hijackloader | 256a457c8b858e7ac59e2d8f0cf8af0ec5e8f3fc63d173bf2c01574e6aaecd74

General

Target
256a457c8b858e7ac59e2d8f0cf8af0ec5e8f3fc63d173bf2c01574e6aaecd74
Size 2.0MB
Sample261019-w4rbjsha22
SHA256 256a457c8b858e7ac59e2d8f0cf8af0ec5e8f3fc63d173bf2c01574e6aaecd74
MD5 19242510152001e1e982a62635c34157
SHA1 5ac5af9555cc58ba71ab74ee2f73cf00df48ca35
SHA512 c406d2a20ed60980e79b8867544e2211a6bd46fa94fa340d773fd118aceb11e907cade2419974f91e4fa52205ce663fa428022045b34d84bbecceeb7bb8ea4c7
SSDEEP 49152:uQTN00nAtFkBWBxmdlHR0py71XVceSoZvvW72nmtjd2:uQpxA8UBxeHGOVce3Zvmtx2
TLSH
T19DA533EAF732BD0CA3B42DB17B55F1A30BE84C5543586AA4E5FBB084CB8B57C1216472
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

hijackloader

Attributes

directory
%APPDATA%\VolumetricBoardSoftware
inject_dll
%windir%\SysWOW64\input.dll

xor.hex

Targets

- Target
  programdata/WebView2Loader.dll_quarantine
- Size 95KB
- SHA256 03dfbdcf05995881b8e30d2590e7e32fc47719bcacda4aa35cce6819fef8637e
- MD5 dc1058f0a96500039d4ecc8003e36467
- SHA1 52bd9ece43107cfc34c7279abac8c11873384c1c
- SHA512 6bac05beb18cfa0ae42747a0e1d3d762f3114d86ea09432d27988a00aa6aba599188cbd772dc3554e6356deff1f3843e134c93224bdd25e5c7df3710588b046b
- SSDEEP 1536:HK5v7mwN6npu2QjJZvWuELqS5Frgg+CB8GPs3QnJ1h1vRqoasWWBcd6498DbEt+7:H8+KJ5W9LqSv6CB8GP1TZqoc6Y8DbEtd
- TLSH
  T1A0A3385075D1C071E6FE19390870DA795B3FB920EF609DEF275416AE4F302C19E3AA2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  programdata/msvcp_win.dll_quarantine
- Size 493KB
- SHA256 9276e394bc5fa9a08b5fc84305d32544ff9f0421d0870c6d76c63a82f1955559
- MD5 7762c51ea02eb943183d597ea0ee5530
- SHA1 0b8c307eba01d0679a2669210862d0afa888c40f
- SHA512 14c955e8acb03e86cd11cb992a69fa6681769b2bb7ebdd3a587b36a519f4084be3dd42825b3c91c0d4e325a2869e96acfc88c3ca05bc59352bf0657e7c4ec758
- SSDEEP 12288:beMcMmVRYcFERWKn9g82vWirmibAhUgiW6QR7t5s03Ooc8dHkC2esJ2Sub:beMKYXQKn9g82vtnbf03Ooc8dHkC2ecC
- TLSH
  T142B44C332A4509F1E48A23B4618D936283FDEC650361A3C357EEF9AD6F6D2C06A771C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  programdata/ucrtbase.dll_quarantine
- Size 1.1MB
- SHA256 0f4ec73cf4f64d4b89f3c87a127bc7c46c052a4226f9876a3a75015b716d9228
- MD5 c4a25dce665733663284750666684703
- SHA1 368f3c3497c1b0121409216282803bcf1b64f35f
- SHA512 768af35c80d0423e72fdc8178b57d4be583569c1e96cac8c00808d07aed988bc614618f7b2077617498079b6ec0faa2d2d48cc314cc34faf11f56b6b7146201f
- SSDEEP 24576:FQeBoON4h/4z/G1YknUkY3Ub6lymKmcvIZPoy4yuhpBR7j:qeBoONs42nUv3UbfjpBlj
- TLSH
  T1D2358C107895C2A4CCAD30F51A8EFA36466DB5904F24A8C377D41BFFCC690D0A9F769A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4