9c3c54401e5d7b51c2fa42c8ff04cf7b8f2ea7447d71f8506e392c2ef0a2f218

Sharing

Copy URL Twitter E-mail

General

Target
9c3c54401e5d7b51c2fa42c8ff04cf7b8f2ea7447d71f8506e392c2ef0a2f218
Size 6.7MB
Sample260824-er3elsx1ct
SHA256 9c3c54401e5d7b51c2fa42c8ff04cf7b8f2ea7447d71f8506e392c2ef0a2f218
MD5 89cdbb9e756b1a355542400f483577cf
SHA1 c4cea4e0980b2f035152ca93a2ead669fd9ced7a
SHA512 219603cb9a475cffa4038a75d83964de6a395495b6533f1f958df0df948b22e29a390dfb207cce5604b3a34bb0c49f0d2a9e66d4fb69b083ed94475b9614355c
SSDEEP 196608:dwKhhUSg/3eOwassDV9E1Gn+kb72h24U4dpiT:Da/3eOwa7YQnVvB4UyQT
TLSH
T16766330C72A4A6B9CD60F3B204E23DEB35EF21E2B110C9C1DC5FA98D55B199EA5740F9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  10/1关闭更新/Wub.exe
- Size 776KB
- SHA256 15fccf8c018bbbed14664d5a5528cdf087b9032543be2169d78ab25d141d2b2c
- MD5 585c5000d1a851b295ff295389d7aa1a
- SHA1 191f4e93781aba9bf81565cece0046ee599c0633
- SHA512 0ba2bbe8ca98e650d6f683f5700b44c11d30e3a5ef4b323a3a2aaa35f466401d808423cad4d497080c4bc9ec080e9a4f156ede3d651d3a718abe2307bc09a6b4
- SSDEEP 12288:EaWzgMg7v3qnCiPErQohh0F4CCJ8lnyKQbv8HzqjqlG:baHMv6Cjrj+nyKQbv8TqjqG
- TLSH
  T13BF4C012F3D680B6DA9338B5197BE32BEB3575194327C48BA7E02E739F111405B3A7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery
- Modifies security service
  defense_evasion
behavioral1 behavioral2
- Target
  10/1关闭更新/Wub_x64.exe
- Size 924KB
- SHA256 bf79bb5da35061353485c7369cc5ecc9cecc79de7543bd71ce73f7192d0f6ec3
- MD5 418dff42eea894a227f78935fbd8b059
- SHA1 24c587c6f765bbbbe70f0d4c2f3a8654e8667a25
- SHA512 ce7f3281dae81006edd545442d32cfe4ffa706964a0a8fc6e8c768fa1ca8a6b92a05a052b57849a73a5d6ecc70c1e4be3a858ddaae21f59a351ee226e248468d
- SSDEEP 24576:q2DW/xbgX2YIbBQsu3/PNLKQ4HyAvsT7GUcUHJb:q2EUXgQsW/PNWQojUcUpb
- TLSH
  T17F158E59F6E444A9C47FE17ACE46C22BE6F1B809437597CF06A04E6A1F23BD06937321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion
- Modifies security service
  defense_evasion
behavioral3 behavioral4
- Target
  10/2.exe
- Size 3.3MB
- SHA256 4f412f2e09ec374a451bfd498ecad35148d08bc8882e7a4f31a1e4f5a825cda5
- MD5 73293d047a60f1138ebbe4569e2fdcb1
- SHA1 ef809254f0dcedc310ab4b551fc6040f17c25b79
- SHA512 31603fbbf3b018f01b416ae07c07236adec0cbf1e1a74a14c5a14c0464745ee0b2afaa2e178ed69a04bc94b513cbfa189ba3bbbc148ebc11a24328ff9248c495
- SSDEEP 98304:JTu5HMvw5LCe9YqjQ2kvV3zwjCeB0RbAZwNt2:0Mvxeq4Q2kvV38jCt8mL
- TLSH
  T12EF533287296566FCFA097F008F12DB93D6F6CB5F1249581E08B79449FB189DE0316F8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery upx
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  10/新共享修复 win10 21 22H解压 OK 修复二/5)NT6打印机共享修复工具 1.0.0.5(支持win71011LTSC).exe
- Size 2.0MB
- SHA256 78deb723b6c231cb774257129202a6c1c09af6592d39e1bd8d4d48b38cfb1e5c
- MD5 41324b2243b77cf76ef6e10a89359802
- SHA1 8c8414cef95f8ef57ace3c350d69da352410dcd1
- SHA512 e2e7a78a674f4268a230305adebb5a5e45394e7aaf9c5bde9ca232dbee7da1a3d2dca06d100b14cc5bdfcb18fd99bb30063ecf52c5674ea6255fe946add23c7c
- SSDEEP 49152:ZN0SHHGqgyMv95sf0TlfQheMFydo9MjB:vgy45s8TloheMFydSMjB
- TLSH
  T133A52343B1EC3CD6C0B072B2337B1BD1D32DDE5280D5CA4D89CA5199A9BD423BA663D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  10/适合win10-20H 老版本/win32spl.dll
- Size 868KB
- SHA256 d417f0b2c3d9cc2bcae46358a391d308993ae537325663647ffb2d2c4679018a
- MD5 2e9581b7b9cd276a5ab115e4df69f6f9
- SHA1 800cdb03e4f2125200974a72f43653110426e56d
- SHA512 c3e39ada472a82a707a6e3e79590c40cfc4fe5f46462fd7bd324ec682505a63be413e3453d703942985a73437d21ba6fac5b19ad96c4b55d524716fdf9257bd9
- SSDEEP 12288:c8ygJA2sRsHn6fOKAWPLL11fcGHft7TWZZAicrK1HZQk:c8yf2mC6fwWPLTEGHfxTWZGrK1HZQk
- TLSH
  T165153B2BA2AC01AAC5BB8279C547464AEBF1B816271146CF0260877D3F27BF55F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  10/适合win10-20H 老版本/管理员运行Fix_PrintSpooler.bat
- Size 1KB
- SHA256 7a7c4645e761205829d8c5490472b6d9371618ad5632ed96da29785496a0ee82
- MD5 b4bcdad4dae1d57e6e38f81deb446e6e
- SHA1 40509574224f0610c65e127cfc19f1664136d905
- SHA512 696392c468fe0a0e9d168946c154eff1f08df839cd35fe27102b80eb66bd8f95d9c9f9375fd35372c154628e1a5dcd132d5c6a6842af7eaf501d51c61d34485c
- TLSH
  T1A8216BB70CE28AA0CB12CF49AE15446FFF23F3809C80122031075EF8DE088D3483C4A9
- MD5 SHA1 SHA512 TLSH
Score

8^/10

defense_evasion discovery execution exploit persistence
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Possible privilege escalation attempt
  exploit
- Loads dropped DLL
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral10 behavioral11