General
-
Target
OfficeSetup.exe
-
Size
7.2MB
-
Sample
250328-btzvqasnw7
-
MD5
29d5d38d66b57bbc99f833265592278f
-
SHA1
432085379e8033e162f2fbfec17c1adadfa9f723
-
SHA256
b01e9e7e49fb36e7757e691df9cd8c61b5fd1936300715c757178a32e259b810
-
SHA512
141bff0f4af5a9da82f34fa9be8335dca5ce7c1dc9a3dcfe66c75ae94199f22c613c86a3ec1eac9aa1be81a596d133b244d3196eca7068abe602bfa94e430059
-
SSDEEP
196608:f5xhhzQhjG+59FThbOTx+MMp8T5nfI5dqICpZo3MpOTiK/ImaI6HMaJTtGbH:3hJsjG+5jUTxnY8cdqpGIe
Malware Config
Targets
-
-
Target
OfficeSetup.exe
-
Size
7.2MB
-
MD5
29d5d38d66b57bbc99f833265592278f
-
SHA1
432085379e8033e162f2fbfec17c1adadfa9f723
-
SHA256
b01e9e7e49fb36e7757e691df9cd8c61b5fd1936300715c757178a32e259b810
-
SHA512
141bff0f4af5a9da82f34fa9be8335dca5ce7c1dc9a3dcfe66c75ae94199f22c613c86a3ec1eac9aa1be81a596d133b244d3196eca7068abe602bfa94e430059
-
SSDEEP
196608:f5xhhzQhjG+59FThbOTx+MMp8T5nfI5dqICpZo3MpOTiK/ImaI6HMaJTtGbH:3hJsjG+5jUTxnY8cdqpGIe
Score8/10-
Suspicious Office macro
Office document equipped with 4.0 macros.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-