Overview

overview

8

Static

static

3

O365ProPlusRetail.exe

windows10-ltsc_2021-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    O365ProPlusRetail.exe

  • Size

    7.2MB

  • Sample

    250313-yykmxs1zh1

  • MD5

    469c0d78d1261e02077af579ecde8526

  • SHA1

    9eec18714e6a0dd90056985c48bbe8afc00238f6

  • SHA256

    f0fa41fd2b9692b3213ec455336e1e78f8be22c33ee827deac8ce5ae7c3676db

  • SHA512

    b948f9c95a60d49885fb4fa1fe6a3540f060e4089d7ddd5da4f9c86a5cd6dd00157648df183838700a6c252bc17b793bc5df07c77edfc831abee6d6aa46d9ccb

  • SSDEEP

    196608:rc8mkLKQjghkRtLjR6RXshF8ibOWuPPGLNqLYpGi0caI6HMaJTtGbUD:9XrjghkRV9acP83Pq0x

Score
8/10
discoverylinkmacropdfxlm

Malware Config

Targets

    • Target

      O365ProPlusRetail.exe

    • Size

      7.2MB

    • MD5

      469c0d78d1261e02077af579ecde8526

    • SHA1

      9eec18714e6a0dd90056985c48bbe8afc00238f6

    • SHA256

      f0fa41fd2b9692b3213ec455336e1e78f8be22c33ee827deac8ce5ae7c3676db

    • SHA512

      b948f9c95a60d49885fb4fa1fe6a3540f060e4089d7ddd5da4f9c86a5cd6dd00157648df183838700a6c252bc17b793bc5df07c77edfc831abee6d6aa46d9ccb

    • SSDEEP

      196608:rc8mkLKQjghkRtLjR6RXshF8ibOWuPPGLNqLYpGi0caI6HMaJTtGbUD:9XrjghkRV9acP83Pq0x

    Score
    8/10
    discoverylinkmacropdfxlm

    • Suspicious Office macro

      Office document equipped with 4.0 macros.

      macroxlm

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks