7cc564a010b8e11de293a9c1be4aba9fc20d63f89d5c906a15d6e87d3aa09779

Sharing

Copy URL Twitter E-mail

General

Target
Sort-Them-Ducks-AnkerGames.zip
Size 696.6MB
Sample260820-pb9tvsdb29
SHA256 7cc564a010b8e11de293a9c1be4aba9fc20d63f89d5c906a15d6e87d3aa09779
MD5 efdb1a74c47be52256cab8fa790b20b7
SHA1 885ca034362671ad59238a6823bc79a26f3b9d87
SHA512 619961eee6997769bac12d00deba571b086748e50cf472ae3b2726f79206f87fbdd191d97840ae79361d1bcc30f20b31fa25723e11525ed1194292b9a161f7b4
SSDEEP 12582912:E05+6cZ8t6xTAUXW0mfNLVBL9Y+7IEPBDvNtleovlimh3G+Hx3moSbacnoBaulVM:Ew+B8t6JAUafxz9xIUbNtlN8khx3moSt
TLSH
T1C47933988122CB0DFCA985BD02813F85F5054DEDF87B46E2CB1AA3A631F379467F9941
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  AnkerGames - Free Pre-installed PC Games.url
- Size 113B
- SHA256 9f87edbeb25a2d74f4d28dda08c94387b01efc114c79296f271405921fb99d24
- MD5 71f27504bd18ec938b6da025cf88f36a
- SHA1 7195d5f24816e3ee617266f25992516b1ab6cc72
- SHA512 4055e560b17163c5b660c8526f70baf8f516adf34e970926f40be094d2ce007863bd26fe52d963f492186a5f51b1a4a21e1d8a2df2310fc5f4e9ea0c5cb06ab3
- TLSH
  T131B012AF4007838DD141440E4071F8488D0FF9A44ED2E0AC6258DECB4C080D6CCC4F36
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Redist/DXWebSetup.exe
- Size 65KB
- SHA256 7e963c1bec5df9b42773877bc24291a04095bbfe5f7128b1286f061c4423a071
- MD5 0415e9fe38d55d1eb5ac7998486e70cd
- SHA1 bad17f277209fc592b0e39ac1b6254c6055cff37
- SHA512 2bba4f6e1988e420870cf2d17ad3feb15200d8e250d4759a7298d306909a654f2078853e2816125433780275f49ecf07f96d41ae6253cc0d27faec2b1d82617f
- SSDEEP 768:7+LUuxgoVGrMeIROhCJx7n6f/X52vVL8:75uxbhcUeXJ2l8
- TLSH
  T14D630F82F7B5999CEF1C753326224415D1FAAEF0370A712A3B8E355EBAF19C0444C99E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  xactengine2_7.dll
- Size 393KB
- SHA256 bcf3012a44b448402166bbab661a9fbca7f9e3c11ad17b3f96a54bbbb82bb235
- MD5 8c970509e0ae10061e3ed6d51e34feb9
- SHA1 29e2b6c6457b04c736b874b91a492d1db3a26124
- SHA512 765ab00113d1d16775be9edeecb69b9a050b7e43eac8b7738e82f2d47d8346f5ffbb9f38c9bb308eef79c1167717fd8a297b5285cf696bbdec4dcb089c596b76
- SSDEEP 12288:8yZUR8I5vcDgCa3R8Lq5ucIMeLGdqrjA:mc28Lq5uS+A
- TLSH
  T121846C93F1E45DE2E2BFE07DC6A68643D7B57094071097C72390522A1757EECAABE320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  x3daudio1_1.dll
- Size 14KB
- SHA256 ff15f14174a5543f028fa49cca745582fe4cacf3bbe490749cf43444690ab359
- MD5 121b131eaa369d8f58dacc5c39a77d80
- SHA1 d8fe20cb6f28bc5334ae64a8df3563d1985beb9b
- SHA512 ffe19ffea137603e5401f133d461b30af6fc25b3affb8a8ce20b98e3270de398b9ecc83a6cd904ff42c5885d3806c7e175957bf4a5827dc2f067756a51bc40db
- SSDEEP 384:rRzhlxrni/jKXEg4iptXWfoWqDLCcM4aeW6l:rRfkLo34ipqoDL3bae/l
- TLSH
  T117624C828F380205FCA52EB4617DFAA3793CF7C21F919D2350A981C60D92BD59EA851F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  xactengine2_7.dll
- Size 255KB
- SHA256 a43c92af3fbe91dfe2a1d415342631fe64e18c7dd3e16e93b6c78947b68e7bd6
- MD5 7febb8ce2233cbae738b16d42ed29674
- SHA1 fdc5682d6aa0ec57b8f3c742fe736d74b3c649cb
- SHA512 73a3c07b13b31d2df1cece720a0268cfdb7ae2a066b9e613f7c4ff0fc37b94bd4f32207149d56e1bcaa5656fd4501b1d136d94e18e97c07a8e793906dbc7927e
- SSDEEP 6144:WAllo3zbGzgRwXrexo1P8tZ5gv0SuR13mr1yF:WAljUwXreu1PgkuHmRyF
- TLSH
  T10C447C21A8509275DCE232F886ADB17592ADC3C21336ABD706582BF6ED603C19F751CF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  d3dcompiler_33.dll
- Size 1.3MB
- SHA256 90dc7e301a3dfb1c015cb73811b77a5ea21f8ee46944011bca3a270584473013
- MD5 3ebf620536a13ca343e52eca4f0de7f8
- SHA1 b46cd27a56c832b04246e22d4d05e0af3ab3d0ba
- SHA512 456aa59fa6b1e3523544f3d644f946ccbe814f8f6ba175b18b2be0600fd72972904f65899d4a2768a261cd8d1f9b7618a2e867ef3aeded8167e0e45a0d4134be
- SSDEEP 24576:qdy1UKdAAi4mygBH2zDINpwFeuiXounteD53aERvR:qI1peiDITwFweD53DZ
- TLSH
  T108554A52F2A244F5C4A78275CA5393A3FA71FC44432457C79290BB1A5F3BBA0AD3B718
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  d3dx10_33.dll
- Size 494KB
- SHA256 3f0248c3bb9bda2a901b343b3b58172e175a86450d421f0fc4aebbd5a7d11477
- MD5 839c3921005bb41d441e3752c74f2292
- SHA1 bb419fd4cd2e9fc9133c88cd6011524411a63fea
- SHA512 f814096af7e17ab01879d2976dbe0f52b0421f355087289f92b10719338852d6fcae88db06afcc4b9a6f95709458f90c4a14a1e26ba40918bc631137ac1309d2
- SSDEEP 6144:anSrK2fBPwZWD0vpK4Oy4ma1HzsjZqaLJuh1yofzEQh7D6GX:bf9wZfOygzq3K7OGX
- TLSH
  T164B45B41B2B5C1EAF03E653DB0D5F11FFA3134100B2046CB97A4856AEBA3AD44EBB756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  infinst.exe
- Size 68KB
- SHA256 34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec
- MD5 45d4dac07aa361bcd77aa815d1724a16
- SHA1 3bbdf7da5d51211ae269572961b5ebf508ada28d
- SHA512 d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be
- SSDEEP 1536:dSKL6bzRYK/ixmu3XyhJRxjWhKfLXJ/y/Fae:dSKL62K/u3XmxCAfLXJ/y/E
- TLSH
  T1E8637DC3A648407AE0BFA53486F15B23F7F5F854033953DF1A1489290A67BDC2A3D74A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral15 behavioral16
- Target
  d3dcompiler_33.dll
- Size 1.1MB
- SHA256 12e238af4b4edc1f774213709a87a91b77b2c9d2d18fe475b027872923b6fa17
- MD5 fae7e1d578c42a7c3d9d61a99d178bd5
- SHA1 8ac88ff2bc5f616ed284a04ddcbaeb72fb1f304a
- SHA512 75107c64acfb6d84e1b05ba78377dc4699ba83b694b7ace474665c85f3e5843db6d06348fefed539c6c2b233775c7ef81d7bfd81937207e04e637043633cd0b9
- SSDEEP 24576:xZ7WQ9poSeEOgXgGZWFO59DF4G5aJQ6N7Q7Trlxux:H7W694FOHxhy
- TLSH
  T1BF358E63A5539132C45212F21A9FA3B576BADF7013215AC796903EE8ED392D34F3A307
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  d3dx10_33.dll
- Size 433KB
- SHA256 b04e2b089656eae01a0071359f9d7fb040dea804c1b9d2379431864174259c2d
- MD5 37a8171accf46a9c196054066c28827f
- SHA1 886264510372602c2ee0193c5a185d719a61316a
- SHA512 713b843a35dcfc32caa67c52ce0a32af6f54dfc4c11615d32613017aeeb257fb3f9168443a4288c71209e5d40f2e1b281febcbae6da076d2b57cf01aa3cd78b2
- SSDEEP 6144:1Ve3sZJUM2iyD5M+g0ecSorz+yOgvQeeaQeeSQeesQeeWEQeehQeesjfOL5CpZIf:1k32ex/K+gzQrz+HHL5CI4z7y
- TLSH
  T1A7948D60A9A41134ECD7C2B0A12E72F8A0EE9377476068CB4D5C06E67CF67C54BB46CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  d3dx9_33.dll
- Size 4.3MB
- SHA256 7338b1d039d0c08e45f24874e4918ffa642ebfe5967c96035f66f509265fa33e
- MD5 3172c3cac8ea7ca1b5d5af6699c037d6
- SHA1 e1e2d11a96072a414a710b93f0b4f6825992c374
- SHA512 6f27d7a388675137d22d6a84449a42b53530b4b07b217e93367eda580f44315c24d520b58b094757ccd02a7690437f173e266fd0df0521dab6ade1e6fb2b4a3d
- SSDEEP 49152:kAjJO1iZRCzAUgCdG0DUJPH58KKfaCVJJq85uxZinys0Us+SrvTTs:vIzJgsJ18C0UmrvTTs
- TLSH
  T10F266B52F2B181E9C5278038B993B317FA71B808071857C793E0AE5A5FB77E06DBA315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  infinst.exe
- Size 68KB
- SHA256 34ab99536ea59ad60ba6efda3ea6d18291ef096a0bab3664248d6045805da0ec
- MD5 45d4dac07aa361bcd77aa815d1724a16
- SHA1 3bbdf7da5d51211ae269572961b5ebf508ada28d
- SHA512 d940002a8e0112a3b56a909008403b447e9cbb80e38b9bbd508f40aa68224f7e5d9681e1039e747ae939e0829a25be2319b9f9d0862cebb042e4c525ccbc20be
- SSDEEP 1536:dSKL6bzRYK/ixmu3XyhJRxjWhKfLXJ/y/Fae:dSKL62K/u3XmxCAfLXJ/y/E
- TLSH
  T1E8637DC3A648407AE0BFA53486F15B23F7F5F854033953DF1A1489290A67BDC2A3D74A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10
behavioral23 behavioral24
- Target
  d3dx9_33.dll
- Size 3.3MB
- SHA256 c6b7b2ad7742dde5dd8d1a35fdc1c185e586e551ad9c74d3fb21759cd8ca4da8
- MD5 cdb1cd22baff21f48606b3c1a18b000b
- SHA1 9315b5db975a34dbebdb4dcae652ba1db01c482c
- SHA512 c5fb24de8f1ee6fc1ed6e74580b5d22599ea4eb6c3589645fff0b15dc8dca051c4917e60fbc00ca86542dd63a8f5e40da92ea77e24826c0c6bdba9b58c36d4db
- SSDEEP 98304:9Yho7VaMeKQqGfyxXIicOExzUx8PjtvssPFAQAl7fxI8f6B2+:ih8V2KQqGfyxXIicOExzUx8Bssun3f69
- TLSH
  T128F5ADA1F6424135CCE242B0418E73F861ADCF7157601ACF96A42FD8AEF66D28F34697
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  xinput1_3.dll
- Size 79KB
- SHA256 8d540d484ea41e374fd0107d55d253f87ded4ce780d515d8fd59bbe8c98970a7
- MD5 77f595dee5ffacea72b135b1fce1312e
- SHA1 d2a710b332de3ef7a576e0aed27b0ae66892b7e9
- SHA512 a8683050d7758c248052c11ac6a46c9a0b3b3773902cca478c1961b6d9d2d57c75a8c925ba5af4499989c0f44b34eaf57abafafa26506c31e5e4769fb3439746
- SSDEEP 1536:TVeqvNS6T6jxeEsU6b0xZtDDVb9X8u9JA7zitdrz/R8cy/FaeBD:TVeqvNOeFgxZ9DVVtRBy/EeD
- TLSH
  T199835B107480D236D8E361F806FDB714763CD66513A559C32BC4BBEE9EA63C26E3069B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Redist/DirectX/DSETUP.dll
- Size 91KB
- SHA256 9d47b4fa2dcce6a02a51324cfb97f5e153086c2eb8832b211e175cbe5fb850b3
- MD5 4d48dbe4d3a06c497435014e5c583f34
- SHA1 159cbc37080b7ea3ceae8d25125b99f9f4948341
- SHA512 b8029bde36e4d6581916c131ec51d74f4a2b03abf5a238c503e1c7b19980d0946606375f0b4c3bd10b9c514e084368c356be8536b282bee887037d7d7f139732
- SSDEEP 1536:HDtBqvGfTOOeR3+MPb3hzgS/1nJvMgqAlTJQs0MajclgUukW+j2c5o5INSeVg7X9:jtAvGbOOA39b3h7/1CfWYcZ5x5o58Sey
- TLSH
  T1C7937D15BA90C072D8D120F916CCE7B1A6BEE1B40B2999C7F35047DAD9713C6AA3934F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  Redist/DirectX/DXSETUP.exe
- Size 512KB
- SHA256 16953a202265db5655b3dd972b855619728da76545a2f94bcbb6c43262f48d5b
- MD5 11dd6e8ab9759d1ac91ffe0d0e4949cb
- SHA1 2a86774d0c87050d5c7aa9738cc3975303a40d0e
- SHA512 06828f51b3866f7c2b29861707bf8552b742e366783115b3062f08a9c0005c96507ecf1fff92ad41dc0318ad715176c39c84ff0424372b080bf7c031e4f307de
- SSDEEP 3072:Yi6LKe0XPM8nUc2nDzw0FWtj/WM0PSQ5lbSN2LhaM96rKmMH2/5Mjt4zT1mFDYkZ:we2nDzw0FWdwewUM1Ws4VIH
- TLSH
  T122B41C1067F99225F4F36B386AB913964E3ABE91DD38C55E6314319E4A31E80DE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32