Extracted

• • Target

    Release.zip

  • Size

    2.5MB

  • MD5

    eaee0ff03c04e223580b6d82c926de3c

  • SHA1

    908871c8b35476444e0a0d95b517db62583a25a1

  • SHA256

    c608bdd745898e19de5dc85942912f2d61727017932fedb4328a4242e64a5521

  • SHA512

    162175a266fc11c3c9c6d58e89a4978f5ef88ffeeb28018e6eaf38320b3e1af6d2598c51f170ff7cd6929ac0d339e249e01e4196bad0340f254759dc34d94291

  • SSDEEP

    49152:yiNPitcKGRKwt0yy+sEp/s0aHx9psNe1aUxKAWNyL1LI6vKFqXBJs1AK5JdE:yiNaiKGEOJQnsNejKAq4JIbFqXB0ndE

  Score

  7^/10

  discoverypersistenceprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1