94f3dc7e34b61d7ea2690ee729ebfd750a471b2455fc374ac5d760e940cfa39b | Triage

Sharing

General

Target

TSA-Client Setup 1.1.19.exe
Size

63.9MB
Sample

240513-tx4beseg26
MD5

fe0b904a63b1bbfb0c673bad96da9c90
SHA1

30e585383f401f85217068037819261bab07e2fd
SHA256

94f3dc7e34b61d7ea2690ee729ebfd750a471b2455fc374ac5d760e940cfa39b
SHA512

089bc927d86b05184d283005278a0f3e2e6f1d752de61bce194fee67b3659642bfa802a6db7d952216132d895c5284529af8bcebb6bc2014cb8b0fba1cc0861e
SSDEEP

1572864:IorkJoOwJSPvYxOlO4Fg41NnDQgncoY63v9/mKDxmLcPmCCU:IcOzPvOXhF6/LxNPZ

Score

8^/10

discovery evasion persistence

Malware Config

Targets

- Target
  
  TSA-Client Setup 1.1.19.exe
- Size
  
  63.9MB
- MD5
  
  fe0b904a63b1bbfb0c673bad96da9c90
- SHA1
  
  30e585383f401f85217068037819261bab07e2fd
- SHA256
  
  94f3dc7e34b61d7ea2690ee729ebfd750a471b2455fc374ac5d760e940cfa39b
- SHA512
  
  089bc927d86b05184d283005278a0f3e2e6f1d752de61bce194fee67b3659642bfa802a6db7d952216132d895c5284529af8bcebb6bc2014cb8b0fba1cc0861e
- SSDEEP
  
  1572864:IorkJoOwJSPvYxOlO4Fg41NnDQgncoY63v9/mKDxmLcPmCCU:IcOzPvOXhF6/LxNPZ
Score

8^/10

discovery evasion persistence
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistence