Overview

overview

8

Static

static

1

InstaIIer.exe

windows7-x64

1

InstaIIer.exe

windows10-2004-x64

8

Resubmissions

08/06/2024, 11:57

240608-n432cabd8s 8

Sharing

Copy URL Twitter E-mail

General

  • Target

    InstaIIer.exe

  • Size

    50.7MB

  • Sample

    240608-n432cabd8s

  • MD5

    963685aadedee049148a9130dc09cdbd

  • SHA1

    7371d4204e2e96b8864be5ed33c645a1b70b5241

  • SHA256

    34a1b60a6cea2e8c4533daafa61a1dcf18434afd82fe15bbaf31a84e2f9db0fa

  • SHA512

    f45aba0cd19f0f4318917e694a31c31ede2d7768a6407e3d409b16e2f29fc2c6450b4471dc76a53c9b732bfe869f39779be90752fb846bc6c3794846f7013262

  • SSDEEP

    196608:sCe1z2rqhFSEcTfmLcBcUudpf8GAqEnqLCAlfMgWNy:5e1zoqqdTfmLcidp863R

Score
8/10
discoveryevasionexecutionpersistencetrojan

Malware Config

Targets

    • Target

      InstaIIer.exe

    • Size

      50.7MB

    • MD5

      963685aadedee049148a9130dc09cdbd

    • SHA1

      7371d4204e2e96b8864be5ed33c645a1b70b5241

    • SHA256

      34a1b60a6cea2e8c4533daafa61a1dcf18434afd82fe15bbaf31a84e2f9db0fa

    • SHA512

      f45aba0cd19f0f4318917e694a31c31ede2d7768a6407e3d409b16e2f29fc2c6450b4471dc76a53c9b732bfe869f39779be90752fb846bc6c3794846f7013262

    • SSDEEP

      196608:sCe1z2rqhFSEcTfmLcBcUudpf8GAqEnqLCAlfMgWNy:5e1zoqqdTfmLcidp863R

    Score
    8/10
    discoveryevasionexecutionpersistencetrojan

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks