db8f01b40f08976c2148bb8ac11f7041ee59f8f5bcf94b997d0705390926a2df

Sharing

Copy URL Twitter E-mail

General

Target
Microsoft.HEVCVideoExtension_1.0.40203.0_x64__8wekyb3d8bbwe.appx
Size 2.8MB
Sample260825-lsbfvagn8v
SHA256 db8f01b40f08976c2148bb8ac11f7041ee59f8f5bcf94b997d0705390926a2df
MD5 9a113178145ce8edc5ee9a72158e1cc4
SHA1 f891c44fb1363942c5133e3f0d6e7f99cd3c9de8
SHA512 28fdb2bbec3a8f7a97b5074d550552e93cb8413dbdf12eaa56b2027ceaa38a71a9f7f7a8d6ed4bee8f974ee80ae7ada9689c82413b89e4a601f31acb2894782e
SSDEEP 49152:5c7iWgLn3PnRjvEboHNP/xeZjQYdOOaihpW8VYZLCEhKkagaEwqbplj5F1k:5cmWgb3PRVn0ZjpTaipf6CpEwIj5fk
TLSH
T101D523D196111ECFDAA04773422A9E70D86B5343FF8187DA43B4B96FA4D3E909012F9E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery persistence

Malware Config

Targets

- Target
  Microsoft.HEVCVideoExtension_1.0.40203.0_x64__8wekyb3d8bbwe.appx
- Size 2.8MB
- SHA256 db8f01b40f08976c2148bb8ac11f7041ee59f8f5bcf94b997d0705390926a2df
- MD5 9a113178145ce8edc5ee9a72158e1cc4
- SHA1 f891c44fb1363942c5133e3f0d6e7f99cd3c9de8
- SHA512 28fdb2bbec3a8f7a97b5074d550552e93cb8413dbdf12eaa56b2027ceaa38a71a9f7f7a8d6ed4bee8f974ee80ae7ada9689c82413b89e4a601f31acb2894782e
- SSDEEP 49152:5c7iWgLn3PnRjvEboHNP/xeZjQYdOOaihpW8VYZLCEhKkagaEwqbplj5F1k:5cmWgb3PRVn0ZjpTaipf6CpEwIj5fk
- TLSH
  T101D523D196111ECFDAA04773422A9E70D86B5343FF8187DA43B4B96FA4D3E909012F9E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

persistence
behavioral1 behavioral2
- Target
  EnablerService.HEVC.dll
- Size 137KB
- SHA256 6eb15662d9e7da97ff11743f210b89965d595a42b968fa29233fe62c2d0ecb9e
- MD5 fb253b711072ab9727f6e7ede49ae710
- SHA1 6c1ab587b093f21aeab5db11f2ee129bf6700ce5
- SHA512 f2f8a2e1ea87ce584680c95ad0c99b4e6fddd28a4247eeb0c2500e7516509f8c87f7691aa6ddca92288849f9ba64388a33fca04c6a19e4a8a54aefa9b1230c86
- SSDEEP 3072:vTmHhzUj0p/rJgeZV6cdKWNhdk+mw5zH:qHhxV6c5Nhdkw5
- TLSH
  T1FAD3C86B7BA880E9D126917E8897CB94F7F5B4501F218BCF1190431F0E776F49DBA222
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  EnablerService_HEVC.winmd
- Size 4KB
- SHA256 de5a4b2c4f534fb1074fcb73846cd681476d462c4ab5359ceb98bf893f3f8e97
- MD5 57f361e33064a292ec1cd470cd2d7f6a
- SHA1 eeca0a836258385f5f2a32ae942666529733fd69
- SHA512 75a34025a3a12ef40eeffab34d5bf6c17392a6701fa1dc6988f0d2bda361265f1ce1089a98f81d21c7d331fb928c9ffb9afd360b117fc5c06cf2895fd947a142
- TLSH
  T12181995763E2C677D8B703324CCB9B80F631A72557DBA31717E8A036BCDD6D60921888
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  codecpacks.HEVC.exe
- Size 44KB
- SHA256 b54086b591f0889e53449a5d2573c4bb1216df2787bbbade9bf6646fdab83d8d
- MD5 67cf38dbe1be70cadc25171c3bb5c679
- SHA1 4b327e082e992d756f7806f1129ecccb6859facb
- SHA512 bc34a726c14b89907827079a2e2f4e2819d8119b102a28a602d96b9d4c1caa59f63a2ad8866a2609242be82b400da6bcc30c61efaaf541499a7875b7ded07b95
- SSDEEP 768:+Q1eJweDPNBCBjGmWhmgWBVmd1QAEsZm+mR:T1IwqFBCRGxmHVRAVZm+mR
- TLSH
  T15913E7A97B6C84D6E076617A8893C34CE466F4614F229BCF6150430E1F763E0ED7E672
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  codecpacks_HEVC.winmd
- Size 3KB
- SHA256 d5373f30b72ea33e4c5b0dae2f83d4945f72575092283fdb98e77392b2bc41aa
- MD5 fd59592eb8f03c58f6b48eccbb616c2a
- SHA1 bd202890ee28d70d27c83bbad56ea8083ce6019f
- SHA512 a22ec59436ba34253e9f027fd846ff0648a276cb9b412128784427f2ae656fdfa11ba0881332f99735c33c2fc11eaf79ae4b8e89ae658a2f5459b85b63cad02c
- TLSH
  T19B51334B76F286A7D4BB07320DCB4F50F231A72993CB931727D86136BCD93D60A60898
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  x64/hevcdecoder_store.dll
- Size 2.3MB
- SHA256 72c816ac67151e3fc83fc77bce092ddb3a30dde2a17fc6bdf42a9b79435d5d3d
- MD5 72f61b89a83ff80fab93c7efc6cce09a
- SHA1 9ff284faa66c1eddb89bbc9a9058be215dd1f2b0
- SHA512 4066d5bf2a5e2800b09aba385c9cef8b787fd98411ace106a2e2642379d1a2b26654b8bdd1457310e239578298bebd0cfb9bd5ff702a3ba464adbd47cfdd3922
- SSDEEP 49152:36/pLk7iGHbdBz+CD1OLclAGfO3QFGd7zw3tmplivbyaQ1AVP8:lJvyQAFaQqk
- TLSH
  T14EB5170BB764EA74C05E85B989E7E211B331B8615BC343C336C4AB6E2B32FD4193D665
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  x64/mfh265enc.dll
- Size 1.1MB
- SHA256 14da879588076686326ed4277dd873b8560b05ab8c7a3ff1ce8be1f4fcb92b40
- MD5 87011be424334c90fc7d65b7e2f023e1
- SHA1 4174e1c8c6836bb04a8e265703cafc3a717a48c5
- SHA512 ccf31ddc0ad249bacf8c7ef0e04e05028c1663923a8dd5ad33b52c3cfad9f8d3ff3c3354c819c80db83013473d8476c9bd21daf30fbe5587c782ba6c48e0ffc9
- SSDEEP 24576:xK6iYJl0hbAZvygLSth3ED7kiLMzCR+llrTKL1AjysDb+m9k:xK6iYJl0hbOvA3KKlrg1AjNDb+d
- TLSH
  T17C35BF92E59650E9D1BF8078CAAAA247F7B8781E03541BF76990D6285F27BF0133F341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  x86/hevcdecoder_store.dll
- Size 1.9MB
- SHA256 8e61cbdd9b1ef60d2e146f07b7b3b1d77fb0d0e81a532f5375ce1cd58b640dff
- MD5 534234311dfa3f3ef6298e8a594583a5
- SHA1 3e7472e0010442f1e07982f2d6af3ff1a1d6ef1a
- SHA512 4b5d441de298a818fba40406fe85e319ae90daf68b65011fefcfaea979d0e7d11515825a6c80c1519d9dc033bf2b39020c8f04980323eeb597471f874dc54df8
- SSDEEP 24576:FAbDkucUfwwYoSDSzIf2D0ya3A1m0D7zOyOQzhpaCLDNR/jxOQmsvNZhYUKs:ebDkuAwl7If2w73AFFXR/lXvfhKs
- TLSH
  T17295F703B741E971C48D1AF089DBF3A56238B9709BD343C336C4AFAE6971AC1693915B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  x86/mfh265enc.dll
- Size 898KB
- SHA256 e0b4382d3d1f64579061c644da1609841e6bbd8067e28372d1f4e8f9ea81a102
- MD5 e1276495d4e1dfddefc2c6b686b3d600
- SHA1 e2043650115884ba917de4bef464e4e218f055c6
- SHA512 9b03eb80888d2a531235149773b09d9ef03fccf2fd6f12442c6387454b342e6f6f84df6980dbb6b04afcc871a23d89cace730a1fbad2b8578a48c2a38f0dc80e
- SSDEEP 24576:711gjtdsIHIyIxgG8geR767mJZi2L7BIIr5Ce6E6ttNqg/wcI9AYezYZAb1ec:h1gjOxgG8geRGKU2LfMtMAAAb1ec
- TLSH
  T18B15BFE1FAD66061E8C624B04AEEB533622C277D4B6041F72ED456ECDC32DC17936A87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14