General
- Target OfficeSetup.exe
- Size 7.1MB
- Sample260721-xtgvssshnc
- SHA256 67608f2553e616b931ca8fa60f29487d43454cc6e788c22fc1f961680e4dae6a
- MD5 4282f1307d28e84fbfa19d86bd18fc90
- SHA1 955932084dc39cc9db4101c8fdc36d331647aee0
- SHA512 98f92ce086e3169ed5d5cb1cc129fc191644d1c51deccc0dd5e783a2f9b6d569417765d6b237b86bff656c78793a0eec958dfbdbfc14512d04d45a2f37a17f46
- SSDEEP 196608:OrPoz2seNNxRPEKPhcceKxNcNu6OaPtoW+kc18bWD/bC5YPkfub:8sAxRPEKPhcrKD5PkocH
- TLSH T1FC767C22E6D14026E1B786706FFBA71B47AABD704872C41FE394064D1AB19C2D712FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OfficeSetup.exe
Resource
win11ltsc2024-20260709-en
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
OfficeSetup.exe
Resource
win10v2004-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
OfficeSetup.exe
Resource
win10ltsc2021-20260513-en
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
OfficeSetup.exe
Resource
win11-20260513-en
15 signatures
150 seconds
Malware Config
Targets
-
- Target OfficeSetup.exe
- Size 7.1MB
- SHA256 67608f2553e616b931ca8fa60f29487d43454cc6e788c22fc1f961680e4dae6a
- MD5 4282f1307d28e84fbfa19d86bd18fc90
- SHA1 955932084dc39cc9db4101c8fdc36d331647aee0
- SHA512 98f92ce086e3169ed5d5cb1cc129fc191644d1c51deccc0dd5e783a2f9b6d569417765d6b237b86bff656c78793a0eec958dfbdbfc14512d04d45a2f37a17f46
- SSDEEP 196608:OrPoz2seNNxRPEKPhcceKxNcNu6OaPtoW+kc18bWD/bC5YPkfub:8sAxRPEKPhcrKD5PkocH
- TLSH T1FC767C22E6D14026E1B786706FFBA71B47AABD704872C41FE394064D1AB19C2D712FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory