d852a2a105a6aaafdf2292580eea27dbfd16e248d7df4f3177b0086291cae60e

Sharing

Copy URL Twitter E-mail

General

Target
VscMgrPS.zip
Size 23.1MB
Sample260812-gnfsjszeke
SHA256 d852a2a105a6aaafdf2292580eea27dbfd16e248d7df4f3177b0086291cae60e
MD5 5d57a21f772104640a6300551b99c82c
SHA1 f704b8e1bd27e07ab99fbbae55b5cb11be6cf2a8
SHA512 d1bf265ac34aae2e5cead875908dba917e7abb47241ccb896ac38666092ce58e5d98f057cd17584ecc8bba109a416d0eb860fc8073e35105afaf0253c9c28aad
SSDEEP 393216:DAaWRHqyGtldD3hn8KQWSbrnDafgHNEzK2jFejzU9YhKaMDnyrBhsvQ3vnXso:MaGqnDdVn83P3nDaJW2pejJrtBhsvKEo
TLSH
T1E837331DCD3BA584EC0732B21A662E215437D6DB0AB48875FF950C6D3CDEFA06B56C0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation

Malware Config

Targets

- Target
  UXFrame.dll
- Size 531KB
- SHA256 1d92ed039c04a3be3768696820c0be86ac90649fc74aa91d767caf802ae0e9f8
- MD5 a3abe28d9b608325e3c1268f27034983
- SHA1 479eb19ddadf00c7ee5140bd18f3172fd3ce52f8
- SHA512 b8b04a42a07b8379f148a3736a214f184a48fe8c7374702cf7de334f936dd74f4e72b88ae9a3fa5b8a855d62bec91b4229953228dd531a4fbbb439f43a1d5557
- SSDEEP 12288:qVujkLRK3fHfSHwNz4gMaivb6FrtZJYmG+W:qVuQLE3fHfSHkEgMaGkemG+W
- TLSH
  T134C45A6962A807E5E2BAE17DD917890BF6B23855037687CB023081491F2BFF4993F761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  UXInit.dll
- Size 160KB
- SHA256 fdaf121aa7ac7b77d07795a603f6c5fedf57c3188bb9db4e0833c544b6d0563b
- MD5 a97e62c75d59d11c54e2dc2e40b88c10
- SHA1 d56e810d190c17f13e4d4e3e6beec2a274d661ec
- SHA512 b2fe36806e948287c06bb8fc5aedd706e623867eadd2fcdecac24c64e92dc99efedb6ec749ee9429755d7c30129f3099a4c935436546c2685b9b4a2956ba3343
- SSDEEP 3072:rk8mfEAgG+vxdGnKhVhPJBdLtqf3pY1cBOi/Y1uav:Y7JZ+VhVhRBxwf32SY1u
- TLSH
  T1CEF34A2E72FA20A5D57A91BC82864215F673743123016BEF06D0C2B99F17ADC7E3AF51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  UserLanguageProfileCallback.dll
- Size 104KB
- SHA256 29bc35f68deedd693383212163f76aa8a8e2ca755d38827f403effad82b56c4f
- MD5 37205156587246eb32c9d5d1dae36f00
- SHA1 c78122f91de791dd7ca8293aff50cfb1d3a5b58c
- SHA512 aeb7299a8516ee3107812d9018ad184fc5cce93968823f0d59244757591b3f99eb5adec520348d0cdaf24b838b25a08c3f959702389f6c3936bb94a3d053b38e
- SSDEEP 3072:5kx5oe25bnqYjSsAaWCIRxT6V+pCbWQWKs5YZl:G5x8bqY2sAaWCIRxTWwnnKs5Y
- TLSH
  T151A32A2E716C20AAE572907D86530A0AD3717076631267FF03A0C1BD5F67FE52E39BA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  UserMgrProxy.dll
- Size 428KB
- SHA256 0e29f22f8ae751b7cc69e2aa9624153466137dfda25147b672c0e3aca5295236
- MD5 00854d2f28d07007c361a66e9fca2511
- SHA1 0a7f70dbdceb959ac7e1653317e087c970c89280
- SHA512 80bb10044b6859e47cbb69a3e06b6040f82ce71f95f2cb9a59d6ffec329edf020aa423dd882321b1eb306fff2e2c8583789be0e204eeb521d1d4cdb9e7a59b1b
- SSDEEP 6144:fN0z7c6UzUIL12splQppxZs+FVJhWWxdW2zeu5k+dWY1rsXdL0Q:fqzHUzU4IpxZlJgtuNsNw
- TLSH
  T1BE94071EFA9840A6D97AE27CC1774606E3B23C145752D3CB2224613D9E3BFD49E39B60
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  UvcModel.dll
- Size 184KB
- SHA256 fb00b161c3bb08d11215af54e90b4087fb5041490cba135334a0fb5c234c2619
- MD5 bdb864b575cecbc260c70074ce805594
- SHA1 6fabd0003f8e3e3595600c4f17bb9d7c0bd9df58
- SHA512 3498d49dd7c8d2453b76a42f398350adcff03cefca2911b749c796d7045b610a71698267fda35dec4597785164393003c35c7b42f93618b95542d2f6d6fe5050
- SSDEEP 3072:YMms9a9eMh88jHhcY78EAHc+ZQM7XSFIv4WB0SaLjJImU78ftF2D9uGc:nK9eMh8eBhA8+ZQM7Qdli8fX28
- TLSH
  T10104195B26AA01B6E176913CC9C34E09E2B37866972297CF0264437E5F13FE89D3D760
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  VCardParser.dll
- Size 204KB
- SHA256 535dbef453d34feec3d6bcc2ea1f20076efa01a956157ce7d95cd9324b1a7190
- MD5 9ee20d607ecf7f6381efc7c450a1c66d
- SHA1 a2036c00554c0a33424fb48cd97c113dbd872ca9
- SHA512 466db4d0bce1793a3578aa6ea82abdadfc1b79f7b3bfb5977d81c991b63f4f5e21137a1000cd3ed0b118cb96a4b8863eef2257acf33a8633c6860b933e91eba0
- SSDEEP 3072:3N/35gy7fwAf2hdgvt6Wa7m6ZQR8jJUSinac9veuUYMCjEmytXzUT:9/3j7f7Igvt686yySnac9eDYTQmyNz
- TLSH
  T176145B597AE011FADDA6933CC2C7461EE2B97702333116DF03D282B85E5BBE1A17A714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  VIDRESZR.DLL
- Size 170KB
- SHA256 05d92be636dae1f6564c29d60388ac1031c41c6c83ef5c81a26ef72877408df2
- MD5 a30b9edb97b9af2cfb60ad765db7e882
- SHA1 503fcfb470e7a4c74db071d61040cbe3d0bba0dd
- SHA512 e724bb300e4a63e513e91f75813c4c806b4a1467f391becf662ad998fd9c3d9209871f911085783ff85f5377d38ea972a0375f8204d8c28b0993e85e161ba5d6
- SSDEEP 3072:tEXE/z2iLjBTzGZ4/Ctcc6GWKiay1lIYUcAKLoiBaQJHsEigIetyCfFrc2Cx6M:CEz32KLoE3PIUyCfFrQ1
- TLSH
  T1DB047C5EB2BA20D5D922A03C86970656FA72B479130027FF16E0C67D5F23BDCAE35724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral7
- Target
  VPNv2CSP.dll
- Size 288KB
- SHA256 c96d32ae9bbc12a0b91ba866ccd31d2380167e6cae1ccce720151a3e19960771
- MD5 5ffd8530022c658d978b21cea5ffe1b8
- SHA1 d9969c8b06ee87a4cbd2389232ad32ae366de744
- SHA512 c692e62d81e2a98feb536692660e0abdb8474aaba203b80f3fbee7272c2b361f808252b9558cd29ac2ea24039b4ee52df0b0efd98fe76a59913ceadd990856fa
- SSDEEP 6144:DaRkY4C0n39dPGhqN6z0g2RSKAgkKUk8QkvNQbJxI:xU0n39tGhjzT2RSKzFEYo
- TLSH
  T198543A1EA2EC1DB9E5B6827C8587471AE3B178550B22C6CF01A181365F23FE49F39F46
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Vault.dll
- Size 320KB
- SHA256 d553c4f4f63da82b231985bfa136d328e4c8dcc35988e89b12820e8f4795ae91
- MD5 94ac1b6c15cfa1a691800a157c37a46c
- SHA1 b4eded3d42207be5216bf47c42bf4e3fe00f00c9
- SHA512 61d8b8ab1be2b52391264e6e9344f5f3c7fca05ba5188763eac083399aac2a37d3ea0b6564c175f0c9f22f59ac5bfdf20b6b33272a41a4625a5980d0590cb72b
- SSDEEP 6144:tA8gBUWsVKCJ+Bl8qGk/FZzgIlbMGYf/MK6l:ynCJ+BlRxMbfel
- TLSH
  T11F64282EB2A80876F1B7827C95838E09E3B274694722C7CF11B1027EBE17BD49D35E15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  VaultCDS.dll
- Size 164KB
- SHA256 e04446893dfab819d39276bfad3b257b052b7908847810784a04fdde33033859
- MD5 8b2e0fb8f68d26f8f6fee4736995075a
- SHA1 6282e02547928ac2b0cf40ce3baf315a811a9c92
- SHA512 9d666b6682d0f6a206e09bdc96de9e24493fb68a02ceaff619386e657582e45bfa640b2255cf6c3b764a4a5fe5a10cf66a0ad91b31c46679e9be2ed86739ec5d
- SSDEEP 3072:LrNlYepwNrLCVfSTlRPTsZe/rk+ozkLnaKqa2UrPo9/xwjAbve:llYOw9uVAHoZeYw+3a2UrQxxsAb
- TLSH
  T1A8F3177D766D10B6E17BE17DCAD24A0AF6B27455431253CF03A002BE1E27FE82D39662
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  VaultRoaming.dll
- Size 144KB
- SHA256 063fd09f2eac8c613325a7069e91556ecbfddc1d2b1d0c246041fde4131f7dbe
- MD5 332dcf13e83ba0fe7ba4e70e35e1bad3
- SHA1 7383d6c7e506322937c432549ec91b2388e859b0
- SHA512 9dfaa9b206c336e07d6ddf7693e687b4e06df85c41f6db2f19960b5506c230655551dcae8d0aee7c002423f4c5801f12e5cdc02179b222bc63395fb1f910e02a
- SSDEEP 3072:eTCmkcjABxs4PsRl7PGCHwLyb12nmCkiMNBoMbDZCnE7N//OzY7:PmtALPg7eybonmrNiMbDZVXOzY
- TLSH
  T159E3171E37E820A9D172523DC9930A15E775B820272163DF07A8827D9F37BE89D3DB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  VhfUm.dll
- Size 60KB
- SHA256 65af7ee12ea2e3a9e553a2b6999440c1d012e43de0e49dc77cec8923d87302bf
- MD5 7d90dad367be2d0b9766053147441eef
- SHA1 47b7803965e3c884dd87f2390314768a66743b32
- SHA512 3b007f1e9d615367d29fc5ec711cef2f320ed70fb40a67e189dcbd784ee03975bc7e32e0dc97c37571c25bad44aece7e5e8c5bb1defd296c1c71e8676d89da1f
- SSDEEP 768:WMcA7vXsvzyuhkEK+0oR4oeSaAPidu/C:WMcmsv+uhkkebAPiY/C
- TLSH
  T1ED53F95D51E410F7ECF9C27D860A451AF2A17825131A7BFF1CE482F86F16BE0993AE48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  VideoHandlers.dll
- Size 256KB
- SHA256 8e60c70b105bf8398150d9ed4569822f364869c5c579a651bd60b920d486eff3
- MD5 9b1b99122fbb601fb3ed5d55edb5d341
- SHA1 683b34f5386e5de2d5d35d2befe38b22691c63b3
- SHA512 73b4faf8ed6f241c4fc735b5037b6ab355455eba075c1620a9fd6426d825fedbd72c31f679f3c53301423484cc8f16a8426260af4bb826bf1131a4cc9e7d0fc9
- SSDEEP 3072:cPmA7o6tnL1NoPbwmEL8pITAIJ2OWp/PQpTDiA9l+P6W5YE2XBk0TNmS3t4cg4Cd:uL7LnpNibZEIpPgp6A9w+sCD0XMDfr
- TLSH
  T1E0443B1F26E90CA7E5B6917DC993450DD3B238611762E3DF0261016E8F1BBE8AD3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  VirtualMon.dll
- Size 204KB
- SHA256 6d53b09702746b67e82e8816331894ec270f716a5531df0f9977218fd8c2eb4b
- MD5 31310e8cb036e9d05441d9a25f7b8b76
- SHA1 d5d80d9f97a8a9fe51e41b19bcf270fc4124d6fd
- SHA512 0de87dc549c63a9c16afe4d83bbcceb637c0537ef1ff644aefc0cb7e33baeedcd2346395384cd806ff96da7eacb02d8b47850d5ef2038d124932797e88a103f5
- SSDEEP 3072:2YM3w6LLZs/t/ljHcJ9H1aC72Jgbv+eQ60A8rQJPIyxMKLMA/vV1:23LLZ0t/ljZJw4GQqYAn
- TLSH
  T1F914292E72AD00B9E0B7D17DDE924A07E9B37429432156DF02A0C27D5F27EE8B539B11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  VirtualSurroundApo.dll
- Size 132KB
- SHA256 53775b81078494328e867e6d51d46c624f85ade42361323b5b7427d7ca550e3f
- MD5 ff23bd7b44f8f8be58053a45235957e3
- SHA1 0e13f150e8bb1ef8ed5b7c5f4568c74d7d0adc4b
- SHA512 ec49cdec57af48a6c3660b08c5412dad4e87e5bb06e5f951932f92bff19bddf0b0a17cc25653cedef95be409526b6dfb4de1e8f042392d3f9c0b07cf2f82c34e
- SSDEEP 3072:YW4NyImYS2yUd/79MC12Gu5YAettsqYKZhWV:Kyhv2yUd/WC12GumAdKXW
- TLSH
  T1ABD34A6BB75940DAD17AD07C89438E1EE3B1B4255B2247CF2790836E0F63BD89E39391
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  VmApplicationHealthMonitorProxy.dll
- Size 53KB
- SHA256 9896fa5b242ebf4bcc9808167001c14bf771b8364c2e62fdde8e38e158a4fb0f
- MD5 c356ee79241cddd7379dceb99edbedb3
- SHA1 1bf060b20123d052d8edab61412c66dc3868c1c5
- SHA512 ee0e80d33a3cdf9e6e32a4a394745b6232ed602d55ba73c6678d7feddf68f18ca026550462eb7271c9090911de25645052150d32542197f05783de940eba536e
- SSDEEP 384:NtOSfaDzWA/VRO/nBkhkwQ53VoWNcWhJ/vDBRJc2jR9zrQE:HO5zR9R6BoPw3V7Bv1PR9zME
- TLSH
  T1F8337DD6EF9D4481E976A93445A7CE17B939FB02031142EB0362B40D0DBBBD6AB343D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral16
- Target
  VmCrashDump.dll
- Size 321KB
- SHA256 e72ea38b1ce6ce91628d03f815f4f6e878685e8de9f2e428ae758b2a783ad2b5
- MD5 eb4bc75f86737c3bdd9a4dd406b701e1
- SHA1 d5a8b43868fde8e8567c27140ee065c6590f496b
- SHA512 370db9229d6e5fe00c4a46a5b5dcfa822a0bb1d5aac5e48d70ee77b174f1a93088110727650e5849b56bc559b412ee589083a995eac59a05a5e57e6e1496c1ca
- SSDEEP 3072:953bzByoFSnbMscuGyE4QeNjvmldoMl2p9MAwtORfJux3RVMJarpa19ZAOJgAm:LLzByoUnwuGTlWjsCRvM7t9f/rpazZA7
- TLSH
  T102643C3D66690CE5ED7BD13889538A05F67278600322D2CF0590827E5FAFFE4A93EB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral17
- Target
  VmSynthNic.dll
- Size 469KB
- SHA256 05b2ec7f74a0a8cd7a515ed408e94671a67a1796ce235c6e91591306ef0c37f4
- MD5 79cf322cae132c2ca37cf2c2c3085a62
- SHA1 d0de9671fe2de7e321cab41e5a55c36bb5c52740
- SHA512 7a4d8fb70efd94c2a0d38291fb612222d4da5b6ea685c9ade43a76ec57d336b23f966de3553d57260e9402eb8668e77647fed3cb693ee1334ce9471c97db1e65
- SSDEEP 6144:N7oVVO/YaJWmQFDd8sCKs2l+m0QP+JnWs5gHH2U1fj1TWo+6PdF:S8A9H8sddeJCHH2U1RT3+6PdF
- TLSH
  T1F9A44A19E7A804E6E1B7D27CC9A38606E6B37C69477187CF11A0D26D1F33BE4993A311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  VocabRoamingHandler.dll
- Size 172KB
- SHA256 d8b90b17082fd1ecd337b79c74b327973354601bdc842b472718cb2a3f358606
- MD5 22842456bfa03a54e8533b3165a09c05
- SHA1 a5760d6a357c446d2c4d39e61a153887e297c65f
- SHA512 f871f5051e9d28859fa361218f575623493af3bd77744ecc7597e83dd00d97df13722e77531a83d7b89fb18a5c518b38c82c6eeaf335c575e82e9c87cfacb308
- SSDEEP 3072:dPCTPcR9W7BpT2T/POL4xpbCo3h6pH+FzoQ6JV1zw34AZ:EjcR9WPT2T+0xhCo3h6x8z0w34
- TLSH
  T14E043B2F72A810E6E676D07CC6570A1AF7727051131252DF43A082BE4F5BBE87E39B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  VoiceActivationManager.dll
- Size 132KB
- SHA256 6c723fc59ff51f7313d6e71514c2f3a5567fccae15b3937b4f486dd084ad2494
- MD5 c01a0d32b22d655952d9b8a5627a5937
- SHA1 5d490cf7d25ed62fe47ec06d62585b079ad97059
- SHA512 4b3cd0f196a89313e9e7ed84d066808fc801b0331736611d748c53e4ba8ed38c29553566cd5e4c2af1349ca3347dd66531047cdc16d3aa51b1037bbce851ff66
- SSDEEP 3072:8mJPg/GSBrF5waEuADX5YIY2bg3LevSaZ0z2h:xaG6HzEuADX5YI5bg3LG0z2
- TLSH
  T132D3182F72A920EAD679C17989520A44EB71B032131127EF52D0C1BD5F27BE8AD3DF25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  VoipRT.dll
- Size 256KB
- SHA256 3072e59c32b1e07cdab2a9681a8d9d53db28edab11a83ef5a5f4007d60fdc539
- MD5 85b5df2c75b509d0f42419487c83f3f4
- SHA1 0220a7be1b4e6c367fd5c80ec9f7584e6523ef32
- SHA512 9cd03816c028be996cc8cfc814bf9921edb00daf44eb083f4616890fe3c8ad3846d5217ad6c2cc7d24c13ce821ac0921ca15e0ed3cf213aeec848c45a7fd6550
- SSDEEP 6144:OaSSeYMQYqWI56zp0IiQebt19oVW5FJV6s:JSSgQYo56zp0H9+VYVn
- TLSH
  T10C444B3A3A7D08E6D926A13D84574F0EE2B5F5211312A6DB0255817D8F1BFF8E93EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  VpnSohDesktop.dll
- Size 32KB
- SHA256 6cec2899f79a816ff3ae63cac9510f14aef11c9638c85dc54f2e1a07cd2e0249
- MD5 5a85d66e6fc1244398840db74bf66fd1
- SHA1 5885fd16a67de1bda85b21353fe7de0bb6f8d3da
- SHA512 c9474a63519237fb3462efe26957b2b1f84e096439bf642fa2189b5f1215dba11ab7cc764e7dd98e9a6d0c2945a8f96e74152e1bfc101f8b5e7cc6e23a79dc23
- SSDEEP 96:OyvvPd8UZ2QD6k/MEHwp551ZdDb7yWIk4TAbmliB6/kYYMX265qlEWz3WwEE:HIDUtQp5XrpN4pvYMX26JWz3W9E
- TLSH
  T1A1E2F9CEB33857BDF4668178C1174503BA35B120674183EB0670929D4E3B7C1AA3DFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  VrdUmed.dll
- Size 53KB
- SHA256 b7c6676ebc48fcae8a409a95936097a57666aef4a5ad7a80fd98be55fbd00b08
- MD5 c159678aa3edd804f8fe47629cf39918
- SHA1 2b1ead759267739b353034b2c13d5634d27a97fd
- SHA512 8e95e6e1313ad78e3fae10dc8ee0783ed6fa8734602ad24afa01de28b1945b646b9ac5974ab6967839518caefd3b05de974b7508380236c8d7e7e51e70094361
- SSDEEP 768:LObEymrY+3EVcQeTIZVxbi9p101Pns9zS2R:wmr30V/OIZVxbi9p1EPkzS2R
- TLSH
  T114336CC5AF5C04C2E9BA2538C583CA4B7839B6911B2122DB47B1C11D1D37BE4EA397DE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral23
- Target
  VscMgrPS.dll
- Size 40KB
- SHA256 8a516050a21e825e0c342da36af0eeb02f28670f856fec2e34e64a6fc8b2ef3c
- MD5 5c5dc394d19c4f0af321459e20d444a8
- SHA1 79d2d9b53d78fd683b37e9dc126c86e47f12d824
- SHA512 463dc43524d5f02b35befbbf6e5bae9b43e3d9a1f3ead41efa8d03babf6e02ffb2a5ad3d43f724f6ecfbe8f167b2f4cf891d44e241fae33b423d6e7f8c665b8a
- SSDEEP 384:AhEWdBzUwzITFnuoHpXcsPLgqWsP7g3MWx:ABQwzonuoHpXtPUh7
- TLSH
  T1DE03C689B731599AF5755178846F0E23A72AFD14076287EB8A30163D1C7B3C18E38BD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral24
- Target
  userinitext.dll
- Size 84KB
- SHA256 179348d544ba498226b3bbd3e0e40a67ae2489ca36647aa3e3ad24d8d2fbb7ce
- MD5 c47908ad2ed944519eab75766a7eba75
- SHA1 18fb640a31200307e6fd1494029850e0588d63fe
- SHA512 f916e97fc0a17a61270d31e769d3ed27a62f7b5360c10e5947fa24a8a894e5c11a69be07cfc35cc764b6d0d7acdc48e39deca69b4aa80d9fbdb95ad3122a2f63
- SSDEEP 1536:49njpsJBM//nN8hnT93zynmKMWINHuZqtPxP7:4NWM/eF93pVNOZqt5T
- TLSH
  T1F0831A1D62B83099E57A8139C5A68614E2F1B43537125AFF03E0C2BD9F17BD4A63DF22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  usermgr.dll
- Size 1.4MB
- SHA256 084d9dafe67d89dc8c3ddc72a949a0c8f027698504fa3809484ee70dca60d3ef
- MD5 d00ffba5982bb07dab64b62f16ffcbc8
- SHA1 4c5237c064a930b029f16d246225f4fee8897e77
- SHA512 eac0e5220b5e5f4d588f29a82f93c9d0693c23612e56c593ae4ede7170e60cc4accf747b9765ed0c63cb27334b77f7f3f8c7f396c3265a8b3dcf3611c1b0cd9f
- SSDEEP 24576:oHV/uEaQng6tEV0KNFehfJp7RlXMP41KTSMJzqxXEH:o1/uYtRLRhX0UEH
- TLSH
  T11B655C2FABAC019AD57AD13DC023461BEAB174261331A6CB0551867D9F2BFE45E3DF20
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  usermgrcli.dll
- Size 102KB
- SHA256 8f36df633756eecef02a2c606a7c5ab7ba032bbb164709c4977a8b26b0232b89
- MD5 0097f2e45943dd0b0bf26e89f03f500a
- SHA1 5324c65c4310b76f52db12c51b098779e61cbb4f
- SHA512 d37d75fb183fcf6caaa0bfda8e16313547706ee62a619faaf2472179b0f4763c2847910315ca73241db8f103dbdef2906427f15bef276c0258383d68708e1007
- SSDEEP 1536:hi4OpyMWYCjcAmKcC+bBRkD2ug29lmKPHlveIP4oz4:wBOjcAD+83HmyHl7Qo8
- TLSH
  T12CA3394AA3682094E43A907C80974E2ADB71F570575253DF2690C2BD5F337C86F3AEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  usoapi.dll
- Size 208KB
- SHA256 21390119b79818b7a8c0af521cebb304552d222667e1106d141a3fb36703838b
