0010f16f494d7f9fd73b2811b0df339d7cfc4550e29fd4f9d2f1c84971c1cffb

General

Target

OfficeSetup.exe
Size

7.2MB
Sample

241023-tlj4eayfkd
MD5

965aa24b25818d31d54fc46b0da5c8e4
SHA1

6c7fa21b195c40833355093c2ef6d74c12179a87
SHA256

0010f16f494d7f9fd73b2811b0df339d7cfc4550e29fd4f9d2f1c84971c1cffb
SHA512

b124f0fc6d308a23c1164e921abae541044b9d30665dfccea1099a369c2eec362729e2a76ebc71ee15b259513bac7ae8e74bbeff871cd8380e3045702e074882
SSDEEP

196608:H5yeJSOxmp+8jIh/FdF3bx30bqGdiZhQNGIwWar45iPaI6HMaJTtGblkw:dQj+8jyF73V3xZ7tkw

Score

8^/10

Malware Config

Targets

- Target
  
  OfficeSetup.exe
- Size
  
  7.2MB
- MD5
  
  965aa24b25818d31d54fc46b0da5c8e4
- SHA1
  
  6c7fa21b195c40833355093c2ef6d74c12179a87
- SHA256
  
  0010f16f494d7f9fd73b2811b0df339d7cfc4550e29fd4f9d2f1c84971c1cffb
- SHA512
  
  b124f0fc6d308a23c1164e921abae541044b9d30665dfccea1099a369c2eec362729e2a76ebc71ee15b259513bac7ae8e74bbeff871cd8380e3045702e074882
- SSDEEP
  
  196608:H5yeJSOxmp+8jIh/FdF3bx30bqGdiZhQNGIwWar45iPaI6HMaJTtGblkw:dQj+8jyF73V3xZ7tkw
Score

8^/10

adware defense_evasion discovery persistence privilege_escalation stealer
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1