bded6937f75438e4892b72f55bb2e6bceb8e1cd2a28db040c8a09183aac6e9bc

Sharing

Copy URL Twitter E-mail

General

Target
06_Touchpad.rar
Size 23.7MB
Sample261030-phlevadt8p
SHA256 bded6937f75438e4892b72f55bb2e6bceb8e1cd2a28db040c8a09183aac6e9bc
MD5 8d011fb8b1bd2289833175d3a06ff9ea
SHA1 7873f90413a8928ba5b159d0f852bf54545b3a84
SHA512 418c6c789acc9a7410d36372bcfbf48cd95d21e994af6ed14c88fa5ab6c2ab9204c5ea255d2de96d22ea0e5d176c1f74701493004e12730f9fb3fc15b78cfd71
SSDEEP 393216:wnHbji1Ta2XfbcZfu9p2xWqkbk/4Zif4/f+9+Jz2lPXD2wPyco6ZJ8Qi2xEq6ZKj:+PmHbcFQp2xWqkbksiAH3JzKPXD/c6Tn
TLSH
T1F047333BBD3461E3C8F82EBDB45A126452ECB7202591DF1565DF884A6A0CEEDD1304BE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  06_Touchpad/Setup.exe
- Size 209KB
- SHA256 be2bfef7589ba2195be76ce8113c99cf04365da4ea7ed0f9c8bc8a697415f5a7
- MD5 11c3c8f8d5f4b217a51e6bb8532b7cf4
- SHA1 1b24576a5917ad24f448faf3f0ec0843523a46fd
- SHA512 b66d72b51f1423ae1541b4a1f3253d5ecb244a0551308ddc835655721bfeb4dd2f3e12cdfe85fb10f8109f6f9fc2a15a05ebd2ececb0bd162d36ceb47a230882
- SSDEEP 3072:B7ez8WRfcaClOcpbhr1orxhgjt5y02pqDcn6WpjL1CrVheZgHpX:QznRc7vpb5oxhUEn1CrS+HR
- TLSH
  T12324910177FA8274F6F32B71ED7556944B3ABC926E38E58E3354089D1830A90DAB9733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  06_Touchpad/WinWDF/x64/InstNT.exe
- Size 147KB
- SHA256 ad73c1f27591eb9514ef0fd241efb7cd4e751d35568ea40e62ce75cbc8c23bd6
- MD5 d00ca58c99cfd499aff105f041c669c7
- SHA1 51a27928a184a502594f1e513c67ef0d28f0316f
- SHA512 a5374a56f5453edccf34f33e08334b5b3b66df0be279e72b5343a8f9c390528bfbac46765bf28d95dc7c8e87bafcdc0ed494ec30b3754aa645e4d21a05625434
- SSDEEP 3072:SbuyPNyl8bbCeHV3/WUxVWOZPFf+6Yvt7SL2h74eTid:SDNzbPhZ9xMn6l
- TLSH
  T1A7E32882B2D184F5D0B7D238CCA266519B71BC155735A3CF3360B6592E37BE8AE39321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

