Extracted

• • Target

    calculator.exe

  • Size

    9.9MB

  • MD5

    339b84951269279395b3bd2edaf47e0e

  • SHA1

    57a526b107da224621e9a27cd428db6705dbc57e

  • SHA256

    70cae04ab70283d131089d489f6285720ba402136ffb632312b2861aa4d1c772

  • SHA512

    83e503b91eba21f2c27de294ba8582326d088c4709840615415244b9b420802d2e390d22ac3b988a3ed5b2137887ced535ea9a223754cd2151a6de9be37ad7ec

  • SSDEEP

    196608:uZTCc0W8/L2cXMCHGLLc54i1wN+yjXx5nDasqWQ2dTNUG2ZXxHMB1l/6zilH+iIW:SCLW8icXMCHWUjKjx5WsqWxT45xHMrlz

  Score

  10^/10

  microsoftdiscoveryexecutionpersistencephishingprivilege_escalation

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Detected potential entity reuse from brand MICROSOFT.

    phishingmicrosoft

  • Drops file in System32 directory

  behavioral1behavioral2