Extracted

Extracted

• • Target
    tsetup-x64.6.9.3.exe
  • Size 50.6MB
  • SHA256 45aa94a591763118c5d3ba9481d3f97c0b95b5e56dc33c9b39311f7c46ee72c9
  • MD5 c33f2cef439084d9d1bf10ba4c0863c3
  • SHA1 e56938c0b89229f928972ed005ddd3d34e21f3ea
  • SHA512 ab40c755f1a32ba4e00bacbe433bade6d640b6527358757af3a3a54a02785601ae63da1b24332151bc87414538f2ecece62cebb9ccd8725b9f5e178e9a0eef66
  • SSDEEP 786432:DZxtqD1DaYLQzDdHmmGFh79bo17R5TYYogyASnxoLZXYJoTJhwC9Kugq8ILORikr:DtAaYUzZGFhO7R58IyAyxw6a9KJUlk
  • TLSH
    T1F5C73323B10E633ED169D5364E639A04897FBE50A91E8CA3DEE0095CDE391946D3FE07
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutioninstallerpersistenceprivilege_escalationransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral1