4dfba261e914d206c8417ea0fd93a8a760ffef744fabe799ae25f52b0deca527

Sharing

Copy URL Twitter E-mail

General

Target
Windows.AI.Agents.zip
Size 17.9MB
Sample260812-gnf4bazekf
SHA256 4dfba261e914d206c8417ea0fd93a8a760ffef744fabe799ae25f52b0deca527
MD5 08696e552700fddb4656e81305f95a5c
SHA1 043f0755f4bf563d1110cfee27be18c9004369e9
SHA512 7406dd3ff9b65979ec382e0916c8968b1e3c72a82819e09d3add272270db1429271a1e85c087d72e7ad2fa05f808ea62200592e82f35bbe474d3a4c70abdec28
SSDEEP 393216:Sbxrt1Sny+2QsZ86YLT9XVWxMgl2XNX+vGsItkFbXRe6Rn2MwwNosUmn2:KtIy+/sZ86YuxVlyZ+espbheYn2JwNol
TLSH
T11E17333290B7440AC70647B3D687C810689C85AFD66238D6F4F6FFD338ED9BEA254646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  WABSyncProvider.dll
- Size 84KB
- SHA256 610e27700fd37e912be20e218fcab29aee4a27b2861405b20ce264b967a3e55c
- MD5 a154c49aaa416340574126fb4488ae62
- SHA1 e80cae330e78bea6a2e6220e2dfe941fc8c92c46
- SHA512 5808b052e33f5025282e78ae71b93252b6f0a2786b2621733ce7cca8c53a38dd927f6d5288544fee5c48dbadeef368825ee8f5230c062dde8ba45f97b72d615e
- SSDEEP 768:K68xsanH13akT3/7Wt0aZYzgZTjkd1JiRGGMMuHzp+fwq3fbelXieCScOcfopslE:b8SqVWttegZjsFGKHzp+MB/0lv2nld
- TLSH
  T19F834B0976E8A1E8E165827C89578F16FA31F4112B2246DF13E0436D6F77FD26E38712
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral1
- Target
  WFDSConMgr.dll
- Size 128KB
- SHA256 fb7334c4625ddbec74e3152ebb1155156ef757e19f60f7e80f736189267490f9
- MD5 a02f1cdfd393872afce903d6f53748ce
- SHA1 a12b1475005f67bdcae717f7def51e3d595d12d3
- SHA512 9b99e1444ce0e49a85a5c1056bfcfc2c83c2f92b7c1c0ce6e72a2b2154e7c8a239bcfd9ced78c3e796e8e207f5154d90fdd69ba5a5ceca8279921d0f9b067aa3
- SSDEEP 3072:/o8Ls92IzCUfdVPb6Bd0DoHCTgLAMGXHEOVzN7/+Z+T:g8Ls92IGUMZMHTzN7/Y
- TLSH
  T127D34C5EB26C14A5D476927DCAA20A05E7727839571243EF03A0D07E6F23FE42E39F61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  WFDSConMgrSvc.dll
- Size 636KB
- SHA256 d5a4152f4c8c0c6872efb12a6ddb0a902ef8dc1f8e6d13d0115a920e721e15c8
- MD5 074e7424edbe4ca34961fcdd4a5d44f0
- SHA1 9fa1d80f7fe225c832daf658fa5921cc92f8f8ee
- SHA512 986b3f02f6739142741fe3983ea75b0fc5cab7267ec9d8187d6961e799fa610b2399beab3bc38d3402b51dadb2c7c734cb47d7f1b65fe944589275226adef69a
- SSDEEP 12288:ZJRaSCH8fr0AJmeUWoh+Ae833wMZXRce2PzrP:ZJRaSPDTJNxAe8nDRcewzL
- TLSH
  T150D4195EA7E80491E0F7C27DCB96470AEE72381A177296CF0261415D2F27FE85B39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  WaaSAssessment.dll
- Size 184KB
- SHA256 1d660748ebaf20731829aa817c6deb2cc0dbec52319a5df65076d6585c8399e8
- MD5 ccb21a2f92dc226bca969ddaee70846d
- SHA1 74cb074b03b1902c4a452b73ed20d6e2ee407dca
- SHA512 0b4b7777ecd744b79edcb0fc0ec280ebef0f0147367ef87576cb7bbdc4d47a0de44d7fc7ff1f38642a65cbc16c53f7f7b1741eaf0005c56205d632ba80bb6ef5
- SSDEEP 3072:50kMX8Xrq+6Xc2gewc1TUmxF9w6R4z+C7sK0YF66I0T:9m8Xrq+6Xc2sqUmz9wKuL70Ys6I
- TLSH
  T19F042A1E33F91099F2B6D27C85660515FA737422272196EF02A0C1BD9F27BD8B939F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  WaaSMedicPS.dll
- Size 56KB
- SHA256 48f777cfab5e308fb85c67c9c6ef53571060568b3210d1cfb5beb0cb527cb49a
- MD5 082411104f59d6454b066411821517da
- SHA1 ade38b02db934aefb8ae7e77257904c16333507d
- SHA512 6c6b73201054663fca1e2190b53c7b2752e56190eba3f257357ce1f80365a1d85c88067c6898c87c75206e3f81517cbd5eb1a9b3cc1ac3f2c01da66c5e21a6c8
- SSDEEP 384:s/efnWNlqboKftTL3gRD+iA/po5e27gc3xWYIWCQd6X7QqkE8quNe:s2y48C/po5e2f3dcw
- TLSH
  T1E4438289F704DA65D82D4631886B8FAA3735EE590F5243C73225730E1DB63C1AF32AD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  WaaSMedicSvc.dll
- Size 92KB
- SHA256 574e6ae25a2efdb0e03013e8346b81cdcebe4021623ff9e92a2a1937b48a5f69
- MD5 f3fdc6eb4085f15cd4e03d4db4dda59a
- SHA1 832ebe1e7b537a70759bfc2b11dd44681806607d
- SHA512 a92fae892ded2d71427c2ea4a47598349222ad28cab24253732b4cbd1ee2e555ec2b6b7ceed75a73a1ecc918d08df8e085ef6ba297a50654552cb98e2231ce34
- SSDEEP 1536:c2ayZgTNM1VbIuhX/zHM8KijOWsW9SHSX/bUZNH+/Cg1z:c2ayZ6ut6W90qz4H+6g1z
- TLSH
  T1D6935C6D75A810F6E5B5D17D89830A0AE7B2B415472247DF03A081BE1F63FE46C3EBA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  WalletBackgroundServiceProxy.dll
- Size 76KB
- SHA256 93b64dd33a43989651e5fb3e7fce56189d41d17e2eedd035014790b4836e576e
- MD5 32acb20b3c02041c29bacbad00786a50
- SHA1 256e909bb991ed114320f83ea2662043d31ff4a4
- SHA512 2a06ea856adc78c516eca136ef9f0ee2ed22144a1c9795ee8a7af87b113759f9a925e34f7f5cfa860d6bbf0986658311f1e0fc4bd37baf74fe150a82f7824237
- SSDEEP 1536:QVzNz71AnW+JhKYKLA2c+1IPfUxb5RueEx1rAr:CzNv1A7ALA2c+Eibr61q
- TLSH
  T1C1733A5D737830E9F562917CC9564A18E6B1B025232166FF03E0C2BDAF67BE86039F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  WalletProxy.dll
- Size 116KB
- SHA256 6c866bd67360ea94f7b85072d13717586935ec1e4bf814827154b73e0e6c84df
- MD5 881c5444354247c6e4e249bf46ff68b8
- SHA1 c35549c1fc93a299810e9fc910b9c2b3099cd84f
- SHA512 4a7db6ecff7b2fccbe610c7e2070631f3290562e53f7b569e6dd21e3e38d24e15db60626fe07c56f1d57546423182f76e51d398886a8431554ef9633b6c7657b
- SSDEEP 1536:9QWhEUDTYHu1I3i7gpt8m1NbsSoSq09W+jIL7DD:9QNbUSq09W+jIL7/
- TLSH
  T1AEC3308BFA548CBBC8AD423A445B0F247336DB74678243C706A4522EADB33C65F759C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  WalletService.dll
- Size 472KB
- SHA256 7c7de5341b80b172490d2ffe5a5591d6cf272df0b33ab7c4d63b7a40605ab9bd
- MD5 937ca5fae402cf5ed870104e3db64fba
- SHA1 75642ab8c102c1eec824c74350c10d000fb4d0d1
- SHA512 7147de660737804992bbd967c4b2f57b4c3b84b7ccba83b0d657f5bf89584e2cc37842651743f71febb65f653faef62ea9fe62aea622285a5362590fdfcce4d2
- SSDEEP 12288:ibSKP0mihcMiNWibkdl6hMYxcha/wqpYjrMEVB:RSsObkdsx/wuY/MEVB
- TLSH
  T12DA43A5E76E407E7C57A823CC6C34205F2B2B4212B539BCB1264C27E6E27BE46E39745
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  WcnApi.dll
- Size 172KB
- SHA256 7144c616981ce83a568f7ef5711cb0e2b931433c12c4d1bb16c0c8f9ce55875d
- MD5 46de3f2a26a230803c233601df83599b
- SHA1 f79f00d2828687f95b85ad0a47ab9e8183a4903d
- SHA512 3af724ae695bf8d0032fce75a3772bebad1296d82448ab53c20c60aa55e1b7986cb0f71f8ac5942e17ae4513eed6f131cdd959a001d418b9b4e229c3c45bf8e4
- SSDEEP 3072:us4SHi/RZ1f0FQB/tq60Y7WY3MWRF+ewNXYchKxnQi/9l:us4Ai5Tf6QFtq6jWY3B3rwNoIKx
- TLSH
  T19C04171FB65C0067E07A9138C9874A1AF372B46A430257CB02A0C37D5F67BE96F76B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  WcnEapAuthProxy.dll
- Size 60KB
- SHA256 4adeeda98d2b7948f2767078fe82a93208985283b8fa4490cf1196992b79473c
- MD5 72da7ee8504da3d7a8e4e3dfd2849d94
- SHA1 6c12e4f85ef45050d22cb707271cdc5721a072fd
- SHA512 1224eeb0bfbdafe8234a7faa8adb0de370c88145f0f4ea6813bc9d475c63aeab85b5074b11115a388b5cf5751b1b942bb76f74fa94a800d0873e51afce59afd3
- SSDEEP 768:hsCYLuDL5rpLfDe3Gi2MtbKUT1l0Nu9swdz7mC:H8ML5rpktbB1+w9rdz77
- TLSH
  T1B753074DB288006AE465417CD9270E1BD3B2F079436257DF11B8C2AD1FA3BE55B3AF92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  WcnEapPeerProxy.dll
- Size 60KB
- SHA256 27f95df0244099873746a8c19da35b52143d67d0b3838b345ffb413134e9afa4
- MD5 aeb44b5ca4321e4713d2e43d34301245
- SHA1 d34cccb260f1769850a5d9a2f45d9bf8ec1a5592
- SHA512 c00754c1ac6c5ac7a07acbb7e1cf3f1b8c9127f1de54edddac21d13df36ed91f64872fc228338dfc1145297b5c9ef16c6bea2701ca0118776b41872f64d68eaf
- SSDEEP 384:dq3KilFhLGeShgvuTgrgIACyBiz55QmR4OWo1aZFcGEcEIl2R7SgIAVKpHcYIob/:dqjc2PkZxAW+aXi+l09NwdcYGfb
- TLSH
  T118530A08B75914AAE47A417CC6630F0FA772F068436157DF12B882AD0F73BE51B79B92
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  WcnNetsh.dll
- Size 68KB
- SHA256 bcbe3ee6199c4a86cf73c25b525c397c255debe9f93cdc1c1d1526c26531651f
- MD5 bb5fa8cd1be8d6f754b3f6f26356a453
- SHA1 e9bdc0dbde91d59a8666528808c88d44d3147211
- SHA512 2d16b44f6f77b10f3e30efd00d325a5051cb897273dd6ab887b348a18a170c59de025be54a3f8c353184fc518fca2b63e07d06b57fe9ee93049c8d9943f3d7c2
- SSDEEP 768:mocdcXx+WY+F+k7q60EWnokdXS49qKl0HSPvUUA7k1mMX:m+XkWYj9pu49v+HOvk7k1me
- TLSH
  T1DD63080D77985499E066827C89630F5EE772F0348B1217CF22A4827D4F67BD89F72B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  WebClnt.dll
- Size 248KB
- SHA256 0f96529271222f63eebd8e87c0b241d8ea9d9e6682b27964f70de3710850df20
- MD5 3b9ee99159fe6f93ae074b06920b4c21
- SHA1 8a7618c5f1a78329af600d900b51c072edc481a7
- SHA512 cc1eb753828531ff1660c1f43012524a04dcb45c04c847a333eec569c172f372d36838ed00908dc5d4b2b1dc4635a3e712a8c3a6b52b9827dbcb049a7026ce84
- SSDEEP 3072:Ic5LqcFJcaDUA+IAt/SsHFjDD5F8Xnjd3RqeEfox+gUQ1iMgxr3LbrpsV:IKdJcaDQ/Sohw3jdIeEAxzwMg9
- TLSH
  T18744F82DE3B938A9E86A9274445353154E31B03D3F2199DF12E0C9386F07AF56B78F98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  WebRuntimeManager.dll
- Size 2.4MB
- SHA256 bad7e0b7ff2a768853ab15ddc54478c1c43d7793d74b1dd8dc8a5f6866888738
- MD5 3bc9790af6358580857bd77c74f9b781
- SHA1 ac2171aafa9a234b7ec814a18221a30af4dee2a2
- SHA512 34e08a329363babff5ebf2923631a578818373e947460788698418e590a18831729bbe2416a72dc539fdaa926fc462e5e4666fd7b921da5edeed453f398d6a3a
- SSDEEP 24576:BPbu6CZMWxcO78eryAWC+7JkiC3ZeZDaG1glOpeZyEXsKi07:9bvCZUO23C+1kiSEZtKA0Z/8Ki
- TLSH
  T1ACC54B6E6AE804A4D27DE27CC857460AE6B17C2117B1D7CF016462AE4F37FE41A3DB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  WebcamUi.dll
- Size 956KB
- SHA256 5e3c9add48a13f3f86b783d11020e0a5b5d0d5af9db9761697d8f6bfb8e94b76
- MD5 f0ab1870dfc475feac2827b152b90f6a
- SHA1 130967ebfdb9c9bf2277e7462bbd7d5a79eb7ad1
- SHA512 532c8350df987763b9e329f15edc815ba7b07bb68aae2553f41466727e70c86f80044e15d8a790db3a030c89ea4f2f19a97f73cae9bc63d17fbf15016117efc5
- SSDEEP 12288:hTnqLogkbQZFWJqSC9gaTd0c0IKNuUOaHrTsnyMij/8:FneogPvfSC6acXa0s7S/
- TLSH
  T182253A2EA7F80055D5BAA33C84831719EE71741C3F2196CF0164823DAF27BE55E39B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Websocket.dll
- Size 68KB
- SHA256 61ede2a204ad579e732e128c416b529a972c46f89a5d8ffa14ec1d5771a76be3
- MD5 4a6aecd13e79f866fbe0fc1dcd56e8cf
- SHA1 586508a591b9d7b6139041b70689f9b03c7520af
- SHA512 95615be95a87b7d47f1b1add1ce4a0f64756a7665a70034fc7521925a257eb72374661bc8e35b0eacb1ad10afa29fc96c1b56cdc2c3286e4c26368ccdaf1fb9c
- SSDEEP 768:srL3JTtKUus1/J0yBUHlTybuKs+FJbWjAlTao+/PDJaPPE1jCqH1Z+E3hyxpom2J:spV1My7ugJb0nU0jf1Z+Exyx2m2J
- TLSH
  T18763494A7BA864E4E0FA427CD59B8A4EE371F411271193DF03A0436D1F33BE1693A7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  WerEnc.dll
- Size 53KB
- SHA256 a49fe664e1a231230e24523587c1039fd8561db3a11eccce1d561f4f111b06c5
- MD5 ba9fca7bb1b7c76f28f53c80e842d163
- SHA1 80420a824657efa4b20691d2fa83de93216428b3
- SHA512 e0bb35e9adf717e82b0d82f023c9e359d6bed0875a9483c518dd869efe811bbacd269d54bf9006e2b3b95078fdee725bb4205f998d5e73284bda7742271bd536
- SSDEEP 384:FbZv0GblmYKQx8tbsLkOWz+YBquCUdjdW6ZWURdn/vDBRJcdlKR9zlo91:FbpWeStbiyzxBQUdT3Rd/v1PIs9z291
- TLSH
  T1D0438E995B5858C7FDB75138C592CB07B939FAA1670006CF03A2915D1E33BF4EA34E89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  WfHC.dll
- Size 100KB
- SHA256 b876ab1fb2d7c638d8b8896ecdaa9337fb624bc4a90f831bc0608838c64e0f69
- MD5 80d21501e25bb0fdd04c0f512947ad18
- SHA1 5a03d715f1f81520e2931c08031f0579c4c092bb
- SHA512 6d3c09ef80a9ce2f054cb03f103752586cd849c265cdd8d7d826112a9ebb022f48d252be61c0a0effb93598ad7ef61769634161f65199f02b450752fa1d43687
- SSDEEP 1536:jBMCO2oN6ihxvqVsdrdMmOubHbvyIYQesBbQ9l+nbmCqS6skIpk:jBMCOXHhYVsnMmFHmQe+QL+nXqbskL
- TLSH
  T122A3080B77A8209AE166D1BD86134A1AE3B1BC24231257EF12E0F2BD5E37BD51E35F41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  WiFiCloudStore.dll
- Size 372KB
- SHA256 49ff652910891a887341cb70e063f98d154196ff0250d328a4c8452fd26e5c0b
- MD5 03225bee73fa0b4229e972e30aaaa398
- SHA1 c8f216ebc01fb5d3f62af20006e1d83ed2fd7511
- SHA512 7a9179210c0b70a55c34961444c5f02cdd430eca3024d00f1602ffcfe502c81b26f7de8abdca8950a49c3f8d9448e9b5b23e5a0bb09235554d9f7876b7ff4b84
- SSDEEP 6144:fZi9ZmNIHc5DULzMVjVeye1VlgDYLIhhfq+rYGI/fY:BijmNIHc5D8zMVxeyevRMYGYY
- TLSH
  T171845D2DA6EC04E4E17BD07DD6934A0BF6B1386A036256CB06D482791F3BFE8653DB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  WiFiConfigSP.dll
- Size 92KB
- SHA256 83f65ec0aad38778de830aa379c23018369438ca55f021772ff523544d1089d8
- MD5 1f98a5bd17f1f7195f520991c705e044
- SHA1 fe2dbf5061403ce2122ffda6084111672ea035ff
- SHA512 39580cf53110050726cca42dcfa1a9ff3d0f8c15d97b3e5b5d4300206b526a3a271d81d9baf746759ea68ecbf50fb00385a4e0755669ef7e1ead7fa469a753f1
- SSDEEP 1536:NsvIdSjet3huGKst8CQz9C5JRjXULD1Fj68hcL7P9hiPmoCKrXb:FdD5Kst7kC5DjE1Ad2Pmoj/
- TLSH
  T16C932A4EA6B42098D4768678C6520616EB717839372287EF02B0D1B96F57BF01F3CF99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  WiFiDisplay.dll
- Size 404KB
- SHA256 3dd19d85fb0cdf89524cbc5993386bb36924b56d4242d4bccf64d6dacb12b9c7
- MD5 13fcd1143915de015125cde74b365f07
- SHA1 b3e71394b17e2d53642e6ccdb54a713ddd595178
- SHA512 72035a4328599c350678f7bae562f1cb1d145d957f31863fbc3e679fd78302b5808ae4c8a7797c83d3835ae87132ac19f0a0319a693b86c9ba77975e91d4aaae
- SSDEEP 12288:5GeeSMoUnJuvfx0whwAKXi5/L8H2IPoDi89tmV:tMo0Y/4pPsi89tm
- TLSH
  T154943B2DE2F914A5E4F6C67C84521719E671386E1F319ADB02A48178AF03FF4AD34F1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  WiaExtensionHost64.dll
- Size 36KB
- SHA256 e95abd61fad5cb1401dbffada81efa24f1ff395aa531f2cf09dd0686b297d6c1
- MD5 50dec13414ebcd7ff13992235b490e5c
- SHA1 aa1019a2db9312c8c743d11d189e5c02971ba35f
- SHA512 c3fe7328aeb610c73ba6253617d3720634fcb7abd9803eef96d32697038fedb37045a920fdb3fca2b458568a9997fdbe2ae3fcfc7c63d6de93bc4adbfb7960e1
- SSDEEP 192:t9BpZu1wBMAPeQBaBs4ci9IzlgfSvnE4PnsU8yLxQVWab4tW0:VpZM0mQQBs4B6zn/CU82KWaMtW
- TLSH
  T1CAF2FA84BBA60DA9F876C63C99D38B49A178FA11472287CF4391069D1D33FD16638FD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Win32CompatibilityAppraiserCSP.dll
- Size 304KB
- SHA256 a34d718d64fb6875737ed9da392c49d0182d2c930dcfedb0c43057682ae682e3
- MD5 11aa4d3eb374828da92380bf6daa94d2
- SHA1 29e78a380bf6f61db7ab8d72458b3c53ceee90e4
- SHA512 33e8cb071d3f51cc60e45b54d80efd2e200eac861c78ee3ffde145f9a3c1dab72df182c351e036e75481d3b3732b8c97d566e6399f59406dff21659f06bfd035
- SSDEEP 6144:mIS/EcZL53a0ZPg1tbrf9VwO4mVNP1hg1UkynXbPif1:mZZL53Ng1tbD9q1SbP
- TLSH
  T1D6643A6D62E614A5F677C23CC9538512F2B2B4351721A2CF02A4C07E6E77FE4A638F91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Win32_DeviceGuard.dll
- Size 132KB
- SHA256 5b1e142ff7d9de0d43292399e70b4d698d9b2337deb26d461716a438e40e07cc
- MD5 7d97c7c7c8f4b63b251c79a48f0e982f
- SHA1 50adfbe2b2e97b28e74a846ba46c55e18b685451
- SHA512 0be52a24de573ef30bcf5adcbff62a30ec51fc3dfa7415ef5a117b6cc6421ee4fcf2a08e017534d19de716a63f2cc80bf3668c6727f493b4f64bbe5cf48be657
- SSDEEP 1536:xDTV6nM37KxZzDK6eo4AxLmMbxKsOP97mm/lKXZAhOj+:xo9ZzDK6GN0KsTVXSh
- TLSH
  T185D3821BEB50985BC8768632C96B0F727BB7EB54138203CF4514822E2DA73CB1F75999
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  WinBioDataModel.dll
- Size 576KB
- SHA256 357bd94630bb71f2fbd528da6db3eef575fab9d99b1a96614e8da00373f4a70d
- MD5 3f7f635dc7d19b3277fd9f040e0943a9
- SHA1 27f413ac04045bae95dcf6308333803990130a2d
- SHA512 cf7afb54bebe58c416e35f6e701abf261093640764cea9edb61ecd7e3daf45d9caadf6ea3ae45aa057e2e637b04885836a61d5435e9e2bde2231b2d8a088c170
- SSDEEP 6144:gSuD9Me410gfxT7Z8oPOwEghmTyUsTiRO2Ql+prdyvzkVd2G/GDqrySrYCR91nR:AMe410gfxTMwDm/RO2QOdcz2djkq/9
- TLSH
  T17EC44A6F6AFC0396E07AD13CC5534A1DE7B278604362E6CF015442AE9E2BFD4593EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  WindowManagement.dll
- Size 2.4MB
- SHA256 930bd57e6fb571cb88831c5622200eeed884c909241f2f842e1ec30b90719d56
- MD5 732ebc24b6da0e20c6c16927fd124f59
- SHA1 da07464e70603f6be831c8ba53bd4b4065454b4d
