7c6f269402ab0c320b92394b746b7900e78af02f2856d005bfa53977b5367393

General

Target
Office_2024_SK_64Bit.zip
Size 3.2MB
Sample260724-a2mppazfnc
SHA256 7c6f269402ab0c320b92394b746b7900e78af02f2856d005bfa53977b5367393
MD5 3e159d767d854287d1e4c39bbdfe5ab7
SHA1 74c456f4c58ae69fad4afd833712797f0412e61e
SHA512 5751b5f709540df67ff3d5355397d400f8c8b3bfe847b7cd90809cf9b982c3eddf3cfe2e7b70bd6f24a9724801d03a9a798bc21e7bdd1f5bc30188217496df63
SSDEEP 98304:aBcUkI032Yr0PcnEXcswzz7HV5gQ7C6Kh1o:kcUkl32PIswzz5ZH4o
TLSH
T13CF533A6E5527AD869D05CCB4D3340594BC36B3E3E232CB640C193BEB4E528E2F876D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  package/Click To Run.bat
- Size 34B
- SHA256 413b8e555d8f42c56d22d6843708f7bfcb0bbedb4f833bf3c89880665925bd14
- MD5 ad3ed1d41f9b51f7f203d56597c05958
- SHA1 724822195edeff84c01f298212dbaebf1b55a0d2
- SHA512 dcb33488d6a8da2ca6ab1307fba58c68e62cd31e592058bf9c6a1621bff20da4b5df49684a7cac058b522619fd8b785446a251ae5656fba7a4d666dfa303f290
- MD5 SHA1 SHA512
Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware stealer
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  package/setup.exe
- Size 7.4MB
- SHA256 b03c4cc3c1377ee81b1f94da126e58a30f484d4d935889538fae1c650dd6828b
- MD5 7488d696f9a3d74e093b4c31ef7282c6
- SHA1 777a182ed8ca8377581c91ac3d91b4b4fe233353
- SHA512 a40d074243ec3ced28fc8b4f3e00ccbfb755415540e655e29820b96b2569d530c21f46e3cb7aee24e46de2339207e46c6c4a05f7bd7ce5d85485952b9f881e08
- SSDEEP 196608:NX4RUixxsuKuIGizTftIEgBkXVKJw579eRGzouxdxGXaI6HMaJTtGbFK:qnmuKuE3f9gVG5xxGo
- TLSH
  T14D767C237AD58077E3B202306E39BB1A4D7DBE7109B1F11F6B86161D0AB09D295F5B23
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4
- Target
  spustit instalaciu.bat
- Size 49B
- SHA256 d7d4b20eb7e17dcf3ce914aa1bc29a94427434cc67519cacfde2c13419c70fb7
- MD5 83eea8c8bf2c4e394bd3d7b5e99b2ee3
- SHA1 e20292207e34ea18dee06ba57c218ac85096b7fb
- SHA512 9e10d9a4553c0fb125869d6575ab744568a9da71ba0b18c8bdcc31cfa53b11a20ee6c1dafc3645c31bae6b75955317a0b294b7c7e18fbf5c123f087154335fb6
- MD5 SHA1 SHA512
Score

3^/10

discovery execution
behavioral5 behavioral6