persistence privilege_escalation
- Drops file in Drivers directory
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral3 behavioral4
- Target
  06_Touchpad/WinWDF/x64/SynCOM.dll
- Size 386KB
- SHA256 fbe221305f101b6a39b333367dc1b55640c76dba12ccf0518bb3c08f6d4280a4
- MD5 6d7c4b655b389bc932d64f6c0776f9e7
- SHA1 37145583a528fd48b8e9bc252029a1d803b08ee5
- SHA512 af83eb3a32b83c3307f5360fea4c197eb0dd740bf7aec1a5e6bb37189d11e37fdc3c46e16ecb30d6831216bc59bc46868d2c5330eeb77996b70c8d1bb68178c4
- SSDEEP 12288:qZxvsqPyxyUAIAALin3aCvLoSsTvCaX7nJZ4h9LG5Tb4y:qjvsqPQVA8Lin3aCvLoFTvCaXTJZF5TB
- TLSH
  T10F846C82F7A548F4D07FE139C9D3478AE6B1340457A16BCB0754879A2E337E1AA3E325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral5 behavioral6
- Target
  06_Touchpad/WinWDF/x64/SynCOM32.dll
- Size 165KB
- SHA256 0177c6d434c2f765849352b35cd2ea5c4f51b0680609d92dc0e62326164ef678
- MD5 04162a531a506b8dec1e388ceb60547f
- SHA1 65457baa56ca3bd7b1557f7cf869677697ba28f1
- SHA512 02ddefb31f77067eff1d98a31f83261d7178c9c267e3fdfbb94f923e7c4fc3d25bad12d403febbc5663ded35c2fc5524fd100c7379835eb27725a394d3d6892a
- SSDEEP 3072:bUAxuHZ2vv8H4mD1VJDmNRHMtDyiBWGmK5:baHZ3uHG5IC5
- TLSH
  T1C4F38D1236C6C073E14E013E8943E3925BFF7C625EF6564B7FA8168D2E742958B39392
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  06_Touchpad/WinWDF/x64/SynCntxt.rtf
- Size 7.4MB
- SHA256 6c01123252306b55fcc8806104bb0654c7f51e99ba7760da1f8dab8a10643ec4
- MD5 d38b1b91e69ac2367372357d12d8bdf0
- SHA1 bdd60e4fc16904a521e2158b2c85e9bb3f9457d8
- SHA512 299a206771924c856a45650df6e3f88cd335e504f10493af356ef125069a183cb02e6474f874328b2036174fa639c920a997676d4bb643b5684d2a52c6730dd6
- SSDEEP 98304:rej9ASn9sWR1J2TeM2nyTGyflQV2g2dK0iKae4lRwlHpAm1hlHTF3TSI3ON:vTeN
- TLSH
  T12D76DC4A6C707A5D0A8A017E970B51D2BBED492ECEF5A012FC5F6207156E4BDE2E34C3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  06_Touchpad/WinWDF/x64/SynCtrl.dll
- Size 255KB
- SHA256 d84da697fd3898b593c02a2fdfaed65189b44d49183d1b053fb8d41189b06922
- MD5 107d20f4a3aa7c1aadb56ce010356420
- SHA1 b1f22a40ac97e48494129897308c638f410f5e34
- SHA512 5b71dee8f27426398b161af177058c5645897cd88eb27d36c17dbac283708ab006d29149c0094937afad058e5e03e4b5e2859685446e25dc2a37a72f0c508038
- SSDEEP 6144:m44/EpCkRlEcSAzycRpKMU0Kbw4f/sKiUNqva:m43p/RmOPUjJNqC
- TLSH
  T1D8442942B76082B2C56FC139C8974795FF7274526F6267CB22114B3D2E733E1AE3A612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral11 behavioral12
- Target
  06_Touchpad/WinWDF/x64/SynCtrl32.dll
- Size 201KB
- SHA256 947bea44d51f54c5e8c302b44d10a51c461dbf4493036db890efb3c41b70feab
- MD5 65ac4f6d5a0f1cdb8d4ef460067876dc
- SHA1 6f3f712e0fd8665d152afdb65ba443138f69723e
- SHA512 307484d50fa7d2b744092e50c29d0b83c725fb215668ddd26540d284ce21f46c2932adc7b7239946322b7ede16a97dafc9409f24049a5fcda6de08a16dd06bf8
- SSDEEP 3072:lbzw2u6pbmXLVRsMFoVRte9UIywfm5Rcv01ZtWrONKqTUzudXVIvB7hVTz:NzcXLVRsMFoV23ywjCCrsKiU2qvJ
- TLSH
  T129145B4277C3C473D81E023A5857D3AA6FFBA912BFE262436F54070E1E72385AF1561A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  06_Touchpad/WinWDF/x64/SynISDLL.dll
- Size 193KB
- SHA256 f250080070de75cdf6a7d70b218ea820594b750a67282eab262ae6e1e4d30b1b
- MD5 6a322ca5cae498d014adc93302300774
- SHA1 ad9742df6b7a8175a1d8a31a0c262aab253bb166
- SHA512 26faff948a0e0c04a26912861db898d514707c983647d29dc2a046ce68cb461d0fdefeedb1e93220cde118cf3178f805e3a830d42b6b8fcf8e91d1876b0fb517
- SSDEEP 3072:xTwXb6awwy1OA4QmVWp6yby/Btfk/1A5pJdW/OGFE2:xUXb6awwqhp2/TktA5pd2
- TLSH
  T1E314A20173F98236F5F36B75997946590A3BBDA2AF78D08F2390094D1D31A90EA78723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  06_Touchpad/WinWDF/x64/SynMood.exe
- Size 233KB
- SHA256 45477c6652836b1ce58871af06ba6450a74f096b90db5a59c0a716f301065be7
- MD5 d728c200948e451698102ae570868383
- SHA1 f8fadcb0ae26c690e897192a37bd81a57f7a172b
- SHA512 57c65acc4ae08190acc23c9bad92febdd93e93da54010f13d3a685d84d1348f6c4a790885e7dc1bf2e7731b6647c58ddd2a419bfa12f00f2523de12ed660e68e
- SSDEEP 3072:ohbkV8x4oOPJQhYFLT4u4b4s2wSabhEu3NStF8AG5wr73VIUTtvfoKsT+q:ohYymxQhYFou4btbm286AboKM
- TLSH
  T1EE347D1276D2C073E5B7067109F683B867B6FC55AF35928F6B903B0D2E306D24A35762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  06_Touchpad/WinWDF/x64/SynTP.sys
- Size 285KB
- SHA256 607779de4382c9342d12894d2b5585917ef05efc84ec7263aa18c1e96ed0011c
- MD5 8f63178d1db81bb79270ae55ecdd8321
- SHA1 3a4a50c6454def1eed9aef2d004ae55943361dd9
- SHA512 e3df6254eee7ae09d1da5920dd3d8577614864a997306e01534297493acc8af28497871509bec435ca44bf5d629869023e49e84510e60c4d574828faba2604e9
- SSDEEP 6144:+MkD0XYDUBNMdU/VKyhFQ+12mDc77a5z/VeHQI:r5X7MdUPjc77a5z/VeHP
- TLSH
  T179545C8B93B1106BE5A3D17EC693C77AEA71784063644BDB03B046AA6F437E05D7D322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  06_Touchpad/WinWDF/x64/SynTPAPI.dll
- Size 200KB
- SHA256 199e7d5253ef78c04280d6480d748b04d0ff2bd6a2087088bd69936e26c0c5e1
- MD5 3b53a115de700d72b1a68e8661544fd2
- SHA1 7579bb2477c334b06b16c9fe5494240c0fe6bbc7
- SHA512 41b3f8b82f6fcf0bdbbbb67391f76a6d19b6daa14136f14e89ff174d8cf5a4a5cc6b78852e475ccb21ad2ac1fbb251d454da8ce240170979f4251f01ae509b63
- SSDEEP 3072:waWiogaTxTDe+BWZFsw6heRO4OiTFb7hyZOeVBDvTTzHYKEWTQZOKRKGZHdodtaL:4ipVv6hiDz9hQB7zHYMQZOxGsm0ed
- TLSH
  T1A9143B82B29540B4D8B7D13D89A20A52FA72BC154730D3DF1760A77E2E337E5A93E325
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  06_Touchpad/WinWDF/x64/SynTPCOM.dll
- Size 117KB
- SHA256 657523b832fd9f4afd5e5eb3e35dc1bf70e29e216efc4627ee1d366771b365d7
- MD5 60fcb65450de86141549b48f8efb16de
- SHA1 fa6d6b4e3b75f65c93a37b6f43694574a97a9470
- SHA512 997c4292d68d2b61a2df5512ca959127f2ddd47d89fd8c54467f07e62cc76b47a159d7a7745318fdf5faed72af1eae61df92e60a24fa32091b220c5d08085cae
- SSDEEP 1536:n5JLgur3p4VCXrMy4OM6hkdEN4N7mMQcASRjnpavs9s0tUIMDPLnj0BdZSNcSmqK:5JBriy4l4keCN7mM9A8LVtUI0PLnIbHX
- TLSH
  T12BC34A56B29580F5D46B8279C8D24B8AEBB2B8158B7163CF4324A75D2F733D08E3D361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral23 behavioral24
- Target
  06_Touchpad/WinWDF/x64/SynTPCOM32.dll
- Size 105KB
- SHA256 d9c970ffd4633770eb8ad8ad6cd53df1337035d334df9872cf756877141d10f0
- MD5 c8f6599e3c145c7ae02589967108fd91
- SHA1 8b51ddf2b31c7a5ee8bff054f78dc8113fea2b52
- SHA512 a2cbabded9ec3bd4953b991239168c83b6edf6a75618c1149dec36241a6ae335a17d975ac59ff83e1b738bffdd74e3863e0157fd7edcbe06529cce3e6c830397
- SSDEEP 1536:S85/dnQrxSGL4hv12wRBoV2VNykShLKFnAtE3USNcgi81qmg:S89ZQBLwzRCEN0h2FnAtE3AgPtg
- TLSH
  T156B37C1274CBC073E489053E8886C3914BBF7C126DF2658BBFD8374D5E752998B29B62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  06_Touchpad/WinWDF/x64/SynTPCo4.dll
- Size 144KB
- SHA256 057a28370fc03ca3a255ac6b70881550c42008428f095ec5f61b99235dee973a
- MD5 1b2ffc3a1181878e28704b81aaea5311
- SHA1 2b92d78dcc0b2846983f23c4d2ceccbeadc6e54e
- SHA512 8ea00184cc4f3fc05780324b0ed37da9ac1e1caf551adce4ecaa8fd64ce9d6754b34c4f12c07541614b7e3bb23a16dc692adbbd041af28f2ebc97172417f03be
- SSDEEP 3072:0rNV/gZ8MVdjI1cZmJYV+D8W6+YeC4MYtEPAhNEfwNovcALs5q3Vm:CNVJy0jAWyZDEhUW5rH
- TLSH
  T1B6E35A96B2A250F9D4ABD23CC9D20792E7B1B424872563CB137086261F637E87F7D724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  06_Touchpad/WinWDF/x64/SynTPCpl.dll
- Size 1.5MB
- SHA256 494f496834290f80e63e0f5701d887bbde0e2ebc336de626ac5957577e1101d5
- MD5 dd4ebb34414f9f4aaf8e98078692173b
- SHA1 6e280951cb97b82ea79c167d523a970f8a3a8a55
- SHA512 9c7fe5fc45962235040088d2812b66320497bb0f51cb71d081f8b4b0c4d4322ac58ff8015e3496c7625a5613672c78931d450dd8c0d266c08cbb2f0a65bb4f85
- SSDEEP 24576:usyhpFSGao8qXbkg0SeKTxPNZkpKH8eeiWbU:usyhpFrrkKeebkreeXY
- TLSH
  T15F654A57BA64C165D1BFD17DCA928E6BD6B234004720DBCB12648B3A1F63BE54A3E730
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral29 behavioral30
- Target
  06_Touchpad/WinWDF/x64/SynTPEnh.exe
- Size 1.7MB
- SHA256 fadd63e22805e23bad3bf13f361641f8af6f08166f8a9317499ee6640383a05e
- MD5 30f41b2e49e182e3bcdbf3735e4bd25b
- SHA1 8001ed1991617815e4b1b1766174fe44a4d4f866
- SHA512 88ed3cfe361c2663059d6302a4c7287b0557ff62008090a519325a14feaecb9c4b5e312841a15d71c476f66ead7564498e7457b73ca8457debd8b2448d6bdfd3
- SSDEEP 24576:84Gho4NgcoZz7RCYVvLSMeej4jz73KqeRG28moMVo:84Gho4KcodwYVNeejceRG28moMVo
- TLSH
  T144859241A3FA4129F2F3AB74EDB552618E76BC92AF34D28F1250265D2D32ED08974733
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Drops file in Drivers directory

Event Triggered Execution: Component Object Model Hijacking

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

Event Triggered Execution: Component Object Model Hijacking

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32