822b3e552d45e07aadb9986945ba910e81cb51e1b9c684ecc85aec57dbd35b5b

General

Target
OfficeSetup-Win.exe
Size 7.2MB
Sample260629-sdps9ahz3m
SHA256 822b3e552d45e07aadb9986945ba910e81cb51e1b9c684ecc85aec57dbd35b5b
MD5 6f4b2d8910fccc66869a18e21f3873e4
SHA1 c2d7c1e02a2acbebb7cca7cccdaf9b84d2dde038
SHA512 023f8d7e0c2c66a74467d5bc11af8feb87fc4c99951c76bc87d3cbc548e02bdc2043964689c7fdbdc6afeeb86929f69a577335c88a49365f90f61b6e884503f5
SSDEEP 196608:XTAf/fcMNyN+tDJLoLh1gdhPZu38X7Byf/zb0DrafLzYaI6HMaJTtGbg:XT4fcMNygLJdpZuxf/zbMafLzn
TLSH
T11A766CE266F544BAE5B302327D7DAADDC5BABD710B31854F63442B0F0970982EB25723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  OfficeSetup-Win.exe
- Size 7.2MB
- SHA256 822b3e552d45e07aadb9986945ba910e81cb51e1b9c684ecc85aec57dbd35b5b
- MD5 6f4b2d8910fccc66869a18e21f3873e4
- SHA1 c2d7c1e02a2acbebb7cca7cccdaf9b84d2dde038
- SHA512 023f8d7e0c2c66a74467d5bc11af8feb87fc4c99951c76bc87d3cbc548e02bdc2043964689c7fdbdc6afeeb86929f69a577335c88a49365f90f61b6e884503f5
- SSDEEP 196608:XTAf/fcMNyN+tDJLoLh1gdhPZu38X7Byf/zb0DrafLzYaI6HMaJTtGbg:XT4fcMNygLJdpZuxf/zbMafLzn
- TLSH
  T11A766CE266F544BAE5B302327D7DAADDC5BABD710B31854F63442B0F0970982EB25723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
behavioral1