- MD5 0ab9cbcbf403c84ea3b83d76c5e5338b
- SHA1 84d2296c47b3f17ce581283502cd3dc1da9630af
- SHA512 db29a6bafa074d80c81fb62f2932700fbbdeb650344d1bc11d6f8cec67160c3667b356aac10ea38ff38b02643db69e59fc4cb91e0d74fa4630a23b4ab294df24
- SSDEEP 6144:2HtKKegt/PTI5cCdC+iXIzO3pcQUfBAZ7OZYiXY:atPebkTi
- TLSH
  T1A5247F0BA9110467CF3DA27884878A49E3B6AC54939643CB0164667DDE3F3CC7F76BA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  usocoreps.dll
- Size 64KB
- SHA256 c71a63e503dcaad929e82e6962a562672c0b37cb7664b28748abb60b8d2180e7
- MD5 70d15022f3538ba2a9fa4676682bd628
- SHA1 53e0b6f6667c0784909c9231bc82a7055d821ee9
- SHA512 cc5ad0a67d9315f310e4ad1caa8179f57cbf0d3f38e2218594ba447836a1e90d99dce88a46466645628f1cdee5c61ac24558d1e7cd7321657d46799957d2b8db
- SSDEEP 1536:vBfSDp1gWeNweXePeNeEecExXjv+DNL9BGrg:vBSl1gpmsNL9Yrg
- TLSH
  T17653185EFB8860AAD1399179C5A70E08E37AF420930257EF02E4513E5E73BD5AF34B85
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  usodocked.dll
- Size 676KB
- SHA256 14a86eb828cce2ea91c310a4db9ed70a82e1891fc7459ccc6ac0a7a28a1f22c4
- MD5 f3859df4530a4fe95cfb474ae6db9f45
- SHA1 56b5646e0050f6d360da7e675b4c1448ede6c5a2
- SHA512 846f7bbb364104d51bd2fcd1e65eba15c6c60af9f5722f3d273db0f022f9bed7378a5db21f9c5265112528dc7e6517fe9ea6e85b2c15ca1e3d4eb314aa267ab0
- SSDEEP 12288:z77c9HS/lYOK5kOBSQJQgCu3A+vmzZ+sX8QOT6TSKL:/xlTK+O8QQgCGAZIsXTSK
- TLSH
  T1C5E43A1EA2FC01A5E175D1BD8A434516EAB37825533296CB025082BD5E3BFEC5B3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  usosvc.dll
- Size 104KB
- SHA256 c2ba76d0661a63220c4e38c6239ba869d0b97a4ba46d3ba14a97c3fc441b7f13
- MD5 52b107670442c8e80144f595919c8924
- SHA1 b685ee0caec995b11cb5747094a7697c152e4648
- SHA512 a1ddb2c87eca8522bd91337ba544e2c7f713add37c912e054bcfd5a6b4860e751bafa31b7b401014ea4331509979d47b0b5bfe0a80de9a9a08316393a19e86f5
- SSDEEP 1536:tDbf8GYPhgWnRUhXRVus2owZZqfCqa0zg96izOQVxlbyF+RZDrXpXVL:tDbNYirb5raUgkLaMF+R1rjL
- TLSH
  T1C7A32A7D32A820A6E476D17CC5860A0AE3B1B025531267EF43D081BE5F57BE46C3EFA1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31
- Target
  usp10.dll
- Size 100KB
- SHA256 23d73fc8824016734847593c0f7767e26d59f99984d8131d45913390d5b7d62b
- MD5 228db6762f62cae20a05f2ec78a55fa3
- SHA1 0c882bab2d7442c32bb3d3e5a9ab7a2134cd9bfb
- SHA512 4d74ba0db1cac10b5bb9c88945eccb67f021efadec99d7454aaac0971860ff63b0aa1e00827a4ee34457413ec5c6736d7ae71e1fefd596bc81ea5cc873126bed
- SSDEEP 1536:7+qE+h5jTZWpwLrCziIK8+wv/O50y5FE2bdEGcToZAD56k8:6qE+hPL2zHoytG5dHJZE5d8
- TLSH
  T14BA3AE31ED806D3BE09A87BE02BBD77BD375AD248763139AB483730C19356D54B6431A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32