Overview

overview

8

Static

static

3

安装助�....9.exe

windows7-x64

8

安装助�....9.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

  • Target
    安装助手_1.0.9.exe
  • Size 5.4MB
  • Sample241223-en3wzawkcn
  • SHA256 6a11d0ca2303bffe42e568f32c1adefd70742379ce2639f2ee2a437051ac9c13
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryexecutionpersistence

Malware Config

Targets

    • Target
      安装助手_1.0.9.exe
    • Size 5.4MB
    • SHA256 6a11d0ca2303bffe42e568f32c1adefd70742379ce2639f2ee2a437051ac9c13
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discoveryexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Creates new service(s)

      persistenceexecution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks