVYNut4yU35WWdPPYPNC:ivRzrtqJr4lIZWQlAouxK5WwHg
- TLSH
  T1A2423E001BF84AB9F5E35BB5ABB31E9203767A28CD62C3196CA8401C1923640AA75F33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  XAudio2_9.dll
- Size 576KB
- SHA256 27a4b53cdabb0bdf10fd299dd297f9c30145232e9285a54f5c9bb660bb8676f0
- MD5 5adc018fcd21bb972f008a4ec4679f75
- SHA1 78aeefb94bf39fea583ead5c9741a4beb02aba6f
- SHA512 d637bbd4561a13cd1eac6a1fdc5b40ebd38bfaf22040ffbf204643d706142d2772fa9c68b6d0ba0c1b724fa50f5ed1bfa9e674d0ff31f34222fd32b64079b38b
- SSDEEP 12288:YqNW9fgvDaq2h1egNsDZyos92nB4sURR6qtiIuk/:YgWGOq2jegNyB4sUzWW
- TLSH
  T11AC47D27B6F448A5E1AB92389157B72FF372B41423528BC703A04259AFB77D01B763B1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  XInput1_4.dll
- Size 108KB
- SHA256 3dcf5e1e93fa1916dcc7f072ead810539095d80a32b14b67493c38effd75eabb
- MD5 4d5123f353b41d853f79b58011a39099
- SHA1 4ab5ba0b52ff49d609e0f6bad76fa5e74ca22a02
- SHA512 6dadc2c3771c5612d3d737062fcd7f2be6665a0b8f58a7daa8c5241e17a63f7d6e9a654a691dede5a8fc80ae065101106a163ba47f5e424f9ca5986a05384f5c
- SSDEEP 1536:g17o4fXhjMhfkPUXJcE4hMypahkiJS2Yba1Y1Mx+nO164ntg4yOX:gxo4ZAcCl46yCkiJ4MEn06Mi4yO
- TLSH
  T1C9B3392D726430A9E86A917CC5564255E7B1B428276127FF03B0C0BDEF67FE02E39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  XInput9_1_0.dll
- Size 36KB
- SHA256 bab5e6e06df32cd7db46d0e94c0ecd9afcbf04798115de4588670d46a3c1a469
- MD5 8b57564f2a664294ca227a6367e6a72c
- SHA1 b6818ec9e5a12f8fd057c25763db77a72dbc671c
- SHA512 8b06e21a9562486511f29469dcce5493567777e072f4f8c8d3a0364e96ef281aed12decc9665ec44b734ed3997489f86503149583b0d66783bbb53d74b6e47f0
- SSDEEP 192:xS9JnD0DIUk5NFj4JffzroscCMT3NId6WTnW:YXD0kndkJffAsvo5WTnW
- TLSH
  T1A1F2D88AFBAC3ABDF079C27985A731062135B91617525BDF0330421D6E6ABD14A34FA3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  XInputUap.dll
- Size 96KB
- SHA256 8ae18f3fce83a133399efd20e19239d4d7fc0300329d98176148049456edb6f0
- MD5 17378df2abeb00d39bc4775e69ef446f
- SHA1 6db213d94fd25f69601ca2cf20adffaa623a4316
- SHA512 0e1000c94747f453bb75816b8124ce4c24dbaa63a4a9758f342ebb21dc8c7f70d343dd4a714dc6bf79a4a06cf2271fe7da8b038616ec9e9f7d84dced56c56e91
- SSDEEP 1536:JO8YBoEWA2Opv/h4AJsmaHqi4SuMX6Qm+KDpFPk0nCTmAEw:JO82WA2ClJsSSvXG+aHVnym4
- TLSH
  T10CA33A1F62A825EAE166513DC5174E19D3B0B021239227FF03E0C1BD9F67BD46D39BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  XamlTileRender.dll
- Size 288KB
- SHA256 8f1f096b3710d8443a84a5644ecdd2b0b518dcb587d3b7b590d6095297392df9
- MD5 76bb9cb92e7e4baeb8873ea717fadf05
- SHA1 37d4ba5e0278c7853ae2a8d237cf4ee871c72ab7
- SHA512 6bf8e2364a922368df77938bd2a9b1cd1fb3d7ab5013e65c37f4e2098b1f01f0f6952f810301404fbb0fb9bf06fc09bdc401ddb0213e9917dcd1c0756164a1d4
- SSDEEP 6144:1UA9nl/MhMjJrGepgNtmp2vzFDnVPVoRjxnfHh:1UA9nl/IMjJDpgDmp2vz/WtH
- TLSH
  T1FF54081F66E80DE5E2B6F17C85835A0AF2713467572386CF039141AE1F2BEE89D39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  XblAuthManager.dll
- Size 1.0MB
- SHA256 e7aee20af196513e9c428228ed5964aa1ac9f3e2a54b5b89c6b5d1615712c7d5
- MD5 637ac895e030b860cb11337b68a82d65
- SHA1 6ed41ab76248917d9db617c33e72ebeaddfaa09e
- SHA512 78f512f7147956ae0bca440eeb40c107920dec7754b276c56468e8e5286ebda9bcc8d0e9351bb5b5b358924558c7901b3f6014c4256290b143f59401906d20a2
- SSDEEP 12288:yzuNtXmJzkzNnPS7UumcjG83M9n+Fjhf00paRPOi9GVak47G2pFlIJE:yqcJyPK0cjiYfPaRGi9GV67G2pFloE
- TLSH
  T17A356B2EABEE01BAC1FAC17CC553542BE7B1742153315ACF079182AD1F17BE1A93AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  XblAuthManagerProxy.dll
- Size 136KB
- SHA256 6ff08436d29ecc8780d429d5be553626b457225fee5c6a36b4a977c33a66f4a7
- MD5 f2fbd8cff0f4b593554c354f15d37dda
- SHA1 b897d45cb99e0073212f2e70aa27450fb8a8517c
- SHA512 214235bfa67a489fb0cb1b091260367255e108f7d724a62138d92798f6f7db3fb40759010547c74f0c10f0fb3c90a0c6edaa6e6d0e0e3370c865158a900e057c
- SSDEEP 1536:R6mtNKIN/Hq/hXAS7+3Pw6Kr5bZ3ZA8zEG6GAvHOqmEp:R6udN62p/JS5bVZA8zl6GAPTmE
- TLSH
  T1CBD3830B729145BBC4BE917940474A25E3B6ED21A3E247DB0180433D8EA77D4BF7AB9C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  XblAuthTokenBrokerExt.dll
- Size 112KB
- SHA256 85835e6a490188c83a15f4b812f993855a81aa0942f01bbafd68b15d6edcfee6
- MD5 b1ea23f2fce5d7ea9f727d1e61923fb7
- SHA1 3d4ff42681dc30a9ef8e994c55a0171bd0c063fa
- SHA512 683bac534f00781eaffcc3a3b027eb9b7bd092985109410b4ba3387e7a5f194950dda22e291c29cc5ac1b87323035eb30cb8a3a0da9060e3a622dee57a885615
- SSDEEP 1536:cwWobV8UZsELCg2ehk1Fg260Ybzmq09V2rZMoncTAxCxJN2PEk2HKKc4sAWMr5/p:c2fsEWeWg2gH0vgETTEOXwMylUs3Bq
- TLSH
  T1E1B3286D22E811B5E276E17CC9E3090AD3B1B865232257EF0391416D0F77FE86D39B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  XblGameSave.dll
- Size 828KB
- SHA256 9d2eacbc8fd2e43fdd2b680804a7aca3da5f22fc98ef9436601d5aa8c159bfd3
- MD5 af3cd06b343e24ef99545b97377515a4
- SHA1 3f489e8fc5aa87d6fddcef95e9705835b1222dd4
- SHA512 f297e29ced4942e3d02307b8558dfc321a7a5e97c393ca00e33d4935b46dd3592f63bd93b873c1904f81a21a3420f9a92710f6a394b351fd53b5a8108fe35a0d
- SSDEEP 12288:BrM0gqLsvbHniF1GDa+lDMdwPtXGOgoJ5Y/GX+1NcK1G0F:S0gqLsvekDPlwaT1Y/GXKNcK1G
- TLSH
  T1F1054C5E95FC01A6E0FAD27DC997890BE6B27C114372DBCF0162426E0E17FE8563A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  XblGameSaveExt.dll
- Size 196KB
- SHA256 5556996b9931f4b78a398551e5963de3590a05276be14b77e8aeef297a09b31c
- MD5 b151cd12ebcd749435779894734f2448
- SHA1 956a97579c952c43b38dcf2e7b90a972857abe51
- SHA512 52c140266e82e76fd00848bc3d17d5e6853dac42e14b68d82c09e57526dd7928f2c0a06be05745fb41e482c7e2a6af6c4c3c35cf539d3ca232cb7a351ea62ce8
- SSDEEP 3072:OheeqL/gyuriJam4xctuEsF2DQRvGSSfur+7pa6GzJ5BVSKn:+eFITiJam4OLlD4SGrXR5Vl
- TLSH
  T1E2145C5D72FA60A5D9BBD17CC6520A49F6B27435132122EF02D0C2B99F677E8B53CB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  XblGameSaveProxy.dll
- Size 64KB
- SHA256 6e8d1b34292aeb750e4629e98c59a0c30f130224791d136537061978d808d1e1
- MD5 fb3ab879093295bebc82bbff57a44449
- SHA1 eceeac052e4a01b61ece837585fd8497f66b1fc7
- SHA512 0fee845677a71e24bd06699c26df6574cfc140e2adc5d338d641b7a688a728ec1ef2187ef3725d269a0ab511022488453ac77aacb8edb0010277929c3899be43
- SSDEEP 384:thWA2K4h9polCQLmzHwv3BE8Hkpcly6L6smE4w1KrdEQVFWo0Waw/ddOweV:PMNFNQaHY3ZHkpcly6L6Tp2KWQVRa
- TLSH
  T154538259FE2448E2C439827A4A6F0F86E23DDB0083135BDB02AD205E5DF67DE8B756C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32