General
- Target extract.exe
- Size 1.8MB
- Sample260903-tlxpha1clc
- SHA256 465128f4dbb5a871c95da9cf58bb6a97268c683b0db6fc3009e219c9beb75310
- MD5 94200e51ad13b0d645db950b98e7a6be
- SHA1 bd7d61178d9482bd6a9f24a9e2a5fcdd1300c5ed
- SHA512 6fa9fc8db18fb523cae18da55b766fbbbc2084bec0b99e71b9f5fc4db44fd9ae743105a3183d6c079ce41be8e742a26dcb26f805092a9cd94ec40c26099b2836
- SSDEEP 24576:g1LqE3uGlNPkmhEAozMBNgRyulPhsfUzoSMP+pg04mFAkyiVL/h7g4ftYVJ4Zh0G:mvLsk07Nh1VY6A
- TLSH T1C895AD56A35D00F8ECAAC9F4CD4A0627EAF13C184308DDFB06945E972E677E0A93D749
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
extract.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
extract.exe
Resource
win11ltsc2024-20260709-en
9 signatures
150 seconds
Malware Config
Targets
-
- Target extract.exe
- Size 1.8MB
- SHA256 465128f4dbb5a871c95da9cf58bb6a97268c683b0db6fc3009e219c9beb75310
- MD5 94200e51ad13b0d645db950b98e7a6be
- SHA1 bd7d61178d9482bd6a9f24a9e2a5fcdd1300c5ed
- SHA512 6fa9fc8db18fb523cae18da55b766fbbbc2084bec0b99e71b9f5fc4db44fd9ae743105a3183d6c079ce41be8e742a26dcb26f805092a9cd94ec40c26099b2836
- SSDEEP 24576:g1LqE3uGlNPkmhEAozMBNgRyulPhsfUzoSMP+pg04mFAkyiVL/h7g4ftYVJ4Zh0G:mvLsk07Nh1VY6A
- TLSH T1C895AD56A35D00F8ECAAC9F4CD4A0627EAF13C184308DDFB06945E972E677E0A93D749
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1