- SHA512 ebed57439dbf102977476020ef45bf983143634a51a18a2764dfb1774e09f330a20592df08a64cd617762c418c0153e83d1d2a4fbc53487f20a2427d3e9c752c
- SSDEEP 49152:dMGbeRDtQkmd4MrfkevuPe8eaFj2tBrI1wloWMr:kZOnx1X63
- TLSH
  T1F1C5391F16EC41C9E27AE23CC15B4B0EF2B234571332AACF0595566A9F17BE4897E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  WindowManagementAPI.dll
- Size 1.7MB
- SHA256 2551800153fe8a54312e13f63fdd7e2ffaee994c6733b6cbcb17e1739f13ee1e
- MD5 f531a0e0aa96e41c6de18d8336c19606
- SHA1 49d23777801e3196816c11abd783f2af3e1468e1
- SHA512 2d7051329bab0b690f3d32c2fa9e3fa9556c8b7e2851466e673f54976191176670cc76679bc2ca3ac36deaabf154df259ccc4657137230a2f628d14fcb1173f4
- SSDEEP 24576:rZbOfcxfw0WupJKWvZaMDPV34S8vh098adEZk4qE/f8:rZnaw8MDZ4Sco8adP4qik
- TLSH
  T1DF853A5E1AEC00D9E2B9E23DC1574A0DE2F138525372ABCF0155166FDE2BBE4497AB30
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  Windows.AI.Agents.dll
- Size 67KB
- SHA256 d43ded9f8a318755ea12909529abffce57e9fa202e61009953944275528f5beb
- MD5 6c9fe886a7364ec68e11edd94a1c8112
- SHA1 8404365dc3286fdc0324fdd21ab8eaff8f93b775
- SHA512 cd036512387b57a13e1bc00e3fc97e9179e0e62135da1527f0f716a068ea2015d9a8620054412977e14f2527b25b4dc58659ffe43f654716cd5b725f85060815
- SSDEEP 1536:VRrsY7CJELNhHUIb+7zfpCeeWR4kt+dH2bIrBHS53+v:YY7dLNhHZyPp6W6ktrbn+v
- TLSH
  T13F636C5576EA01FAE03A813DC4D31E0AE672F8515B215BCF0764835E2F23BD1AA7E391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Windows.AccountsControl.dll
- Size 760KB
- SHA256 1b9cc446bec0eaa5b52d92d7851d28e25c36fd3b6e6b576f02ed07534c2f899f
- MD5 61962306a058e359d7897994c39a6ee0
- SHA1 bc104acebc5cb50b7522ef253508ff7610dccc78
- SHA512 0b1dc2cb4b2e6d2d1328b17f82279997c278802bd301dacfccedb3a5400ab141f14a86c67e59250cec81c30471703d2963ea3b156def396451d2b74a4c588704
- SSDEEP 12288:aPFCtUI56PdfHwPib/kBmLaVgkGgXmE1m7Ai:jeI5gPwabhLZktXmEo
- TLSH
  T1DFF42B5E2BE8059EE179A23DC1534A1AF7B27C155762D7CF0150526E8E3BFE04E3AB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  vss_ps.dll
- Size 76KB
- SHA256 36ca3bb48d8e679200647967f86a4f94306748d2a6ea852616e2559dc8e7b118
- MD5 e3adc7c7ef6bb577c169655ff459597e
- SHA1 3e26eee5a2adeccb1bc904c182f5d87f1d244b3c
- SHA512 e143c6fa33320c0af58e4fce811b3db19a669fed3b198292f56cbba4e9fefb05775ec78bd9d1e1dce81299b14a709a5b345b1cdc3cfaa0621e3151a12cf46763
- SSDEEP 384:KKjImXcdEVi9MJ2nBrngTyaEREaM4VFsDxeNV7FGwW/uWLWcqB5Z1:KKTIN1NPVFlVQIWm
- TLSH
  T12673829DFA144875C438523284AB0E25A369DE059BD347CF01A8122F5EFB3D1AF76EC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32