f0fa41fd2b9692b3213ec455336e1e78f8be22c33ee827deac8ce5ae7c3676db

General

Target

O365ProPlusRetail.exe
Size

7.2MB
Sample

250313-yzjr1s11bz
MD5

469c0d78d1261e02077af579ecde8526
SHA1

9eec18714e6a0dd90056985c48bbe8afc00238f6
SHA256

f0fa41fd2b9692b3213ec455336e1e78f8be22c33ee827deac8ce5ae7c3676db
SHA512

b948f9c95a60d49885fb4fa1fe6a3540f060e4089d7ddd5da4f9c86a5cd6dd00157648df183838700a6c252bc17b793bc5df07c77edfc831abee6d6aa46d9ccb
SSDEEP

196608:rc8mkLKQjghkRtLjR6RXshF8ibOWuPPGLNqLYpGi0caI6HMaJTtGbUD:9XrjghkRV9acP83Pq0x

Score

8^/10

Malware Config

Targets

- Target
  
  O365ProPlusRetail.exe
- Size
  
  7.2MB
- MD5
  
  469c0d78d1261e02077af579ecde8526
- SHA1
  
  9eec18714e6a0dd90056985c48bbe8afc00238f6
- SHA256
  
  f0fa41fd2b9692b3213ec455336e1e78f8be22c33ee827deac8ce5ae7c3676db
- SHA512
  
  b948f9c95a60d49885fb4fa1fe6a3540f060e4089d7ddd5da4f9c86a5cd6dd00157648df183838700a6c252bc17b793bc5df07c77edfc831abee6d6aa46d9ccb
- SSDEEP
  
  196608:rc8mkLKQjghkRtLjR6RXshF8ibOWuPPGLNqLYpGi0caI6HMaJTtGbUD:9XrjghkRV9acP83Pq0x
Score

8^/10

discovery adware defense_evasion link macro pdf persistence privilege_escalation stealer xlm
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
- Suspicious Office macro
  Office document equipped with 4.0 macros.
  macro xlm
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1 behavioral2